@AntonyVennard Here's what I do. If the tag is just relevant, I reject as too minor. If the tag is essential (expresses the core concept of the question) I accept it.
The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the paradigm. Can anyone shed some light on this?
@Polynomial Should've seen Ubuntu back in the 6.06 days (i.e. when I first started using Linux) or Fedora Core 2. Things have gotten better.
Actually, just last year ext4 kept corrupting itself on my luks volumes. Been better since I switched to xfs, but being dumped into dracut and being told to run e2fsck is not good.
@Polynomial Do you recommend any other pentest distro? I was thinking of looking at Kali having seen the ad here, but now, I'm not so sure ;)
I expect that it going to be teething troubles for a while with Kali, they have jumped Linux distros from their original Backtrack days. It'll settle down eventually (he says re-installing windows...)
@Adnan Hmmmmm, that's a hard one. I successfully use ext4 on top of lvm for a raid volume on normal disks. I simply personally had a lot of corruption issues for the root volume on an SSD.
The SSD itself worked fine - sata leads replaced etc.
The one downside to xfs is the inability to shrink it should you wish to later.
So, in answer, I'm personally a tad paranoid about using ext4 now, but hopefully that'll settle down. My RAID has never had any issues and I've been backing up like you've never seen.
@Adnan So to answer that, not unless you have a specific reason to use it and/or a bad experience with ext4.
One of these days btrfs will become stable and all will be good, but until then...!
@AntonyVennard Aha, alright then. Thank you for the explanation. Currently I have no issues with Ext4, I'm happy with the overall performance and for my usage I think I'm not gonna mess around with other file systems.
@Adnan menu died randomly due to their stupid menu package thing, you can't clean config or re-install the package, so the entire thing becomes useless
so I re-installed it
then it was doing an apt-get upgrade and ran out of space on the disk (limited VM size) so its idea of "the safe option" was not to roll back the updates and warn me, but to fucking reboot mid-update.
so it completely screwed gdm3 and gnome-shell
and the whole thing died horribly
@AntonyVennard BT5 is still good, but I hear good things about backbox.
@lynks Once the bounty expires the grace period is over, the 50% of the bounty amount is awarded to the answer after the bounty with score of 2 or more.
@Polynomial I wouldn't go as far as saying it sucks. But I like the whole organization concept of Kali much better than BT. Give them a while to sort out the issues and it will be great.
@TerryChia yeah I like the idea of Kali. But to be honest I've never really got the whole 'pen testing distro' thing. I mean, how hard is it to apt-get install nmap, dpkg -i metasploit etc?
@Adnan I have used XFS for some years but I found it disappointing: when you delete a lot of small files, it tends to stall completely for several seconds, a dozen seconds after the deletion. Quite inconvenient when you do Java development (where you tend to often delete then recreate a bunch of .class files).
@Adnan As far as I know, XFS has been optimized to handle very big files gracefully (e.g. appending to a file which is already in the gigabytes range still works at top harddisk speed) but this required some special layout of metadata, which implies some reorganization when structural changes occur (e.g. when adding or deleting files)
Filesystem design is a bunch of heuristics. It is very hard to make a filesystem which is efficient both for small files and for big files, and still robust with regards to power cuts (journalling and similar tricks)
@Adnan Yeah. In fairness, my issues may have been self-inflicted as I was messing around with mount options. You need a special invocation to TRIM correctly with a LUKS volume and I don't think that helps. The defaults seem safe.
Basically the choice of XFS was "what else is supported at install time by Fedora that isn't ext3" and XFS was the only one, aside from say FAT12, which I'm not using for obvious reasons.
@lynks Well, those are the main ones for sure. But there are some nice tools that are less often used. It's handy to have all the tools available right there.
Plus some tools aren't in the repos of the normal distros, so building them yourself is quite troublesome.
@AntonyVennard I think that's what they are moving towards for Kali.
> Some packages obviously had to be forked in order to implement some of the Kali-specific features but Kali strives to keep that number of packages to a minimum by improving the upstream packages when possible (either by integrating the feature directly, or by adding the required hooks so that it’s trivial to enable it without actually modifying the upstream packages).
Each package forked by Kali is maintained in a Git repository with a “debian” branch so that updating a forked package can be easily done with a simple git merge debian in the master branch.
Do you think it is against ethics to publish a 0-day vulnerability? I've found a serious security issue in a widely-used website. I personally am not interested in abusing it, but rather have its bragging right. Am afraid that the website owner would fix the bug and treat as if it were never there. Any help on that?
@SeMeKh Make a video showing you exploiting it, blur away all the details that would allow reproduction, share however you want, inform the vendor, wait until you hear back from them.
@SeMeKh Like I said, document everything properly with screenshots and the likes. Alternatively, go through something like zerodayinitiative.com if the bug is serious enough.
You can even make some good cash if they accept your report.
@SeMeKh I'll be honest with you. I have some experience specifically with at least 2 Iranian websites regarding SQL Injection (which I think it's what you found). They never replied to my email and didn't fix the issue. Probably after a couple of months they silently fixed it.
@SeMeKh I had a similar problem not a week ago, and the consensus was that I should write an anonymous email to the site and explain in detail how easy it is for someone to exploit it
@Adnan Not a SQL injection. Overall, Iranian sites are too vulnerable. But this one -- being defacto blogging service in Iran -- tends to care for its users security.
@Adnan Having that said, they may deny its existence because (I know) they fear losing their users that way.
