The DMZ

Iszi

21:00

Stuff like the OSI model exists exactly for this. Make sure everything's working at the networking layers before you move on to the application.

Rоry McCune

people using metasploit have this problem (which is a networking issue) when searching for a solution to this class of issue, they search Sec.SE only to find they've been punted to SU

Iszi

@RоryMcCune No, most likely they search Google first.

Rоry McCune

people on SU who would look to answer this question may well be turned off it by the lack of understanding of how metasploit works

viz, this got no answers on SU

yes it's a networking question, but if you don't understand the terms used, are you likely to dive in with an answer...

Rory Alsop

wonder whether networks.SE would have been better in the first instance

but similarly, if someone hadn't plugged in their ethernet and was wondering why nmap was failing, it isn't an nmap issue - it's a physical network issue

David Freitag

Anyone got a link to the question?

Rory Alsop

21:02

0

Q: How to properly establish a connection to a remote host without router?

First of all, this is my first post, so please don't ignore this. You may have seen this question before. Before marking this as duplicate please understand my problems. I have many issues. I'm using this for an educational purpose. please note the following: I don't have a router. I have inst...

Iszi

Hell, this just happened today and it blew my mind. System Administrator came to one of our guys and asked how to translate a SID to a username. The guy can't put five frakkin' minutes into Google before running to a completely separate department to ask for help!

@RoryAlsop We has networks.SE now?

Sorry. Random crap's got my fuse short lately.

Rоry McCune

if you think about metasploit as a good example, most/all problems with it are not strictly "security" issues

so if we follow this doctrine we end up punting all metasploit questions

SEJPM

Rоry McCune

they're either "tool use" (SU) "environment setup" (SU) "networking" (network.SE or SU)

Rory Alsop

@RоryMcCune which I think is wrong - I just dunno where the line should be, hence why I wait for 4 close votes or so :-)

Iszi

21:05

@RоryMcCune But there's a difference between "question requiring someone familiar with Metasploit" and "question needing a 10 year old who's set up a Quake server before".

Rory Alsop

@Iszi lol

AviD

@RоryMcCune if metasploit had a reporting function, would we accept a question about the printer not working for metasploit report?

@Iszi exactly - the criterion is "who is the best crowd to ask"

David Freitag

@AviD Sure, if someone had the answer

Rоry McCune

@AviD if the answer was best answered by an experienced metasploit user yes!

AviD

@DavidFreitag why would we want to do tech support for printers now?

@RоryMcCune I mean, a problem with the printer. not some idiosyncrasy with configuring metasploit to make reports.

Iszi

21:08

@SEJPM Holy crap, that one's even graduated? How'd I miss that?

David Freitag

@AviD Oh. I see. You were a bit vague

Rоry McCune

if you punt a question relating to the configuration of a piece of software no-one outside of security has ever used (most likely) then what are the chances of the user getting an answer...

AviD

@DavidFreitag pfft

David Freitag

@SEJPM Is it just me or is this bloody impossible to see?

SEJPM

@Iszi cause they are really picky about their questions apparently

Iszi

21:08

@RоryMcCune Y'know, there's still a tail left behind over here too.

AviD

@RоryMcCune I'm talking about the printer, not the reports.

SEJPM

networkengineering.stackexchange.com/help/on-topic

Rоry McCune

@AviD but that's not analagous to the quetion we're talking about.

SEJPM

@DavidFreitag white on grey, indeed hard to see

AviD

@RоryMcCune oh I dont know anything about the question we're talking about.

I was answering your comment about onsitedness...

Iszi

21:09

@SEJPM Oh, come on! Why the hell have Networking.SE and invalidate SOHO questions?

SEJPM

6 mins ago, by Rory Alsop

0

Q: How to properly establish a connection to a remote host without router?

First of all, this is my first post, so please don't ignore this. You may have seen this question before. Before marking this as duplicate please understand my problems. I have many issues. I'm using this for an educational purpose. please note the following: I don't have a router. I have inst...

android metasploit kali-linux port-forwarding

Rоry McCune

@AviD sure but you're just setting up a strawman with an obvious answer :op

SEJPM

@Iszi because they can push those to SF and SU

AviD

@RоryMcCune hmm but it does look analogous.

it is a purely networking question.

the only question is why SU and not neteng.

