« first day (3841 days earlier)      last day (33 days later) » 

5:26 AM
I have a webapp that generates PDF files from several user-supplied fields and can use CSRF to change those fields. Is there a way I can try to put malware (e.g. rev shell) in the output PDF by controlling the fields?
 
 
4 hours later…
9:21 AM
@JohnZhau I don't know enough about PDFs, but I'm dubious about a reverse shell. Many PDF readers can run JavaScript thought, but theoretically you will be sandboxed. Presuming you're looking for something for a bug bounty submissions, I might try looking into running cryptomining in a PDF via injected JavaScript, if that's possible
I was just reading about this for the first time and thought it was hilarious, so I might as well share:
The Emu War, also known as the Great Emu War, was a nuisance wildlife management military operation undertaken in Australia over the later part of 1932 to address public concern over the number of emus said to be running amok in the Campion district of Western Australia. The unsuccessful attempts to curb the population of emus, a large flightless bird indigenous to Australia, employed soldiers armed with Lewis guns—leading the media to adopt the name "Emu War" when referring to the incident. While a number of the birds were killed, the emu population persisted and continued to cause crop destruction...
 
Just referred to shitposting in the DMZ as "consulting with other security experts"
 
@MechMK1 Sounds accurate to me :)
 
@forest What do you mean the CEO? My feedback goes to the Burger King himself.
I still can't get over that one Saber/Burger King fanfiction
But why like Saber when you can like Jeanne? She's like Saber, but better in every way
I still can't get over how weird Fate is
 
 
4 hours later…
1:16 PM
24
A: How can the U.S. government ensure that the black budget is spent appropriately?

Joe CSuch a budget will, inevitably, fall under an executive department, headed by either a Cabinet Secretary, or the President himself. The budget for that department is scrutinised by Congressional Committees. Both the relevant Cabinet Secretary, and the senior members of the relevant Congressional...

Is everyone in the congress a trained accountant?
And what's the point of oversight, if everything has to be kept secret?
Basically the oversight is:
Committee: "Where is the money going?"
"Here, here and here, but it's all classified so you can't do anything about it"
 
1:37 PM
here, "government black budget" isn't even in the books...
it's more like this: you do some service to the government and charge $100k, but someone comes and asks you to charge $150k, wire that extra $50k to someone else, or your services won't be needed anymore, forever...
and that "someone else" sometimes isn't even aware of anything, because his documents were misused to open an account somewhere that does not care much about your ID at all
funny story: a woman was fired from his work, and went to work somewhere else... the new job asked her to open an account at a specific bank (it's a nuisance but common occurrence here) so she would be paid. when she got to the bank she was informed that she already had an account there. she would be paid around $1k/month on her job and the account already had around $150k.
she said she wasn't aware of that, asked the account to be locked, and went to the cops. they found out her former boss was the secretary of a senator, and she was using her account to receive those kickbacks...
 
@ThoriumBR In my country, you use dead people's information to avoid exactly this
 
here there's a national registry for dead people, and the banks are required to update their databases weekly if I am not mistaken
I know that insurance companies refresh their databases weekly, because some miscreants usually pay insurance for dead people and file for damages later
 
How do you get people to register the deaths?
 
1:53 PM
to release the body for burying, the hospital needs a death certificate, and to emit the certificate the government must be notified
the other way to bury someone is homicide, but that does not count...
 
Well, we can work around all of that. Plus a lot of people don't die in hospitals.
 
when people don't die in a hospital, the police must be notified and they will notify the government
because no death certificate, no burial...
unless, of course, homicide...
 
2:41 PM
urgh why does my brain turn off at 3pm
 
 
2 hours later…
4:58 PM
why do I always feel like writing my own password manager?
I took a look at the source code of "pass", which is a bash script that uses common linux tools like gpg. I was curious how it managed to edit passwords without writing them on disk, and it turns out it does write them on disk, in a temporary file which can be edited with vi, but then uses shred to delete it
my idea would be to write something like "pass", but much much simpler (and customized for my needs), where everything is kept in bash variables and never written on disk. Then the only problem left would be swapping I guess, which I wanted to disable anyway, but I could add a "swapoff" command at the beginning of the script anyway
 
 
2 hours later…
7:30 PM
> my idea would be to write something like "pass", but much much simpler (and customized for my needs), where everything is kept in bash variables and never written on disk.
never, is hard
sure, you could use a ram disk
but if stuff gets swapped out, it's on disk
 
@reed Turning swap off and on might not do what you want.
Imagine this scenario:
 
you can tell Linux to not swap your program...
 
@ThoriumBR Yeah mlockall().
 
there are 453 password managers.
- what? 453? let's make a password manager that solves everyone's problems, it's safe, small, portable, and run everywhere, from mainframes to arduinos...
... there are 454 password managers.
 
