@DavidFreitag I heartily disagree. It should be like, #7-8 on the security experts list...maybe. It also falls under the heading of "common sense"..most people know not to give out their personal info unless they're really, recalcitrantly stupid.
@DavidFreitag the average person will do a lot better with two factor authentication than thinking they shouldn't share personal info.
@Iszi I had one of the first 1000 or so facebook accounts as my university was like #10 to be invited to join TheFaceBook. I never used it, since i had a security background, and I immediately saw its potential for a loss of all privacy. Still don't use it.
And yes, back then it was thefacebook.com :)
and for those who don't recall how facebook became cool..it was limited to only college students for the first year of its existence. Needed a .edu e-mail. They rolled it out one group of .edu's at a time so each school would sign in and it get popular there and then keep moving. Was a great marketing strategy.
@Iszi Pics of kegstands and stuff like that isn't as important as SSNs and credit card info. People know not to post that on facebook. Except the truly stupid.
Maybe, but I see it as perhaps guiding them in the right direction... even if slightly. I don't want someone to come to the board and get chased off. Nobody really reads the intros.
@AviD Go look at that debit card twitter feed..the people posting images are... some guy getting released from prison, some people who can barely speak english in textspeek, and miscellaneous hoodrats.
I prefer using this phrase to explain it: "If man can build it, man can destroy it."
There's almost always a way around everything in this life, if only you're able to see it. It's not just limited to computers. You can only make things harder to achieve.
Eventually, someone will find a way ar...
Just ran across this in my own browser (Chrome, Mac OS) where going to google.com would serve a *.portal.azure.com certificate. It seemed to be signed all the way to the root too.
This disappeared after 60-100 seconds.
What is the most likely cause for something like this?
@DavidFreitag, anything. Like recently, I found a funny way to turn a piece of malware back on it's author and use it to gain access to their machine. :x
@DavidFreitag, so what exactly is hardware reversing? Are you bypassing some kind of circuit path or something, to make the hardware perform uh... a thingy?
@MarkHulkalo You can figure out a lot about electronics just by figuring out how other people have done it (similar to software). Also, if you do things right you can get access to a programming port and you can dump the firmware. Then it becomes a software reversing project.
@DavidFreitag I believe they are specifically used in devices using DRM. I was going to ask your opion on the sophistication of the technology. It sounds like there is more or less "always" a way to remove it, but the question is how many boards you destroy in the process or how slowly you go.
If it's the same as software, then there's always a way to break it down. You can run it through a debugger and find a function that stops you from doing something, and either disable it or make it move to the next part
@MarkHulkalo The idea is to prevent debug access. I.e., you cannot see or touch the internal circuit traces. At least, not without physical (sometimes chemical) removal of the protection. But the second Wikipedia article provides some examples of other ways to find out what's going on inside the circuit.
@MarkHulkalo If you are interested, I believe there was a beginner-friendly video about clock glitching from one of the recent CCCs. I can dig it out for you if you want.
I know they were doing (or planning on doing) some changes with their SSL. They were using CACert for a while, which works if your audience knows what CACert is.
@MarkHulkalo I am not finding a separate subtitle download. And I might be thinking of their goal to have every video translated to English/German (live), not subtitles.
Well, I don't think you can wage much complaint against the CCC. The conference is held in Germany and the majority of the talks are in English, even when the speaker knows German natively.
@TheDoctor I assume you have verified that these do, in fact, decrypt the ZIP file. (That is, it is not merely a bug in the script.)
I would not be particularly surprised to find that multiple passwords work, but the number and readability of those listed are quite striking.
I've been meaning to read this for a while now. Section 2.2, about filtering possible passwords, might be of interest: math.ucr.edu/~mike/zipattacks.pdf
@MarkHulkalo Awareness regarding certain dangers, and how to avoid those dangers by utilizing flaws in them, has the inherent problem of helping the danger originators to learn the flaws in their methods.
The benefits outweigh that problem, though.
but it's still a problem intrinsic to the awareness-spreading process itself.
got a general networking security question. I've got internet through my University Campus, but I VPN out to my apartment first before I make requests to the Internet. My main question here is whether my assumptions on this are correct:
(1) The University would be able to intercept standard traffic from my computer to their network and decrypt it (802.1X connectivity) (2) Using OpenVPN would encrypt that traffic further so that only my computer and my network off-site would be able to decrypt that communication. (3) ISP at my off-site location would be able to intercept from that network outbound to the Internet
ultimately being the University wouldn't be able to decrypt the VPN'd traffic
@ThomasW. Somewhat, but I'm not sure what you mean by "standard traffic". Also, you don't say what your routing table looks like and if all requests, including DNS, are going over a full tunnel VPN.
@ThomasW. If it's a full tunnel VPN, basically, all the TCP/IP traffic should be VPNd..and all they should see is DHCP, ARP, and broadcast-level services e.g. bonjur or netbios probes
Got it. In that case, yeah, they're basically only seeing encrypted traffic. However, comcast can (and does, especially DNS) spy on the traffic from there
You shouldn't run afoul of that....since it's a home connection, I doubt you'll be able to open enough TCP sockets or use enough bandwidth to raise flags.
However, if your needs change or thoughts about the most evil company in america being your ISP, you can get an AWS/rackspace/etc cloud server and just run openvpn on that. Should be fairly cheap.
@Herringbone_Cat I've got a bunch of VPSes with RamNode I could set up as VPNs, but the issues at hand are just making sure I can do my research from the campus without them killing my internet access because i'm researching the security concerns of given 'bad things' as part of my network security classes.
and Comcast is aware that I am doing research for a network security firm as well offsite so... :P
@ThomasW. And comcast is OK with that? :) Pentesters tend not to use comcast...
