The DMZ - 2012-10-06

« first day (660 days earlier) ← previous day next day → last day (4212 days later) »

4:53 AM

1

Q: Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. I can't understand why fundamentally disposable mass market consumer devices need a working tes...

mobile hardware android risk debugging

Is it just me, or is there no real question in there?

3 hours later…

7:55 AM

@Polynomial lol . I'm guessing it's "Pre-Employment Screening" a term used by a large UK financial Co. One of the one's who's hiring checks are quite a bit more onerous than SC...

8:16 AM

@Polynomial it's incredibly irritating to get it, you need a gazillion number of documents

2 hours later…

9:58 AM

@ThomasPornin the UK's one weakness is that they do tell the US sometimes

and then the US might leak

@Gilles That statement was in relation to information gained during DV clearance checks.

and, from what I understand, the government actually signs an NDA stating that they can't release your information.

there's an exception clause, of course, where they dig up the fact that you've actually secretly been involved in 9/11 or something

in which case they're allowed to share with GCHQ, MI5, etc. but not foreign bodies

though those bodies might share it anyway lol

@Polynomial in theory, in most democracies, what you tell to one government department doesn't go outside that department

which is good for privacy, but annoying when you've moved and there's always one who loses your change of address form

@Gilles Indeed. As I said, there's an NDA, and some sort of exception rule for circumstances where they discover a serious crime.

@Polynomial I'm surprised that they even feel the need for an NDA

but in general they don't give a shit about stuff like nicking a car when you were 14 or 15.

@Gilles The NDA is part of the authorisation process at the start, where the person about to go through DV says "yes you can do this".

10:05 AM

also when there's a leak, it's from the less privileged to the less privileged

e.g. MI5 isn't going to tell the local cops anything

DV is ridiculously exhaustive and invasive, so they have to get the go-ahead from you

there's a reason it takes a year.

guardian.co.uk/technology/2012/oct/05/…

TLDR for most readers I expect

they do cite xkcd, and they conclude that you should use lastpass

passwords have become "a pain in the ass! Who can keep track of all these things?" It's a subject on which Cheswick, a volubly enthusiastic man at most times anyway, grows so animated that people at other tables start to look up from their laptops. "And all these rules! You have to mix symbols, cases, numbers…"

Cheswick calls these "eye-of-newt" rules because they resemble recipes for magical potions, although sometimes, when getting carried away giving speeches, he has been known to call them "password fascism", too. "I have 25 different accounts, so now I have to remember 25 different ey…

> It gets worse: because passwords are too hard to remember, we've added account recovery processes involving security questions that are far too easy for the hackers to answer. That's how Sarah Palin's personal email was hacked in 2008: the intruder correctly guessed information about her postal code and high school. A related weakness in account recovery was also to blame for a vicious hacking assault on the Wired magazine writer Mat Honan in August.

pretty good article

see, what I think we need is a standardised hardware token system that works with all browsers and OSes, which integrates with the current HTTPS (SSL) infrastructure that we have right now.

something that does strong CHAP and acts as an identity provider

with hardware keys that can be locked down, but re-used (flashed) if a particular implementation if found to be flawed

or just make them cheap enough to be replaced if they're later broken

something that's USB, so anyone can use it

so passwords would remain a vital part of access, but we'd have ubiquitous 3-factor auth potential.

even something simple like <input name="hardwaretoken" type="token" provider="pkcs11" demand="identity" /> in a webform.

10:27 AM

@Polynomial but that is never gonna happen.

@TerryChia Why? We have web standards, hardware standards, and security standards. Some of those have been joined together before, with great success.

the framework is already there, albeit with smart cards in dumb form factors

the three major OSes already come with PKCS11 smartcard drivers.

all someone needs to do is come up with a way of integrating that identity provider into PKI (which is already partially done via client certs) and publish a new HTTP extension in an RFC

once the RFC is accepted, the browser devs will do the implementation work

once that's done, manufacturers will get behind it because being the first to provide a zero-config USB smartcard on the market will be a ridiculous profit-maker

you will still need to get the web devs to implement that function into their applications.

which is a major obstacle imo

assurity.sg/ok_naf.html

This is a project by the Singapore government to implement 2FA on a national scale. pretty interesting imo, but getting user support is troublesome.

most users just don't care about security.

