The DMZ

Mark Buffalo

22:17

@SEJPM oh, my bad. sorry. Windows CE. :)

arstechnica.com/information-technology/2016/03/…

@ThomasPornin I thought it lasted up to 7 years?

Huh. I read about that a while back, but didn't think it wasn't common.

SEJPM

@MarkBuffalo I didn't meant their defensive recommedation, but their (internal) offensive phone equipment

Mark Buffalo

@SEJPM They're almost all script kiddies, so probably some variant of Kali?

Kali is the #1 tool of script kiddies

SEJPM

@MarkBuffalo Kali mobile?

Mark Buffalo

NetHunter

SEJPM

with UKP? (universal kali program?)

NetHunter

The Kali NetHunter is an Android ROM overlay that includes a robust Mobile Penetration Testing Platform. The Kali Linux NetHunter project is the first Open Source Android penetration testing platform for Nexus devices, created as a joint effort between the Kali community member “BinkyBear” and Offensive Security. The overlay includes a custom kernel, a Kali Linux chroot, and an accompanying Android application, which allows for easier interaction with various security tools and attacks. Beyond the penetration testing tools arsenal within Kali Linux, NetHunter also supports Wireless 802.11 frame...

(for everybody, too lazy to look up what NetHunter actually is and who doesn't know)

Mark Buffalo

22:24

=]

tools: for people who can't write their own.

still, some things are super useful... so yeah

SEJPM

@MarkBuffalo gl hf writing everything in binary machine code

Mark Buffalo

haha

My version of nmap is nowhere near as good as nmap...

So why not just use the best tool?

SEJPM

tools accelerate workflows. no more, no less

Mark Buffalo

similarly, my packet capture program is not as good as wireshark

I take offense to people who can't program using the tools though

SEJPM

@MarkBuffalo so people who don't know (at least in theory) how their tools work?

I can live with that

I also don't fully understand how Windows works

or GCC

TildalWave

22:27

@SEJPM they don't :P

Mark Buffalo

I don't mind that, I'm mainly referring to "hacking" tools

SEJPM

@MarkBuffalo so did you implement Unix sockets yourself?

TildalWave

like a hatchet

Mark Buffalo

Let me give you an example, SEJPM

SEJPM

@TildalWave if you throw enough moneyz at people Windows will work!

Mark Buffalo

22:28

You download a basic RAT/trojan

You infect a file, and send it to someone

You then take over their computer

That's not hacking. That's being a script kiddie.

Unfortunately, this works really well, so it doesn't matter if you're an actual hacker, or a script kiddie... you can still do damage.

SEJPM

@MarkBuffalo so you insist on people finding their 0days themselves?

Mark Buffalo

I look down upon drag-n-droppers who push a few buttons to "hack"

No, it doesn't matter what I think/insist, it isn't going to change anything

My thoughts on the matter aren't going to stop script kiddies.

SEJPM

@MarkBuffalo so you look down on people who just use the best tools to get the job done?

TildalWave

nothing wrong with doing things by the path of least resistance ... if simple things work, then I'm fine with that ... and if that labels me as script kiddie then even the better, it's been a long time since anyone called me a kiddo

Mark Buffalo

No, not really. I look down upon people who think they're amazing after drag and dropping a trojan launcher into a file, and then having someone execute it, without knowing anything about what they're doing.

I'm mainly referring to malicious hackers here, not actual penetration testers who know what they're doing.

SEJPM

22:33

@MarkBuffalo so on people who brag about being able to use (simple) tools?

Mark Buffalo

@TildalWave Here's how I feel about the subject. If you can do this, sure... fine, go ahead. But this will lead to atrophying your actual hacking skills.

TildalWave

@MarkBuffalo you didn't see pentesters I saw then

SEJPM

@TildalWave -> pen testers don't know what they're doing!?

TildalWave

@SEJPM some do

SEJPM

@TildalWave as in (nearly) every profession

Mark Buffalo

22:35

Yeah, I have nothing against learning...

If you want to learn, please do. Really, please do

SEJPM

@MarkBuffalo so it's the bragging part that annoys you?

not the part that they're using tools?

Mark Buffalo

Partially, yes

Using tools and not knowing what you're doing... lame. Unauthorized hacking... lame, unless they target you first > : o

Also, I am slightly irritated about "hackers" who can't write their own tools to get the job done d:

This is just my personal opinion, that's it. It also doesn't change the fact that both script kiddies and actual hackers can do damage.

SEJPM

@MarkBuffalo if they don't need to, why should they? to show off?

Mark Buffalo

@SEJPM tldr: I'm an elitist?

