The DMZ

TildalWave

23:00

@HerringboneCat *asinine

apparently, assenine is just whatever comes before asseten

Mark Buffalo

@etherealflux lmfaooooooooooooooooooooooooooooooooooooooooo

I'm dying IRL in public

@etherealflux bahahahahahahahahahahahahahahahahahahahahahahahahahahahhahahaha I'm pissing myself

Thomas Pornin

@Gilles Apparently the situation solved itself, no need for me to consider yet another poor protocol and the vacuity of Mankind.

etherealflux

"certain encryption software"

what, hackertyper.net?

Mark Buffalo

@etherealflux lmfaoooooo

ISIS didn't use encryption during the Paris attacks. Sigh

etherealflux

One of our new profs came from Mozilla and is big on security

I'm gonna' print this out and pin it to his wall

Thomas Pornin

23:04

@MarkBuffalo No, indeed. They used guns.

David Freitag

store.steampowered.com/app/353090/?snr=1_5_9__205

LOL

Mark Buffalo

Lol @ hacker typer

TildalWave

better watch out that your Windows don't BSOD or boot into command prompt, some anti-terrorist sniper might take you out

David Freitag

> Eggcellent game, very well done. 10/10 would fry again.

Mark Buffalo

@ThomasPornin lol.

@TildalWave lmfao

etherealflux

23:06

oh god, I hope they don't see GRUB

or the gulp BIOS config

Mark Buffalo

I hope they don't see my bios without the splash screen. I'd get killed immediately for that.

David Freitag

> Chicken Invaders is the first game I ever played, and is still the best. I mean, who just though, damn, lets make a game where you kill evil space chickens. Whether you want to have a casual gaming experience, or go on a sadistic poltrycidic rampage accrost the Milky Way, this game will do that and more.

Ladies and Gentlemen, I give you McChicken Sim 2016

TildalWave

frankly, I can't wait for all those terrorists that use base-64 encryption being waterboarded

David Freitag

@TildalWave Yeah and the bastards using ROT26

kalina

OH MY

ROT26 IS BASICALLY UNBREAKABLE

TildalWave

23:15

it can't be decrypted!!

David Freitag

rot26.org

lol

> WARNING!! we have not yet been contacted by NSA/USA/UK to provide a backdoor to our encryption service... but its only a matter of time until it happens.

Mark Buffalo

@TildalWave lmfao

@DavidFreitag haha

Man chat is hilarious tonight

kalina

no

Mark Buffalo

8m h

I'm having a great time

schroeder

@MarkBuffalo where's the woman chat?

kalina

23:18

I'm here, all alone

surrounded by nerds

David Freitag

@schroeder We need your credit card in order to do that

Mark Buffalo

@kalina is that a euphemism?

kalina

no

David Freitag

@MarkBuffalo You're a euphemism.

schroeder

@kalina I took my infant daughter to the local games store, and they were having a MtG tourney - the place was filled with guys - I held my daughter up, facing outwards, and said in too loud of a voice, "Look, nerds! And you will rule them all!"

Simon

23:20

@DavidFreitag Why am I getting cc'd on this?

kalina

@schroeder well yes that is true

David Freitag

@Simon I thought you would enjoy it.

Simon

o

Mark Buffalo

@schroeder lol, you damn weirdo Nerd. I'll do that too

Simon

I hate kids so I don't really enjoy it

soz

David Freitag

23:20

:|

Simon

KID HATER MASTER RACE

David Freitag

I was going to say something mean about the world being better off without @Simon offspring but I decided not to say it

Because it was too mean

kalina

you're making a lot of assumptions there

like his ability to perform

his fertility in general

range, size, thickness, and overall rigidity

David Freitag

His ability to not fertilize his underwear instead

kalina

and that's before considering things like "finding somebody willing"

David Freitag

23:23

Well yeah, he can't very well get his hand pregnant

kalina

or the carpet

or tissues

David Freitag

Or a tube sock

kalina

or his mo... oh wait

Simon

ok bye I'll let you discuss this together

David Freitag

bai

kalina

23:23

@Simon oh @Simon please don't leave us

we need you

Simon

MY MOUSE DOESN'T WORK

TildalWave

look at all these experts here

Simon

I'll stay until my mouse starts working.

