The DMZ

Thomas Pornin

01:24

@DavidFreitag The idea is that the "canary" is chosen randomly at the start of the process. The attacker cannot guess its correct value, and thus cannot include it in his payload.

Of course, canaries do not prevent buffer overflows; they just try to mitigate consequences.

Simon

01:51

>

God damn it, that was my cat walking on my laptop.

Scott Pack

Lazy cat.

Simon

Absolutely, she could have typed a whole sentence at least.

Scott Pack

So your pussy types?

Simon

My 3 pussies type. 2 of them are really hairy.

Scott Pack

blinks

Simon

02:01

^_^

Scott Pack

I'm watching a guy doing gymnastics and pole dancing during a sword swallowing routine

Simon

Pole dancing and sword swallowing, nice.

Scott Pack

Here's an example of the guy but not the one I saw.

►

Simon

Bitch was so happy when he took off his t-shirt

Scott Pack

So you watch AGT?

Simon

02:05

I watched BGT more but some of America too.

Scott Pack

I think AGT is like BGT but with better teeth and more pecs.

Simon

I usually spend a random night catching up performances I haven't seen on YT.

hahaha

Poor Brits, they'll never get out of this.

Scott Pack

Give it another generation or two.

Simon

Is it stuck in their gene though?

Scott Pack

Not because it'll mutate out but because it will take that long to work itself out of cultural memory.

Simon

02:10

Oh, haha.

Scott Pack

The Brits Have Bad Teeth jokes are already on the downturn, being primarily a vestige of my parent's generation.

Simon

Isn't that like Rory generation?

Scott Pack

I make those jokes knowing it's largely antiquated.

taps his chin At the risk of thinking of Rory's genital maturity too much I doubt he's quite old enough.

Simon

Wow, nobody told me he wasn't old enough for something when I first came here.

Scott Pack

Shh!

Simon

02:18

How do you like the new house so far?

Scott Pack

Don't tell anyone, but he's only 9 years and a few days older than me.

Settling in.

Still lots to do, but all the rooms are pretty well staged.

Mostly there are a few plumbing things I need to do and find my studfinder so I can tether the bookshelves to the wall.

Also need basement shelving so I can start putting things actually away for storage, instead of just in boxes on the floor.

Simon

Meh, boxes are good for a while.

You said you moved like 2 hours north, that means you work remotely, right?

Scott Pack

Not when they're every where

We ended up with a smaller kitchen and we have a lot of books. So we just don't have a place for gobs of what we had in our old kitchen, plus all the books are in storage until I get the shelves secured.

Simon

02:35

Right, you have a young kid.

Scott Pack

Meh. They're just really big. We didn't have them secured before, but they were on wood floors then. They didn't really rock so much as slide.

On carpet, however, you could rock them into tipping.

Simon

True.

Lucas Kauffman

02:59

morning

Simon

Morning?!?!?

Scott Pack

He's on Mars or something

Simon

Probably

Scott Pack

I should do a find and replace John Carter with Lucas Kauffman in a Barsoon book and enjoy it.

2

TildalWave

03:15

@ScottPack Too funny! :)) Tho he's in Singapore so maybe "2046" or "2000 AD" would fit the bill better? (IIRC they were staged there... not sure they're actually books too, I've only watched the movies)

@LucasKauffman Morning sunshine ;) How's the weather like? I'm mentally preparing for 40°C that's forecast for today here... have the cooler filled all the way up with lager :))

BTW I've heard some news that there was a tornado in Flanders... something about some stadium blown to smithereens?

> Storm damage in West and East Flanders between 05.00 and 06.00 local time this morning, apparently caused by small tornadoes on the passing trough line. No injuries reported. Oosterzele: severe damage to several house roofs, football ground canteen demolished. Meulebeke: garage, carport and greenhouse destroyed, roof tiles blown off. Roof tiles ripped off and trees blown down in several other places. Damage by lightning strikes in Oostrozebeke and Roeselare.

Terry Chia

Why is Adnan a girl?

Simon

His new experiment to see if he's gonna get more views.

Scott Pack

@TerryChia When a boy comes to realize that his boy parts don't appropriately describe his personal identity..