@SeMeKh Well regardless of the vulnerability itself. That's what happened with me. I'd say screencast it, brag about it. Just don't disclose enough information for others to exploit it.
@SeMeKh I said it might as I don't know the background and I'm just reading your posts here and the question. Not sure, did the process of learning about this vulnerability involve some illegal activity (depends on local laws as well), or did you stumble upon it by pure chance?
@SeMeKh I think that the best way forward is to consider what those that can solve this issue would consider most decent of you, without resorting to FUD
@SeMeKh BTW, does the vulnerability have any anything to do with sanitizing user posts for XSS? Just reading your other question here and wondering if it's connected?
@SeMeKh But for what it's worth, IMO the way you have shown URL sanitization should be considered sufficient, I don't see any way to exploit that (provided the escape_double_quotes escapes URL encoded double quotes as well)
@Polynomial yep, got that, so its just a generic fingerprinting approach? why would malware not randomise the mutex 'name' (do they have names?) with each run?
take a space of, say, one million possible mutex names. Have each malware instance lock 3000 random mutexes in that space. If there is another malware instance, chances of a collision are very high.
I was the only one that up-voted on that answer today, and it looks like the system unupvoted it automatically. What the...? I realize there's a need to detect sockuppeting for users with more than one account, but what's with this? The answer is actually great and shows a lot of effort. I'm not allowed to support answers from individuals I trust and make sure my upvotes are equally distributed among members even if that's not necessarily deserved?
@Polynomial Nice! Congratulations! If I can maintain my current rate of approximately 55.6 rep points per month, I too should hit 30k, 'round about...October 2055. :-)
Anyone else been on the HTG Discourse board? Kind if interesting the way discussion threads sort-of display similar to SE chat rooms - linear by post time, with links back and forth between reply posts.
@lynks Actually, no, I still don't get it. Operating on 8-bit blocks means encrypting each letter by itself (since generally, each 8bits are 1 char). Using mod 26, ROT256 = ROT22.
So ROT256-ECB("ab") = "wx"
I'm genuinely trying to learn, so I'd be happy if someone corrects what I got wrong.
@TildalWave According to @lynks it ROT256-ECB keeps the text unchanged. I feel that it should (similar to @makerofthings7 ROT26), but I just can't see it.
@lynks Well, it's simple. Your "explanation" is treating me like an idiot. Explaining what ROT is and what ECB is, and telling me to forget 26 as "it has nothing to do with it" without telling me what has to do with it.
@lynks Please don't get it the wrong way, I'm truly grateful that you tried to help. But just this time, the attempt wasn't successful.
@Adnan i thought "ROT doesnt exclusively have to act upon the set of lowercase letters, it just means, rotate the set of possible plaintexts. all block ciphers are permutations, ROT is just a very simple permutation." would have nailed it
@lynks Well then the problem is on my side. I probably just needed to hear it twice :p
@ThomasPornin I know we/I say this a lot and I know that you're here waay before me, but I think it must be said. Thank you for being here. You're great.
Last Monday (25th) I learned that Windows has some advanced task scheduling options, after some messing around I've set the following command to run every 2 hours on working hours.
msg adnan "Stretch and do some situps, then come back and sit correctly"
Today I checked my situps log and I've made 600 since that Monday.
My client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload their photos, and the photos are judged by moderators for a winner. The site will be hosted on a ...
@Adnan FWIW I think it's pretty good. It's difficult to answer such questions and cover all aspects of it, especially since OP isn't all that active in the comments. Other answers kinda complete yours, so IMO that's enough. But I don't think that pen-test would be done on Rackspace server, so maybe that warning could be less intense? :)
@TildalWave It would be pretty silly to DDoS-test the poor developer's laptop. Unless you can replicate the production infrastructure and stress-test that, you have to stress-test the production infrastructure itself.
@Adnan aren't they after pen-testing it? I think this question is just some case of lost in translation as it doesn't seem all that sensible to me either.
@polynomial - will you be involved with the Portcullis Arms at Infosec? Just asking as I'm taking the wife to London/Infosec for her 40th and looking for fun things to do, and specifically drinking.
@Adnan I actually don't even know what SuperCollider even is in the scope of Sec.SE really. OK, I get what it's supposed to mean, but what's the official way of measuring collisions here? That's a nickname for which list of questions?
Right now the front page Popular tab is fairly broken -- it's a simple descending sort by views. As Joel said in podcast #18, it is "a self-fulfilling prophecy." But this is not intentional, it's only because we haven't had time to improve it yet!
As I sit down to write a better algorithm, I tho...
I need an advice. I have a communication protocol using 3DES cipher.
Each time the client connects (and it can be very often like 1-10 per second), the 24-byte key is generated randomly on server side, encoded by XORing with some static 24-byte password (quite complicated, not many repeated bytes...
@Gilles I'm more interested in his key length. IIRC 3DES had a key length of 168bit. He seems to be using a 192bit key. Or am I reading the question incorrectly as well?
DES is defined to use a 64-bit key. Only 56 of these bits are really used, so the "effective key length" (for resistance against exhaustive search) is that of a 56-bit key. Yet, any implementation will expect a sequence of 64 bits (hence, 8 bytes, not 7).
Triple-DES (aka "3DES") is three DES ins...
@Adnan yeah, well... between holidays, kids vacation, local cultural equivalance of spring cleaning, and that damn project that was overdue - I had to make the hard choices, and refrain from popping in here.
The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the paradigm. Can anyone shed some light on this?
