The DMZ

3:55 AM

What are some good web spiders? I've tried hakrawler but it returns a lot of off-site results even with scope strict and its output needs quite a bit of processing, unlike gobuster.

John Zhau

8:30 AM

I'm having trouble with ROP Emporium's ret2win 64bit. I've done the 32bit pretty easily, but with 64bit, I can't seem to overwrite RIP, only RSP & RBP. I'm on Arch Linux rather than Ubuntu, and I'm not sure if that changes things (I don't think it should affect this). Can I get some help?

A. Hersean

8:51 AM

I've got 1 day to learn the standard ISO 19011... I'm already tired of it.

reed

@A.Hersean, how many pages is that?

A. Hersean

61

The exam is fond of tricky questions on exact definitions and stuff like that

reed

9:17 AM

@A.Hersean, and what exam is that? For some kind of degree or certification?

A. Hersean

It's part of a certification as a (source code) auditor. So that I can work on another category of audits than the ones I'm used to do currently.

Conor Mancone

@reed I mentally quote that one in my head on the regular :) One of Randall's best for sure

reed

This question made me realize that maybe the usual classification of authentication factors is incomplete.

0

Q: How "Somewhere you are" authentication adds further security?

In addition to the authentication techniques that are based on “something you have”, “something you know” and “someone you are”. authentication techniques that consider “somewhere you are” also used. Why? Does it add further security?

If "somewhere you are" is an auth factor (and it is, however weak), then it doesn't fall into any of the classic three categories (something you know, something you have, something you are)

A. Hersean

"somewhere you are" is not an authentication factor, but an authorization factor.

People keep mixing up authentication, authorization and identification. Same with integrity and authenticity.

And mixing up authentication of data vs authentication of persons (sender of the data).

MechMK1

9:43 AM

@ConorMancone To bring a little bit of that discussion here, I find 10^-50 to be very interesting, as it's ~2^-166, which has roughly half the bitlength of 2^-80, which I was taught to be "negligibly small"

Statistically, you'd win the lottery ~100,000,000,000,000,000,000,000,000,000,000 times before you would randomly guess a password with 128 bit entropy

Conor Mancone

@MechMK1 As the answer-er said there, 10e-50 is definitely arbitrary. I wouldn't have expected someone to actually put a number on it. It was convenient in this case though, and I think the idea still holds: at some point in time the probability is so low that even though it could technically happen, it's certainly not worth discussing.

AKA "statistically impossible".

MechMK1

Also, pro-tip if you want your math professors to hate you: If you want to get something done quickly, do it as follows:

Round every number to the nearest power of 10, so your numbers are just 10^x and 10^y respectively. Also make sure X > Y.

For addition: The result is 10^x.
For subtraction: The result is 10^x or -10^x..
For multiplication: The result is 10^(x+y)
For division: The result is 10^(x-y)
For power of 2: The result is 10^(2x)
For square root: The result is 10^(x/2)

Conor Mancone

So JCRM is correct that "statistically impossible" is not the same thing as "impossible". However for practical purposes they are.

MechMK1

"Look I am technically correct, even though it has no meaning and didn't contribute anything"

JCRM, probably

Conor Mancone

@MechMK1 This is how astronomers work :) I once listened to 2 astronomy professors get into an argument about whether the error of a particular measurement was only a factor of 3, or a factor or 10. In any other context that would just be "wrong" or "more wrong" :)

MechMK1

9:56 AM

I love doing that when it comes to incremental games

Because they're just teaching you how to really think with big numbers

I mean, if you have 1.851*10^67 of something, your regular approach to numbers becomes useless

Conor Mancone

That is a true story

MechMK1

So if you have 10^67 of something and something costs 10^64, it basically costs nothing

reed

10:38 AM

@A.Hersean I'm not convinced. But maybe I'm one of those people who mix up things like you say

I also don't want to bother you now, you need to study the ISO standard, lol

But maybe you are right. "Somewhere you are" is too weak as an auth factor, so weak that it cannot be used to identify a person. So it can't be a real auth factor.

So maybe limiting the areas where someone can connect from, is a limitation of your role and capabilities, so it's a matter of authorization. Ok, I'm convinced

Conor Mancone

11:02 AM

@reed This is a good perspective to consider the zero trust model from. Consider the fairly common use case of limiting access to an external resource by adjusting a firewall to only allow access from the office IP address.

This is, in essence, using physical location for authorization. The trouble comes if no further authentication is required (aka being on the office IP is sufficient - you aren't required to login to access the external resource as well)

This would be a violation of the zero trust model, and is a bad idea in general, because there are countless ways for an attacker to gain access from the office IP. Therefore you basically just have a (crude) authorization layer without any authentication, which is of course very dangerous and doesn't allow proper auditing

ThoriumBR

12:11 PM

like compromising a computer on the office and using it as a proxy...