TildalWave

@Simon he better be careful he doesn't get more looks instead!

Simon

@TildalWave No chance, he didn't choose a great picture.

If someone wants to look into this, I'd appreciate it: hackthissite.org/missions/basic/11

I can't figure it out.

It's an Apache misconfiguration.

index.php brings you to a password page so I'm assuming that I gotta find a password somewhere.

You can type /index/index/index..

and it's supposed to be a music site, if that helps.

Terry Chia

03:36

@Simon I think I remember this one. You know about directory traversal?

Simon

@TerryChia Doesn't ring a bell.

TildalWave

@Simon that's Elton John's songs LOL

Terry Chia

Directory traversal attack

A directory traversal (or path traversal) consists in exploiting insufficient security validation / sanitization of user-supplied input file names, so that characters representing "traverse to parent directory" are passed through to the file APIs. The goal of this attack is to order an application to access a computer file that is not intended to be accessible. This attack exploits a lack of security (the software is acting exactly as it is supposed to) as opposed to exploiting a bug in the code. Directory traversal is also known as the ../ (dot dot slash) attack, directory climbing, and ...

Check out the singer's name and play around with this attack.

Lucas Kauffman

@TildalWave cloudy ^^ but hot

Simon

Alright, thanks.

TildalWave

03:39

@Simon You want the example / spoiler?

Simon

@TildalWave I'll ask you for it in ~ 5 mins.

Terry Chia

@Simon Just play around with the directory name.

It's pretty stupid though.

Simon

Ugh.

TildalWave

@Simon what do you have? index.php as login, and names of songs pointing to "Elton John"... what's your next move?

Simon

I guess there's a directory about Elton John?

TildalWave

03:45

@Simon must be, it's a music collection... look at the source

Simon

Yeah I saw that.

Humm.

Alright screw this, spoiler please!

Terry Chia

@TildalWave Heh, it took me quite a while to figure it out even with the Elton John connection.

@Simon hackthissite.org/missions/basic/11/e/l/t/o/n

Simon

jesus fucking christ.

Terry Chia

There is still two more steps to go.

TildalWave

@TerryChia I've got it... but I don't get it yet what's next... so we have "apache misconfiguration" ... that's the clue, right?

Terry Chia

03:49

@TildalWave Hehe.

TildalWave

@TerryChia ---

aha

Terry Chia

@TildalWave Cmon! Too obvious!

TildalWave

@TerryChia done :)

@TerryChia It is, but I can see how it could drive you nuts! LOL

Simon

Holy shit, I would have never found it.

Never ever.

Terry Chia

@TildalWave It's actually the last part where I got to the file that drove me nuts....

TildalWave

03:52

@TerryChia that's what I meant :))

Simon

Oh god, right. You said there were 2 more steps which means there's 1 more

d'oh

TildalWave

@Simon what do you have now?

Terry Chia

@Simon You found the answer file? It's right there in your face.

Simon

Ya.

DaAnswer.*

wadafuk

TildalWave

@Simon use it

> The IndexIgnore directive adds to the list of files to hide when listing a directory. File is a file extension, partial filename, wildcard expression or full filename for files to ignore. Multiple IndexIgnore directives add to the list, rather than replacing the list of ignored files. By default, the list contains `.'.

ManishEarth

03:54

@TerryChia /j/o/h/n doesn't work. Am I missing something here?

Simon

Great, now I got to a page that says: "The answer is not here! Just look a little harder."

TildalWave

@ManishEarth e/l/t/o/n/

Terry Chia

@Simon It's right there....

Look a little harder!

TildalWave

hehe

ManishEarth

@TildalWave Got that

TildalWave

03:56

@ManishEarth oh... the clue is: "apache misconfiguration"

Simon

UGH.

ManishEarth

oh got it

That's very stupid of them :P

> The answer is close! Just look a little harder.

Terry Chia

@ManishEarth This is rubbing it in @Simon's face a little, but it's just a basic mission. :P

TildalWave

@ManishEarth I kinda liked it

short, but sweet

ManishEarth

yeah

TildalWave

03:57

like sex

Simon

I haven't had any trouble with the other 10 missions though. Apache is not my strength.