SEJPM

they are apparently like MathOverflow: Only for professionals

Rоry McCune

21:10

@AviD well for me on SU, people won't answer a question about metasploit

David Freitag

> /* FIXME: This is definitely how it should be done.
* Someone more familiar with the framework needs to make it proper
*/

Yaaaay love seeing that in prod code

AviD

@RоryMcCune as other rory said, its not about metasploit

Rоry McCune

@AviD because they don't understand the terms, the people who understand that exact problem and it's solution are on Sec.SE

Iszi

@AviD Presumably they don't control the network end-to-end?

Rоry McCune

@AviD so your options are leave it here, and it may get an answer, or punt it and it probably wont....

AviD

21:12

@RоryMcCune or close it as unclear.

Iszi

@DavidFreitag I presume that's meant to be "this is definitely not how it should be done'?

AviD

but it looks more likely there than here

David Freitag

@Iszi I think so, I didn't even notice the word not wasn't there

Rоry McCune

@AviD I didn't think it was that unclear. it's obvious that OP's not that experienced and his first language may not be english, but several people in here reckon it's clear enough to be obviously a networking question :)

Iszi

@SEJPM That's just elitist.

SEJPM

21:14

@Iszi but apparently this served both sites well enough to get graduated

Iszi

@SEJPM Doesn't negate my point.

Rory Alsop

I wonder if we should have just edited out the metasploit bit and then pinged it over

Iszi

@RoryAlsop s/Metasploit/an application/ ?

David Freitag

@Iszi That makes no sense. ENGLISH, DO YOU SPEAK IT?!

SEJPM

@Iszi apparently the user base and the question base is great enough with a big enough difference to warrant the split

Rory Alsop

21:16

Heh

Iszi

@DavidFreitag i.e.: Is @RoryAlsop proposing that we just genericize the question, so that instead of referring to "Metasploit" we just say it's "an (unnamed) application"?

AviD

@Iszi I think so, yes.

David Freitag

@Iszi We're trying to make the distinction between providing support for niche infosec applications

AviD

and if that can be done, does it even matter anymore?

Iszi

Anyone else betting that if we do genericize the question it'll end up closed as dupe for something answered (or asked) by a 10 year old who's set up (or is setting up) a Quake server?

Rоry McCune

21:19

@Iszi For me that's the difference between "are we trying to make a question that is useful for others" vs "are we trying to help the questioner get an answer to their question

David Freitag

@Iszi Probably

Rоry McCune

editing would very likely confuse the questoner as to why it had been done

and not help them understand the answer

but might produce a more useful question generically for other people with port forwarding issues

however I'd almost guarantee that a generalized question of that type would be closed as a dupe

Xander

0

A: Scanning private IPs from outside network

Great detailed answers, cannot think of anything to add.

Iszi

@RоryMcCune Maybe it's just the cranky talking, but if they're using Metasploit and don't grok port fowarding already I get the feeling any SE answer we have isn't going to help them.

Xander

In isolation, that looked like a "Thank you" answer, but now that I see the whole thread, I'm thinking spam user.

AviD

21:21

@RоryMcCune so if the questioner already has an answer waiting on SU in another question, why would we insist on keeping him here, and probably not get any answer?

Xander

He just posted another answer that I flagged for the mods.

@AviD @RoryAlsop

AviD

@Iszi I agree

Rоry McCune

@Iszi well I guess it's just the ex-helpdesk person in me, but I have a tendency to try and help the original questioner, even when it's a bad question

David Freitag

Grok is such an odd word.

AviD

@Xander no he didnt

David Freitag

21:22

I have to remember to use it in regular conversation more.

Rоry McCune

@AviD because he won't understand the generalized version of the answer, most likely

Iszi

@RоryMcCune You must've been on a crap-ton of fluoxetine in your help desk days. I never worked one myself but I know that's what it'd take for me.

Xander

@AviD Ha ha, thanks!