You disable swap. You run in bash PASS=hunter2, so bash allocates some memory from the heap. It can't swap it out because swap is disabled. Now you unset the variable, so bash frees the memory used by PASS. You re-enable swap. Unfortunately, "hunter2" is still there in unallocated memory, and gets swapped out.
Anyway, a personal password manager is easy to write. I wrote my own since I have my own use for it, but mine doesn't use encryption, because my disk is already encrypted and I use mandatory access controls to protect the contents of the file at runtime.
 
7:44 PM
you can use register as the storage class for the variable, and it will be stored on the CPU registers, not on memory
 
Only if you use volatile register, otherwise the compiler will surely ignore the keyword.
 
yep! volatile register is better
 
But it'll still leak into memory during context switches, although Linux doesn't use "true" swap so the saved execution context won't get swapped out (it counts as kernel memory, which doesn't swap).
But if you really need swap, you can just have encrypted swap easily. :)
But if you don't want something to be in swap, mlock() is what you want.
 
you can store the data encrypted, only decrypt it on the moment you need it, ask for the decryption password as late as possible, store the decryption key on volatile register variable, so it won't be swapped out
maybe volatile register is overkill and reduces the amount of registers available. mlock() is enough for almost every case
 
Given that you'd need 2 or 4 registers (or 4 to 8 on a 32-bit system), it'd be better just to lock the memory. Using registers also doesn't guarantee that the compiler won't shadow the value as part of some optimization, even if you do use volatile to disable optimizations with side-effects.
Or the key might be on the stack before it's saved to the register, and unless something overwrites those bytes on the stack, they'll be free to be swapped out.
 
7:55 PM
or you use some inline ASM magic and explicitly tell the compiler to not optimize
and put this function on an external object and compile only this object without optimization
 
Sure, but that's going a long way to keep something out of swap when mlock() already works. :P
I've worked on a project where I had to ensure that some data in memory would never touch RAM (not even temporarily), and it's actually surprisingly difficult. I had to "spread out" the data so that a single SMI that would only cause 64 bits to be leaked to memory would not be able to reconstruct the data.
 
yep, it's against all the ways a computer works
 
Yeah. I did manage to do it in the end, but it was ugly, and kinda slow.
Luckily, TRESOR already came up with a lot of the ideas. :P
 
a smart card is an easy way, but it's cheating...
 
Only if you can offload the computation to the smart card as well.
If you're just storing data, then the data will still exist on the computer at some time.
 
8:00 PM
you can... there are a couple models of smart cards with ram, processor, encryption processor... but they aren't cheap
 
I'm not surprised.
This kind of thing requires careful threat modeling, because sometimes it's as easy as tweaking some C code. Other times it requires modifying the kernel. Other times it requires different hardware.
 
or inventing a new hardware...
 
If you've got the money for R&D, yeah.
Or enough guns to steal from taxpayers.
But often, all it takes is some clever code. A lot can be done with x86.
 
when I saw someone writing a full 3d FPS with enemies, soundtrack and textures using only 98kb of code, I stopped doubting what could you do in x86 assembly
I said 98kb? no... it wasn't 98kb. it was 96kb.
.kkrieger (from Krieger, German for warrior) is a first-person shooter video game created by German demogroup .theprodukkt (a former subdivision of Farbrausch), which won first place in the 96k game competition at Breakpoint in April 2004. The game remains a beta version as of 2021. == Development history == .theprodukkt have developed .kkrieger since mid-2002, using their tool .werkkzeug (from Werkzeug, German for tool). They used an unreleased version of .werkkzeug called .werkkzeug3. The source code of .werkkzeug3 engine was made available by the group in 2014, either under the BSD license or...
 
You'd like Retrocomputing then!
Of course, 96kb is a luxury for many systems.
 
8:07 PM
and then someone writes a notepad on Electrum and it takes 450MB of RAM...
 
lmfao
(To be fair, 99.99% of that will be virtual memory that doesn't map to physical pages, but still...)
I miss the days when every cycle and every byte was precious and valued.
Nowadays everyone's like "pft only a million cycle overhead on this inner loop? Why should we bother optimizing that out when we're doing 3 billion cycles on 8 cores?"
 
there comes the mainframe guy...
on mainframes, you pay licensing by cycles used. so the less cycles you use, the less you pay to IBM every month
 
Wow really?
Licensing... by cycles used???
 
yep... it's called MLC: monthly licensing charge
 
So what, does it have something like an odometer that keeps track of how many cycles passed, and you have to faithfully report that to IBM? Or is it automated?
 
8:11 PM
it's automated, and it's not exactly per cycle, it's even worse...
 
