The DMZ

etherealflux

15:00

you stopped??

there probably weren't even any naked dead people

Simon

@AviD Yes.

@etherealflux Yes.

raz

0

Q: Can an XOR cipher be broken if the plaintext is an incrementing number?

Many moons ago, I was working with a team that was building a public-facing website. We originally built the system using auto-incrementing numeric primary keys as the public identifier for each piece of content that was collected. Word came down from on high that exposing this number was a risk ...

encoding

Simon

... what?

Terry Chia

@raz Lmao.

AviD

while the incrementing number sounds like that is the weak point, its not even the worst part.

missing how "XOR encryption" works....

ergo my comment.

(assuming I got basic math right...)

Terry Chia

15:06

@AviD Mm hmm.

etherealflux

dear god

raz

@AviD I can't do math, I'll trust you

Terry Chia

@AviD No wait.

AviD

that kind of should be the answer he needs to hear, but I can't bear to post that.

Terry Chia

(A XOR K) XOR (B XOR K) == (A XOR B)

etherealflux

15:08

yeah, I think you need more info to get the key

I can look at my crypto notes..

Simon

Look at your donut baking notes instead.

AviD

@TerryChia uhh

and what if I XOR that with K?

raz

@AviD But you don't know K

Terry Chia

^

AviD

right

wait

etherealflux

15:12

this's a bit special, though, since most of A = most of B

AviD

ah right, I meant (A XOR K) XOR A == K

raz

It does?

AviD

right?

raz

Right, but you don't have A either

etherealflux

the cleartext is an incrementing integer

Terry Chia

15:12

^

AviD

but if I supposedly dont know A....

etherealflux

wat

Terry Chia

You know what the real problem is? The "key" is 32 bits. Trivially bruteforceable.

etherealflux

where are you getting that from?

it's a primary key, not a prime number

AviD

@etherealflux wat

self fail

Imma ban myself to the corner now

gonna give tigger lessons in creative reading

raz

15:15

So we all know security

Simon

I don't.

etherealflux

if you can get sequential values, then you could find out some key bits by watching for a bunch of bits flipping simultaneously

e.g. 01111111 -> 10000000

this reveals the lowest 7 bits of the key

because the encoded thing will look something like

AviD

@raz yes, just need to give our full attention to one thing for more than a few seconds. That's the tricky part.

etherealflux

01100110 -> 10011001

Terry Chia

@etherealflux Or you know, you write a loop and let your computer do what a computer does best.

etherealflux

15:18

@TerryChia Show cat pictures?

raz

@AviD But.... SQUIRREL

Simon

@TerryChia Pretend that it can count?

AviD

damn boy

etherealflux

when I saw "watch", I mean "delegate to your slave machine"

then resume sipping your martini

AviD

Terry Chia

15:19

@Simon We are talking about computers, not @Simons.

Simon

pls float

AviD

@etherealflux pls, @Simon is not a machine

raz

@TerryChia his comment is true, how will they know that they have the correct 32-bit ID?

etherealflux

if you just want to figure out deltas, you can look at how the values change over time

e.g. the 16th bit flips every week

so they're adding 2^16 pieces of content per week

AviD

ohmigawd

etherealflux

15:21

well, 2^15

AviD

@Thomas is gonna come in here soon and slap us all for being damn silly donuts.

raz

@etherealflux Yeah, once you've found 12 and 13 you've found your key

AviD

@raz depending on the XOR key, even sequential ids may not be one up from each other.

okay, I'm going to call it - this question is a lot less WTF than we thought at first glance.

raz

@AviD But if you're bruteforcing.... how would they not be?

AviD

@raz the XOR makes them different.

e.g. if the LSB of the key was 1.

raz

15:25

If I have 0x1234 and 0x1235 encoded with K. And I attempt 2^32 Ks... eventually I'm going to see 0x1234 and 0x1235 decoded by the same K.

Or am I just way off and need a beer?

Simon

@AviD honey pls

Geck-o & Wavolizer - Honey Pls (A New Wave Album)

►

AviD

@raz ahh okay I thought you were talking about the encoded values.

raz

@AviD Oohhhh, no that shits different

AviD

@raz yeah thats what I was saying

raz

I think we all deserve beers after this question

Simon

15:26

BEEEERS

AviD

you mean BEARS. we all deserve BEARS after this discussion.

Simon

pls no

AviD

buncha damn silly donuts

Simon

I don't wanna become bear boring

Or as some would say, bearing.

Terry Chia

@raz @AviD @etherealflux It's fun to debate this and all but the system is clearly broken under the CPA model.

AviD

15:27

oh sure, that's broken as hell.

etherealflux

CPA?

can't remember that one

Terry Chia

@etherealflux Chosen-plaintext attack.