AviD

@RоryMcCune ah, so you're saying we should kick the user from the site?

and take away his metasploit license, if we could

Rоry McCune

@Iszi I used to quite like solving people's problems, unless they were actually rude, problem solving is fun. I remember spending about an hour on the phone to a guy who worked in a power station helping him setup a windows 95 printer, that was fine... it was just rude people I wasn't a fan of.

kalina

21:24

@RоryMcCune really? You think @Ohnana is one of my sockpuppets?

Iszi

@RоryMcCune I like solving real, technical problems. Layer 8 issues, not so much.

Xander

@kalina Who doesn't?

kalina

-.-

Rоry McCune

@kalina why not :)

kalina

oh I don't know, we're just two people in the same chat room

that would be like saying @AviD is also my sock puppet

AviD

21:25

@kalina that would explain what your hand is doing

kalina

yes my hand is currently deeply involved in portraying the suckage that is you

which actually doesn't make it any better

that could still be...

nevermind

AviD

@kalina actually, this makes sense. If you were to make a sockpuppet, it is clear you would put on airs of actively hating him, even sometimes ignoring him, even though you often agree with him.

kalina

I rarely agree with you

sometimes you just happen to say things that don't annoy me as much as usual

AviD

@kalina but cmon, admit I made you hate me just a little bit more.

@kalina hehe

in other interesting news, SSL Labs has added tests for DROWN.

it is interesting to see a site with otherwise high scores, green bars all over, but still getting an F grade.

David Freitag

Has any information come out on badlock yet? I can't remember the release date

Xander

21:29

@AviD Hmm. You already get an F if you have SSL v2 enabled so...

kalina

you started by saying interesting and then it was just white noise

MickLH

@AviD Obviously someone trying to make sure their sockpuppet is not suspicious would point out the cause for suspicion in advance to avoid appearing threatened by it.

Xander

@DavidFreitag April 12th. Not that I've seen, but I haven't been looking.

AviD

@Xander hmm yeah, interesting - SSLv2 is not enabled, so why is DROWN marked as vulnerable?

David Freitag

@Xander Ah, thanks

AviD

21:30

wasnt DROWN just for v2?

Xander

@AviD Just v2 with export ciphers available.

David Freitag

@AviD According to the bear: "This attack is of the same kind, but with a new technique that relies on the specificities of SSL 2.0. "

AviD

@Xander hmm, so its weird

> Vulnerable (same hostname with SSL v2)

that was the comment in the DROWN section, but SSLv2 is marked as not active.

David Freitag

@AviD Perhaps SSL 2 isn't actually disabled?

AviD

@DavidFreitag same SSLLabs report says it is.

Xander

21:32

@Avid Technically if you just have SSL v2 enabled, you might not be vulnerable to DROWN, so a specific test kind of makes sense. But since everyone with SSL v2 enabled will get an F anyway, it kind of doesn't make sense.

Iszi

IIRC, DROWN only requires any service (not necessarily the target site) to be running with SSLv2, export ciphers enabled, and the same certificate.

David Freitag

@AviD So ping the bear and let him ponder it for a few milliseconds

AviD

@Xander I'm concerned about the opposite - why test, if v2 is disabled. and how fail....

Xander

@AviD Ah, yes, they must be checking for other services using the same cert that are also vulnerable to DROWN.

AviD

ah wait a second - this is weird, it is showing the DROWN result on a different IP?

Iszi

21:33

So, your HTTPS website runs TLS 1.2 with no export ciphers? Great. But your mail server uses the same certificate and has SSLv2 with export enabled? Website is still hosed.

Xander

Which would make stronger sites vulnerable by default, as the secondary targets.

AviD

@Xander bingo

Xander

That's quite useful.

Iszi

Seems The Bear has been summoned. Let's allow him to weigh in.

Xander

@Iszi Yes.

David Freitag

21:34

Which is pretty freaking cool since nobody pinged him

AviD

@Iszi but how would it know which sites to check? certscan the internet?

@Xander indeed, this is looking more interesting.

Iszi

@DavidFreitag Ah, you're right. You only said "the bear". Nobody actually said "@ThomasPornin".

