The DMZ

nobody

00:46

@MechMK1 Wouldn't you ideally want to use cards that have some sort of challenge-response mechanism so that cards couldn't be cloned at all?

belkarx

02:10

Those could technically still be cloned, it would just require a bit more reversing/fuzzing/data collection. it also means you'd have to add a micro-processor (or realistically sensor circuit?) of some sort to the card, which is not desirable because complexity and cost

nobody

02:48

@belkarx if you make it into an HSM (sort of like a smartcard), then I guess it would be pretty difficult to clone. But of course, that's higher cost.

A. Hersean

09:22

This RFID attack only works against the most basic RFID identification tags. It's so well known it gave MIFARE its poor reputation. Newer (and a little more expensive) RFID authentication tags include asymmetric crypto that can't be replayed.

MechMK1

10:42

@nobody As A. Hersean said, better cards basically have a private key and a certificate, and the whole authentication is quite a lot more back and forth

The thing is cost. You likely want to buy them for all your employees, so you buy them in packs of 1000 or so. And from what I've seen, Mifare DESFire cards cost ~$1.50 per piece and a normal key fob costs ~$0.25

So the DESFire card costs 6x as much, plus the need for a HSM or similar

A lot of higherups look at it like "85% cheaper?! Let's go with that one"

A. Hersean

Sadly true

MechMK1

And then they rationalize it like "we're not a bank, we don't need top security" or "it's better than nothing" or "the building has its own security anyways"

Journeyman Geek

lol

Not just the card

the whole system

$workplace has a very old system, and not really enough cards to go around

A. Hersean

And then they get audited and we get paid twice: once to tell them they fucked up, and at least a second time to check their fix attempts.

2

Journeyman Geek

That kinda ends up in people following other people into lifts "normal" or even sabotaging specific doors for card free access :D

Another location gives you an access card with your pass per user coded to where you need to go

MechMK1

10:54

@JourneymanGeek That's very good. Train people that it's normal to let other's in.

@A.Hersean Even on the "fix", they'll cheap out, being like "Which component can we replace to make it work?"

A. Hersean

of course

MechMK1

And then they replace their shitty card reader with a slightly less shitty one, issue a handful of better access cards they received as "sample" to some people and say that's their "high security solution"

A. Hersean

At work we start working on healthcare (hospitals & similar) cybersec. That will be fun. Lots to be done.

Journeyman Geek

@MechMK1 As I once said

"There's many things here that annoy me, but If I started complaining about all of them I'd vomit blood"

MechMK1

:D

Journeyman Geek

10:57

@MechMK1 and swap out the dumb passes for access cards

Which immediately simplifies and improves access control

MechMK1

I once picked the door to our small office, which was still secured by keys

As I always say, "we may not be able to afford to go cheap here"

ThoriumBR

11:48

@MechMK1 this was a good video... when it loaded the first frame I thought "this looks like The Lockpicking Lawyer videos... and it was!

physical security is utterly overlooked

and even "secure access" are not that secure anyway. Watching the LPL videos I am convinced no lock is secure anyway.

here in my building someone opened the gate, stole a bike and never got caught. We have those RFID tags (an upgrade from 4 digit passwords we had before)... but I guess if someone put a strong magnet on the controller it would open

tenants will hold a meeting Saturday to discuss the situation, but I won't be around to attend

MechMK1

@ThoriumBR Actually, LPL once did a talk on security at a conference

ThoriumBR

I saw that too

MechMK1

Keynote - LockPickingLawyer

►

For everyone

"My favourite video is called "Getting into my wife's beaver". You should have a look."

His april fools videos are the best and I am so hyped for next week

ThoriumBR

I watched that one too! it's one I laughed so much at

one video of physical security I like is youtube.com/watch?v=rnmcRTnTNC8

MechMK1

12:03

DEFCON 15: No-Tech Hacking

►

This is mine

My funniest moment in this video was "Only at Defcon will people look at someone using TOR and say he's likely of medium computer literacy."