ManishEarth

but who would be so stupid as to do that?

TildalWave

@ManishEarth it's an example of apache misconfig... wanna bet there's loads of sites with those?

Terry Chia

@Simon You already found the answer.

ManishEarth

@TildalWave People who know about IndexIgnore bit not Options -whateveritis?

Simon

04:00

It's like if I have the key to open the door but no hands to use it.

TildalWave

@ManishEarth maybe not exactly this one, but I saw plenty of cases with mod rewrite rules all mixed up, using [OR] all wrong, e.t.c.

ManishEarth

@TildalWave ah

Terry Chia

@Simon That sounds vaguely like an euphemism.

Simon

Ok screw this, what is it?

Terry Chia

@Simon The answer is not here! Just look a little harder.

Simon

04:02

FUCK

ManishEarth

The best euphemisms come from those who never intended to make one in the first place

@TerryChia I tried that though

Simon

Well, that sucks.

ManishEarth

umm redirect loop?

Terry Chia

@ManishEarth Hmm. It did work for me when I did it a year ago.

TildalWave

@ManishEarth it's really common, because there isn't any [AND] which is "assumed" when you nest conditions in multiple lines

ManishEarth

04:04

> The web page at hackthissite.org/pages/errors/404.php has resulted in too many redirects. Clearing your cookies for this site or allowing third-party cookies may fix the problem. If not, it is possibly a server configuration issue and not a problem with your computer.

Terry Chia

@Simon Did it work for you?

TildalWave

@ManishEarth didn't you get a different response?

Simon

@TerryChia Yes.

TildalWave

7 mins ago, by ManishEarth

> The answer is close! Just look a little harder.

Terry Chia

Ah yeah, @ManishEarth's answer is "close".

ManishEarth

04:05

@TerryChia Oh, you mean that's the answer?

I didn't know where to brute-force test the answer :P

Terry Chia

@ManishEarth hahaha!

TildalWave

@ManishEarth index.php

Simon

I'm gonna do the JavaScript missions tomorrow, sounds fun.

ManishEarth

it's giving me a rediect loop everywhere now

Simon

Time to go to bed, gn8!

Thanks the help.

TildalWave

04:08

@ManishEarth hmmm that's not supposed to do... you've broken it!! LOL

@ManishEarth have you been playing with the session cookie?

ManishEarth

nope :P

TildalWave

@ManishEarth try deleting it anyway and reload from the start: .../11/

ManishEarth

meh, later

TildalWave

right

I'm off too... have fun!

Lucas Kauffman

@ManishEarth if it's giving you a redirect loop you have fuxed your mod_rewrite or Redirect

ManishEarth

04:11

@LucasKauffman mine? Oh no. hackthissite

the 404 page is redirecting to the 404 page. O_0

Lucas Kauffman

WTF

Svetlana

xD

TildalWave

@ManishEarth hehehe I have a cure for that, it's really stupid actually... peeps at Webmasters didn't quite get it either, at least at first:

3

A: 404 page not showing URL

Stephen answered your question spot on, but another observation regarding your example code that you linked to, that you might want to remove these lines in your PHP code: <?php header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found"); ?> Your web server already responded with 404 when this docu...

It's a 404 attached to the response in PHP, then the server redirects to a 404 page, with the PHP 404 page response attaching another 404, server redirects to the 404 page,... ad nauseum = redirect loop

Lucas Kauffman

too damn lazy today

> My wife said that she was leaving me because I always exaggerate. I was so shocked I almost tripped over my cock.

ekaj

05:23

NTML, first and third from the bottom. Why does the first one have a lower success rate than the second? project-rainbowcrack.com/table.htm

pnp

06:19

Anybody home? A quick question here- can the Skynet botnet, known as a Tor-powered botnet, be referred to as a Peer-to-Peer based botnet ???

Svetlana

08:52

@Simon Awww!

Here are the initial results: Before this change, I averaged at about 5.4 views/day. If we exclude the days on which I wasn't very active, that's an over estimate of 9.2 views/day.

Now, after the change: It has only been 12 hours and I've had what could be 140 views/day.