Also I find it odd your'e doing research for class that your campus won't allow their network to be used for
Has to be some kind of loophole in this with campus judicial. :)
In either case the short answer is if your full tunnel VPN is setup properly, all the traffic outside of your immediate subnet will be encapsulated with encryption and not readable to an intrusion detection system or other snooping
Depending on the VPN client, traffic to your immediate subnet might be allowed to go out...so watch your RFC1918 address space. Easy to test with ping as well
@Adi One school of thought is that if we can, through our advices, make the bad guys more competent at what they do, then, in the grand scheme of things, it would still count as a gain.
At least, somewhere, someone will know what he is doing.
@ThomasW. Send me your paper when you're done. I hired an engineer 2 years ago who went to your uni, and have been very happy with his abilities. Might have something you'd be interested in San Francisco. I'm not kidding. :)
Yeah. Linux has cool stuff like..package mangement. Want to install something on UNIX? Well, you uncompress the .Z file, and then you can untar (tape archive!) it, and it might have a makefile
You can use proprietary AT&T make (rather than GNU gmake, which is 'make' on Linux) to then compile it using the c compiler (nto the GNU C compiler, gcc, that's linux!) or whatever else and pray it compiles and runs
And since UNIX never got aruond to supporting ELF binaries or anything modern you'll probably end up with an a.out piece of crap.... the story continues..
@MarkHulkalo Keep doing so. Just FYI, Herringbone_Cat is either full of it or trolling. It's only a tiny minority of mostly-ignorant people who believe that there is some reason why Linux wouldn't be a Unix.
I used to consult for UC berkeley, which as you know is where BSD (Berkeley Software Distribution) and I went into their data center about 5 years ago, they showed me all their IBM Z series mainframes etc etc
and I asked.."Hey, where's all the BSD boxes? I see MS Logos, Penguins..where's BSD?" ..and they engineer said, we have a saying in spanish...
@RoryMcCune I think it makes sense for the name because it's the only thing that they can group all those OSes under. But notice it's called Unix & Linux and not just "UNIX"
@MarkHulkalo and a deprecated practice! Doesn't stop moneyed universities from running them still though.
@Herringbone_Cat the reason it's called “Unix & Linux” is that a majority of people who are interested in the site know the name “Linux” but not “Unix”. The name is redundant: the site could be called “Unix” but then a lot of the potential audience wouldn't know that it's relevant to them.
@RoryMcCune yeah, it's not just the UK banks. I used to consult at Credit Suisse. I helped them buy a Sun M5000 sparc station so they could continue to run deprecated old software that couldn't handle their huge amounts of data. So they threw more hardware at it..
like a $500k server that performed like a $10k intel server
Wonder how anyone can bear to be spending so much money on rent there. I'd probably buy an RV and live in the parking lot or something.
@Herringbone_Cat, that's incredibly sad. Why not rebuild the programs? They aren't that hard to do. I specialize in rebuilding a lot of things from the ground up, and it doesn't take long for something like that. :(
@Gilles There used to be a job title that I had called "UNIX Administrator" and pretty much no one hires for this job title anymore, at least ni Silicon Valley.
@MarkHulkalo Good luck with that. Most banks require 5 signatures just to reboot a server.
Well, I moved here during the downturn. I'm becoming less and less enthralled with SF culture and can't wait for the tech bros to leave, in all honesty.
@MarkHulkalo I'll give you some advice: if you're not married, and not into polyamory, SF is not for you. :)
@MarkHulkalo They are the armies of recent college graduates getting paid $150k+ to work at the likes of uber, airbnb etc. They are responsible for the rising rents in SF, gentrification, and basically all the newsworthy issues SF is facing
@MarkHulkalo the problem is they come from a very mainstream culture instead of silicon valley/nerd/geek culture, so it's creating a cultural divide
@MarkHulkalo Unfortunately the bubble will burst at some point.
I'm pretty secure I'll be around when the bubble pops, but IDK about all the tech bros. Might be bad for the industry having all these people hungry for work.
@Herringbone_Cat Why? I don't get this. :( I take responsibility for my code because I have a duty to do so. Not just to my team leads, but to our customers.
If our customers' data gets breached, I could be out of a job for not taking the necessary steps to get it right. Even worse, the company could go out of business. And I only work for companies whose products I believe in.
@MarkHulkalo Yes. Try doing some big corporate RFPs. They want to know how long your company has been in business, and if you're in the software business <10 years, it gives you like -5 points on the bid.
@MarkHulkalo We have a lot of issues in this in the healthcare sector I work in, at a startup. Big organizations want to buy from GE or Siemens, not from a startup. We have actually sold our product through Siemens, same product, but with their brand.
hah, i think the people I'm aruond might be more savvy then
I don't hang around anyone dimwitted enough to 1) admit their CP convictions 2) think ssomeone can "hide" them magically. Sounds like a lot of TV watching makes them think of hacking of somethign it isn't.
I prefer using this phrase to explain it: "If man can build it, man can destroy it."
There's almost always a way around everything in this life, if only you're able to see it. It's not just limited to computers. You can only make things harder to achieve.
Eventually, someone will find a way ar...
Just ran across this in my own browser (Chrome, Mac OS) where going to google.com would serve a *.portal.azure.com certificate. It seemed to be signed all the way to the root too.
This disappeared after 60-100 seconds.
What is the most likely cause for something like this?