:p

SEJPM

@MarkBuffalo bad environment.

too much money for the NSA makes the people there elitists and reality absent

TildalWave

22:41

@SEJPM problem with pentesting as I see it is that it's an extremely tough job if you wanna do it right, and a good pentester will always realize they couldn't have possibly covered all the aspects of it and will give recommendations to that effect... but there's loads of bad pentesters that will basically run automated tools, produce generic reports and not only fail to mention what their tests don't cover, but also brag about their exhaustiveness

Mark Buffalo

@TildalWave yeah

I agree

TildalWave

the latter can actually be very dangerous

SEJPM

@TildalWave every well paid job is extremely tough (that's why you pay them so much). There are always people who have the best interests of the client in mind and some who have their money in mind

TildalWave

it's that age old wisdom that security can't ever be a product

Mark Buffalo

@SEJPM client = my reputation. Money is something I can always get elsewhere

@TildalWave Security most definitely can be a product

SEJPM

22:43

@MarkBuffalo a decent amount of money today > a lot of / constant stream of money in the (long-term) future for many people

@TildalWave the lack of features can be a feature

(features = bugs and such)

TildalWave

@SEJPM what I meant is that a good pentester will realize there's limitations to their methods and that vulnerability tests are non-exhaustive... they will also tend to produce far more detailed reports, give many more recommendations, and be available for follow-ups ... bad pentesters will sell you security scans and try to make you believe that's the best you could hope for

Rory Alsop

For professional firms who use penetration testing, it can be essential to not have individuals develop their own tools! For testing large companies, you need consistency, absolute control over what the tools do, repeatability etc

Yes, it is essential that testers know what the tools do, and being good at the research helps immensely here

But requiring each individual to develop their own 0-days? Almost irrelevant in industry

Research teams should do this, yes. And individuals can do research to further their own learning as well as improve the tools

SEJPM

@TildalWave I can only agree. But have to point out that all the complaints in the world won't change some parts of basic human egoism

Rory Alsop

For example, I could never employ a solo tester who developed their own tools, without an awful lot of red tape, assessment etc

TildalWave

@RoryAlsop sure, what counts is resourcefulness, even inventiveness ... but that requires loads of knowledge to begin with, you won't get those attributes from a newb that can press some buttons

Rory Alsop

22:47

@TildalWave totally agree

Mark Buffalo

@SEJPM only thieves think like this

Rory Alsop

And one of the reasons I was so supportive of developing a proper terminology is so we can distinguish between someone who can run nmap and someone who understands where a particular exploit may need to be tweaked inorder to attack a particular instance

TildalWave

and yes automation helps a whole lot, especially with reporting... you don't wanna do one single good pentest in your life then die of exhaustion

Mark Buffalo

@RoryAlsop agreed, I'm mainly complaining about malicious black hats who think they're hackers after using tools

SEJPM

@MarkBuffalo replace "money" with "a general good wellfare" and "thieves" with "most criminals"

Mark Buffalo

22:49

@RoryAlsop I develop my own, but don't rely on them. For me, it is sufficient to use better tools which have been developed over a long period of time. However, I need to know how these tools work at the programming level, this is why I make my own. Doesn't mean I'll utilize them though

Rory Alsop

@MarkBuffalo I figured many years ago that I'd ignore anyone's opinion of themself. Some are too modest, some overblow their skills. What counts is what they can do - and I just used to test them on that (using security assault courses etc) and now using things like CREST. It shows a certain skill/experience level that I can trust

Mark Buffalo

@RoryAlsop agreed

I'm not talking so much about penetration testers. I am referring, in general, to script kiddies who hack people. Unauthorized hacking, that is. Still, doesn't change the fact that they're a real threat. I just look down on them and have no respect for them

Not trying to toot my own horn. I just think its sooooooooooooooo lame that a script kiddie can download a rat and "hack" someone. It's sooooooooooooo lame

SEJPM

@MarkBuffalo why would you have any respect for people whose sole objective is to harm people anyway?

TildalWave

@MarkBuffalo what's lame is lack of protection against that in mainstream products

Rory Alsop

@MarkBuffalo the issue though is not the respect or lack of (I don't see why either is relevant) but that they can still do just as much damage as a 'proper' skilled attacker just by using easy tools, so the defence is remarkably similar.

Mark Buffalo

22:53

I have none, obviously lol

@RoryAlsop Yup. I acknowledge this 100%

SEJPM

@RoryAlsop, we're currently discussing @MarkBuffalo 's general dislike of "bragging script kiddies"

not whether they are effective (which they can very well be)

Mark Buffalo

Pretty much

Script kiddies can often do the same amount of damage as a skilled hacker because of tools. I simply wish it wasn't so

SEJPM

@MarkBuffalo so properly set up your defenses / make safe defaults against standard tools?

Mark Buffalo

Yeah. I'm just complaining about it

Defenses against standard tools are wonderful. I've written a few. Shuts down script kiddies really fast.