The female picture didn't just double the average views, didn't triple it, didn't even multiply it by a factor 5, not even a factor of 10. That is 15.2x the over-estimated average.

Terry Chia

@Svetlana View-whore.

Svetlana

@TerryChia If you read up in the transcript, you'll see the background story. We noticed some very interesting outliers in the views stats. On of which is that Scott has a more normalized views count that Thomas. I wanted to see how far I can push it.

@Terry Actually, not only that. I think you can go and say rep-whore. I'm still not able to prove it with the current data, but I think that my rep gain increased by a factor 2.

Terry Chia

09:08

@Svetlana So in other words - If @Thomas wants to dominate Sec.SE (more than he already has), he just has to change his profile picture into a bear wearing a bra?

Svetlana

@TerryChia Due to the large number of posts he has, I believe a female in his profile picture will double his view count in less than a month.

What I don't understand, though, is why the rep gain wasn't as statistically significant as the views gain. Is it, perhaps, that voting has a higher guilt factor than merely viewing the profile?

I don't know

Or is it that after clicking on the profile the user realizes that the picture isn't as attractive as he thought when seeing the smaller version?

Terry Chia

@Svetlana You need a hotter picture! Maybe @Iszi in a dress?

CodesInChaos

I was mainly wondering which high rep user changed his nick

Svetlana

@TerryChia Or @Simon in a mini-skirt.

CodesInChaos

a new high rep name popping up obviously leads to profile views

Svetlana

09:14

@CodesInChaos Well, according to that, then the average number of views will drop significantly after a couple of days.

We'll see.

Terry Chia

@Svetlana Are you sure this isn't just an excuse to embrace your inner female?

CodesInChaos

My javascript isn't great, so can you take a look and check if I messed up this answer? Writing security critical code in languages you're not familiar with is annoying.

0

A: Javascript to generate random password with specific number of letters

Since a password needs to be unpredictable, it needs to be generated by a well seeded crypto PRNG. Math.random is usually not secure. Modern browsers (At least the current versions of Firefox and Chrome) support window.crypto.getRandomValues which generates secure random values. Opera doesn't s...

Svetlana

@CodesInChaos Looks good to me, I just wouldn't have gone with the Crypto API

The support is still very poor

CodesInChaos

What else could you use?

those weird entropy gathering libraries?

Svetlana

@CodesInChaos Exactly.

CodesInChaos

09:24

Code works in latest Firefox, Chrome and Opera

one could add a fallback for crappy browsers

Svetlana

I'd definitely go with what CryptoCat is using

CodesInChaos

didn't like cryptocat's code too much

Svetlana

@CodesInChaos But you see, the latest Firefox is 22, this is only supported in 21

@CodesInChaos Yup, perfectly viable reason.

@CodesInChaos Also, you're falling back to Math.random() for Opera.

CodesInChaos

because it's secure for Opera

but not for other browsers

Svetlana

@CodesInChaos I'm almost sure that it's not secure, regardless of the browser

CodesInChaos

09:29

Looks like 80% of FF users are on 21 and above

@Svetlana Opera explicitly stated they're using a secure rng for Math.random

Svetlana

@CodesInChaos I guess that makes sense. CrpyoCat is using it for Opera.

@CodesInChaos I think you're ready to go, then. No need to use other tested libraries.

CodesInChaos

looks like ~80% of firefox users are on 21+

Svetlana

8 mins ago, by CodesInChaos

Looks like 80% of FF users are on 21 and above

CodesInChaos

memory XD

please replace brain

Terry Chia

09:45

@CodesInChaos So most firefox users are adults? Interesting.

Lucas Kauffman

10:12

@Svetlana you dance on the table for me yes?

I should rename myself to Durga or Oksana

Svetlana

@LucasKauffman Or Lucia

@Lucas It's not very far from your name, and she's also a saint, like Svetlana

More so, Svetlana is the Slavic equivalent of Lucia

and then we'd answer questions both at the same time. Svetlana and Lucia! ALL THE REPTRAINS FOR US!

Lucas Kauffman

I'll do that will change my name to lucia for a month

Svetlana

@LucasKauffman Why a month?

