The DMZ

forest

00:15

@JohnZhau Depends on what you mean by "weak".

But weak algos in TLS (such as RC4) can be practically exploited to reveal e.g. secret headers.

forest

01:35

9

Q: Area 51 uses insecure avatar generation

Area 51 uses a different system for avatars than the rest of the network. While on every other site Gravatar URIs are salted, on Area 51 they aren't because it hasn't been updated (Area 51 uses a really old fork of the SE engine). This could allows determining the email address associated with an...

haha

forest

07:13

@A.Hersean There's a saying: "Attacks only get better. They never get worse."

Which only applies to cryptography, of course. When it comes to security against binary exploitation, attacks that were once cutting edge are now only possible in extremely contrived scenarios or numerous security features disabled (e.g. classic linear buffer overflows which were once quite powerful, but have now been defeated by NX, ASLR, guard pages, etc. mandating the use of ROP instead... and even ROP may one day be defeated if we manage to get fine-grained CFI to be ubiquitous).

nobody

08:06

Is this true?

> for example, most distros configure their kernels such that if Secure Boot is used, the kernel is locked down and root cannot read or write arbitrary kernel memory or load untrusted modules.

forest

Yeah, but it's not very good protection.

I believe they call it lockdown mode. In theory it works, but there are often ways around it.

However, you can configure a Linux system so that root is not sufficient to gain access to kernel mode, but lockdown mode is not always sufficient.

@nobody See man7.org/linux/man-pages/man7/kernel_lockdown.7.html

> On an EFI-enabled x86 or arm64 machine, lockdown will be
automatically enabled if the system boots in EFI Secure Boot
mode.

nobody

So like lockdown mode prevents you from installing kernel mode drivers and stuff that can access all memory?

forest

Correct. It does a bit more than that (the manpage gives the list).

nobody

And how do you bypass that protection?

forest

Exploits, mostly. The problem is that unhardened Linux is not very well-protected from a root-capable adversary as kernel code that was traditionally thought to be unnecessary to secure is now exposed to a user which may be untrusted. It's for the same reason that unprivileged user namespaces are so insecure.

nobody

08:16

@forest So there are publicly known unpatched exploits for this?

forest

There usually are, at any given time, for the kernel config for things like Debian.

But it's not like they have a CVE. Linux is notorious for not labeling security bugs as security bugs.

So you often have git commits with some mundane "fixed unintended yada yada" which should have been called "fixed local privilege escalation bug". Linus and gkh are against marking security-related commits as security related, which repeatedly backfires and prevents distros from performing security backports efficiently. Gkh just says to always use the latest official kernel and not a distro kernel, which is of course a non-starter for the majority of people (+sometimes provides worse security).

nobody

So the linux team doesn't even inform the distros which bugs are security critical?

forest

Correct, unless it's really bad (by their standards) or someone gets a CVE assigned.

I mean, it's not the end of the world. Trivial privesc bugs that work on stock distro kernels (think: DirtyCOW) are fairly rare and usually widely-reported, but it's not the pinnacle of security design. You can significantly limit the issues by configuring your own kernel and disabling stupid configs, tweaking sysctls for better security (panic on oops and warn, for example), and disabling module autoloading.

nobody

That's stupid anyways. It just means people with inside knowledge can continue to exploit the bugs (and I imagine that includes atleast some state-sponsored attackers)

@forest You can't, if you don't even understand what half of those things mean :)

forest

@nobody Not just inside knowledge. Anyone with a basic understanding of kernel exploitation can read the commits and think to themselves "this is a fix for an exploitable bug, but no one is backporting it!". One technique is to look at all the commits for certain contributors who introduce certain types of bugs at a higher frequency than others ("Mr Foo seems to have a hard time writing integer overflow-free code... I'll look at all his commits to common drivers/APIs to find juicy bugs"!)

nobody

08:26

Well that's slightly better. I'm of the opinion that if a bug is out there, it should be made exploitable by everybody, not just an elite few.

forest

Yep. The problem is that they don't label it as a security bug so it's exploitable in kernels in use in the real world by many people. It's so much better than if the development was done behind doors, but it's not as good as if it was security-focused. Remember when Linus called security people "masturbating monkeys"?

nobody

No :D. But that's a view a lot of people hold.

forest

yeah lol

nobody

Until they get hacked themselves, that is.

forest

Nah then they blame it on the hacker, not the insecure code.

nobody

08:30

Well they do, but atleast some of them start taking security more seriously

forest

I have a much more pessimistic view of security than you.