AviD

but what I find interesting is how a group of relatively smart people who specialize in this, can get simple XOR math so damn wrong.

in so many interesting ways.

Terry Chia

@AviD You mean yourself? ;)

AviD

@TerryChia even without that

@TerryChia all of us.

I'm being gracious, here

Terry Chia

15:29

21 mins ago, by Terry Chia

(A XOR K) XOR (B XOR K) == (A XOR B)

etherealflux

ah right

not Certified Public Accountant

AviD

right, exactly

raz

So is anyone going to actually answer him, or should we wait for the french dude to eff it up

Terry Chia

@raz I volunteer you.

raz

@AviD I volunteer you

etherealflux

15:33

I'm working on something

but first I'm discovering it takes me 25 minutes to get 1 byte arithmetic right

AviD

@raz nah, Im already on the way out for the weekend

thats why I havent been able to even read the question straight

etherealflux

wait, this isn't very exciting

Simon

TWSS

etherealflux

I discovered that if you do (A XOR K) - (B XOR K), you get A - B

but that's kinda given

does this check out, though?

Thomas Pornin

@etherealflux Not in general.

raz

15:44

@AviD I'm one short hour away from the weekend.

Ohnana

@raz my weekend already began

and "begin" i mean I can no do the next pile of schoolwork

school is dumb, i just want to work at a corporation

Thomas Pornin

a + b = (a XOR b) + ((a AND b) << 1) = ((a OR b) << 1) - (a XOR b)

raz

@Ohnana it's nice to get paid

Ohnana

@raz and do work that is actually applicable to the real world that covers a board range of topics and is not easily spoonfed by teachers and the internet

etherealflux

nvm I can't bitwise

I have to get put food in my face brb

Ohnana

15:47

I'm NOT bitter at all why would you say that?

raz

@Ohnana I didn't say anything

Ohnana

@raz yes that's the joke

Simon

@Ohnana Have you started taking testosterone?

Ohnana

@Simon i'm looking into getting an endo appointment sometime this week

then a blood test and then I get to stab myself in a weekly ritual

Simon

Nice, nice.

Ohnana

15:49

my pharmacy is going to be so confused...

Simon

Hahaha, yep.

Are you planning to change your name too?

Ohnana

well i'd look a little weird with a name that literally means girl

so yea

Simon

Indeed.

o it's roro

An update that unlocks another update? You remind me of Windows Update. — Simon 28 mins ago

I TOLD HIM

Ohnana

omg new profile soon

Simon

If by soon you mean in a few months, sure.

Iszi

15:55

Anyone else 'round here got a Wawa in their neighborhood?

Simon

What kind of donut would name his store Wawa?

Iszi

@Simon A guy that got his start in Wawa, PA.

raz

@Iszi Maybe....

Is there something special at Wawa?

Iszi

Wondering about this "order at the pump" thing I'm hearing about. Some folks saying you can order food at the pump when I've never seen that at a Wawa near me.

raz

@Iszi Do I still have to go inside, or is there curb-side pickup?

Because if I have to go inside, then what's the point?

Ohnana

16:05

@Iszi i have three

Rory Alsop

@TildalWave Mix - DEVO- mongoloid: youtube.com/watch?v=F2tZqXWa7no&list=RDF2tZqXWa7no

TildalWave

@RoryAlsop that's what I hear each time someone mentions Mongo DB :)

Ohnana

@raz it may be so that you can pump gas while you wait for your sammich then waltz in and grab it without waiting

Rory Alsop

@TildalWave quite right yup

TildalWave

there should be the official video available on YouTube too, much better sound quality

raz

16:10

@Ohnana hmmm idk about this

TildalWave

Devo - Mongoloid

►

not sure it'll be available everywhere tho

but the sound is great for YT

oh yeah that's the version with slightly NSFW jiggly parts in it :)

raz

Yet another close flag for what I believe is an on-topic question.

-1

Q: Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few variation of "%0a" and managed to include my payload in the response: Request: "https://ads.exam...

injection

Simon

@RoryAlsop @AviD ^

I feel like it's the same donut that rejects flags.

Terry Chia

16:38

@AviD, @RoryAlsop, any other mods: WTF? chat.stackexchange.com/messages/23137186/history

Simon

pls terry fill us (the non-10kers) in.

Terry Chia

@Simon I got chat suspension for "@raz You get 2 or 3 pieces of data that has been encrypted sequentially."

Simon

@TerryChia .............................

Terry Chia

@Simon Exactly.

Ohnana

wat?

Simon

16:41

There's someone here who's being a little bitch on the site these days.

Terry Chia

The first time in a few months I say something actually on topic and I got suspended for it. Fuck that, I'll just continue mocking @Simon.

The chat moderation tools are so broken it's not even funny.