Lucas Kauffman

Permanent is a bit well ...

Svetlana

@LucasKauffman Oh no, I meant why month (as in it's too much).

HamZa

10:20

Hey all and have a nice day/night !

Svetlana

I'm planning to stay like this for one more week

@HamZa Hey hey

HamZa

@Svetlana a new face. Well maybe I'm new :p

Svetlana

@HamZa Check the 3rd starred message on the right side -------->

HamZa

@Svetlana lol makes sense.

Svetlana

►

HamZa

10:23

Argh, spent the whole night copying data to my drive to install linux. Now I'm too lazy lol

Svetlana

@Lucas Your most favourite women on the plant. The Swedes

@HamZa Yeah, typing cp -r /home/hamza/pr0n /media/USB is so difficult

HamZa

@Svetlana I'm still on windows :(

but finally downloaded ubuntu and made a bootable usb

now. I've got to backup my DB

Svetlana

@HamZa Then it's copy C:\Windows\System32\System_Files\homework E:\Backup

HamZa

@Svetlana lolz, more like : first open Virtual box and do that

Svetlana

Oh I know where you hind your porn

HamZa

10:29

off-topic cutecatgifs.com

Terry Chia

@HamZa I think that falls under libations.

Or food.

HamZa

@TerryChia are you chinese o_O ?

Terry Chia

@HamZa Actually, yes. :P But not from China.

And I don't eat cats.

HamZa

@TerryChia I see ...

Polynomial

@TerryChia masturlibations

HamZa

10:56

@TerryChia Is it true that some chinese eat cats/dogs ?

Lucas Kauffman

@HamZa koreans eat dogs

I still need to try it

HamZa

@LucasKauffman I see ..

Lucas Kauffman

but I don't think you can get it in SG

Terry Chia

@HamZa I think some people in China do.

@LucasKauffman Definitely not.

Lucas Kauffman

@TerryChia so you going to the parade tomorrow?

Terry Chia

11:02

@LucasKauffman Nope.

I'm locking myself at home over the long weekends to study up for RHCE. :P

Lucas Kauffman

-1

Q: backdoors in hardware (ie. intel/amd cpu) possible?

There are several reports about hardware based attacks on IT-security as for instance those here: http://wccftech.com/intel-possibly-amd-chips-permanent-backdoors-planted-nsa/ http://www.afr.com/p/technology/intel_chips_could_be_nsa_key_to_ymrhS1HS1633gCWKt5tFtI duckduckgo-search using "nsa i...

The OP doesn't like me

@TerryChia I'm going to the zoo tomorrow

went to the botanical gardens today, was also pretty nice

might go for a jog there with my dad one of these days

Terry Chia

@LucasKauffman Enjoying all that touristy stuff I see.

Lucas Kauffman

@TerryChia yes :p

Terry Chia

@LucasKauffman Have you tried durian yet?

Lucas Kauffman

@TerryChia I also was told about Orchard towers

@TerryChia no the stand which I wanted to get it from was closed today :(

Terry Chia

11:07

@LucasKauffman Ahh pity.

Lucas Kauffman

@TerryChia yea, I also went to the city center the other day for a muy thai workout

holy fuck these guys are machines :/

HamZa

hahaha

humanityANDpeace

@LucasKauffman I do not know you to that well. I guess not liking you would require to get to know you a bit more.

Lucas Kauffman

@humanityANDpeace that would require several beers though

humanityANDpeace

@LucasKauffman anyways I wanted to enter a "chat" as suggested by you just to not bloat the comments below the question "as defacto chatting". Just wanted to convey that for me IT-Security is a place to look up information about IT-Security and if or if not hardware can be the mean of a backdoor is for me (as a non-expert) a valuable information

HamZa

11:12

@humanityANDpeace hardware could contain a backdoor to spy on it's users

humanityANDpeace

Therefore I do not totally understand the objections made to the question. Surely there can be tons of question you like more. But I assume there is an answer to the question and I cannot see why IT-Security SE would not be a good place to have this question and answered

