« first day (2707 days earlier)      last day (2471 days later) » 

00:12
Heh, nice prediction.
And yeah the way it is advertised (yes, advertised is the correct word) makes it sound more like it's a problem with the standard or with the crypto itself (bad RNG in gcrypt, etc), which would be pretty world-ending.
If all my PGP messages could suddenly be decrypted by anyone today, I don't know what I'd do. At least QC is something we all see coming, but a bug?
 
6 hours later…
06:38
A German news outlet chose the following title for their breaking news regarding efail: "Researchers find: encrypted emails are not secure"
07:16
wow
Conspiracy time: This was released to desensitize people to high-profile bugs.
Seriousness time: Heartbleed was successful and contagious and "Efail" is stupid.
@TomK. It always afraid me when I see that newspaper are sometimes far from reallity on topic I know, because I wonder how far from reallity they are for topic I don't know...
@Kepotx yeah, I have that all the time
07:42
Unrelated: wasn't there some research showing how the stock market could be used to reveal confidential information like finding out what company got a contract to use some kind of proprietary rocket fuel?
It makes me wonder if the NSA's Utah datacenter's general specs could be estimated, since it would be prohibitively expensive if they built all the drives in-house. Some company like Seagate or WD must have nailed a jackpot contract.
And that info should show in the stock market.
@forest unless they multisourced and filtered it through a bunch of sources
and government contracting is pretty damned byzentine
In which case it would still show. I mean you really can't assemble that many drives in secret without it showing, even if you split it up among several companies.
(And yeah I know, the sheer number of shell companies the NSA uses... The majority of the NSA is actually split up into 11 or 12 distinct shell companies that do all their work for them IIRC)
don't even need that
just spilit them into multiple contracts
the actual servers might be a bigger thing but x86s are mostly commodity
Yeah makes sense if they also split it over time.
and cough Its the government.
07:46
Exabytes of data storage in the hands of those fucks is a little freaky.
they can make things super complicated
say break it up into a few hundred lots of say 500 servers
then have folks bid for each seperately
Well, even if you could: what then?
That hides the fact its one big buy
You could literally have 5-6 different contractors on even a declassified project
and/or buy off VARs or consultants rather than directly
08:34
Wow, I was joking with that tweet: twitter.com/benoitesnard/status/995997052856291328
But it seems that CVE-2017-8291 really has a theme song: ghostbutt.com
"The new CVSS score" heh
be honest though @Benoit ... did you buy these likes?
I didn't
okay
You can check who liked, it seems to be infosec people
i trust you
08:36
I was quite surprised how much people liked it too
08:47
I love India. "Hey, lets make a payment system where you onl give a number and firgerprint"
also India : "Hey, Why should we protect biometric data? instead we can sell this info for some roupies"
@BenoitEsnard do you have a minute?
I had a pentester here yesterday who whill be continuing his test today. We couldn't really start yesterday, because the web application that had to be tested had response times over 2000 ms long
Our setup looked like this:

test system <-> some firewall (allow any/any) <-> web app
the web app is also reachable from the internet, but there is a web application firewall in front of it
so a normal user has to take this route:

user <-> WAF <-> web app
so if you try to reach the web app from the internet, the response time was fine (<50 ms). but with our setup the response time was >2000 ms
the theory of the pentester was, that the web app made a reverse lookup, and because the test system had no host name, the reverse lookup couldn't find anything, timed out and then proceeded as normal
any normal user would have have a hostname because of the routing through the WAF
does that sound like a probable scenario to you?
That sounds quite strange, why would a webapp do a reverse lookup?
Does the test system have a good connection to Internet?
yes to the connection
and to the lookup: I guess for logging purposes
other connetions work just fine
you have to pay to use the webapp, so the logging is indeed quite extensive
08:58
Well, how hard would it be to add an hostname?
pretty easy I guess, you could just add it locally to /etc/hosts
but that means involving server admins and I don't know who..
I'm not an expert, but doing two HTTP requests consecutively should raise only one look-up right? Because of caching or so
Unless the absence of hostname causes caching failure :/
09:17
dunno, I don't have the code for the app
but you are probably right in that it's probably easiest to just test it with adding the hostname
I guess using another system is not an option
Since it's a paid app, and you most lilkey had a specific free access to pentest it
yup
well, it's a bit more complicated, but that's the gist of it ;)
09:58
well, that did it
weirdly, the admins were reachable in a couple of minutes :D
10:35
Wow, nice
 