Simon

@TerryChia You know who else is doing a shitty job? Those who validated the flag.

Terry Chia

@Simon The problem is any 10ker across the entire network can validate chat flags.

Simon

Yup and I guarantee you that anybody in The Bridge validates every single of them.

raz

@TerryChia I don't get it.

What's offensive about that?

Other than your horrible grammar

Terry Chia

16:47

@raz Who knows?

@raz pls

raz

How is this not closed yet

-6

Q: Simple question about lists

Question When data changes In multiple lists and all lists are not updated, this causes ? Options (1) Data redundancy (2) Information overload (3) Duplicate data (4) Data consistency (5) Data inconsistency I believe the answer is (5.) data inconsistency but I am not sure.

databases

Ohnana

what's wrong with the bridge?

Simon

@Ohnana A bunch of trolls.

@raz It looks like we needed more than 1 new mod.

Ohnana

maybe we need smoke detector's help

Simon

@RoryAlsop This is borderline ok: security.stackexchange.com/review/suggested-edits/56255

TildalWave

16:59

@Ohnana it's a mod trap!

or a sanity check ... if you're a new mod you're excused to be there, if you're supposed to be an experienced mod you should know better :)

etherealflux

17:11

back

Martin Rory Ingesen

17:22

front

etherealflux

@raz I like "information overload" the most

CAPTAIN, WE'VE GOT AN INFORMATION OVERLOAD

WE CAN'T TAKE HER TO WARP NINE

Simon

othereal pls

etherealflux

also I'd like to take a moment to REEEEEEEEEEEEEEE

someone referred to a magazine as a clip a few days ago

they know who they are and will forever carry the burden of their sins

Martin Rory Ingesen

security.stackexchange.com/questions/95601/… I am inclined to edit this into: I am trying to build the Zeus source code so that I can create my own botnet, please help me get it to build.

Simon

If you wanna get verbal'd, do it.

Xander

17:28

@etherealflux The horror.

Ohnana

RTFM kiddo

etherealflux

ahh, Microsoft error messages

"Could not parse, somewhere"

"have fun, kiddo!"

Simon

Are we overusing the word "kiddo" now?

Martin Rory Ingesen

script-kiddie?

etherealflux

"Kiddo" referring more to users in general

oh, Ohnana just used the word as well

pls

Ohnana

17:32

pls?

Simon

pls

Ohnana

also i'm trying to stop an https connection right now and I never thought i would

i just wanna sniff my own traffic ;-;

etherealflux

just do a MITM attack and ignore the cert errors

Martin Rory Ingesen

I love to take a good sniff of my own stream.

3

data.. stream

etherealflux

I think I did that with Cain once

elite hacking

Iszi

17:35

@etherealflux You & Cain sniffed each others' streams?

Martin Rory Ingesen

Don't forget Abel!

Simon

@Iszi Is the Rory wanna-be guy your son?

Iszi

@Simon Your mom is my son. Wrap your head around that now.

Simon

wat

Martin Rory Ingesen

wat

Ohnana

17:37

wat

etherealflux

I am my mom

Iszi

@etherealflux Now that's some crazy-ass Back To The Future shit right there.

Simon

What was it again, the guy is his own grandfather?

Iszi

@Simon No, he totally had a shot at being his own dad though. His mom was really into him.

Simon

lololol

Martin Rory Ingesen

17:40

Yeah, being "Calvin Klein".

etherealflux

calvin klein bottle

Simon

I am your bottle.

Martin Rory Ingesen

Your mom gave you bottle.

Simon

Bottle is the new container.

Ohnana

oh the sec.Se chat bots are here

etherealflux

17:42

private Bottle<JSFrameworks> bottle = new Bottle<JSFrameworks>();

Simon

Sec.SE is not as Sex.SE as Sex.SE.

Ohnana

tru fax

Martin Rory Ingesen

Bottelization, the new containerization solution.

etherealflux

can I ask about my cabling-related sexuality there

Ohnana

@etherealflux probably. tag it BDSM and I'll try to answer

etherealflux

17:43

"My server likes when I pull its cables..."

Martin Rory Ingesen

OOh. "YEAH! STICK IT IN! AUTORUN IT! RUN! RUN!"

Ohnana

@etherealflux server edge play: kicking the power cord

rack suspension

Iszi

Well, this one took a weirder-than-usual turn.

Ohnana

fiddling with the UPS for electro play

etherealflux

allocating all of its memory

oo baby, work that swap drive

Simon

17:45

do the pls dance

Ohnana

i am a bad person and this is fun

etherealflux

i'm basically hitler and i'm okay with this

Iszi

Like, I think it drifted for 90 degrees and then suddenly spun 180 degrees in the opposite direction, then kicked it in reverse.