So I take it the system automatically uploads the cycle count on a monthly basis, and will refuse to run if IBM doesn't return some kind of DRM-esque code indicating acknowledgement?
 
there's a software that I don't remember the name running all the time and it records the maximum amount of cycles you used every hour. So if you used 75% CPU in one hour but 10% 23 hours, the entire day is charged 75%
 
Ah, so it's software that does it, not hardware? I guess that wouldn't be too hard to fool.
 
every month the report is sent to IBM and you pay that amount minus a lot of rebates depending on your relationship with IBM
 
But that's still incredibly stupid. Even Microsoft isn't that bad (and plenty of *nix is free).
 
8:14 PM
the problem is that you can only run mainframe code on mainframes... and there are no platform as resilient as a mainframe. so no matter how draconian this scheme is, and how expensive are both hardware and software, banks use mainframes for their core business and they don't think much on changing platform
you can kinda run mainframe code on emulators, but it's against the EULA, and the performance is abysmal..
so while is technically possible to run mainframe code on x96 systems, you will need so many top line x86 servers that will end up being more expensive than buying a mainframe
5 years ago I saw someone running an emulator on a (then) last-gen i7 and achieving 20-30 MIPS (meaningless indicator of processor speed), and back in 2002 I worked on an old mainframe with 700 MHz and it had around 800 MIPS. so the math isn't very promising.
 
You can't compile arbitrary code to run on a mainframe?
 
you can, GCC can create s390x code
 
So it probably wouldn't be too hard to write something to exploit that licensing software.
 
that is possible, but risky
 
How would they ever find out?
 
8:20 PM
that licensing software is the golden-egg laying chicken for IBM, and you can bet it's among the most cared piece of software they ship
 
Do you know if the binary is published anywhere?
 
and if you bypass it, you may end up paying a hefty fee that would cover a decade of mainframe usage or having the mainframes shutdown and taken away for breach of license. and that would be more devastating than a ransomware that lost the private key for your data
 
I suppose with a big company, following the rules of capitalism is more important.
 
@forest I doubt so. zOS isn't donwloadable, the code is shipped on sealed disks and carried by career IBM engineers that won't risk their jobs leaking it, and customers are under contract to not leak it
 
Hm.......
 
8:23 PM
@forest and we are talking about million dollar yearly contracts here, not nordvpn subscription
and IBM knows their hardware better than Apple
 
Apple just buys their hardware and puts it together.
Not like they even make their own CPUs.
 
and you guys think the "you aren't the owner of your hardware" started with Sony and MS and their consoles...
 
Well, those guys started doing it to consumers.
Do you have a PGP key?
 
virtualization? ibm does that since 67...
renting you your own hardware? since even earlier.
walled gardens? since always
@forest I believe I do, but it's on the other computer... I have to put it on my site.
 
I've never been a fan of IBM. :P
Alright. I'll import it when you have it available.
 
8:26 PM
btw, thanks for telling me my site was down... it's up now and now it have usable data
@forest IBM did a lot of good things, and a lot of bad ones too... the PC standard was great, for example. and the idea of creating software not tied to the hardware was great too
IBM basically created Microsoft
 
IBM created a lot of things.
 
I have the book for the IBM centennial, there are a lot of things there, and I forgot most of them
 
@forest I didn't expect you to use a password manager without encryption
 
@reed It doesn't serve any purpose for me.
External attackers are still protected against by disk encryption. Local attackers (compromised browser, malicious user process, etc.) are protected against by access controls.
 
and if someone can run software on your computer as your user, the password manager cannot protect you
 
8:37 PM
is it that hard to become root on your computer? I'm wondering if and why you left out all kinds of privilege escalations from your threat model
 
My computer is quite hardened against local attackers. Obviously not impenetrable, though.
And even root is isolated. After all, root is just another user, fundamentally.
@reed What kind of privesc are you thinking of?
 
what do you do to become root, or have root privileges for administrating stuff? This is actually a question I might ask sooner or later here on SE. I use the usual "sudo", but that means I'm basically already root all the time (sudo is easy to bypass by malware).
I was thinking I would need a separate root account, and switch to it in some "safe" way
 
Switch to another virtual terminal. Use SAK key combo. Log in with agetty.
 
I read about ... that, the special key, exactly
so it sounds like you are doing what I was planning to do
 
@forest my site got updated and my pubkey is now there
 
8:46 PM
It's a sysrq combo (on Linux) which kills everything in that session. That way a malicious non-root user won't be able to hook the "switch VT" keys and display a fake login.
But even if they did, my system won't let anyone get root from a lesser user, only from a login with agetty. So the SAK combo is more to prevent it from setting up a fake root to record me entering sensitive data somewhere else (i.e. the password itself is not too sensitive).
 