SEJPM

@MarkBuffalo does EMET actually (already) defend you against "script kiddies"?

Mark Buffalo

22:59

There is a misunderstanding here. I'm not personally worried about script kiddies. That isn't why I'm complaining

TildalWave

maybe we should count our blessings and thank the great Cthulhu that most lunatics are crap at what they do, huh?

Mark Buffalo

I'm just... Well, I started ranting and you kept it going :p

My fault, shouldn't have ranted about them.

SEJPM

@MarkBuffalo otherwise it would have been soooooooooooooooooooooooooooooooo boring in here as usually on weekends

Rory Alsop

Lol

Mark Buffalo

Haha, wanna keep it going?

I can go all night

SEJPM

23:00

@MarkBuffalo YES

Mark Buffalo

BBL, next dad taxi stop

SEJPM

The modern Suite B

(B stands for "Bernstein" here)

metzdowd.com/pipermail/cryptography/2016-March/028824.html

2

TL;DR: We use B's crypto almost everyhwere now, because he's the only one who wants crypto to just work (tm) and everybody else's crypto works worse.

TildalWave

> How on earth did it come to this?

SEJPM

@TildalWave everybody else sucked more than Bernstein

TildalWave

no, it has a simple answer

SEJPM

23:09

@TildalWave ?

TildalWave

most cryptography products are subject to export laws and/or classified

Nate Kerkhofs

After reading about AlphaGo and other machine learning initiatives, I can't help but wonder if it could be a viable instrument for finding cryptovulns and other vulns

SEJPM

@TildalWave and / or patents

TildalWave

what's missing there is open spec

SEJPM

@NateKerkhofs not enough data (I think)

TildalWave

23:11

it came to that in the open spec cryptography

not necessarily in cryptography in general

SEJPM

@NateKerkhofs as for standard vulnerabilities, I think somebody is trying this right now

Nate Kerkhofs

@SEJPM Like, could we use machine learning to analyse AES or bcrypt and find vulnerabilities in them?

I mean, a computer might come at this from a whole different angle than we do

SEJPM

@NateKerkhofs machine learning needs massive amount of samples (usually millions or more), even for simple concepts and those concepts aren't simple (only talking about crypto here)

Nate Kerkhofs

@SEJPM What do you mean by "samples"? like individual bcrypted passwords or something?

because those are easy to come by

SEJPM

@NateKerkhofs algorithms and analysis samples

you know, the stuff you want the machine to do

Nate Kerkhofs

23:15

I see.

TildalWave

so I again got pinged 3 times for replies I already cleared before ... seems like some bug

Nate Kerkhofs

I was thinking more like "okay, computer, here are 30 million passwords and their bcrypt hash, could you tell us if something is fishy here?"

SEJPM

@TildalWave edits

Nate Kerkhofs

@TildalWave I think you get pinged if you are on another tab

TildalWave

@SEJPM no, they were all your replies and you haven't edited any of those

SEJPM

23:17

@TildalWave maybe I edited one heavily?

Nate Kerkhofs

@SEJPM you edited this one 3 times

SEJPM

@NateKerkhofs = 3 pings

TildalWave

it's not edits

nor heavy edits :P

SEJPM

@NateKerkhofs :)

Nate Kerkhofs

but that ping noise is so annoying, so let's stop that

SEJPM

23:19

7

Q: Can machine learning analyze random number generator?

I'm studying for random number generators(RNG) and I saw about machine learning a few days ago. So I searched analysis of RNG using machine learning. But I couldn't find such fields. Are there such examples for analysis of RNG using machine learning? No matter some papers of articles.

11

Q: Any practical uses of machine learning for cryptography?

I am about to go study for my masters in machine learning, data mining and high performance computing, but have recently become very interested in cryptography after taking Dan Boneh's Cryptography course on coursera.com. I was wondering if there are any practical applications for machine learn...

encryption cryptanalysis

TildalWave

@SEJPM interesting enough, that's also something that SETI is working on and it has also other applications, it's basically signal processing

SEJPM

@TildalWave apparently there are also a number of paper about machine learning for static code analysis

TildalWave

@SEJPM that would be about the 2nd question, I was replying to the 1st one :P

SEJPM

@TildalWave I know, I was just too lazy to scroll up to get a proper link :P

@TildalWave sure, throw a machine learning at a stream of bytes and let's see what it'll find

TildalWave

as far as I'm aware it hasn't produced anything that humans wouldn't be much better at

Mark Buffalo

23:27

I'm eating at a Chinese restaurant. Look at all these script kiddies who can't use chopsticks!!!

SEJPM

google-engtools.blogspot.de/2011/12/…

@TildalWave because we're stuck at a bee

@MarkBuffalo technically they aren't script kiddies

Mark Buffalo

They're fork kiddies!

