« first day (2869 days earlier)      last day (2020 days later) » 
01:00 - 11:0011:00 - 14:0014:00 - 23:00

daya
daya
2:01 PM
One more question, As I interested in infosec, Do I need to participate in Programming competitions?
I am pretty confused
I am much more interested in CTFs
Rather than programming competitions
 
forest
forest
You don't need to participate in any competitions.
Fwiw, I have never participated in a single programming competition.
And I turned out OK.
You should definitely learn at least some programming, but many hackers programs/scripts are very... hacky, not the kind of thing that would win a competition.
 
daya
daya
Exactly, I know some programming languages
But I am not as skilled who can solve any complex programming problem
 
forest
forest
Many hackers aren't extremely skilled programmers.
All that you need is something that works here and now. Professional software developers on the other hand need to do unit tests and the like to make sure their software will work for millions of people in any possible edge case.
If I'm hacking around with a PoC, I don't need to make sure that it has a pretty GUI and doesn't crash if I pass it a kilobyte-long argument list. I don't need the code to be pretty or readable, or even efficient. I just need to make sure it does what I want.
 
Anonymous
I want to be a pen-tester at least for a while and my Python skills are worse than hacky.
 
Anonymous
I just bash it together, cut bits and hope it works lmao
 
forest
forest
2:07 PM
Exactly. A lot of infosec folk do that.
 
Anonymous
If in doubt, StackOverflow is still about.
 
forest
forest
^
 
daya
daya
fair enough
 
Anonymous
Every script I've written for any CTF challenge I've ever attempted has been smashed together just hoping it will work.
 
forest
forest
Always remember... no matter how hacky your code is, it will never be worse than that of PhD academics! Their code, the times they release it at least, is horrific.
Yet they're the ones with a PhD!
 
daya
daya
2:09 PM
But as a computer science student, people or companies always expects you to be a superstunt programmer
 
Anonymous
Well, fuck 'em.
 
Anonymous
Doesn't matter what anyone else expects or says you should do.
 
Anonymous
Just learn what you like learning and get a job in that.
 
Anonymous
If it's not fulfilling, find a different subject.
 
forest
forest
That's just them not knowing what they're looking for. Computer science has probably the worst programmers out there. Sure, they know the theory behind data structures, but can they contribute positively to any popular program? Rarely.
I've seen CS students who can rattle off more insane facts about computer algorithms faster than ever, yet didn't know that structs in C are padded to a certain alignment.
 
Anonymous
2:11 PM
Honestly, this whole idea of a "perfect" candidate is just complete bs.
 
Anonymous
HR know they will never find such a thing.
 
Anonymous
They just ask for such things because.. Because it's how it works lmao.
 
forest
forest
Cuz that's how mah pappy did it, and his pappy 'fore him!
 
Anonymous
I literally got a job as a network engineer with nothing.
 
Anonymous
lmao.
 
daya
daya
2:14 PM
*Data Structures* is considered a really important subject in CS but In infosec, is there
any use of trees, linked lists, queues, sorting, searching etc?
 
forest
forest
Sure. I wrote a simple Linux kernel patch once to reduce attack surface area of certain syscalls in a way that couldn't be done with seccomp-bpf, and I had to use a radix tree to make it performant.
Though I only know the basics.
Any sorting algorithm I could make would be a variation of stacksort. :P
 
daya
daya
The 2nd line of yours just goes over my head lol
But at the end I think I should also learn this stuff
As after all, it is the part of the course lol
 
Anonymous
I've always preferred learning at my own pace, what I want to learn, when I want to learn it.
 
Anonymous
Hence I dislike formal education. Plus I never fitted in at school and that made it very difficult for me.
 
daya
daya
Hmm
But to be fair, I learn all the stuff on my own
I don't like to listen boring lectures
 
Anonymous
2:30 PM
Well, I just don't like going there at all.
 
Anonymous
I hate formal education :p but, I was looking at doing an OU course though.
 
Rizerzero
Rizerzero
4:35 PM
hello guys
i'm searching for information i you cloud help me please :)
i'm using aws graphql api, i'm pretty new to it and was wondering how secure it was
 
Rizerzero
Rizerzero
5:05 PM
and also the refrash rate for a TLS1.2 tunnel, aws lets me make the refresh token once a month, but i have no idea about the recommendations
 
 
2 hours later…
HamZa
HamZa
7:21 PM
Say that i want to start fuzzing for fun (and hopefully profit), a few linux targets and play around with AFL and some other tools. Would it make sense to buy a new rig and have it at home or just rent a Xeon server for 50-100euro per month?
 