David Freitag

@Simon I stole the battery

kalina

is that a euphemism

is that the name you gave it?

mouse isn't a very reassuring name

Simon

23:24

@DavidFreitag pls it's flashing

David Freitag

@kalina It's purely ironic

Simon

Even seen something flashing without a battery other than a chick at a party?

David Freitag

Sure

kalina

sure, anything electrical that doesn't require a battery

Simon

IT'S WORKINGGGGGG

David Freitag

23:25

Your mom terrified me when I was walking to work yesterday

Simon

babai

David Freitag

She drove by and suddenly I was blind

Took me two hours to crawl to work

kalina

@DavidFreitag how do you know it was her?

did she completely fill the vehicle

David Freitag

@kalina Oh trust me, you know it when you see it.

kalina

?

David Freitag

23:27

@kalina Well he was mostly in the back of a dump truck

Simon

I came back to say that mouse acceleration is literally the worst thing ever in a VM.

David Freitag

@Simon So turn the sensitivity up

TildalWave

@DavidFreitag is that a euphemism?

kalina

@DavidFreitag he should do that in general

Adi

Fun! arxiv.org/ftp/arxiv/papers/1603/1603.04865.pdf

> Analyzing HTTPS Encrypted Traffic to Identify User’s Operating System, Browser and Application

David Freitag

23:29

How on earth...

Simon

@DavidFreitag Still feels really unnatural.

Adi

@DavidFreitag Using these bad boys

David Freitag

@Simon Give it some time, it will settle in to place and you'll be right as rain

Simon

am not so sure dovid but ok

Adi

Apparently, the combination is enough to fingerprint the OS and browser

David Freitag

23:31

@Adi Reminds me of evercookie

Adi

I..

Okay

David Freitag

Well I mean the technique to aggregate information like that is enough to fingerprint something with decent accuracy

TildalWave

@Adi neat

etherealflux

Isn't evercookie just violently spraying an ID at as many storage locations as possible?

Not quite fingerprinting

David Freitag

Maybe I'm thinking of something other than evercookie

Adi

23:33

@DavidFreitag You're thinking of Panopticlick

David Freitag

@Adi Yeah that's it, thanks for reading my sleep-deprived brain

etherealflux

aka lines of code with no pictures and no internet

TildalWave

that's still not the same thing tho

David Freitag

@TildalWave Well no not the same, but the same sort of concept

TildalWave

that's endpoints, this is MiTM

Adi

23:36

@TildalWave Nope

In that context, not a MiTM

At least not necessarily

TildalWave

how's eavesdropping not MiTM?

Adi

You when can do it without necessarily being a MiTM then you're not a MiTM

@TildalWave Being on the same WiFi

David Freitag

It's passive eavesdropping not active

Adi

You can passively listen

TildalWave

@Adi no that's not MiTM

Adi

23:37

@TildalWave Of course it's not

That's what I'm trying to say

That attack works by passively listening

David Freitag

lol

TildalWave

geez

Adi

merely by being on the same WiFi

What do you mean "geez"? You're wrong

TildalWave

I meant that you don't have to be on the same WiFi to qualify as a MiTM

it can be whoever in between the two endpoints

David Freitag

Adi

23:39

Wow

Okay

Clear misunderstanding on your part, @Tildal

Or, rather, miscommunication

TildalWave

OK so you're saying your ISP can't be a MiTM?

Adi

Ö

@David Sanity-check me, please.

TildalWave

OK nevermind

Adi

@TildalWave I'm not saying you need to be a on the same net to be a MiTM

TildalWave

clear misunderstanding on my part, or better still, miscommunication ... on my part... wot?