MechMK1

12:32

ＤＯＯＭＥＤ

►

belkarx

16:24

@MechMK1 What is "advanced" in that case? Tails+tor? Or is it just that using Tor in and of itself does not make you technologically competent (whereas it would seem impressive to laypeople)

I feel like tor is heavily overhyped as "dangerous". While there are some very illegal parts, most of it is drug selling and govt honeypots. And there are some more "normal" forums as well, it's not all 'dark web'

also as for physical pentesting talks, I quite enjoyed this one: youtube.com/watch?v=JsVtHqICeKE

nobody

@belkarx Uses lynx or elinks (or maybe even curl) and proxying through your own botnet ;)

belkarx

Lmao. botnet's probably less traceable sadly

MechMK1

17:47

@belkarx If you take the average computer user, someone using TOR is probably pretty high up on the literacy scale. The point is that among expertes, either here or attendants of DEFCON, we have a very skewed perception of what the "average" user is able to do.

ThoriumBR

18:07

@belkarx this one is really very good

Fire Quacker

I always assume that if I say, "Open a command prompt and type i p config dash all", people will open a command prompt and type ipconfig -all. I'm usually wrong, even with people that I have guided through this exact same command before.

nobody

18:23

@FireQuacker So you're telling me they don't get stuck at the "Open a command prompt" part?

Fire Quacker

18:53

@nobody Weirdly enough, that doesn't catch people nearly as often as the space between ipconfig and -all does

belkarx

20:44

I was helping a longtime WSL user (and programmer) execute a python script yesterday. I was wrong to expect they knew what an interpreter was, or how to specify flags (even just --help) to the python script. A lot of us are living in technology-competent bubbles (self-imposed?) so we forget that the average individual has no clue what they're doing.

ThoriumBR

21:28

2

MechMK1

@ThoriumBR Also, you can just paste the XKCD link as is

And you get title text as well like that

How could anyone consider themselves a well-rounded adult without a basic understanding of silicate geochemistry? Silicates are everywhere! It's hard to throw a rock without throwing one!

ThoriumBR

really? TIL!

MechMK1

:D

ThoriumBR

made my day

MechMK1

Glad I could help

(That actually made me smile a lot)

ThoriumBR

21:31

today was the day I wanted to have my phone recording a conversation

so you guys know I am a security conscious guy, and I had to access a gov account and it was locked. I had to go to a bank to restore the access and found out my email and my phone were changed.

so I asked the guys to change back, changed my password, and went home. I couldn't access the account from my phone at all, it just said "the amount of access attempts was exhausted for today, try tomorrow"

first thing I did in the morning was to try, and got the same message. So I got to the bank again.

and now, the recorder thing: the clerk said "Yes, there was an unauthorized access to your account, people changed your records here, they scheduled a withdraw, but don't managed to get anything because the scheduled day haven't arrived yet. so your account is secure"

how in brazen tropical hellish fires of the abyss someone accessed my account, changed my data and scheduled a withdraw and my account is safe?

I told her "well, I work in IT Security, and this statement does not make any sense"
she said "I know you are uncomfortable, but rest assured that you suffered no financial loss, your funds are safe..."

and I said "saying I am uncomfortable is a great understatement..."

one of the auditors of my team said that if I had recorded the conversation I would be eligible to be paid a restitution from the bank even if there were no financial loss...

MechMK1

oof

ThoriumBR

22:16

and the way to deny the attackers the access to my money was to open an account on that bank so the money will end up in my hands and not on the attacker's...

what do you guys think I will do the second the money lands on the account?

forest

@MechMK1 Tor, not TOR.

@belkarx Tor hidden services are not the entirety of the Tor network. I use Tor exclusively but I rarely go to onion sites.

ThoriumBR

22:36

I once used a Tor hidden service on my home PC so I could SSH-in from anywhere without NAT getting in the way

forest

Lol me too.

I have this deja vu that you mentioned that before and I replied the same way... hm...

But yeah, Tor is a great way to bust NAT while remaining anonymous. And now days you can also enable an "insecure mode" for the HS so it only creates one hop instead of three, which improves performance.

ThoriumBR

@forest I don't think this is true anymore

IIRC, there's no way to change the hops to 1...

forest

@ThoriumBR I'm fairly sure it is, since it's used by some large websites that have HSes.

@ThoriumBR It's only for the circuit built by a non-anonymous HS.

ThoriumBR

sure, on HS... I misread

for the clearnet you cannot change the hop count to 1

forest

Facebook has no reason to hide its location for example. Clients can also change their hop numbers, but only by editing the source code (or using a third-party client, I guess).

Right.

belkarx

23:14

@forest true, Tor is merely a protocol (and a great one at that). Are there any other interesting non-conventional ways you've used it besides punching through NAT?

forest

hmmm

I've used it to bypass firewall-based censorship, although I'm not sure that counts as "non-conventional" given that it's one of the stated purposes of Tor. It's just not one of the well-known purposes (outside of certain countries).

