The DMZ

« first day (4176 days earlier) ← previous day next day → last day (716 days later) »

5:14 AM

@JourneymanGeek Human side of cybercrime, not security. And it may be interesting, but from what I saw in a quick skim of the article, not very useful.

@JourneymanGeek Problem with krebs is he is mainly a journalist who caters more to the general population than the security community (which is understandable). So he mostly isn't interesting for us

nobody

5:28 AM

Q: Best Way to Reliably Performing Checksums Assuming Entire Internet is Compromised

I am under the assumption that large parts of the internet are under supply-chain MITM attacks all the time. I'm wondering what's the best way of reliably ensuring the integrity of system packages, etc. I'd like to get my packages from multiple sources and make sure the checksums etc. match up. I...

checksum

I wonder if these are the same people who later progress to claiming their neighbors hacked them?

2 hours later…

nobody

7:15 AM

-1

Q: How to find information that NSA trolls on Stack downvote?

I'm just curious and I'm not saying this has ever happened to me. But what if Stack Security was actually under an active supply-chain attack in the form of trolls under "NSA" payroll or spiritually "NSA"-aligned entities? I just say "NSA" because of their bad reputation - it could be any spiritu...

nsa

AHAHAHAHAHA

First time I ever heard the NSA being called a "spiritual principality"

1 hour later…

A. Hersean

8:16 AM

That's babble from a conspiracy theorist.

1 hour later…

nobody

9:18 AM

Q: How to Ensure Adversaries Receive Information?

assuming an organization / person is under a sophisticated, on-going supply-chain attack, how can you basically make sure they read something? I get hacked all the time and I want to, for better or worse, send them a short blib of text that they should read. I want to make sure they hear my side ...

ssh keyloggers

> divinely inspired

This is beyond regular conspiracy theorists

> how can I make the message travel through the people hacking me to the people hacking them?

Journeyman Geek

@nobody AH as I joke... I'm not a really security guy

A. Hersean

9:44 AM

> the devil [...] thinks I'm Jesus. I'm not.

Yeah, he is not. But heavily deluded he is.

3 hours later…

ChocolateOverflow

12:36 PM

if an RFID card can be made in 2-3 hours in a normal office building, how likely is it that the card can be rewritten with something like a proxmark?

Journeyman Geek

@ChocolateOverflow uhhh

You can't overwrite 'normal' RFID cards

there's special ones you can, and with the right hardware/software tools its a 5 minute job to clone an existing card

2 hours later…

ChocolateOverflow

2:46 PM

I've seen cards cloned in 10 seconds with a proxmark

Fire Quacker

3:16 PM

I think 5 minutes is using a Proxmark III as a Wiegand sniffer and cracking the keys. When you're cloning a card, that's using a different vulnerability (unencrypted 125kHz format)

Journeyman Geek

But 2-3 hours is probably incorrect

Office cards are basically sold 'preburnt' and you authorise the cards for the system

I've done access controls at an old job ;)

BUT you definately can't rewrite an excisting card unless its designed to

Fire Quacker

@JourneymanGeek Yah, hours may indicate somebody wants to finish watching stuff on YouTube before dealing with actual work

Journeyman Geek

lol

or paperwork for onboarding in general

watching youtube before dealing with actual work

Fire Quacker

For cloning, you have to get blank cards somewhere, or rewritable keyfobs or something

Journeyman Geek

@FireQuacker yup, which are a thing

Fire Quacker

3:20 PM

@JourneymanGeek Priorities, man

Journeyman Geek

but those are not 'standard' cards

@FireQuacker nothing blowing up yet, can't start on the reports before 1am

Fire Quacker

@JourneymanGeek Honestly, the whole preburnt thing weirds me out. Like, if somebody is able to get one of your cards, doesn't that mean they can make pretty good guesses about your other cards?

Journeyman Geek

@FireQuacker Well in theory they give you a shuffled random stack of cards with nothing more than a looooong serial number

Fire Quacker

For HID, I thought it's just 5 digits + optional site code (3 digits)

And when you buy packs, it's like 100 cards in a specific range (like 412xx)

nobody

5 digits sounds like that is vulnerable to bruteforcing anyways

Fire Quacker

3:35 PM

I wonder if it is

I mean, obviously you're not going to carry thousands of cards with you

Ah, it probably depends on Wiegand vs OSDP

nobody

@FireQuacker Can't you have a device that tests all the combinations one by one?

Fire Quacker

You mean by changing radio stuff?

Radio is magic, man. I have no idea.

nobody

Everything is magic for me, and I have no idea about anything. :)

I just make guesses that sound plausible to me

Fire Quacker

I would suspect it's not as simple as that. I know that you can do that with some garage door openers

belkarx

@FireQuacker You can in fact do that.

@FireQuacker Replay attacks! Unless there's proper mitigation, most RFID devices are vulnerable (Honda was)

2 hours later…

belkarx

5:19 PM

MiFARE cards, which are commonly used for auth, have microprocessors onboard with cryptographic keys so that merely sniffing signals isn't enough, as you'd need to be able to reproduce them. But plain RFID is vulnerable.

4 hours later…

belkarx

9:09 PM

hey @forest do you have any advice on mitigating vulnerability to timing attacks on Tor?

belkarx

9:32 PM

found a paper (https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-kwon.pdf):
Suggested mitigations
- circuits should have similar lifetimes (400-800 seconds; pad/re-establish circuits as necessary)
- HS and Client IPs should be more difficult to identify - more variety in outgoing and incoming cells (pad as necessary)
- preemptive, more homogenous circuit building