@LucasKauffman beer is good :) just about to brew some here

@LucasKauffman any chance you are close to Berlin? I'd invite you

Lucas Kauffman

@humanityANDpeace There have already been reported backdoors in hardware systems produced by the chinese (routers mostly), the result is that they can easily access the system remotely. This causes in its turn that one has unrestricted access to this device and will therefore mean that any data passed along the device will not be secure anymore

@humanityANDpeace I'm not too far from Berlin, few hours driving ^^

humanityANDpeace

@LucasKauffman great. So the offer stands when you are in town, we should have a beer or tow. My own brew will still take some 3-4 weeks fermenting though, but you might know that there is no problem to get good beer from else places here in Berlin :)

Lucas Kauffman

@humanityANDpeace german beers are quite nice ^^

Terry Chia

@humanityANDpeace It's not a good question because unless any hard facts are made known, it is just speculation. It's definitely possible to do it on a theoretical level, but it's definitely impractical.

humanityANDpeace

11:18

@HamZa Know that is good to know your opinion. But this is stated in a chat and will not be accessible to all those searching the IT-Security SE site. I think having a question addressing the hardware trickery / tempering etc etc would reflect well the risks also to be addressed there. What is your opinion?

Terry Chia

Even if both Intel and AMD were to be caught doing it, let's face it.... what other options do you have?

HamZa

@humanityANDpeace I haven't read the question, I'm more active on Stack Overflow

humanityANDpeace

@TerryChia Appreciate your input - as already said sometimes before thank you. Still I wonder why just because it would be so terrible it should not be addressed in a question. The answer could be. Yes it is possible and it would be difficult to do this. This would suffice to get a right idea. Many people would have a better idea then they might have had before,

@TerryChia ARM

or Transmeta

Svetlana

Was I just kicked out of the chat?

Terry Chia

@humanityANDpeace Really? ARM chips on laptops/desktops?... ARM is no where near matching x86 in any sort of performance metric in the near future.

Plus software support is still a bitch for ARM.

humanityANDpeace

11:23

@TerryChia I agree , but it was not perfromance I want to achieve. I also need a tradeoff for security

surely greater variety of CPUs would make a hardware backdoor covering most everybody harder

I assume?

Lucas Kauffman

@humanityANDpeace it depends on where they are produced, for instance 70% of all hard drives roll out of 2 factories located miles from eachother in taiwan. While they are different hard drives, the production itself is still being done by only handful of specialized plants.

Terry Chia

@LucasKauffman This. Besides, with the exception of Intel and maybe a few others, most CPU manufacturers don't actually own fabrication plants.

There is always the risk of any one of these plants planting backdoors in all the products they produce.

Lucas Kauffman

@TerryChia no indeed, for instance Foxconn produces most of the ARM processors we know

humanityANDpeace

@LucasKauffman I do not contest the idea that it is hard / problematic. This actually even demonstrates how worthwile it is to attack on the hardware level. Escape is very difficult and detecting as well

Lucas Kauffman

@humanityANDpeace the problem is that it will probably be detected once quality control starts being done by the home company (unless they built it in purposely)

humanityANDpeace

11:29

I assume that a normal script virus is inferior (detecable/defeatable) to a rootkit. This again to a bluebill hypervizer virutalization rootkit and this yet again to a hardware attack. If I was as rich as the NSA/BND etc etc etc. I would know how and where to pull the triggers :)

@LucasKauffman Please explain. what do you mean by home company?

Terry Chia

@humanityANDpeace Hardware attacks are effective if they can be pulled off. It is also incredibly difficult to pull it off. Why would the NSA do so much work when they can simply scoop up 99% of all the data they need by asking a few companies nicely?

humanityANDpeace

Is quality checking a cpu that easily done? the structures are minute and very small... I wonder if there are many able to do such a checking. With only a few being able it would again be perfect.. because small number of persons to "convince" to let the attack pass by unoticed ;)

Lucas Kauffman

@humanityANDpeace Let's take Qualcomm for example, they want to have a new chip to sell to phone builders like Apple or Samsung. They first pay a company like IMEC (en.wikipedia.org/wiki/IMEC) to research the chip. After that they use these guys research to improve an existing chip or use one of their new designs to design a new chip. This chip design is then sent to a company like Foxconn who actually produces the chip itself.

humanityANDpeace

@TerryChia Because they can! And because its better then having data scooped up only

is also controll

HamZa

@Svetlana huh ?