Ohnana

simon started it

Simon

simon did it

Iszi

17:46

Well, at least we have a confession and a corroborating witness.

Simon

Simon saysception

Iszi

You know why you were named @Simon?

Simon

No ex-one, why?

Iszi

'Cause your mom got talked into making you during a game of "Simon says".

Simon

oszi pls

Martin Rory Ingesen

17:50

@Simon, btw, why are they giving you such a hard time?

Simon

My mom wanted to name me Maxime but then she saw on the news that a dude named Maxime murdered his mom so she named me Simon instead.

etherealflux

simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says simon says ERROR: Out of memory

Ohnana

@MartinRoryIngesen he's our punching bag

Simon

@MartinRoryIngesen Because I'm always messing around.

Martin Rory Ingesen

Mkay!

etherealflux

17:52

because pls

Simon

^

It's 2 PM on Friday afternoon at work lads, you know what this means?

BEEEEEEEEEEEEEEEEEEERRRRRRRRRRRRRRRRRRRRRR

Ohnana

@Simon :|:

Martin Rory Ingesen

I had my last day at work today :(

Simon

That's what you get for being students.

etherealflux

Almost everyone in the office is out today

Martin Rory Ingesen

18:02

Yeah. I really liked the place though.

etherealflux

My housing runs out on the 9th, so I'm leaving my internship next week

Simon

@etherealflux Me too and I don't wanna be the first one to reach the fridge for a beer to look like a damn drunkard.

etherealflux

time for telecommuting guys

we need to hold a Worst Question Contest

where we compete to develop the most fundamentally awful Sec.SE questions

"[..]using a personal crypto system i developed[...]" should elicit a sigh of relief after reading the paragraph coming before it

Simon

Honestly, anything about "decrypting" a hash is awful.

etherealflux

I love decrypting me some hashes

Simon

18:15

@etherealflux How is it like to not be legal?

David Freitag

Yup, I slept from 22:00 to 14:00 again

Simon

dovid, this is not healthy.

etherealflux

@Simon wot

Simon

I've been legal for 7 years?!?!?

I'M SO OLD

No, 6, lulz.

etherealflux

@Simon I'm still 19. No ethanol for me

David Freitag

18:18

@Simon It will be ok, basic arithmetic baffles me as well.

@etherealflux You're not supposed to drink the gasoline.

etherealflux

@DavidFreitag I don't drink hydrocarbons

David Freitag

@etherealflux Apart from the oxygen molecules, ethanol is pretty much a hydrocarbon.

etherealflux

@DavidFreitag Pretty much, but so are most other organic molecules

and guess which one is capable of participating in solvolysis of tertiary alkyl bromides?

David Freitag

@etherealflux Also, I'm not sure about where you live, but here they put ethanol in some of the gasoline, hence the joke.

etherealflux

I filter out the ethanol before drinking my gasoline, thank you very much

David Freitag

18:26

> I'd love to make that work, but it's not in my job description to motor boat

Heh.

tylerl

Anyone know what the "bits=" suffix means on the cipher spec designation found in SMTP received headers?

 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);

obviously it's 128-bit AES, but why 128/128 at the end?

Lucas Kauffman

@tylerl nsa backdoor

etherealflux

0

Q: Do iPhone Chrome & Safari keep refreshing and sending my IP address to websites while in background?

Hi I have a question about privacy on Apple iOS... When you are not actively using Safari or Chrome, but if they are in the background still with open tabs of websites that were visited while in the foreground, do they keep refreshing and sending my IP address etc. to the websites? Also how about...

web-application web-browser ip iphone internet

I'm pretty sure the answer is "no" for both questions

but

David Freitag

@tylerl Must really be 1-bit AES.

etherealflux

why are they afraid their IP will be hacked

by the ddos

Simon

18:38

Because your IP address is bounded to your soul.

tylerl

Lucas and David, you're as useful as always.

etherealflux

sometimes bits fall out of the internet

2

so it's letting you know that all 128 bits made it

Simon

@etherealflux the internets

etherealflux

@Simon only bytes can go on more than one internet

tylerl

dammit onebox

etherealflux

18:50

...dammit

I tried to copy an image from the desktop and paste it into imgur

t-thanks

David Freitag

@etherealflux You must be an OS X user.

etherealflux

@DavidFreitag I'm using one for work

although I dunno why

David Freitag

@etherealflux You poor, poor soul.

Ohnana

@etherealflux haha

David Freitag

Nelson

►

tylerl

18:55

You all are useless. It's easier just to dig through the goddamn Gmail source code and look up where the value comes from.

etherealflux

@tylerl I looked at some of the SMTP RFCs, but didn't see anything obvious

tylerl

the first number is the cipher strength bits you're using, while the second is the max supported by the cipher, since some support variable length keys.

Transcript for