@Polynomial and then you lose your hardware token, and you're screwed

either you don't have a backup and you can no longer authenticate anywhere

@Gilles Same process as forgetting your password.

or there is a backup infrastructure, in which case it's too easy to lose a token or obtain someone else's backup

10:36 AM

@TerryChia Hell no. Banks?

@Gilles "I lost my hardware token." -> phone up and reset using account information (previous transactions, etc.)

look, I'm just saying that it'd actually be a lot less work than most people would make out

@Polynomial tell that to Matt Honan

@Gilles Erm... what the hell has some dude getting his iPad wiped got to do with it?

he had his password nicked

and they wiped his iPad

@Polynomial no, he didn't

hell, if he'd have required a hardware token to have it wiped remotely then he'd be much safer

the attacker exploited the awful account reset procedures

10:38 AM

@Polynomial the hackers reset his account by social engineering on amazon support

fair enough

and apple support

didn't know that bit

and even then they wouldn't get in, though

they'd get to reset his hardware key

but they'd still need his password

the attitude of "It'd never happen, people are lazy" is completely counter-productive.

@TerryChia not even much social engineering really

I bet a lot of people said that about computers being ubiquitous, or the internet catching on

10:39 AM

the Apple and Amazon employees did not deviate significantly from their company's official procedure

or people having internet-connected phones

@Polynomial it is technically feasible for sure, but i won't like the job of explaining to the average person why they need to carry around that damn token to login to a website.

@TerryChia I'm not talking about every-day websites. Banks are the primary target market.

@TerryChia if that happens, that token would be in a mobile phone

@Gilles Oh no no no no no.

DO NOT DO THAT.

10:41 AM

@Polynomial see: assurity.sg/ok_naf.html

either a physical token with the phone as a UI, or on the phone itself

Don't even get me started on rsa-key-as-an-app bullshit.

a hardware token's security comes from the fact that is an immutable brick.

it is a government effort to get banks to implement a common 2fa token.

@Polynomial it's tomorrow's bullshit

a phone is a computer. you're saying "here, let's secure this computer with another computer"

10:41 AM

its on a national scale though, not nearly what you envision.

it's BROKEN.

anyway, back to the real discussion

@Polynomial crazy, isn't it? It's almost as if the people who made the decisions were the people who didn't understand them

@Polynomial yes, but it's happening. Digging your head in the sand won't change it

@Gilles I ripped the shit out of a guy giving a talk at InfoSec London who was pushing a product like that.

@Gilles Yes, it will. I will not be party to their stupidity.

in fact, I'm not gonna stick my head in the sand, I'm just gonna constantly make sure that everyone knows it's broken and stupid.

anyway, give zero-config USB identity providers to users for access to their online banking and PayPal and such, and make them optional for stuff like Dropbox.

the more people that say "hey, you can use one of these on my site!", the more ubiquitous they become

@Polynomial USB? what for?

and for the layman, having it available for their online banking is hardly a hassle - just plug the damn thing into your machine and be done with it

10:44 AM

if you need an insecure computer to access the token, you have a problem

@Gilles identity provider device.

@Polynomial how does it help if you can't access it securely?

you can do CHAP quite easily over USB

so you can access it securely.

@Polynomial most phones don't have USB host connectors

@Polynomial oh, you mean the computer is only relaying? ok

indeed.

10:46 AM

@Polynomial but that means no physical presence detection on the token

@Gilles hmm?

and no connection between what the token authenticates and what the user thinks he's authenticating

you can talk to me without tagging me in every post btw :P

the first one has you attacked by Ross Anderson

the second one has you attacked by the bad guys as well

You'd have some sort of popup, saying "Do you want to authenticate to https://bank.example.com using your hardware token?"

10:47 AM

The problem is: my token is authenticating giving $10000 to Eve. My browser is saying I'm giving $10 to Amazon.

no no no

the token is for providing identity.

nothing more.

@Polynomial but what shows the popup? Your browser, which is running 10 kinds of malware?

@Gilles And that concern isn't current?

I'm not talking about replacing passwords.