Lucas Kauffman

11:33

Qualcomm will produce these chips with foxconn but will also regularly take a few random produced CPUs and verify their built manually (quality control)

even if you want to hide something on there, a few engineers who worked on the chip will immediately notice something is off

Terry Chia

@humanityANDpeace I'm arguing they can't. I'm arguing that even the NSA does not have the resources needed to pull it off on a large scale.

humanityANDpeace

@LucasKauffman thank you for the example. Still seems to me that if Apple ir Samsung might be "ok" with a attack then there is nothing there that will be discovered. At least not by any actual user

right?

Terry Chia

Sure, they might have done and might be doing it on a small scale against select targets. But pulling it off on a large scale against millions is another matter.

Lucas Kauffman

@humanityANDpeace and then a company like IOActive comes a long with skilled hardware hackers :p

humanityANDpeace

@TerryChia follow up questions. Asked 10 month ago you would have believed that NSA saves all traffic in Utah? Because if not we might just make the mistake of underestimating them again

Terry Chia

11:36

@humanityANDpeace Yes. I have absolutely no problems in believing they can and are doing it 10 months ago.

Cmon, it doesn't take much expertise to store large amounts of data in a datacenter somewhere. Heck, give me a couple of hundred million to buy hard drives and I can do the same thing.

Lucas Kauffman

@TerryChia I even believe they could have quantum computers

@TerryChia the chinese did do something similar with routers, but they were caught in the end

humanityANDpeace

@TerryChia But it takes lots of effort and expertise to get to the places this data was flowing through. I do not think it is trivial to get this setup. I am rather optimistic about the potential of further things. I cannot tell but it seems that there are lots of resources. If I was NSA official -decision-maker I would definitively consider the options in hardware hacking and as it seems to me it is totally doable

Terry Chia

@humanityANDpeace No it doesn't...... If I'm the government, all I have to do is ask a few ISP's nicely and I'll have all the data I need.

It's the analysis of said data that's the real marvel. Collecting and storing it is trivial.

humanityANDpeace

@LucasKauffman given the Chinese router "prove" what speaks against answering the OP question? to have it clear that there is a risk. At present the downvote kind of hides the risk and makes me (though I do not care for that too much) simply look like a wierd, unreasonable person,,, Still the question could be with a tendency be answered with "yes hardware backdoor is possible"

Lucas Kauffman

@humanityANDpeace yes indeed the question would could be answered with a simple yes it's possbile, but that doesn't mean it does not suggest we still need to speculate

@Svetlana what size are those btw?

humanityANDpeace

11:45

@LucasKauffman What would require speculation here? The Chinese router thing would give a proof-of-concept. Only saying that there is a backdoor indeed already there is speculative. The fact that it could be designed in seems far less up to speculation.

@LucasKauffman @TerryChia Any suggestion how there could be a question / answer that would give some highlight to the issue of hardware backdoors, that could be accepcted / received more welcome in the IT_Security SE?

Terry Chia

@humanityANDpeace Firstly, I'll rip out anything regarding the NSA and speculation.

Lucas Kauffman

@TerryChia Rumor has it the NSA has actually planted secret operatives in the hawker market to spy on the Singaporians :o

Terry Chia

And place a larger focus on what are the possible effects of such a backdoor as well as methods of detecting it.

@LucasKauffman You see the old people walking around selling tissue papers? Do you really think they are old people walking around selling tissue papers?

Lucas Kauffman

@TerryChia I bet they are highly trained NSA ninja operatives.

Some say that the stig is secretly an evolved form of PRISM

humanityANDpeace

@TerryChia What do you mean by "I'll rip out anything regarding the NSA...". Why would you be so categorial? Is there no chance that NSA might be something to consider when dealing with IT-security? This seems not logic to me, maybe you can explain what you meant by that, since it interest me

Lucas Kauffman

11:55

@humanityANDpeace that's IT security more based on a legal level than a real security one. Don't forget they mostly received their data by using subpoenas rather than hacking them.

Transcript for