@AviD Maybe port scan on the same target, or enumerate and scan targets in the same domain?

AviD

well its a different IP, so likely the latter

Iszi

Could also be storing and referencing certificate data from its past scans.

AviD

ahhhh all is clarified blog.qualys.com/securitylabs/2016/03/04/…

much as @Iszi suspected, but a bit better

Xander

21:37

@AviD It doesn't need to, it only needs to look for common SSL/TLS services on hostnames that are in the CN or SAN for the cert of the site you're testing. Which, of course, it already has.

AviD

@Iszi ooh almost got there

Iszi

@AviD LOL!

> DROWN actually makes things worse, because it abuses SSL v2 to attack all other protocols, but we don’t have a worse grade, so F will have to do.

kalina

this conversation is interesting

David Freitag

@Iszi F--

Xander

@kalina It's at least the second security/crypto discussion we've had in here today, which is probably a record.

Iszi

21:40

@AviD Heh. Nice. Funny thing about their explanation though. They're saying to be mindful that the certificate data they're using might be stale. That doesn't really matter. If your cert still matches one they can look up, and the one they're looking up was ever used on an SSLv2 service with export ciphers, you have to assume it's compromised regardless of whether or not that other service has been locked down.

i.e.: Make sure all your services have SSLv2 off, and change your certs.

AviD

oh hey @RоryMcCune - btw, got an update on that proposal - it's a no-go :-(

turns out the alternate gave them a much more detailed, elaborated set of options.

THIS IS WHY I ASKED THEM WHAT THEY EXPECTED TO GET :@

perhaps the next year after that.

Thomas Pornin

@Iszi Technically you do not have to "change your cert" because the attack recovers one encrypted message, not the private key.

Iszi

@ThomasPornin Hrm? I thought the whole problem was that the attack compromised the key?

Thomas Pornin

(Otherwise it would be a demonstration of the equivalent of RSA with factorization, and such an equivalence is not demonstrated right now.)

AviD

@ThomasPornin so if thats the case, why would other services with the same cert on v2 expose the cert?

oh nevermind, I just answered myself.

no, that is not a euphemism.

Thomas Pornin

21:45

@AviD In the attack, the target is one value of E(K, m) pour public key K (RSA) and a secret m (pre-master secret for one SSL/TLS session). Attack abuses a SSLv2 server that uses the same RSA key and recovers m.

It is still an expensive attack that must be done all over again for each past session to decrypt.

AviD

@ThomasPornin yeah got that.

Thomas Pornin

Also, it works only on 1/1000th of sessions or so.

AviD

i.e. you can use serviceB to decrypt serviceA's messages.

Thomas Pornin

Also, it works only on sessions that use RSA encryption for key exchange, so it won't work on sessions that use a DHE or ECDHE cipher suite.

AviD

@ThomasPornin I'm a bit slow, but I get there eventually.

@ThomasPornin does v2 even support DHE?

Thomas Pornin

21:47

@AviD Amusing fact of the day: America gets away from Europa at about the same speed as the growth of a fingernail.

Iszi

@AviD I'm still at a loss for how that makes sense. Wouldn't the session keys on service A be different from service B?

AviD

@ThomasPornin wow. that burn was subtle.

nicely done.

Thomas Pornin

@AviD No, but that's irrelevant, since the target is a SSLv3 or TLS session.

TildalWave

@AviD is that what your pyramid builder told you?

Iszi

@ThomasPornin Europa the moon? I'm pretty sure we move a way a helluva lot faster than that (or perhaps towards, depending on timing) right along with the rest of the Earth.

AviD

21:48

@ThomasPornin hmm, that seems to be redundant.

@Iszi as @ThomasPornin said (or rather as my understanding of what he said), you're not retreiveing A's keys from B, you're just decrypting the shared master from the public key.

David Freitag

@ThomasPornin Wow this means at some point America's hat is going to get knocked off by Russia!

Thomas Pornin

@DavidFreitag By Wilson's Cycle, it should.

Iszi

@AviD But that's exactly my problem - if you're recovering session-specific keys, why would there be a match between two separate services?