MechMK1

one thing I could think of in regards to "somewhere you are" is that Android might not require re-authentication if you are in a "trusted location"

That of course would necessitate that the GPS data the OS receives can't be spoofed

ThoriumBR

12:49 PM

but that is something you cannot guarantee...

as pokemon-go shows, even with lots of money and lots of anti-tampering, people still fake gps

and even if they don't use android itself, they can do fake-gps using SDR

github.com/osqzss/gps-sdr-sim

crazydanishhacker.com/…

slowmin.com/fake-gps-with-a-hackrf-one

MechMK1

1:40 PM

@ThoriumBR That's true, so I don't think that GPS coordinates should be in any way trustworthy

Enabling a secure location at which your phone remains unlocked is a typical "usability vs. security" tradeoff

A. Hersean

Some use cases need trustworthy localization. Thus, some hardware GPS manufacturers do apply to have a security certification attesting that their output is reliable, precise and cannot be tempered with. It can be a Common Criteria evaluation or a more focused one (without a standard equivalent yet in Europe).

MechMK1

@A.Hersean But how could you ensure that the data you receive is not tampered?

1

Q: Why not signing a certificate with more than one Certification Authority

A student asked me a good question today when I was explaining the concept of certificates chain. As I say "if a CA is compromised by an attacker he can emit false certificates for the entities the CA is allowed to sign (e.g all the *.fr)", he asked me : "why not signing each certificate by more ...

certificates public-key-infrastructure certificate-authority

Also, interesting question

ThoriumBR

@MechMK1 military-grade gps sign the updates... but those receivers aren't available to civilians

A. Hersean

@MechMK1 Since 100% security is impossible, you 1st define the target level of security, that is what you assume are reasonable resources available for an attacker (a risk assessment). Then you either prove the security ("this TLS config is robust") or try to demonstrate flaws in the product ("there, see this MITM? pwned").

MechMK1

@ThoriumBR Yeah, that makes sense.

A. Hersean

1:51 PM

I'm talking about hardened steel boxes.

With a GPS output.

MechMK1

I see

A. Hersean

(Well, not all are hardened steel boxes, but you get the idea. Unfortunately I must not be too precise.)

reed

2:09 PM

If you don't sign the output of a piece of hardware (using a secret private key that cannot easily be extracted), it's impossible to prove that the output is genuine, right?

ThoriumBR

yes

and even if you sign, you cannot prove data was changed before it was signed

reed

but you basically need to rely on the fact that tampering with hardware is difficult

So they way I understand it, if you want a GPS coordinate to be reliable (make sure it hasn't been changed), you need to rely on the fact that the attacker cannot steal the private key easily (because it's embedded in the hardware). In practice this can be done, in theory though a very powerful attacker can always rely on advanced reverse engineering practices

ThoriumBR

2:24 PM

not like that... your GPS receiver can be as secure as possible, but if your GPS receiver is relying on the public, civilian-grade GPS data, an attacker can trivially spoof GPS data and lie to the receiver

to really be sure to receive non-forged GPS coordinates, you need to receive the military-band gps, that signs the data... but civilians aren't allowed to have those receivers

Anonymous

I haven't slept in 60 hours.

Anonymous

insomnia is fun

reed

@ThoriumBR, oh, maybe we are talking about different scenarios then. By the way, in your example/scenario, where is the GPS data signed exactly? Signed by the satellite, or what else?

ThoriumBR

it's signed by the satellite

good luck stealing the private keys from them

reed

Oh, ok. Then you can't really tamper with that hardware, LOL. Yeah, now I understand

A. Hersean

2:42 PM

Needless to say, in those kind of audits, the physical tempering resistance is evaluated, too. Against side-channel attacks and memory dumps. Again, depending on the assumed resources of the attackers.

MechMK1

2:55 PM

Can't wait for 42C3 when this german hacker team is like "So we launched a space probe to dock at one of the military satellites, probe the internal hardware and extract the private key"

reed

3:05 PM

@MechMK1, what's 42C3?

MechMK1

42nd Chaos Communication Congress

Conor Mancone

@MechMK1 tehehe :)

Also relevant

20

Q: Is it possible to remotely hack the GPS system and disable GPS service worldwide?

The title pretty much says it all. I'm wondering if it is possible through "digital" means only (aka any physical disruption of satellites is not allowed) to disable the US GPS satellite constellation. Here are some additional details to help with answering: This would require that the GPS sa...

reality-check earth satellites hacking gps

reed

That's a nice name for a congress

The mottos each year seem even better, judging by what I see on Wikipedia. 2016 motto: "works for me"

jdgregson

11:34 PM

Suppose you used a password manager and discovered that it leaked your local computer hostname and username to any website visited in the browser, even if that website didn't have any saved entries in the password manager. Would you personally be upset by this and want it fixed?

Caveat: The password manager is part of an all-in-one security suite, and getting the leaked data triggers a detection in the anti-virus and it will be obvious to the user that "something" happened. However, the antivirus notification assures the user that an access attempt was blocked, and the attacker still has the hostname and username.

ThoriumBR

11:56 PM

is this theoretical or really happened?

Transcript for