@Polynomial yes, it is. But your solution isn't better

you use passwords and a hardware token.

@Gilles sure it is. keylogger can't nick the token.

10:49 AM

@Polynomial then the concern is the relaying attacks

a box with malware on it is beyond securing.

you plug in your token, and the attacker (the guy who controls the malware on your computer) identifies as you

And still needs the password.

so he's back to square 1

@Polynomial then what's the benefit of the hardware token?

you're tackling this from the wrong perspective. a box with malware on it is NEVER safe, regardless of what authentication you use.

you CANNOT dismiss a protocol or design just because the user might have malware.

10:52 AM

@Polynomial if you assume that no box has malware, you don't need all that rigmarole

sure you do - people use crappy passwords

and re-use them

the problem is, for most boxes out there, you can't know for sure that they don't have malware

site-A gets hacked, stores passwords in plaintext or unsalted hashes

attacker uses email credential and password to get onto their banking

the benefit of the hardware token is to provide resistance to cases like that

and most existing malware, too

you could also go for the isolated desktop route, within the OS, like UAC does.

where an authentication request to a site requires you to accept it, and it tells you how many times you've authenticated to that site before, and when you last authenticated to it.

so malware wouldn't be able to authenticate without user interaction

@Polynomial did I access it yesterday? Did I access it 23 or 24 times this month? I don't remember

@Polynomial what interaction could the malware not fake?

@Gilles the important point is "have I ever authenticated to it before?"

@Gilles have you not seen the UAC prompt?

10:56 AM

@Polynomial UAC?

User Account Control, it's a Windows thing

@Polynomial is that Windows's equivalent of the sudo prompt?

kinda

dims your screen and asks whether you want to perform something as admin?

basically it moves you to a secure desktop, where no window handles can be created after the first one is, and that desktop can only be created by a privileged session manager process (of which there can only be one on the system)

pretty much, except it moves you to an entirely separate desktop

10:57 AM

annoys me every time I get it because it doesn't tell me what is going to be done

so malware can't even talk to it - it's on a different session and it's locked down quite well

@Polynomial that's not my experience on Windows 7

so I guess I haven't seen a UAC prompt then

it does show the older windows dimmed, actually, since Win7.

I forgot it does that.

I think it just drops a blurred image of them on the secure desktop's background

@Polynomial I've never noticed any dimmed windows (except while the yes/no dialog box is active)

that's what I'm talking about - the UAC prompt

11:00 AM

I've only ever used Windows 7, not Vista, and that's on a corporate PC, I have no idea how it was configured

either way, you're no longer interacting with your normal desktop. malware has no access to it - even most keyloggers can't get at it, because they rely on window message hooks or GetAsyncKeyState, which all deal with the current user session (which the privileged desktop doesn't run in)

@Polynomial ok, so that's a secure UI

you want a prompt of that kind for every authentication to a web app?

yep

sure. why not? you type your password in to each of them.

@Polynomial I almost never type my password to a web app

You use "remember me"?

11:02 AM

@Polynomial of course

see - that's fine.

you wouldn't need that, then

I'm not going to memorize hundreds of passwords

@Polynomial you do realize that most people just turn off the UAC in windows because it was too much of a hassle?

your initial session creation is what provides the token authentication

the "remember me" cookie is your login token after that

requiring that every time you authenticate into a website is just gonna annoy people. and they WILL take drastic steps to fix that annoyance.

11:04 AM

@TerryChia Don't let them - make it mandatory. Also, if it's only for creation of the initial login, excluding "remember me" logins, they won't care.

so for your bank, that's every login, because they don't provide "remember me"... I hope!

@TerryChia yup. Only my bank and my local computer get to authenticate me every time. Other remote apps get a stored password.

and my local computer only gets to authenticate me if there's no physical security around it

you break into my home while I'm away, you can access my session

I lock my work computer because it's accessible by others

I have a TC password on boot, plus fingerprint on login.

so even if someone broke in, they're not getting anything

at worst they can steal my TV/movies drive, which is unencrypted for performance reasons

for someone who works in security, I'm rather on the minimalist side when it comes to confidentiality in my private use of computers

I'm paranoid.