HamZa
HamZa
7:48 PM
@Rizerzero i would say AWS is a pretty solid company but in the end it all depends on how you define your threat model and most importantly secure your stuff. I've never used the graphql api, but surely there must be some configuration/security guide somewhere?
 
NH.
NH.
AWS is a service offered by Amazon.
All kinds of fly-by-night companies use AWS at some point in their workflows (evil or not)
oh whoops I should have read the context
 
NH.
NH.
8:21 PM
ugh, the Cash app is evil. When you go to add a bank, and you click the Chase button, it looks like it has the Chase logo, but it is actually still in the Cash App and isn't even a webview containing the Chase website! (same goes for Navy FCU, etc.)
So basically they are taking your online banking username and password, and logging in on your behalf. Terrible, Terrible idea. Why, oh Why, do financial apps (where security is most important) always have the worst security?!?!
 
HamZa
HamZa
@NH. is that even legal?
 
NH.
NH.
who is going to stop them?
 
Tom K.
Tom K.
8:37 PM
wrt weird security: a lot of German online banking apps do "2FA" where the TAN is provided to you by a second app that is also on your phone
 
HamZa
HamZa
i mean from a legal perspective you can always sue them
it doesn't make sense anyways
oooor they must have included somewhere in terms of use that they are snatching your credentials and you agree to this :p
I've heard a similar story where an app asked you to sign in
they were doing it over HTTP but faked a "secure lock" icon :D
 
NH.
NH.
@TomK. That is still a second factor
 
Tom K.
Tom K.
...is it?
 
NH.
NH.
yeah. completely separate app
 
Tom K.
Tom K.
the phone is already the first factor, you can't as well use it for the second factor
 
NH.
NH.
8:46 PM
um, factors don't have to be physical
 
Tom K.
Tom K.
I'm very well aware of that
but if an adversary has access to your phone, she has access to your online banking
 
NH.
NH.
wait you are saying passwordless?
 
Tom K.
Tom K.
the two apps?
 
NH.
NH.
it sounds like the first factor is the one you are missing (the password)
 
Tom K.
Tom K.
the main banking app is, but it gets the TAN automatically from the second one
it's like an add-on to the first app
(but in a separate app)
 
NH.
NH.
8:52 PM
oh, now that is a little weird
why even have separate apps at that point?
 
Tom K.
Tom K.
beats me
 
NH.
NH.
no fingerprint or anything on the other app?
 
Tom K.
Tom K.
nope
 
NH.
NH.
dumb
 
HamZa
HamZa
@TomK. a PIN at least?
 
Tom K.
Tom K.
8:54 PM
devs thought: "ah well, containerization should be enough!"
there are 30 different providers in Germany, maybe some have something like that. and the talk I watched on that was a year old
 
HamZa
HamZa
i see...
Is it perhaps a CCC talk?
 
Tom K.
Tom K.
yeah, so in german
nomorp hack
 
Rizerzero
Rizerzero
@HamZa Thank you for your answer Bro !
 
Tom K.
Tom K.
btw
0
Q: Square CTF | 08 Nov. 2018, 19:00 UTC —14 Nov. 2018, 19:00 UTC

Tom K.Let's participate in the Square CTF! Format: Jeopardy Duration: 6 days(!) Start: Thu, 2018-11-08 19:00 UTC (Other timezone) Finish: Mon, 2018-11-14 19:00 UTC (Other timezone) Official URL: http://squarectf.com CTFtime URL: https://ctftime.org/event/695 Rating weight: 25,00 (?) Organizers: squar...

discussion ctf
 
HamZa
HamZa
if we're talking about the same talk
then this guy pretty much bashed it: https://www.youtube.com/watch?v=PNuAzR_ZCbo
Although i didn't watch the original talk
@Rizerzero welcome
 
Rizerzero
Rizerzero
9:02 PM
@HamZa sorry, without considering the Graphql api , do you have recommendations for refresh tokens ?
i can't find that :(
 
Tom K.
Tom K.
@HamZa yeah, without having watched the full video yet, I think I know the criticism and I partly agree
or even mostly
 
Rizerzero
Rizerzero
with your experience do you guys think that a man in the middle attack could be achieved using just a refresh token ?
 
Tom K.
Tom K.
but one point still stands, and that is that everyday users reuse passwords, reuse pins and don't handle their phones well. good 2FA is necessary because of that
 
HamZa
HamZa
i don't see the relationship between refresh token and MITM
Make sure you fetch the refresh token in a safe way then you can avoid MITM
depends also on your client code and what the server supports etc... (TLS, ciphers, pinning, mTLS?)
 