SEJPM

@MarkBuffalo do they brag about being able to use a fork?

Mark Buffalo

Yes

TildalWave

there's an inherent problem that for learning you have to recognize patterns, and as soon as you recognize them in PRNG you've proven it isn't random... but these patterns or mode of establishing them might be entirely different case to case, so learning to recognize one might not be very helpful

SEJPM

23:30

@MarkBuffalo that's kinda ashaming for them

Mark Buffalo

Lol

SEJPM

@MarkBuffalo please don't start bragging by yourself about using the chopsticks though

TildalWave

I think a better operating word there would be teaching, not learning

SEJPM

you're better than this

@TildalWave machine learning works by looking at stupid amounts of data

you can't skip that (AFAICT)

TildalWave

i.e. can machine be taught to recognize patterns = yes, can machine learn to recognize patterns = erm, wot?

Mark Buffalo

23:32

@SEJPM too late. I'm doing it

SEJPM

@MarkBuffalo did you hit them?

@TildalWave first one is called "programming" and "regexes" and second one is machine learning which continually gets better

TildalWave

@SEJPM OK but in that sense, learn isn't any different to detect, and it doesn't have to have any learning capability to do that

Mark Buffalo

@TildalWave machine learning is simply teaching a machine to recognize patterns, and create things based on those patterns...?

TildalWave

@MarkBuffalo which is what I said

thus a better word would be teach :P

SEJPM

@TildalWave detect = binary, you detected it or you didn't, learning means more that you get better at detecting with practice, so the machines are learning to detect

TildalWave

23:36

I can learn, but I'm not sure I could learn to recognize any new patterns in supposedly random data... and if they aren't new, then I have been taught to recognize them

Mark Buffalo

I create a lot of things that analyze patterns and create solutions / programs around those patterns.

I need a definition of machine learning, Heh.

SEJPM

@MarkBuffalo like on bulk internet / telephone data?

TildalWave

@MarkBuffalo when it comes to new conclusions without being taught how to get to them

SEJPM

@TildalWave what is speech? supposedly random data to machines

Nate Kerkhofs

@TildalWave you can definitely have a machine learn new patterns it hasn't been taught at first. It's the basics of learning: learning through analysis

It's how we discovered most if not all scientific discoveries

Einstein wasn't taught relativity, he just learned himself them through analysis

TildalWave

23:40

@NateKerkhofs yes that's a very good point

Mark Buffalo

One of the more interesting products I developed is detecting common hacker \ script kiddie attacks and automatically undoing their damage.

@SEJPM can do.

Nate Kerkhofs

@MarkBuffalo to take that as an example: you taught the product how to detect them, but it doesn't learn new common attacks, because it can't tell an attack from a genuine change

SEJPM

@MarkBuffalo I know that you can, but the more interesting question is are you doing it already?

Mark Buffalo

@NateKerkhofs actually, I wrote the product in a way that it can learn, but you have to feed it data

Nate Kerkhofs

@MarkBuffalo yes, but it has to first be told which data is an attack and which data is a genuine change.

TildalWave

23:42

@NateKerkhofs OK but can you say that a machine analyzing PRNG randomness will develop new analysis methods on its own? Or will it draw new conclusions out of conventional wisdom so to say, a set of built-in algorithms.

Mark Buffalo

Yep, it has to be told. So machine learning is basically: the machine doesn't have to be told?

Nate Kerkhofs

@MarkBuffalo sort of

TildalWave

Einstein wasn't taught relativity, but he was taught analytical thinking

Nate Kerkhofs

Machine learning basically is "if you do this, something else will happen. Try to optimize the "something else"

at least, that's how I understand it

Mark Buffalo

@TildalWave ahhhh

Nate Kerkhofs

23:45

example: Google developed a machine that has taught itself (i.e. learned) how to play SNES games like Super Mario

Mark Buffalo

@NateKerkhofs the only way I know how to do this is a hacker detection project I was working on in beta. It would arbitrarily detect any hacker, and add the pattern to its database.

SEJPM

@TildalWave machine learning isn't "just throw it at the problem and wait for the results", you do usually adapt the system (more or less) for the specific task

Mark Buffalo

So it would learn on its own from what you were doing on the network, and it would shut it down. And it easily knew the difference between a genuine change and a fraudulent one

Nate Kerkhofs

The machine wasn't told "if you run through a coin, your score increases", but instead it was told "get as hich a score as possible" and discovered what improved the score

Mark Buffalo

I never got to finish it. I can't afford to develop it on my own

:(

SEJPM

23:47

@MarkBuffalo THROUGH MORE MONEYZ AT IT

Mark Buffalo

@NateKerkhofs ahhhhh, OK, I totally get it.

silverpenguin

I built a genetic alogirthm before it was quite good...just have to be carful of inbreeding...

SEJPM

Transcript for