All I see are people falling into the trap of cargo cult security.

"Doing something is better than doing nothing, so let's put out this half-assed mitigation!"

Like OpenBSD's stupid NOPGuard shit.

Or Linux's KASLR.

nobody

I guess your view must be more realistic, since you're more experienced

So hopefully, in a few years, I'll be as pessimistic as you ;)

forest

It might be. On the other hand, there is a slow trend towards improving security in general, especially when it comes to hardware security (which is still in its infancy). But it'll take time...

@nobody It always starts with a feeling that everything is fucked. Then you start learning and begin to feel like you're getting a grasp of it. Finally you know enough to know how little you (and others!) know, and you begin having the feeling that everything is fucked, again.

2

nobody

I already know how little I know (basically nothing)

forest

It'll take time, but the amount of information out there is finite.

nobody

08:36

And the capacity of my mind is finite too, albeit with a much smaller limit

forest

If you really want to learn, jump in to the deep end. Install Gentoo or something.

Learn how to configure a kernel and how a system really works.

nobody

I'm always confused about where and how I should start learning

forest

Well, what is it you want to learn about?

nobody

Just too many things

forest

*nix system security?

nobody

08:38

Yeah that first

And crypto

forest

I learned most of my crypto at Crypto.SE and reading various papers and resources that people referenced there. As for *nix system stuff, I started by installing Gentoo myself, and that was the start of that rabbit hole. I highly recommend it. Wonderful documentation.

nobody

Documentation and papers confuse the hell out of me

forest

How much *nix do you know currently?

nobody

@forest Nothing, just command line basics

forest

(Reading docs is something you'll need to get the hang of. Papers can come later, since they're often targeted for more advanced audiences and contain a ton of jargon)

@nobody Well, make Linux your daily driver. Use it for everything.

And try to maximize your use of command line in lieu of graphical tools.

It's like going to another country to learn a language. If you immerse yourself, you'll learn quickly.

nobody

08:42

I have this problem where I'm too afraid to immerse myself. But I'll try doing this as soon as I find time

forest

Do you currently use Windows for daily computer use?

nobody

Yep, cuz I'm more familiar with it

forest

Well fire up an Ubuntu DVD. :D

It's quite easy to get started.

All the basics for computer use are already there (browser, text editor, video player, etc)

nobody

I have it installed, just rarely use it

What's the difference between something like ubuntu and gentoo?

forest

Ubuntu is much easier to use. Gentoo is more useful if you already have good Linux experience, as it is very "raw". In fact, it has no installer per se. The installer is a very basic boot CD that gives you a simple command shell, and a whole lot of documentation. But that also means it's extremely customizable. You get to choose everything from your kernel version and configs to the cron and system logger you use. And it's source-based installation involves compiling the software.

The package manager Portage handles that, but lets you choose individual compile flags (via what they call "USE flags") for even greater customization, so you can even decide what builtins bash gets, or what video formats mpv will be able to play.

So if Ubuntu is a Toyota, Gentoo is a hunk of metal, a CNC machine, and a book on car manufacturing.

nobody

08:49

looks interesting and fun!

forest

It's very fun! The documentation is extensive. If you're rather new to Linux, even getting it up and running can be an accomplishment, but certainly not an insurmountable task.

nobody

Is it possible to install it in a vm?

forest

Yup.

Or dual boot on real hardware. Both work fine.

nobody

Good, because otherwise you'ld need two computers, one to look up the docs on and one to install it on :)

forest

Well, you could print just enough docs to configure networking on the install CD, then run elinks and access the rest of the docs that way. :p

But yes, you generally do either need a VM or two computers.

John Zhau

14:26

How often do you even reverse engineer binaries on pentests?

ThoriumBR

16:10

@nobody use Linux as a daily driver for a month, write a contract with yourself to burn $100 if you relapse into windows, and after a month you get back to windows and say: "how on Earth I was able to use this for so long?"

the first week will be rough, your memory muscle will make you stumble on everything

second week your brain will acknowledge you are on new territory

third week your muscle memory changed to Linux, and you are more familiar with it

fourth week you will be using it without thinking much, and after you move back to windows to compare, you will see how linux don't get in your way as much as windows does

nobody

17:06

@ThoriumBR Man, how I wish I had enough $100s lying around to burn.