Rizerzero
Rizerzero
TLS v 1.2
Ciphers
 
HamZa
HamZa
9:07 PM
well i'm seeing a trend here...
For example: i can now with my mobile phone send money with just a simple PIN code
 
Tom K.
Tom K.
exactly
cash app works in a similar way if I'm not mistaken
and it's heavily advertised atm
usability is pushed at the moment especially for these banking and payment apps
 
Rizerzero
Rizerzero
without RSA
 
HamZa
HamZa
I don't know about that app
but i know that the banking industry in NL has heavily done some threat modeling
The general idea is: we want to move away from hardware identifiers (second factor)
they deem the current solutions "secure" enough and accept the risk (potential damage)
for example, i know that some banking apps have some client side detection of banking malware
 
Tom K.
Tom K.
okay, that sounds interesting
 
HamZa
HamZa
i'm a bit sorry to say that it is impossible to give you an answer with full certainty "hey it's super secure what you're doing"
it requires a lot more in depth digging and probably a handson verification
but so far, it sounds good
 
Rizerzero
Rizerzero
9:14 PM
@HamZa Thank you Sir !
i'll try my best to dig :)
 
HamZa
HamZa
@Rizerzero i think you need to ask yourself: what are you trying to protect from?
another example is "device binding". While going through the onboarding process of the app (assuming you already have an account with the bank). They will do all kinds of magic to determine your mobile phone so that even if the content of the app/data is stolen and put on another device, it won't work since it's bound to the device itself. Now of course, you might say "it's all reversible!"
Well yes, that's why they use some products which implement fancy obfuscation techniques (also labeled as "white box crypto"). And the idea is: the cost to reverse engineer these complex routines is heav…
Usually they will add some verification via TAN, SMS or hardware device while onboarding.
Basically after a successful onboarding, the device itself IS an authentication factor and the PIN code becomes the second factor
 
Rizerzero
Rizerzero
@HamZa Ok :)
 
HamZa
HamZa
also note that fingerprints, although it sounds fancy and "biometric"
most of the times it's just the OS that handles it but underneath, there is a simple auth token that is saved in the keychain/truststore
in worse case scenario i've seen some apps store the plain password/pin in the keychain :_)
 
Tom K.
Tom K.
@HamZa yeah, the guy from the CCC talk actually talks about these obfuscation techniques and the ones used by the German brand leader are laughable
 
HamZa
HamZa
oh darn, that's awful...
I didn't expect that tbh since I thought that the Germans were pretty serious about security/privacy
 
Tom K.
Tom K.
9:23 PM
the function names and variable names and whatnot are obfuscated
but there is no real code obfuscation
just a simple substitution cipher if you will
yeah, I was kinda baffled as well
 
HamZa
HamZa
well to be honest, I think obfuscation now a days is pretty hard to do well
especially with all the dynamic tools that are emerging...
 
Tom K.
Tom K.
what I also believe is that the attack vector is very specialized and that it is pretty slim
I don't know how many people really install malicious apps
or jailbreak their phones
 
HamZa
HamZa
@TomK. on iOS not so much but on android there's a lot of malware, even on the playstore
 
Tom K.
Tom K.
but how much downloads are we talking about?
several thousand? tens of thousand?
if we are talking playstore
"good" thing about the exploit tool, it can attack 20 different mobile banking apps iirc
so it isn't specialized on one bank
why? because all banks buy their security at the same place and they use(d) the same bad practices in a lot of apps
 
HamZa
HamZa
@TomK. I think in that range yes on playstore, at least so far found
if you google "playstore malware" you will find a lot of stories
but i think the "main actors" behind these malware are much smaller than that
sometimes it's just some kits or same variant being spread and re-used
 
Tom K.
Tom K.
9:32 PM
okay
I just now watched your video far enough to see, that this guy was several times at the CCCongress and that I watched another talk :)
 
jdgregson
jdgregson
9:59 PM
Hello all. I'm an aspiring security researcher, and the SquareCTF seems to be a good one to dive into for my first one. My question is, if I tag along with the secse team but find that I cannot contribute anything, is that a determent to the team? If not I'd like to participate just to get a feel for the whole thing.
 
Tom K.
Tom K.
no, it's not @jdgregson ;)
 
jdgregson
jdgregson
Well in that case, I'd appreciate it if you could shoot a slack invite off to jdgregson at sign gmail
 
01:00 - 11:0011:00 - 14:0014:00 - 23:00

« first day (2869 days earlier)      last day (2020 days later) »