1 hour later…
12:00
@Anders: "Stop encrypting email in your email client (e.g. by disabling the PGP plugin), and instead copy paste the encrypted data into a separate program to do the encryption." - say what now?
Did you mean: "Stop decrypting email in your email client (e.g. by disabling the PGP plugin), and instead copy paste the encrypted data into a separate program to do the decryption."?
Flood mail clients with electricity
I wonder if we made up a name, a website and a logo and faked a half good looking paper how far we could take a new vuln/attack that was called "Flooding with electricity"
3
don't present it to the academics, directly give it to news organizations
Should we create a theme song and a cryptocurrency?
+1 for the coin
theme songs are hard
"invest in our new cyber attack crypto spectre currency buzzword ICO attack"
2
Do you know how to rap?
12:11
umm...
I can rap as good as I can mine our new coins
damn serious
also, we should massively invest after releasing our cryptocurrency to the newspapers. lot of folks will think it's worth it, we sell all our coins and we are rich
@TomK. Wooops. Edited.
12:49
@Kepotx Isn't that what all coin developers already do?
Flooded with red electricity
 
1 hour later…
13:59
I think this answer on Crypto.SE contains some very relevant criticisms of OpenPGP in light of EFAIL. While not disputing that obviously mail clients are to be blamed, it also highlight some pretty important design flaws.
24
A: Is the software that uses PGP broken, or is it PGP itself?

Squeamish OssifrageThere are a few parts to the EFAIL attacks. Some are the fault of the mailer authors; some are the fault of the OpenPGP and S/MIME designers for failing to heed modern cryptography engineering principles. HTML interpretation. If you receive a message with <img url="http://efail.de/0a7492fc62d...

is finding a password with personal information (like birth date used as a PIN number) considered as social engineering ?
Hmm... If you are just guessing on your own, without no interaction, I wouldn't say it counts as social engineering. Tricking someone into disclosing their birth date so you can test if it works as a PIN, on the other hand, would qualify. Other might disagree.
so a manipulation is always needed ?
14:15
Yeah, I'd say so. Not sure if the dictionary definition would agree, if there is one out there...
14:40
Manipulation is needed to get the "social" aspect, in my opinion
Or at least a social interaction with the victim
15:11
Social engineering is using people. not knowledge. So yes interaction is needed in some form
 
1 hour later…
16:20
That's awesome: "For safer communications on desktop systems, please consider the use of a safer end-point client like PGP or GnuPG instead."
Oh, the irony.
IRL race condition
16:38
I think the real moral of the story here is that HTML is evil..
HTML has always been evil
I mean, HTML xor 0x0D020400 = EVIL
5
That's now proved with maths!
the only thing that makes HTML seem less evil is JavaScript
2
but that's just by comparison
Yeah, that's why I code in JS, to look good in comparison.
atleast until you go crazy and murder a small village somewhere
coding in Javascript is known to do that
16:45
I know you can claim insanity, but can you claim JavaScript in court?
sure, it just type coerces in to insanity
Ha ha, that is brilliant.
17:08
it's so sad that you can't star several messages
17:20
@TomK. what do you mean?
18:04
@AJHenderson Well, If you make a good comment over several lines or one that makes only sense in a conversation, I would have to star every single line. Which is a bit weird IMO
Just staring "sure, it just type coerces in to insanity" would look kinda weird on the wall

« first day (2707 days earlier)      last day (2471 days later) »