while travelling in the US, I had convinced a high school geography teacher that, living in Vancouver, I lived in igloos, had sled dogs, I had to stick my snowshoes upright at the end of the runway for the bush pilot knew where the end of the runway was
I know Windows Phone 8.1 moved Bing Vision from being a Cortana feature, to being a Camera Lens. However, I've just upgraded to a Lumia 950 (with Windows Phone 10) and I cannot find Bing Vision anywhere.
I double-checked Cortana and don't see anything there. I checked the Camera app, and found t...
@AviD Heh. That reminds me. Another thing that came with WP10: Skype messaging via the Messaging app. i.e.: Someone at Microsoft said "Hey, let's try this iMessage thing."
@Iszi actually in WP7 (or progably 7.5) skype was already part of messaging. In 8 they "learned" from Android and split it out, then Apple put iMessaging in.
It's entirely possible to hack a system without malware, you can do this by taking advantage of vulnerabilities in applications/OSs or poor configurations. Some great examples (some historic) are:
Default passwords: there are still routers on the internet with the default password cisco (or no ...
@kalina Using one for a system you're setting up: no. That's being a plonker. Using one for attacking someone else: yes. Otherwise we can't escalate to SQL injection being an "unprecedented attack against our systems", as TalkTalk claimed...
@kalina Not really... We have 2 major backbone providers (BT and Virgin Media), but BT offer exchange level peering for other ISPs, which most ISPs do use
I know the ways to hack a computer or a mobile phone by injecting payload using some exploits with metasploit. We can inject a exe, or we can use pdf file, or docx file as I know.
I wonder the possible attack types for any operating systems without injecting any payload, to just directly connec...
@kalina Not quite. BT is obliged to provide connectivity everywhere, but other providers tend to do their own network backhaul for major exchanges (e.g. city centre areas). There are some BT owned ISPs too, which are literally rebranded BT... Essentially, it's a mess
@kalina Depends where they experience it... In my experience, most issues are BT's fault, and down to some bugger unplugging a cable in the local exchage!
Yeah. They don't use BT. They use Kingston Communications. Essentially, someone cocked up when setting up a national telecoms provider, and missed out the bit that said "and Hull"
@MarkBuffalo I also received a mail from the IT guy giving me a PW to the company site. He says he sent that to me but it was weird. Like, the site was www.something.com and the link was to some long string of numbers that ultimately redirected to admin.something.com
Now you see the danger of phishing attacks. If one company machine is compromised, it can quickly spread.
You can easily pretend to be someone else
And emails coming from inside the corporate network seem legitimate, right? Actually, I do not even open attachments or visit links without confirming with the person who sent it
Of course. I didn't really expect an answer, just a scope of possibilities
It's way more probable, if I really am the one who unleasched that algorythm, that I did it by clicking a legit mail than for browsing to a site I shouldn't have reason to from the google search.
@DavidFreitag I think that using socat in SSL server role does not happen often.
It still highlights a shortcoming of the SSL protocol, which is that with DHE cipher suites, the server sends the modulus and generator but NOT the subgroup order.
@DavidFreitag At least, this example shows the cryptographic competence of the socat developers, and thus highlights how much you want socat to be part of any cryptographic solution used in production.
(In my case I only tunnel SSH traffic, so that's OK if socat does anything stupid.)
@DavidFreitag From the source code, it seems that you can specify your own DH parameters with the "dh" option; alternatively, use the "ciphers" option to remove DHE cipher suites, and use only ECDHE cipher suites.
@diagprov To know how long the DH private keys should be.
@DavidFreitag The devs have patched, and that worries me a bit: they just generated new DH parameters instead of using existing, well-vetted parameters. This means that they did not completely understood.
@diagprov Knowing the subgroup order allows the client to safely select a shorter private exponent, for improved performance.
If you know that the subgroup order is q then you do not need to generate a private exponent longer than q.
If you known that the subgroup order is prime, then you do not need to generate a private exponent longer than about 256 bits.
The current protocol conveys neither q nor the primality of q. That's the problem.
My hypothesis on the socat blunder is that whoever submitted the modulus just used a random sequence of bytes, and since it worked (connection was established) he did not bother understanding it any further.
If the protocol required also the subgroup order then this would have stood a greater chance to prevent that kind of sloppiness.
@ThomasPornin If the subgroup order isn't prime, don't you just keep breaking it into smaller prime subgroups and eventually get hit in the face by Pohlig–Hellman? So what I'm asking is, are you saying the order of the subgroup should be sent so the client can check it is prime?
@Ohnana Crypto implementation is always fun. At some place I saw code where someone had filled in the pesky field called "IV" with "0x1 0x2 0x3 0x4...". Statically.
Which effectively makes using SSL with socat useless
> It irks me that in security advisories that fix a possible backdoor—like here—sometimes no root cause analysis is done or communicated to the public. Who chose this parameter? Who wrote the code? Who committed it? So I did a little sleuthing... Here is the commit introducing the non-prime parameter (committed by Gerhard Rieger who is the same socat developer who fixed the issue today): http://repo.or.cz/socat.git/commitdiff/281d1bd6515c2f0f8984f... The commit message reads: "Socat did not work in FIPS mode because 1024 instead of 512 bit DH prime is required. Thanks to Zhigang Wang for re…
@diagprov If the subgroup order q is not prime, but the biggest prime divisor of q is sufficiently large (say, 200 bits or more), then selecting the exponent in the whole 1.._q_-1 range is sufficient for security.
@Ohnana 0x00000xDEADBEEF counts as initialized, right?
> ...so instead of allowing anyone on one of the hosts log in, you're going to allow anyone with access to the network to create a VM without any kind of authentication?
From a security perspective, that doesn't really sound like an improvement...
> Note that if host B allows incoming migrations from host A, then host B is trusting host A completely. This is because the migration data contains not just the guest's state (which is of course encapsulated inside the Xen VM security boundary), but also the VM configuration. The VM configuration specifies the mapping between guest resources and host resources.
So host B trusts host A to specify the correct set of host B's own resources to expose to the guest VM. If host A is malicious it can
I'm still very unclear on what I can actually do with teams. Are we so early in the beta that there is literally no features implemented except the basic creation of teams?
@MarkBuffalo I don't think so...? I went to high school with him
His parents found all the smoke detectors and they called the cops and told them they think their son is making a bomb. The cops called in the FBI who called in a huuuuuuuge hazmat team
It's entirely possible to hack a system without malware, you can do this by taking advantage of vulnerabilities in applications/OSs or poor configurations. Some great examples (some historic) are:
Default passwords: there are still routers on the internet with the default password cisco (or no ...
