The DMZ - 2020-12-02

« first day (3639 days earlier) ← previous day next day → last day (1231 days later) »

2:09 AM

Suppose you visited a website serving malicious JS (through an ad, for example). This malicious JS sends a large POST request to your router, crashing it and forcing it to restart. This knocks you offline for about 5 minutes while the router restarts, constituting a short-term denial of service attack. Would you think this is rewardable under a bug bounty program?

The issue is with one of the current rental modem+routers from a major US ISP, so there are likely millions of devices vulnerable. I'm still trying to find if it's a buffer overflow or just memory exhaustion, but I suspect the la…

2:46 AM

There are probably others here who know a lot more about bug bounties than me, but my gut reaction is that the bounty may be much more dependent on the attitude of the company than on the severity of the bug.

The company at least has a bug bounty program, so I'm sure they'd give it a good look. I'm just wondering if you personally feel that it's even worth reporting.

4 hours later…

6:36 AM

Major caveat: it takes about 80 seconds to send enough data to exhaust the memory and cause the crash, and using concurrent connections makes it take even longer than that.

It's interesting that they didn't have the router kill the connection prior to exhausting memory, but I can't see how this could be anything other than a nuisance. The router firmware is using PHP and PHP has a "post_max_size" setting, but they don't seem to be using it, or it's set to something greater than the router's memory.

2 hours later…

8:26 AM

Since they have a BBH program, they definitely describe what's allowed and what isn't in their rules.
As it seems, you're talking BBH for a router? If yes, then it doesn't really matter if it's through an ad or whatever. You can be a server sending the router a ton of content, and the router needs to block it or break it down before it comes in.

Can you better describe if this is part of their rules, their product is what, etc. Otherwise it's a bit difficult to help

2 hours later…

10:30 AM

Good morning, Hackers and Hackresses

Today's shitposting in the DMZ is sponsored by me.

10:47 AM

Cool! We can expect quality shitposting then.

Wonderful. Let me be off-topic from shitposting and ask on-topic real quick

What does it mean when a cipher list says +SSLv3

Dafuck?

The nginx configuration on bettercrypto suggests using the following as cipher string: ...:EECDH:+CAMELLIA128:+AES128:+SSLv3:...

I mean, SSLv3 is disabled in some other setting, so it doesn't enable SSLv3

Do they mean the ciphers?

Ah yes it does

+SSLv3 enables all SSLv3 ciphers...dafugg

Let me boot up a VM and check that real fucking quick

damn I forgot my login

Just make a new VM

11:17 AM

SSLv3? today?

Ah, I get it now

It's all SSLv3-compatible ciphers, minus all the shitty ones

I believe every browser today accepts TLS 1.2, so why enable sslv3?

SSLv3 is not enabled

TLS1.0 and 1.1 is enabled

I'll give you a cipher list in just a second

Actually I'll give you the full testssl report

11:42 AM

0bin.net/paste/…

So TLS 1.0 supports ECDHE-RSA-AES256-SHA, ECDHE-RSA-AES128-SHA, CAMELLIA128-SHA and AES128-SHA in that order.

With the config offered by bettercrypto

And while support for TLS 1.0 and 1.1 isn't great it's also not perfect

Jesus, I'm getting flags up the ass again

12:36 PM

I wonder if my question security.stackexchange.com/questions/241600/… is actually on-topic here, or whether I should have posted it on law?

@plonk I'm all for migrating it to Law

okay, should I delete it and repost it there? Or can I migrate it somehow?

@plonk It can be migrated, I'll mark it for a mod.

Or you know what, just delete it here and copy it

It's faster

ok!

I hope you get a good answer there, and if someone there comments that it's better suited here, well tell them they sent you there :D

12:46 PM

should I close or delete it?

( guess closing means if someone comes across it here, they can find it there, but I'm not sure if this kind of cross-posting is wanted)

Deleting is better. If push comes to shove you can still undelete it

thanks!

1:35 PM

25

Q: Best way to let people know you aren't dead, just taking pictures?

First of all, sorry if this question is off-topic - I have looked at the help section and I believe this falls into the "techniques and best practices" category, and similar questions have been asked before, but I'm still open to suggestions about editing, moving or closing this question. My wif...

macro shooting-technique tips

"Not dead, just taking pictures" :D

interesting problem...

His wife would probably make a good sniper as well

I love how the first rule of Personal Finance & Money is "If you have to ask if it's a scam, it's a scam" and it has always held true.

@MechMK1 if you have to explain why is not a pyramid, it's a pyramid...

@ThoriumBR It's more of a trapezoid really

Have you ever opened mail that wasn't for you?

1:55 PM

email, sometimes... physical mail? not that I remember

but I have a funny story about that. When in college I rented a very small studio, my rent was $300, more or less, and I was an intern for a large corporation. I lived on the unit 13 and there was a guy that lived on the unit 03 what almost had the same name as me.