9:03 PM
@ThoriumBR Imported. My public key (encrypted with yours so I don't get spam):
-----BEGIN PGP MESSAGE-----

hQGMAwAAAAAAAAAAAQv/SH8SnDmyN1DuC1+Dyx5byi7qj8fuW0iK6T1qh0X5zzmr
PHKIUD/yTKZ2Ph1buK6vUhz1+gJBTCcPPxr4l71P7a5L3baOmHI74d1wJKO53RIo
f1SpyohJ5RoOUIu8mTK/5GRJCAm6wkRr7QE4Od3GUO1T1t/LRT34GSfv8FDrweRH
lyBVdIOU7AUOyooWC5fH3MUQAV8YnNcqBENN53dFInKHHS9PM3EZE5EvmKpwSjW0
HUt7pnqfP2/GQJx2MymlfNxEKAkmyFZ4SlIuAWEiWgWV7K+dpMsSISMZ6ifalG51
q4OrHs/q1OmIsoeKIWXM6klv3PX4kbiG2FkimoLzsfuC3x0V1E+JYlAB9X4yvzex
tx+pMnK2UM2VRqgVcrDqXoO5HVhSL/fEphT1bmWAD6+CoMW4BE1LaSCTxAjZsfUl
nLiMKuVbC3Zd5vZI2k6IiiGQSiu6e1w7Z3AHyLuP67vDpfJOauU5StMzkE3RLJ3U
 
@forest, can I ask how your SAK is set up? I mean, what action do you perform to make sure after the key combo you have a secure tty?
 
@reed You have to enable it with the kernel.sysrq sysctl (it's a bitmask). After that you just do the combo and the screen flickers once as the running agetty is killed and respawns.
If you totally trust people who are physically at the keyboard (and use a screen locker which disables SysRq), you can just set kernel.sysrq = 1 to enable all SysRq commands.
 
yes, but what combo? I read there are several, to perform lots of actions
 
SysRq K
The SysRqs are all "Alt+SysRq+$something".
The common combos are REISUB (SysRq-R, SysRq-E, SysRq-I, SysRq-S, SysRq-U, then SysRq-B).
That's return control from Xorg to terminal (R), send SIGTERM to every process (E), send SIGKILL to all processes (I), sync disk buffers (S), remount all filesystems read-only (U), and emergency reboot (B). That's the common combo which is used to recover from a locked up system.
But there are others like SysRq-F which triggers a manual oom_killer event.
 
oh, ok, it's "k" the key you are using (kill everything in the virtual terminal)
I'll have to remember that. Or end up asking again, lol
wikipedia says that combo was designed to imitate a SAK, so that's it
 
9:16 PM
5 mins ago, by forest
SysRq K
yeah :P
But remember, you have to have it enabled! The kernel.sysrq contains a mask which disables it by default.
  2 =   0x2 - enable control of console logging level
  4 =   0x4 - enable control of keyboard (SAK, unraw)
  8 =   0x8 - enable debugging dumps of processes etc.
 16 =  0x10 - enable sync command
 32 =  0x20 - enable remount read-only
 64 =  0x40 - enable signalling of processes (term, kill, oom-kill)
128 =  0x80 - allow reboot/poweroff
256 = 0x100 - allow nicing of all RT tasks
> The number may be written here either as decimal or as hexadecimal with the 0x prefix.
But again, make sure your screen lock program disables SysRq while it's running! Otherwise someone can bypass your screen lock with just a key combo.
 
the screen lock hack is worrying, yeah, I'd have to think about that
 
What screen locker do you use?
I know vlock (that's the one I like) can disable SysRq with the usual -s argument.
 
although my threat model does not include local threats with physical access while my PC is turned on
to be honest I have no idea what is locking my screen, lol
 
Usually "local" refers to non-physical but running on the system.
 
could it be lightdm? Or something like that
 
9:23 PM
What DE are you using?
KDE?
 
xfce
 
You could run f="/proc/sys/kernel/sysrq"; cat "$f"; sleep 30; cat "$f" and start the screen lock and unlock it after 30 seconds. That should tell you if it disables SysRq for you.
 
oh, cool
 
Honestly, I don't trust X-based screen locks. But if your threat model doesn't include physical attacks, it shouldn't really matter.
 
just tested, looks like it doesn't disable it, I see the same value (176)
 
9:33 PM
Thought so. So test to see what options that mask enables.
Might even allow bypassing the lock.
You may want to use vlock instead tbh. It's much simpler.
 
I see. Thanks. I need to go now, bye :)
 
bye o/
 

« first day (3841 days earlier)      last day (33 days later) »