Oh, I supposed I've used for dynamic DNS.

belkarx

Could you elaborate on dynamic DNS?

forest

It's a way to dynamically update a DNS server when the host IP changes.

ThoriumBR

it's a DNS provider that allows you to run a client on your PC and it will change the domain pointing to you when your IP changes

forest

Dynamic DNS

Dynamic DNS (DDNS) is a method of automatically updating a name server in the Domain Name System (DNS), often in real time, with the active DDNS configuration of its configured hostnames, addresses or other information. The term is used to describe two different concepts. The first is "dynamic DNS updating" which refers to systems that are used to update traditional DNS records without manual editing. These mechanisms are explained in RFC 2136, and use the TSIG mechanism to provide security. The second kind of dynamic DNS permits lightweight and immediate updates often using an update client, which...

ThoriumBR

23:19

noip.net is one of those

dyndns.com another one

forest

DynDNS still exists?

ThoriumBR

yep

not free anymore, but exists. my ancient wifi router had an embedded client for them

a dlink dir-600

forest

Anyway, dynamic DNS is a solution to roaming or mobile servers, or any server which won't necessarily always keep the same IP. Tor gets around that by not requiring DNS in the first place. No matter what the server's IP changes to, the server's Tor client will ensure that attempts to connect to an HS it hosts will always reach it from anywhere within the Tor network.

belkarx

Yay p2p

forest

It's also a great way to get around needing an SSL certificate! As long as you typed the URL in correctly, you can be guaranteed that you will only be connected to the server which has the private key for that onion domain. Of course, you can use an SSL cert on top of it, which I suppose helps if you're using OV or EV.

belkarx

23:22

Aren't "roaming or mobile servers" most likely to be Tor hidden services? In what other scenarios would you have the IP changing often enough that dynamic DNS is desirable?

forest

@belkarx Anyone who's running a small server behind a router with a dynamic IP, which is most people.

belkarx

Ah I see

Does anyone here have a homelab btw

forest

Never heard of it. Searching now.

belkarx

r/homelab

forest

This thing? homelab.com

belkarx

23:24

personal NAS/networking/compute setup

forest

Oh. Yes. I have my own network and a small cluster of computers that I use for hash cracking and fuzzing, a switch to connect them together, a small management server, a DMZ...

belkarx

is your compute cluster GPU or CPU

forest

I have a small GPU cluster but it's pretty outdated right now. 90% of what I use is CPU.

Especially since I do more fuzzing than hash cracking, and GPUs aren't ideal for fuzzing (actually, they can't fuzz at all as far as I'm aware. Maybe do symbolic execution or fuzz very small individual functions or something...)

belkarx

I see

forest

I also have a thin client so I can be anywhere near my house and connect to my main system without having to lug a giant desktop around. :P

("Near my house" because my latency is too high to run anything but SSH remotely)

Random question: Does anyone here know much about GPS?

in The Hangar, yesterday, by forest

Do aviation-certified GPSes have any particular resistance to spoofing or jamming that typical consumer GPSes lack?

Trying to improve an old answer of mine:

12

A: Mitigate Time Spoofing Attack

There is no single way to mitigate time spoofing attacks. However, getting time information from several sources and ensuring none of the sources too strongly disagree with each other is a start. NTP The Network Time Protocol, with the common version 3 specified in RFC 1305, is the most widely us...

The thing is, I know very little about how GPS systems work or the security issues surrounding it.

In particular, the security issues surrounding using it to obtain the current time.

belkarx

23:39

I know a fair bit about radio but not about GPS in general, maybe check out this link? csr.utexas.edu/texas_pwv/midterm/gabor/gps.html

forest

I'll check it out. Is that up to date?

belkarx

No, and probably doesn't go into as much detail as necessary, but I believe the frequencies and design spec are still valid

forest

ah

belkarx

That was a great answer btw, fascinating read

forest

It's more the modern implementation of GPS that I'm curious about, since I'm aware that there are many ways to heuristically detect GPS spoofing, but information on that seems very limited. It seems like information on spoofing which influences the time the receiver believes it is is even less common.

forest

23:57

Then again, I don't even know how a modern GPS receiver calculates time from the signals it receives...

So I probably do just need to read up on the basics a bit more before trying to understand how a modern receiver does it.

Transcript for