I was required to travel, the day after xmas, for an emergency at a client. air ticket prices are as expensive as possible, and had to travel to a city with expensive hotels, and had to stay one week at a 5-star hotel where the only available rooms were the expensive ones... what a shame.

my corporate credit card bill came, and it was $25k, and I made a little over $1k. the poor guy got my credit card bill thinking it was his, got home, opened it, had a heart attack, his soul left his body, grabbed the bill, looked at the price, died again, looked at the name, ops, isn't me! Got back to his body...

he gave the opened envelope to my roommate, and said sorry for opening it... when I got home he told me a very scared guy went there to drop it and apologized for opening my mail... when I looked at the bill I understood why.

Yeah, understandable. It happened to me by accident too, quite a lot even

The guy who previously lived here still gets a lot of mail

And since it's addressed to the apartment number, it's given to me

Since I live in Foo St. 22/Apt 6 and it's addressed to that, even though our names are different

So one day I get a letter, look at the cover and I'm like "Oh shit, what does the ministry of finance want?"

I open it up, inside is a bill for 26,000€

I'm like WHAT THE FUCK

Start reading, it talks about court fees, police fees, etc...

I'm like what the fuck is all of this?

(Mind you, this was a while after the mushroom story)

Then I look at the name, and noticed it was for that guy

So I called the ministry, explained it to them, and they too were like "Why are you opening other people's mail?"

How come this even gets delivered to you if its name is not on the mailbox?

Where I live, when there's no name it's not delivered, and if the name does not match, it's not delivered either. It's returned to the sender with the mention "wrong address".

here if the mail can find your address, they don't care if your name is in the package or not

and we don't have our names on the mailbox

2:10 PM

Now, since a few years, even letters with obvious typos (like wrong postal code) are sent back.

@A.Hersean I occasionally find mail that is put on top of the mail box, which is addressed to Foo St. 22, but with no name matching on any of the mailboxes

and in my house, even with my full name, correct address and being home all the time, mail does not get delivered because the post guy says there's nobody home and I have to drive to the post office to get mail

I assume that's for a previous tenant who no longer lives here

Lazy postmen are everywhere

@A.Hersean Same here

Though funny story

One of the friends of our family once sent a postcard from italy, labelled as "To Mama", with just the ZIP code and no address

It indeed got delivered

Rural Austria is just different :D

2:13 PM

I never got a single mail delivered here...

That's not lazyness anymore...

I mean to be fair, "towns" in rural austria are sometimes 3 houses on a street

My great grandmother used to live in such a "town" - if you were good, you could throw a stone from one end to the other

here is possible to send the mail to a post office branch and get it returned to sender

I always wondered...could you send a mail with a fake sender as recipient?

ah, this week the police got a post man gang that re-routed mail containing expensive electronics... they have to xray mail to see if you are shipping forbidden items, and when they found you were to receive a brand new iPhone, they would slap they address to the box and guess who got a shiny new iphone?

they re-routed thousands of packages

2:21 PM

@ThoriumBR Same in russia. if you ordered anything expensive, they'd open the package, take out the box, take out the item itself, fill it with stones, close the box, wrap it again and ship it

As in: Alice wants to send a mail to Bob, but remain hidden as sender. So she writes a letter addressed to Norbert (who does not exist) and uses Bob as the sender. The letter would then be sent to Norbert, who does not exist, and "returned" to Bob.

Would that work?

0

Q: Is it illegal to send mail through the US Postal Service with a missing or fake return address?

Is this illegal: Let's say someone wants to send a letter to a recipient. But if the sender were to put the correct return address and name on the letter that it likely will be thrown away by the recipient unopened. So they put the name of a fictitious or incorrect name and return address on ...

criminal-law fraud mail us-federal-government

@MechMK1 here it would work...

@FireQuacker I'm fairly certain it's illegal

But since when do i care about that? I commit crimes every day

Well, from the answer, I'm guessing they wouldn't care for the most part, unless there was something else obviously wrong with the piece of mail

If you were under investigation for some other crime and you were discovered to be doing this, it might be added to the list of charges

I hope I'm never getting investigated

2:36 PM

But if there's nothing else to make them notice you then you might get away with it

For some reason it reminds me of hidden city flights - which are not illegal as far as I know, but against the ToS by airlines

1 hour later…

4:06 PM

6

Q: Why does Spring Security unset and set the same Cookie in one Request?

In the CSRF implementation of Spring Security (https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java#L57) they first "delete" the XSRF-TOKEN-Cookie (Line 58) and directly after that they set a new one...

cookies csrf spring-framework

Want some cheap rep?

22 hours left

Get to it

4:36 PM

You answered better than me just before me, so you got my +1.

I still left my answer because it goes into the history of the bug, but you can include it in yours if you wish and I'll delete my answer.

4:58 PM

@A.Hersean I'll give you the bounty tomorrow since awarding it myself would feel like a dick move

Keep it, I do not need it.

Arf, yeah, you can't cancel a bounty, I forgot.

I answered because I needed a break in my work...

4 hours later…

9:19 PM

hm nvm.

About that question, despite you looking a certain comment, which I believe was a bit weak, we can open an issue in spring security pushing them to provide a better answer.

« first day (3639 days earlier) ← previous day next day → last day (1231 days later) »

Transcript for

Dec '202

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile