« first day (2776 days earlier)      last day (2113 days later) » 

Sagar V
Sagar V
5:55 AM
@forest Ask him to google "CVE 2006-xxxx" exploits to get the methods
 
 
3 hours later…
Tom K.
Tom K.
8:49 AM
Meh.. should we find a good duplicate for these kind of questions and close them all forever? security.stackexchange.com/questions/190158/…
or open up a canonical question like "How do I calculate the time that is needed to brute force a specific password?"
or is there one already?
 
Tom K.
Tom K.
9:29 AM
well, speaking about processor bugs: intel.com/content/www/us/en/security-center/advisory/…
a buffer overflow in http handler in Intel® Converged Security Management Engine can lead to arbitrary code execution and DoS via the same subnet
 
forest
forest
@TomK. Well most computers have that disabled anyway.
Thankfully.
 
Tom K.
Tom K.
well, Intel tells us every 3 months that it's fixed now :P
and then they or somebody else finds something new
 
forest
forest
That's why I prefer good old IPMI with a regular BMC :P
 
Benoit Esnard
Benoit Esnard
Use pen until further advice
 
forest
forest
That too
 
Tom K.
Tom K.
9:34 AM
@BenoitEsnard Aaww, still? :(
 
forest
forest
@TomK. Still 4 Spectre bugs left. :P
And far, far more microarchitectural bugs lurking in the shadows.
 
Tom K.
Tom K.
@forest yeah, I'm waiting :>
 
forest
forest
99 little bugs in the code, 99 little bugs! Take one down, patch it around. 143 little bugs in the code!
 
Benoit Esnard
Benoit Esnard
It's like a good TV show.
 
Tom K.
Tom K.
if I were a researcher looking for CPU bugs
or someone who wanted to sell vulns
I would reeeeally look into CPUs for mobilde devices
 
forest
forest
9:36 AM
Well people are looking into ARM.
(and pretty much every mobile device is either a light x86 or ARM)
Personally I'm more afraid of x86, since it's just so damn complicated.
Shit like the A20 hack that pwnt the original Xbox? You won't see that shit on ARM.
Because ARM doesn't have to be compatible with an ancient 8080 piece of crap.
 
Tom K.
Tom K.
aren't there a lot of Qualcomm cpus in mobile devices?
or am I mixing that up?
 
forest
forest
Yeah there are.
But it's the architecture that matters.
(i.e. ARM)
 
Tom K.
Tom K.
ah, they're also ARM, didn't know that
 
Benoit Esnard
Benoit Esnard
I think I have an entire missing knowledge field between "add 0 and 1 thanks to transistors" and "oh, look at this C code"
2
 
forest
forest
heh
 
Benoit Esnard
Benoit Esnard
9:40 AM
Too bad all good vulns are hidden in that field right now :(
 
forest
forest
I'm trying to gain some of that missing knowledge but it's... complicated.
 
Tom K.
Tom K.
amen to that
 
forest
forest
Reading Anders Fogh (or is it Agner Fog? One of them is x86 optimization, one is x86 hacking), but god, it goes into some crazy detail.
 
Benoit Esnard
Benoit Esnard
When I learnt about micro-code updates I was like "how the fuck are you upgrading physical micro-transistors?"
 
Tom K.
Tom K.
reading two books on that shit in parallel
 
forest
forest
9:41 AM
Microcode updates just update a simple lookup table.
Certain instructions are hardcoded to go down a slowpath which touches the microcode table, others (the ones that need to be really fast) totally bypass that table so can't even be hooked with microcode. The thing is, those patches are a lot more limited than most people think.
Pretty much just hooking certain slow path instructions and toggling chicken bits.
 
Tom K.
Tom K.
agner fog @forest
 
forest
forest
Ah ok
 
Tom K.
Tom K.
anders fogh is the danish ... prime minister?
some danish politician I think
 
forest
forest
This guy
 
Tom K.
Tom K.
thought you meant this guy: agner.org/optimize
 
forest
forest
9:44 AM
Oh I did, I just mix them up all the time :P
Because they both work with CPUs and have similar names.
 
Tom K.
Tom K.
Hooray, I win!
 
forest
forest
:P
 
Tom K.
Tom K.
also, this guy
Anders Fogh Rasmussen
Anders Fogh Rasmussen (Danish pronunciation: [ɑnɐs ˈfɔwˀ ˈʁɑsmusn̩] ( listen); born 26 January 1953) is a Danish politician who was the 24th Prime Minister of Denmark from November 2001 to April 2009 and the 12th Secretary General of NATO from August 2009 to October 2014. He is now CEO of political consultancy Rasmussen Global and a Senior Advisor at The Boston Consulting Group's Copenhagen office.Rasmussen was first elected to the Folketing in 1978 and served in various ministerial positions, including Minister of Tax (1987–1992) and Minister of Economic Affairs (1990–1992). In his early career...
 
forest
forest
No clue who that is
 
Tom K.
Tom K.
"the 12th Secretary General of NATO from August 2009 to October 2014"
!
 
forest
forest
9:46 AM
Never heard of him.
 
Tom K.
Tom K.
god, read a newspaper from time to time!
 
forest
forest
Waste of paper. News is the one thing that leaves you more ignorant about the world after reading it than you were before.
 
Tom K.
Tom K.
that is the most bullshit statement that ever transpired out of your brain. :P
 
forest
forest
:P
I prefer my opinions not to be made for me by mass media.
I like to form them on my own.
Unfortunately that necessitates avoiding some of the more major media outlets.
 