ThoriumBR

17:35

So burn anything you have...

forest

22:31

@JohnZhau Depends entirely on the pentest. Generally not very often since companies don't want to pay you extra for all the time you'd need to reverse engineer something when they could just give you the source code and cover it in the NDA.

Anonymous

22:57

@JohnZhau Very, very rarely would anyone be willing to pay for this. I don't do external pen-tests but I know plenty of people who do, who have the skill set to do that and like Forest says, they more often than not (if they require that kinda' thing) would rather just give you the source code.

Anonymous

If you're wanting to do that kinda' thing commercially your best chance is A. research focused team in some company. B. independent research for bounties, D. contracting. A is the most stable without a doubt, but could take a while to find such a position because it is super competitive from what I've seen. Whereas with bounties you can just go wild.

forest

@J-- I thought you might find this amusing: Procedural worlds, statistical analysis, image processing and PRNG exploitation for the lulz by Sam Hocevar.

Anonymous

@forest Will read in a few minutes.

Anonymous

Also, hey!

Anonymous

How are you doing?

Anonymous

23:02

"Male individuals from Niger were made to appear artificially more frequently" hahahahahhaha.

forest

> The most probable dictionary sizes were between 170 and 190. As expected, that was small and allowed for a CAPTCHA breaking attack that did not involve OCR: given the size of the corpus, they only had to count characters instead of decoding them.

I find that so clever.

Anonymous

@forest Where did you even find this page? There is a strange assortment of things on here :D

forest

@J-- Was looking at sam's blog since he's one of those "troll in plain sight" folks. He worked on projects which I would get permabanned for even mentioning the name of here, and yet he's well known and respected as the author of WTFPL and a Debian maintainer (also the author of DeCSS).

Anonymous

@forest Hah, I just got to this part. That is super cool.

Anonymous

@forest Oh, I see.

Anonymous

23:08

No, no idea what those are :D

forest

:p

Anonymous

Oh, I just Googled it.

Anonymous

Right, I get it now. He seems like a rather eccentric individual.

forest

Yeah the first on eis pretty obvious.

Anonymous

I never really understood art.

Anonymous

23:09

I just went to the home page and he has this "one drawing a week series". I just don't get it.

Anonymous

My brain cannot understand why it is interesting or why anyone would be interested in it.

forest

I find it interesting.

Anonymous

I wish I did.

Anonymous

It would make me more cultured, for sure.

Anonymous

Speaking of cultured, time to load up on Modafinil for the night.

Anonymous

23:11

Big study session required. I say study, I gotta' do a lot of writeups for these challenges so it is really boring, actually.

Anonymous

I am 50% through this course in 2 weeks, I am feeling super happy about that.

Anonymous

But I think the next sections will be A LOT more work. Format strings, DEP bypass, ASLR bypass, ROP gadgets.

Anonymous

@forest Hahahahahahhaha. The second one :D

forest

yup

Anonymous

THAT is funny.

Anonymous

23:15

That blog post was cool, thanks for sharing :)

Anonymous

I swear Modafinil is starting to help less and less.

Anonymous

I don't use it THAT much, so I don't see why it would be less effective.

Anonymous

I am not even sure it works like that.

forest

Lots of stimulants wear off over time.

Not only stimulants. Ambien too.

Anonymous

Yeah, true but it is meant for people with ADHD.

Anonymous

23:17

I didn't think it would become so ineffective.

Anonymous

But I often don't see any benefits from it anymore.

Anonymous

Unless I take 400mg at once, but you're meant to wait 12 hours for every 200mg so I don't like doing that, really.

Anonymous

Oh well, I guess. I don't find it that hard to focus but it does help, well, it did. Not so much these days.

forest

You might find that it's only useful for short bouts of ADHD.

Anonymous

You say that but, for a good few months it was working really well. I was using it like twice a week only with 3 days in between, 200-400mg on those days.

Anonymous

23:20

But then I stopped using it for a while and now it just feels super ineffective, I don't know why. Maybe I just don't notice the difference much anymore.

Anonymous

It could be the case of I look like a fucking crackhead to everyone else except myself since I am used to it.

Anonymous

Like you know, when you do coke you talk really fast but you don't notice. That kinda' thing.

forest

heh

Anonymous

I mean, what?

Anonymous

:upside_down:

forest

23:25

Ugh, more attacks against Sci-Hub by a notoriously anti-Sci-Hub user from Academia.SE

22

Q: Does Sci-Hub use malware and phishing to obtain researchers' credentials?

There is a new BBC article, Police warn students to avoid science website about Sci-Hub, a pirate site to circumvent paywalls on science journals. But Max Bruce, the City of London police's cyber protection officer, has urged universities to block the website on their networks because of the "th...

security internet scientific-papers

tl;dr answer cites misleading and biased BBC article to further a stupid rumor

"zomg if you go to sci-hub u'll get haxx0red!!11one they steal teh accounts!"

WAIT

Nevermind I take that "notoriously anti-Sci-Hub user" thing back.

He just had a similar name to the guy I'm thinking of.

But it's still furthering that stupid myth.

8

Q: /dev/random EXTREMELY slow in Ubuntu for Windows 10 (WSL)

I am using Ubuntu 20.04 for Windows 10 (WSL2) on a Haswell laptop and I am getting about 0.6 bytes per second. As in 6 bytes total after 10 seconds of waiting. This is unacceptable. What is the problem? EDIT: This only appears to be an issue when operating in WSL2 mode. WSL1 = 40MiB/s WSL2 = 0.6 ...

windows-subsystem-for-linux random

Haha @J-- I can't imagine that hit HNQ.

Anonymous

@forest Hahahahaha, what the actual fuck.

forest

Yeah, BBC keeps looking less and less reputable.

Anonymous

@forest "This is unacceptable. What is the problem?"

Anonymous

I am struggling to understand this post.

Anonymous

Why is he so mad he had to wait 10 seconds?

forest

23:33

The problem is lrn2lunix :D

Anonymous

@forest Oh, they absolutely are not reputable at all.

Anonymous

They're publicly funded but constantly beg for money, get extra grants from the government.

forest

@J-- He thinks /dev/random should be as fast as /dev/urandom.

Anonymous

And have that stupid fucking TV license thing. Which they also profit from.

forest

They used to be great.

Anonymous

23:34

Not to mention they're totally bias and in the pocket of the UK government.

Anonymous

@forest lol.

Anonymous

I am reading some of his comments.

Anonymous

He seems like an angry guy.

Anonymous

I now understand why he is mad at waiting 10 seconds.

forest

A very confused guy.

Anonymous

23:36

He seems like a guy that if you asked him for the time he'd tell you to go buy a fucking watch.

Anonymous

Or something along those lines.

Anonymous

^ someone said that to me once, hence i draw down the parallel

Anonymous

Found this cool post thanks to that HNQ though

Anonymous

2uo.de/myths-about-urandom

Anonymous

Oh by the way, this will make you laugh

Anonymous

23:40

cityoflondon.police.uk/news/city-of-london/news/2021/march/…

Anonymous

^ in regards to scihub

Anonymous

"A spokesperson of the City of London Police’s Police Intellectual Property Crime Unit, said:

“Students should be aware that accessing such websites is illegal, as it hosts stolen intellectual property. "

Anonymous

lul

Anonymous

That whole page on the police website is FILLED with fear mongering.

Anonymous

Even more than the BBC article.

forest

23:41

>accessing such websites is illegal

Which is simply untrue. Even accessing The Pirate Bay is legal.

Anonymous

Yup.

forest

It's like that one idiot on CNN who said "reading Wikileaks is illegal, only the press can read it"

Anonymous

HAHAHHAHAHAHAHAH

Anonymous

No way.

Anonymous

Do you have a link?

forest

23:42

Lemme try to find it.

Anonymous

Thank you.

forest

techdirt.com/articles/20161019/07004935835/…

Anonymous

Hahaha, Jesus.

Anonymous

Seems like they removed the link from YT?

Anonymous

Probably used a false copyright strike to get it removed.

forest

23:44

No idea. I just did a quick web search of "cnn wikileaks illegal".

Anonymous

Wait, what the fuck, he added this as well: "So everything you learn about this, you’re learning from us.""

Anonymous

HAHAHAHAHHAHAHA

Anonymous

This guys unhinged.

forest

From CNN:

> “Also interesting is, remember, it’s illegal to possess these stolen documents. It’s different for the media. So everything you learn about this, you’re learning from us.”