Adi

23:41

You're saying all eavesdropping is MiTM

Which is wrong

Simon

I hope you two don't plan to adopt because you're always gonna fight in front of your kid.

Adi

You can eavesdrop without being MiTM

e.g. being on the same WiFi

TildalWave

OK there's sidechannel

Adi

I'm disproving your assertion by showing an example that contradicts your claim

TildalWave

but this isn't it tho, is it?

for this to work you have to be "in the middle"

Adi

23:43

What do you mean by "this" here?

TildalWave

mind, I didn't say MiTM attack

I meant literally in between endpoints

Adi

@Simon One reason I won't be having kids

TildalWave

whereas the panopticlick is exactly the opposite of this

which is where I was coming from

Adi

The little fuckers will be wrong about soooo many things

and I'll keep arguing with them

David Freitag

@TildalWave Panopticlick uses metadata from the browser directly

TildalWave

23:45

@Adi the thingy described in the arXiv doc you linked

David Freitag

That document uses metadata from TLS/SSL traffic

Adi

@DavidFreitag Aye

David Freitag

Which can be passively obtained just by seeing the traffic

TildalWave

which is rephrasing what I said

David Freitag

ie seeing packets whiz by on WiFi or in promiscuous mode with a lan throwing star

TildalWave

23:46

but @Adi agrees with you and doesn't with me

David Freitag

@TildalWave No, it's not. This has nothing to do with MiTM

TildalWave

but whatever

I get the hint

David Freitag

You don't MitM someone by being on the same network as them

Adi

@TildalWave Which hint?

No hint

What the wow!! BinDiff is now free!

David Freitag

I mean, don't get me wrong @TildalWave you can obtain this information by acting as a MitM, however it's totally unnecessary (and pretty unfeasible given the traffic is solely TLS/SSL)

Thomas Pornin

23:49

@DavidFreitag Strictly speaking, a MitM needs not understand what he relays. It is a question of definition.

TildalWave

I still think you're considering me saying "MiTM" as me saying "MiTM attack" (not the same thing, at least not necessarily)

Thomas Pornin

Low-power attackers will spy on SSL connections by making a DNS poisoning then relaying packets, which makes them MitM.

And still "passive" from the crypto abstract point of view.

David Freitag

Well since this data collection doesn't need to touch encrypted data it's sorta perfect

TildalWave

all I meant was MiTM = someone positioned between the endpoints where traffic is in this case encrypted and you infer information based on its metadata signature

etherealflux

Man Somewhere near the Middle

MSntM

David Freitag

23:52

@TildalWave Yeah but what we're trying to say is that you don't need to be "between" any point, you can be latched on to the side of the network and still collect all of the relevant details

Mark Buffalo

Time to teach my wife to drive.

We're going to the Arcade.

Adi

I wanted to see if eavesdropping on satellite traffic by having a listener on the ground has a name

I googled "man on the ground attack"

Wasn't what I was looking for

David Freitag

lol

@Adi You can do it with a HackRF motherboard.vice.com/read/…

eprint.iacr.org/2012/051.pdf

Basically it entails putting an antenna between the ground dish and the satellite and passively capturing everything

Adi

I've always thought you need a dish to concentrate the signal

Mark Buffalo

@ThomasPornin This.

@DavidFreitag Which can be done in space as well, correct?

Adi

23:56

@ThomasPornin In this case, it's not even relaying anything

David Freitag

@Adi Nope, the signal is plenty concentrated by the transmitters. The main issue is keeping your antenna in line with the communications (the ground dish will track the satellite)

@MarkBuffalo Sure, but keeping in direct line with something in space is infinitely more difficult

Adi

I've done it with geostationary satellites, but I never was able to get a good signal without the dish

A lot of porn. Man, people watch a lot of porn.

You can use Skygrabber to extract files from TCP streams coming from satellites

Left it a few days running, came back to about 500GB of porn

etherealflux

That's impressive

Transcript for