Tom K.
Tom K.
you can consume fringe media for all I care
 
Benoit Esnard
Benoit Esnard
9:49 AM
I don't even know what NATO is.
 
forest
forest
Fringe media is almost as bad.
 
Tom K.
Tom K.
it's OTAN for you, benoit
 
Benoit Esnard
Benoit Esnard
Oh, thanks, I know it under that name. :D
 
Tom K.
Tom K.
then listen to NPR, whatever. just get yourself informed.
:P
 
forest
forest
Yeah NPR is OK. I like The Intercept too.
 
Benoit Esnard
Benoit Esnard
9:50 AM
You English people are strange. Why do you keep messing with letters' order in acronyms?
 
forest
forest
But the specific secretary generals of NATO?
 
Tom K.
Tom K.
haha
@forest sure. I mean.. you know who the prime minister of the UK is, right?
 
Benoit Esnard
Benoit Esnard
I know who the queen is.
 
forest
forest
Is that thatcher?
Idk much about UK politics.
 
Tom K.
Tom K.
I hate you guys..
 
forest
forest
9:51 AM
I just hear names and forget them as soon as I can.
Oh I know who the queen is too.
It's almost all I know about the UK :P
 
Benoit Esnard
Benoit Esnard
I think the prime minister is that blond guy looking like Trump
 
Tom K.
Tom K.
the secretary general of NATO makes decisions that are pretty serious..
:/
 
forest
forest
Trump's that guy with orange hair that everyone is talking about now days, right?
 
Tom K.
Tom K.
that guy just got fired
 
forest
forest
:^)
 
Benoit Esnard
Benoit Esnard
9:53 AM
@TomK. Oh sorry for him then. Can Sherlock Holmes replace him?
 
Tom K.
Tom K.
:(
okay... I'll stop this now.
 
Benoit Esnard
Benoit Esnard
Oh, Theresa May
 
Tom K.
Tom K.
@BenoitEsnard: are you coming to offensivecon.org ?
 
Benoit Esnard
Benoit Esnard
Thanks Google.
I guess I was thinking to Boris Johnson
.
"Secretary of State for Foreign and Commonwealth Affairs" until July 9th
Oh god thanks, I was afraid he was being fired because I compared him to Trump.
 
forest
forest
lol
 
Benoit Esnard
Benoit Esnard
9:56 AM
@TomK. I don't think so, Berlin is quite far from me
 
Tom K.
Tom K.
psshh.. it's not
 
Benoit Esnard
Benoit Esnard
And I still need to get my driver licence first
 
forest
forest
Screw driving. Get a pilot's license!
 
Benoit Esnard
Benoit Esnard
Isn't Berlin doing Brexit soon?
 
Tom K.
Tom K.
 
forest
forest
9:57 AM
Berlin doing Brexit, huh?
Berlexit?
 
Tom K.
Tom K.
or go by train, whatever
 
Benoit Esnard
Benoit Esnard
I still don't understand why you insist quitting the Earth, Moon doesn't even have an atmosphere right now.
 
Tom K.
Tom K.
Benoit is in full-troll mode
 
forest
forest
Full troll mode is good for the spirit.
And the moon is lame anyway. I want to go to Venus.
 
Tom K.
Tom K.
full throttlle
 
forest
forest
9:59 AM
ehehe
 
Benoit Esnard
Benoit Esnard
~160€ atm
@forest Venus is too hot right now - I prefer waiting for winter.
 
Tom K.
Tom K.
your employer doesn't pay?
 
forest
forest
The upper atmosphere (60,000 feet IIRC) is actually a nice temperature and pressure.
With perfect density to float using oxygen balloons.
 
Benoit Esnard
Benoit Esnard
My employer has nothing to do with information security
I'm doing web development :P
Wow, tickets are expensive too
 
Tom K.
Tom K.
that's why I'm asking now #earlybird
and HamZa asked if anyone will be there
 
forest
forest
10:02 AM
At offensivecon?
 
Tom K.
Tom K.
yup
 
forest
forest
I'm only going to DC this year.
 
Tom K.
Tom K.
yeah, I'm also going to disconnect a lot
:s
 
forest
forest
:^)
Ugh, just found out that my favorite piece of homebrew video game software is closed source :/
I hate it when homebrew is closed, it really goes against the nature of the scene.
Especially for a scene that's mostly dead (e.g. DS or GBA homebrew).
Not sure if I should try to RE it or just steal the source. I have been meaning to learn more about ARM assembly, but starting with a complex application like a homebrew emulator would prove a rather difficult starting point...
I mean you'd think that someone wouldn't mind willingly giving up their source for a homebrew scene that's no longer active.
 
Tom K.
Tom K.
is that that weird game you posted some screenshots a while ago?
 
forest
forest
10:17 AM
No that was Touhou which is a PC game.
I mean I've also been wanting to get the source code for that but if I recall, the creator actually lost his own code for all but his most recent games lol
 
Benoit Esnard
Benoit Esnard
10:50 AM
Touhou music is great.
 
 
3 hours later…
Benoit Esnard
Benoit Esnard
1:25 PM
This post is awesome.
 
Tom K.
Tom K.
Avalanche!
nice find
 
 
6 hours later…
Tom K.
Tom K.
7:45 PM
it really is all just people
how depressing
 

« first day (2776 days earlier)      last day (2113 days later) »