@RoraΖ Problem he's getting at is, if you have a domestic attacker and target, you can figure out your target received bursts of data in sizes X, Y, and Z at times A, B, and C. Then you can figure out that the attacker sent packages of those sizes (plus predictable TOR overhead) at around those times (plus somewhat-predictable lag) to a domestic TOR entry node or across a monitored international link.
You're being scanned by researchers
Is this a hack attempt ?
This is a research scan performed by the University of California at Berkeley:
This is a research scanning machine from the University of California at Berkeley. This machine regularly conducts scans of the entire Internet so ...
The problem is there's a metric shite-tonne of metric shite-tonnes of data to sort through, to find those correlations. And even then it takes a standard fuck-ton of fuck-tons of speculation, supposition, and assumptions to even come up with probable suspects from within that data.
I work with data analysis quite heavily. I can piece things together, analyze trends, and find connections. It really wouldn't be too difficult to create something that monitors/unmasks VPN/TOR circuits automatically, even at scale
Right now, I am only assuming that this is part of what they do, not that they do it. It's definitely possible, though
@schroeder Where are you coming from country wise if you don't mind me asking? (I'm a Brit of the English sort and live in Switzerland so I have some experience with immigration:) )
@schroeder Wow. Well in Switzerland health insurance starts at around 250 CHF /month. That probably means the first 2500CHF of any health costs are yours to pay entirely and only then does the insurance pay.
Anyone would think these so called millenials, of which I am one, are entirely different in their world view, speak a foreign language and require a whole new field of management to deal with.
Yep sorry being ironic. Funnily enough millenials are also people and they would like things like "food to eat" and "somewhere to live" and to "have fulfilling work"
@DavidFreitag Return-Oriented Programming. Basically you can't write code to the stack so instead you write a bunch of addresses and ret. Also called ret2libc for when you could direct call library functions by prepping the stack. Can't do that on x64 since the calling convention is rdi rsi rdx rcx r8 r9 on unix, THEN the stack. So you need to prep those registers first.
Ok so. In the basic stack overflow exploit, you dump your shell code in the stack somewhere. When the function where the overflow happened ends, you hit ret, and since you've overwritten this in your code you direct execution to the stack. Plus or minus some minor details.
In a modern system with "DEP" or NX-bit, that stack area is marked non-executable as a page privilege. If EIP/RIP ends up there the processor goes mental and fires the "moan at the kernel someone done bad stuff!!!" interrupt.
The kernel then kills the process.
No exploit.
But what if we had some executable code already in the address space that did what we want?
ASLR is supposed to make this harder because, even if you know the version of say libc you're likely to find, you don't know where it is. So sure, you can control the flow, but you don't know where you want to go because you don't know where the bit of assembly or whatever you want is.
I was trying earlier to make a MITM attack using both ettercap and arpspoof, but neither of them worked. I am connected to the internet from my dorm-room, we have a shared wifi connection, where OCSP authentication is used (network sign-on is required via HTTP).
When I do the MITM attack, the vi...
You're being scanned by researchers
Is this a hack attempt ?
This is a research scan performed by the University of California at Berkeley:
This is a research scanning machine from the University of California at Berkeley. This machine regularly conducts scans of the entire Internet so ...