Anonymous

How dumb..

Anonymous

23:45

Yeah, I see that.

Anonymous

What a cretin.

Anonymous

You know the scary thing? I bet over 30% of the viewers believed them, hell, even more.

Anonymous

They would in this country too, fucking morons everywhere.

forest

Oh, way more. Way way more.

It's funny how the left used to love Wikileaks because they leaked all those Afghan war files, but now that they leak something that makes the left look bad, the left hates them.

Anonymous

Yeah, much like with anything, I guess.

forest

23:46

And the right used to hate Wikileaks because they "violate national security", but now they treat them as their savior for pointing out that liberals are also corrupt.

Anonymous

People only like facts when they help them.

forest

Yup.

Anonymous

I have lost all faith in people, politics, everything.

Anonymous

People are seemingly more unintelligent than ever.

forest

mhm

Anonymous

23:47

Greed is rising. Corruption is rising. Hypocrisy is soaring.

Anonymous

What's the fucking point?

forest

It's all just temptation for us to join the dark side.

Fall into temptation. Join the dark side. We have cookies.

Anonymous

Yeah, agreed. The thing is, it still makes me so fucking mad.

Anonymous

I WANT to not care but I can't. It is really quite sad.

Anonymous

As I was saying to Mech a few days ago, my girlfriend started turning off the news any time I had it on. As she knows it makes me mad so she quite frequently suggests to stop looking at it.

forest

23:49

As the world gets more and more polarized, more and more people will have the choice to take the red pill or the blue pill (god I feel dirty saying that, ever since the alt-right hijacked those terms).

Anonymous

But I can't. It's like... Bad story porn.

forest

hahaha

Anonymous

You don't wanna watch because the story is bad but you also want to watch BECAUSE the story is bad.

forest

Is that why you like Big Bang Theory? :P

Anonymous

But yeah, despite the use of red or blue pill, you're not wrong. That is exactly what will happen.

Anonymous

23:50

Yeah, pretty much :D

Anonymous

Although, I do actually find that quite funny but I don't really know why. Probably because of how far exaggerated the characters are, who knows.

Anonymous

Also, Penny is hot.

forest

Have you ever seen IT Crowd?

Anonymous

Yes, of course!

forest

It's like Big Bang Theory done right.

Anonymous

23:52

I LOVE that show.

forest

It's actually funny, unlike that Sheldon shit.

Anonymous

I like it way more. It is also British.

Anonymous

It is easily one of my favourite shows.

forest

"I use Ubaaahntu"
[laughtrack]
"It's my favorite LINUX-based operating system"
[uproarious laughtrack]

Anonymous

I think Black Adder comes first then probably IT Crowd.

Anonymous

23:53

@forest :D

Anonymous

I have seen every episode of IT Crowd so much but I should watch it again some time.

forest

Compare that with IT Crowd where in the very first episode, they casually mention syscall hooking.

I doubt Big Bang Theory even used the term "syscall" once. Probably not even said "API".

Anonymous

Yeah, BBT is way more suited towards a casual audience.

Anonymous

As you said before, it is just mocking "nerd" culture in general.

forest

It's not mocking because it doesn't even try to understand nerd culture.

Anonymous

23:55

It isn't really a show for "nerds." Whereas IT Crowd mostly is.

forest

It's for people who want desperately to feel that they're geeks when they're really uneducated sheep. They hear the laugh track telling them when it's OK to laugh at something they don't understand and think to themselves "haha I'm such a nerd for laughing at this".

Anonymous

See, I really like the show and find it very funny but I don't at all disagree with you.

forest

But do you like it in the way you like IT Crowd, or in the way you like Manos: Hands of Fate?

Anonymous

Oh for sure in the way I like the IT Crowd.

forest

You need to get your brain checked lol

Anonymous

23:58

But then again, I don't think it is a great show. I just find it funny. For whatever reason.

Anonymous

I think any show which plays on stereotypes is something I'll likely find funny. BBT does that a lot.

Anonymous

The whole show is that, really.

forest

But it doesn't even get the stereotypes right.

Anonymous

No, that is true.

Anonymous

There are a lot of wild inaccuracies but I guess my brain ignores them when I am in the mood to just laugh.

Transcript for