Gilles

@ThomasPornin what happens when the nail gets trimmed? Earthquake in Califorina?

Thomas Pornin

@Gilles That's the tricky thing: it is only an average. Continents tend to move in bursts. So we are talking Wolverine-like nails here.

Xander

21:52

@Iszi You're attempting to recover the pre-master secret from the TLS session so that you can then compute the session key for that session.

David Freitag

@ThomasPornin Is that a reference to some event in the future?

Thomas Pornin

@DavidFreitag Worse than that, it is actual Science.

AviD

Supercontinent cycle

The supercontinent cycle is the quasi-periodic aggregation and dispersal of Earth's continental crust. There are varying opinions as to whether the amount of continental crust is increasing, decreasing, or staying about the same, but it is agreed that the Earth's crust is constantly being reconfigured. One complete supercontinent cycle is said to take 300 to 500 million years. Continental collision makes fewer and larger continents while rifting makes more and smaller continents. == Description == The most recent supercontinent, Pangaea, formed about 300 million years ago. There are two different...

David Freitag

It's waaaaay past bed time

@ThomasPornin Blasphemer!

AviD

David Freitag

21:54

@AviD Image not found

Iszi

@Xander I get that a weakness in SSLv2 is allowing compromise of a PMK. What I don't get is how that enables computation of the PMK for a different session, absent compromise of the certificate itself. Unless we're just expediting a brute-force approach?

David Freitag

@AviD Yeah I got that from your wiki entry.

AviD

I love all the crazy things just being near @ThomasPornin makes us learn.

4

David Freitag

@AviD Dude me too

Then I can go an regurgitate them to my friends IRL and be as cool as @ThomasPornin is.

AviD

@DavidFreitag yes yes, I love you too, dovid

David Freitag

21:56

oooooh someone loves me :o

Iszi

@DavidFreitag Dude, if you regurgitate anything to me IRL, you're gonna get kicked in the teeth.

'Cause ew.

Thomas Pornin

To say things simply: continents kinda "float" on tectonic plaques. When two continents collide, they stick. So, ultimately, they will all stick together at some point. When that happens, the continents make an effective heat shield that changes convection currents in the mantle, and initiates a break up and spread of the continents.

David Freitag

@Iszi Maybe that's exactly what I wanted?

AviD

156

Q: What is DROWN and how does it work?

There is a new recent attack "on TLS" named "DROWN". I understand that it appears to use bad SSLv2 requests to recover static (certificate) keys. My question is: How? How can you recover static encryption or signature keys using SSLv2? Bonus questions: How can I prevent the attack from applyin...

tls openssl attack-prevention

Thomas Pornin

It takes about 300 million years to get to the next supercontinent.

David Freitag

21:57

I wish building the linux kernel took less time

I removed a bunch of unnecessary things and trimmed down the build by a few minutes, but damn

AviD

@Iszi I think this is the bit you're missing:

> The attacker begins a SSL 2.0 handshake with that system, using as ClientMasterKey message a value derived from the one that the attacker wants to decrypt. He also asks for using a 40-bit export cipher suite.

thats what dropped the penny for me.

Thomas Pornin

@Iszi DROWN abuses a SSLv2 protocol flaw to recover m from E(K, m), when the SSLv2 server uses the same key K itself. It so happens that in most cases where the attack applies, the "encrypted m" that the attacker may want to obtain is really a premaster secret for a completely unrelated SSL/TLS session that just uses that key K.

David Freitag

@Iszi Also, that's not the only dictionary definition of regurgitate.

Thomas Pornin

In theory, with DROWN, you could decrypt an S/MIME email, if the email recipient used the same RSA key pair as a SSLv2 server.

AviD

@ThomasPornin would it be correct to say that the attacker is basically trying to redo the initial handshake, which creates the pre master secret?

Thomas Pornin

22:01

@AviD Mmh... not really. The math is a bit more convoluted than that.

AviD

@ThomasPornin WHOA. Wait. I thought this was a SSL issue, what does it have to do with S/MIME?

Iszi

@DavidFreitag TWSS!

David Freitag

I think I might also make a chrome extension to change dark to dank like I have for cloud and cyber to butt

AviD

@ThomasPornin I meant, at a logical, high level perspective.

David Freitag

@Iszi Yeah maybe if she's a penguin

Thomas Pornin

22:02

@AviD It is an issue that allows decrypting something that was encrypted. Usually, when a key pair is used in both a SSLv2 server and "something else", that "something else" is also a SSL/TLS server.

Iszi

@ThomasPornin @AviD Okay, I think I'm more or less getting it now. Thanks. I still say you should change your keys though. I mean, why the hell are you running the same key on two different services anyway?

Thomas Pornin

But it could theoretically be applied to anything that uses RSA encryption.

David Freitag

@Iszi $/overhead

AviD

@ThomasPornin ohhh

Iszi

@DavidFreitag i.e. "cheap/lazy/needs to be shot anyway"

Thomas Pornin

22:03

@Iszi Because it takes weeks to go through the administrative red tape to allow the purchase of a SSL certificate.

David Freitag

@Iszi Yup

Man tetraethyllead is some scary shit

TildalWave

@DavidFreitag or a cow ;)

well, any bovine actually

David Freitag

@TildalWave It's true, @Iszi is very fond of @Simon's mom

Iszi

One of these days, I need to write a script that will go through a spreadsheet and break it out into multiple sheets with content and names determined by a specified field.

David Freitag

Or, you know, stop using Excel as a database.

Iszi

22:10

@DavidFreitag That too. Unfortunately, I'm just a middle-man. Actual "database" is managed upstream.

David Freitag

@Iszi I suppose you could install VS2015 CE and write a plugin

TildalWave

@Iszi OMG that would take like 2 lines of code!!

David Freitag

Add a button to the excel ribbon

kalina

@Xander "yay"

TildalWave

why wouldn't you just use auto-filters?

Iszi

22:11

@TildalWave I'm sure. I just haven't gotten through figuring out which two.

@TildalWave Oh, that's great for when I am working with the data. But the data represents information that needs to be distributed to about a dozen different teams who don't have need-to-know on the full set.

kalina

LOL

that's so funny

Xander

@kalina How was your pizza?

kalina

it's like that one time

when this meme was created

Iszi

@kalina But it is. They're just all standing behind the camera. Duh.

kalina

@Xander it was tasty and exactly what I needed

David Freitag

22:15

I could go for pizza right about now

TildalWave

@kalina what is?

David Freitag

Or anything, really

Iszi

@kalina I mean, you're only seeing part of two walls there. And a corner. To even remotely get a proper perspective on the room's dimensions you need at least two corners. Three, for a definite measurement. And that assumes all corners are either right or acute angles. And that there's at most four walls.

kalina

@TildalWave nothing

TildalWave

@kalina OK, what isn't

everything?

kalina

22:15

I don't understand the question

David Freitag

@kalina 42

TildalWave

@kalina if nothing was, then what wasn't?

kalina

I don't want to play anymore

David Freitag

@TildalWave Nothing in the history of the universe since the big bang has ever been funny, or not funny for that matter.

kalina

please the big bang theory is full of funny

David Freitag

22:18

a lot like your face

TildalWave

erm no most of the funny came much later

kalina

@DavidFreitag so mean

David Freitag

You know me, the meanest mean that has ever meaned

kalina

:(

#chatkiller

David Freitag

Good, I like it better that way.

OK time to get something to eat, I'm getting cranky

Thomas Pornin

22:33

@DavidFreitag "A good chat is a dead chat."

kalina

@ThomasPornin stop stealing my lines!

although mine is man, not chat

</shameless>

David Freitag

I guess it's a good thing I'm more of a manchild anyway

Thomas Pornin

latimes.com/local/lanow/…

David Freitag

@ThomasPornin Nice.

Thomas Pornin

Summary: FBI drops fight against Apple because they confirm that they could access the San Bernardino iPhone data.

So everybody gets home with its reputation intact.

I expect a sequel in a few months. When some other terrorist happens to have used another model of smartphone.

David Freitag

22:40

@ThomasPornin I doubt it, the FBI will probably use their trusted "3rd party" again.

Gilles

@ThomasPornin “Terrorists use Samsung phone. FBI: ‘We just switched on the phone and it displayed everything we needed.’”

Thomas Pornin

@DavidFreitag Nobody promised that the method would work on other models.

From what I could gather, things would not go as smoothly on an iPhone 6.

David Freitag

@ThomasPornin Sure but presumably this 3rd party does not specialize in one very specific form of attack.

Gilles

(but, seriously:what terrorist doesn't use 1234 as their password?)

David Freitag

What terrorist is idiotic enough to use a smart phone?

Thomas Pornin

22:43

I mean that the breaking of an iPhone 5 would have entailed opening the chip and doing a brute force on the tamper resistant part, but the one on an iPhone 6 would lock itself, thereby preventing such a brute force.

David Freitag

OSHW arduino throwaway phones is where it's at

Thomas Pornin

@DavidFreitag All of them? Being terrorists does not make them smarter than normal people.

(Arguably the correlation would be in the other direction.)

David Freitag

@ThomasPornin I think we can count out lucky stars that this is true

Iszi

@ThomasPornin Arguably. Apple is surely not happy that a third-party could break into their phone with yet-unknown tools. And I'm sure they'd love to find out how that worked so they can roll out a patch (if one is possible).

Mark Buffalo

Speaking of phone haxoring... I witnessed it in action recently, and saw a very good reason for this to occur.

David Freitag

22:45

@Iszi If the attack is as @ThomasPornin suggests I highly doubt there is a fix.

Mark Buffalo

</unpopular opinion>

Iszi

I'd love to see Apple sue for details on the vulnerability.

David Freitag

@MarkBuffalo Ah, so the FBI's "3rd party" is the NSA?

@Iszi I bet they already know

Thomas Pornin

@DavidFreitag There is a fix which is right into Apple tradition: buy a newer iPhone.

David Freitag

@ThomasPornin LOL

Iszi

22:46

@DavidFreitag Doubtful. Wasn't Cook saying it would take them months to develop what the FBI needed?

Gilles

@DavidFreitag can't be: NSA would never talk to FBI

David Freitag

@Iszi Perhaps that was an underestimation on Cook's part?

Gilles

@Iszi one week for the engineers to do it and three months for Apple to stall after a court order

Mark Buffalo

I have no problem with the government hacking/cracking stuff. My issue is with intentional weakening of standards

Thomas Pornin

@Iszi Cook also said that he didn't want to do it, so his estimates could be, let's say, somewhat skewed.

David Freitag

22:47

He also could have been puffing Apple's chest despite the knowledge of an existing vulnerability in order to dissuade any attempts to attack

Pendulum - The Other Side [Lyrics]

►

Aww yiss

@Xander and this is the third crypto-related conversation, definitely a record.

Mark Buffalo

I hope the FBI can break it

Thomas Pornin

Honestly, if the FBI could not break the iPhone 5, then US taxpayers could legitimately ask what the Hell they do with their budget.

David Freitag

Pretty much

This is one of those "unless a nation state is after you" situations

Iszi

> Two law enforcement officials said while they have not conclusively verified the suspect’s identity, they believe the man is Larry Russell Dawson, a 66-year-old from Tennessee who police described as a frequent visitor and protester to Washington.

How the hell can you claim the guy is a known frequent visitor, while not being able to "conclusively verify" it?

washingtonpost.com/local/public-safety/…

Ohnana

@Iszi they haven't run his fingerprints yet probably

Thomas Pornin

22:57

@Iszi They say that there is a guy called Larry Russell Dawson, a frequent visitor, and the one they got looks like him.

Ohnana

they tend to verify you heavily just to make sure you're not giving your friend's name

Thomas Pornin

@Ohnana It has happened.

Ohnana

@ThomasPornin yep, i've heard plenty of stories

and then the real one goes to the police station and is super pissed

Iszi

@ThomasPornin Yeah, but if the guy really is that frequent of a nuisance, odds are the police who know enough to say as much would also be able to "conclusively verify" on sight.

Transcript for