I take off my shoes and my paranoia at the door when I get home

3

11:09 AM

I do have a Windows password on my laptop, but I don't know it.

it's generated with Keepass, and I only use it for RDP.

I do the opposite - I work as a dev, so my paranoia has to stay at home.

anyway desktop computers aren't the problem here, the problem is mobile phones

which people want to use to connect to everything

and they don't want to wast time and effort with complex authentication procedures

at some point you need to say to users "no you cannot use your phone for online banking"

it's not a trusted device.

either that, or hard-wire the authentication token into all phones

@Polynomial "screw you, I'm moving to a different bank"

@Polynomial see - that won't work. users only care about convenience.

I'm aware.

11:11 AM

@Polynomial that is something banks are looking at

but at some point all banks need to stand up and say "yeah, no. this is dumb."

in fact, an auth token inside all phones would be very useful.

not just for banking, but for app purchases and all sorts

@Polynomial banks don't work like that

Banks calculate what makes them the most money, and they're very good at it

I didn't say they did work like that.

But at some point they need to do the risk assessment.

You seem to be thinking that banks are trying to achieve zero fraud. They aren't

the result will be "yeah, this is a dumb risk, go make it work"

11:14 AM

Banks calculate how much they lose to a certain kind of fraud, and how much it would cost to fight that fraud

@Polynomial it won't happen unless there is some regulatory requirement.

indeed.

from what I've heard, the fraud from online access costs a lot less than it would take to arrange for everyone to have a secure phone

can people stop beeping me please, my desktop's speakers are on quite loud and I cba to go switch them off.

so I keep getting that "DONK" noise

so the banks are not interested in paying for more secure phones

11:16 AM

anyway, I need to go get a shower

and some foods

laters .o/~

(they'd surely be happy if someone else paid for it)

i bet @Iszi is gonna complain about the chatter again later. :P

2 hours later…

1:00 PM

@Polynomial usmartcards.com/card-readers-accessories/…

Device is ready and the protocol is already there; it is HTTPS with client-side certificate.

What you are calling for is basically a worldwide PKI.

The problem is on the side of issuers: managing millions of identities is not easy.

I should know, I am doing it all day long.

The client side hardware, the device drivers, the protocols, the browser integration... are the easy parts and are mostly solved.

And already deployed.

1:23 PM

God.. printer driver installation is driving me nuts.

2 hours later…

3:08 PM

@TerryChia No, that's usually @AviD's job.

3:48 PM

@Polynomial

@ScottPack What?

@Polynomial Oh

@Polynomial Not

@Polynomial A

@Polynomial Whole

@Polynomial Lot

...

I don't get it.

@Polynomial Donk

Oh. Yeah, I turned that off about 4 hours ago.

3:50 PM

shit

god damn that's a sexy spinloop! 47 f0 87 3d 00 00 30 02 85 ff 75 f2

erm, spinlock

So's your face.

47                    - inc edi
F0 87 3D 00000001     - lock xchg [01000000],edi
85 FF                 - test edi,edi
75 F2                 - jne -0E

mmmm, tasty.

part of some reverse engineery code injecty debauchery I'm doing with a game :P

4:05 PM

I was just about to go on the back porch and watch some training videos

Then realized it's 52F (11C) and windy.

yeah, 11C is pretty cold if it's windy.

I think 15 is about as cold as I can actually be comfortably outside. Plus my back porch is covered on the north-west side. So it generally doesn't get any sun until about 5pm. Usually that's a good thing.

I'm like an eskimo. Cold doesn't bother me.

excess heat pisses me off though.

If it wasn't windy today would have been fine for me, definitely on the cold end but probably fine.

4:51 PM

99 F (37 C) here.

ouch

it's about 15C here (it's 6pm)

so not too bad

anyway, off to a gig. laters

5:45 PM

@Iszi That sounds rather unseemly.

6:15 PM

@AviD So, check it. Green beans, tomato, parsnip, and spinach.

user image

1 hour later…

7:44 PM

@ScottPack That looks awful

2 hours later…

9:16 PM

@JeffFerland Your face looks awful.

The pizza, however, was fantastic.

« first day (660 days earlier) ← previous day next day → last day (4212 days later) »

Transcript for

Oct '126

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile