The DMZ

Gilles

00:04

1

Q: ASLR affected by entropy available on Linux?

It is mentioned in the kernel source in random.c that get_random_int is “Similar to urandom but with the goal of minimal entropy pool depletion”. However, where (and how) does get_random_int interact with the entropy pool? Now, urandom actually calls extract_entropy_user, but I don't see anythin...

4

Q: Can entropy consumption at program start be prevented?

I use Knoppix (or other Live CDs/DVDs) as a secure environment for creating valuable crypto keys. Unfortunately entropy is a limited resource in such environments. I just noticed that each program start consumes quite some entropy. This seems to be due to some stack protection feature that needs ...

linux kernel security glibc linker

ASLR calls get_random_int. get_random_int has changed several times but I don't see it depleting the entropy. What kernel version did you notice this on? What architecture? Is the kernel compiled with CONFIG_ARCH_RANDOM? — Gilles 3 mins ago

D3C4FF

00:29

Godamnit, customer website just went down because i tried to crawl their shitty site -_-

Adam McKissock

01:09

Great

First-time victim of financial fraud!

Xander

01:26

@Adam That's no fun.

Adam McKissock

01:38

@Xander Indeed it is not.

TildalWave

01:52

@AdamMcKissock ouch what happened?

Adam McKissock

@TildalWave Who knows, couple of grand worth of card payments that weren't me

TildalWave

@AdamMcKissock can't you demand a chargeback?

Adam McKissock

@TildalWave Already sorted. Bank refunded it all over the phone inside five minutes

D3C4FF

@AdamMcKissock Ouch.

TildalWave

@AdamMcKissock oh then all's good :) good that you noticed it... I've once paid for some dude's yacht blueprints :)))

Adam McKissock

01:55

@TildalWave Yeah, they were pretty cool about it. Thanks for those by-the-way :P

TildalWave

@AdamMcKissock hehe doubt it was you... was probably over 10 years ago

Adam McKissock

@TildalWave I do enjoy sailing on a regular basis though...

D3C4FF

Sailin' the seven prox-seas!

Yo ho-ho!

TildalWave

@AdamMcKissock ditto here... well, not now but soon enough again :)

Adam McKissock

@TildalWave I think I'm going to go back to the med to sail again this summer.

TildalWave

01:59

@AdamMcKissock Mediterranean is nice, I'm mostly on Adriatic but time permitting med too

Adam McKissock

@TildalWave Ahh nice, I was on the Ionian last summer

TildalWave

@AdamMcKissock wasn't there this century... damn I'm old :) but it's similar than Adriatic... ya'know... island hopping and such

Adam McKissock

@TildalWave Yeah, I love hopping around the little islands. You have your own boat?

Terry Chia

@TildalWave Wait, so you are @RoryAlsop's sock puppet?

TildalWave

@AdamMcKissock neah too expensive to maintain and anchor... we either rent or some friend invites us

@TerryChia say what? :o

Adam McKissock

02:02

@TildalWave Yeah, usually go bareboat here too (thats if I can find people to rent with)

Terry Chia

@TildalWave Referring to the ".. damn I'm old" part. :P

TildalWave

@TerryChia well I just realized I haven't been to Ionian sea in this century... actually millenium, that's all :) I could be anything between 13 and a 1000 years old :P

Adam McKissock

I will own a boat one day.

TildalWave

@AdamMcKissock I had one of those gum boats... or however they're called... we named it Titanic... it sank :))

Adam McKissock

@TildalWave Lol.

TildalWave

02:07

In a cave no less... mid lake... water had 10 degrees C

Oh, and snow outside... was fun

Adam McKissock

Heh, I'm actually seriously considering living on one later on

TildalWave

@AdamMcKissock If you leave by the sea then that's probably awesome but all I have here is a river and I wouldn't want to know how that looks like in the winter tbh

Adam McKissock

@TildalWave Yeah, I couldnt see it being that much more expensive than a house.

TildalWave

@AdamMcKissock You know I've talked with some people here and it's actually a lot cheaper (at least here) if you maintain it yourself... but it's a lot of work

Terry Chia

@AdamMcKissock You need to look into Boat Programming in that case.

2

TildalWave

02:11

@TerryChia now where's that link?

Adam McKissock

@TildalWave Aye.

Terry Chia

@TildalWave I can't seem to find it. All the existing ones looks dead.

TildalWave

@TerryChia should be in the transcript ;)

62

Q: What is the boat programming meme about?

I remember some time ago there was some huge problem regarding some question that had something to do with a boat, and I think I missed that topic completely. As I see it being mentioned every now and then, I'd just like to know what it was about.

discussion memes boat-programming

But yeah the links are dead

Hooray for circular links! — Weldangerbog Aug 14 '09 at 14:32

Indeed LOL

19

Q: Computer and Internet use on a boat?

Let's assume that I seriously would like to be able to use my computer as easily and as carefreely while on a boat as I do while at home. In short, if I were on a boat for extended periods, such as two weeks at a time and occasionally over a few days out of port (this would be a two-person sailin...

internet hardware-rec

TildalWave

03:08

43

A: Is it a bad idea for a firewall to block ICMP?

Compared to other IP protocols ICMP is fairly small, but it does serve a large number of disparate functions. At its core ICMP was designed as the debugging, troubleshooting, and error reporting mechanism for IP. This makes it insanely valuable so a lot of thought needs to into shutting it down. ...

@ScottPack LOL @ Rory forbid :)) Good answer that BTW ;)

Adam McKissock

@TildalWave firewall ALL the things!

makerofthings7

Does anyone remember the name of the proposed replacement for HTTP/S authentication? SPV?

It's where the password isn't sent over the wire.

TildalWave

Digest access authentication

Digest access authentication is one of the agreed-upon methods a web server can use to negotiate credentials with a user's web browser. It applies a hash function to a password before sending it over the network, which is safer than basic access authentication, which sends plaintext. Technically, digest authentication is an application of MD5 cryptographic hashing with usage of nonce values to prevent replay attacks. It uses the HTTP protocol. Overview Digest access authentication was originally specified by RFC 2069 (An Extension to HTTP: Digest Access Authentication). RFC 2069 sp...

you meant DAA?

makerofthings7

ahhhh

Session Initiation Protocol

The Session Initiation Protocol (SIP) is an IETF-defined signaling protocol widely used for controlling communication sessions such as voice and video calls over Internet Protocol (IP). The protocol can be used for creating, modifying and terminating two-party (unicast) or multiparty (multicast) sessions. Sessions may consist of one or several media streams. Other SIP applications include video conferencing, streaming multimedia distribution, instant messaging, presence information, file transfer and online games. SIP is an application layer protocol designed to be independent of the un...

found it in the link you gave me.. thank you!

(hmm or at least I think it was the standard...)

Not sure what it is... but it's like a newer version of DAA

TildalWave

03:24

@makerofthings7 SIP? The way I read it it's just a protocol based on DAA algorithm, so it's semantically different but much the same thing

makerofthings7

I know... that was the wrong thing.. I think the thing I'm looking for starts with an "s"

Adam McKissock

@makerofthings7 sanity?

makerofthings7

It's a newish password challenge "protocol" that doesn't require the PW or a hash of the PW to be sent across the wire.

Terry Chia

@makerofthings7 SRP.

Secure Remote Password protocol

The Secure Remote Password protocol (SRP) is an augmented password-authenticated key agreement (PAKE) protocol, specifically designed to work around existing patents. Like all augmented PAKE protocols, an eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess. This means that strong security can be obtained using weak passwords. Furthermore the server does not store password-equivalent data. This means that an attacker who steals the server data cannot masquerade as the cl...

makerofthings7

yes!

TildalWave

03:28

well at least it was linked in the DAA wiki too LOL :)

makerofthings7

I see it now TildalWave

The mathematics are beyond me right now, but I'm hoping SRP can be used to prevent theft of a UProve Token...

Terry Chia

@makerofthings7 Ah see, for the maths you will need @ThomasPornin.

makerofthings7

I'm afraid to ask since I don't know enough to understand the answer!

Terry Chia

@makerofthings7 You have nothing to fear as long as you have an offering to appease The Bear!

I heard he likes rep. And badges.

TildalWave

You might get monkeys in return tho :))

Neah, joking... didn't want to discourage you :P

makerofthings7

03:38

Well since Thomas Pornin will be visiting in the future and reading this, I wonder if a UProve token disclosed an ASCII blob containing a hash of something the owner knows (like a password), and the password was sent to the Prover, if that would prevent casual theft of the token

TildalWave

Actually ... going through it there isn't any math per se in it at all it's just logical procedures and safe primes (and their reverse counterparts Sophie Germain primes)

makerofthings7

Then I was considering that since the UProve exchange hasn't been formalized yet AFAIK, the client and server could use a more secure version than sending along a hashed version of the password and prompting for a challenge. SRP popped into my head...

TildalWave

OK, there is some maths ... nothing too demanding tho... if I have problems understanding what I do is name each variable and then read it out loud like so... with names and all... it can be pretty funny sometimes too

you have to be careful how you name your input variables, otherwise you get Debbie does Dallas pretty often

makerofthings7

I had only a vague idea that there were different "types" of primes

TildalWave

safe prime (r, Rhonda) = 2p +1 where p (Peter) is also a prime ... Sophie Germain is the other way around... so Peter is one

If anyone ever wondered how a safe prime sequence sounds like: oeis.org/play?seq=A005385

I bet my father can even hear those +1s LOL

makerofthings7

03:58

Fascinating and I don't know why

"why" these patterns exist.

D3C4FF

04:55

anyone around? Do you know where i could find any kind of Http Logs for "Apache-Coyote/1.1"?

on a windows box >_>

Or would any/all logs be on the tomcat engine side of things?

TildalWave

@D3C4FF Google search for something like "compatible; Googlebot/2.1; +google.com/bot.html";... they should start with page 2 or later... then check for GET response headers, say with web-sniffer.net

D3C4FF

@TildalWave what...? I don't getcha

TildalWave

@D3C4FF I would search Google for strings that would be usually found in such logs, find some that have them published, and then check the server signature with the GET response header... it's incredible what all I got with the example I gave... SQL logs with all usernames and similar stuff

Of course, you could refine your search... say for ".log" or ".txt" files

What do you need that for anyway? I mean, if I knew what you need it for I might get a better idea how to find them

or use "compatible; Googlebot/2.1" filetype:log

D3C4FF

06:06

@TildalWave oh right, nonono. So. I'm using an automated vuln scanner to crawl a website, -something- that i'm hitting is KILLING the website dead. It appears the app they've developed is a hybrid of apache-coyote and tomcat backend... I've called their admins up and they know sweet fuck all, so i'm trying to direct the guy where to find/look for any kind of log files that might tell me what i'm doing that's killing their shit...

TildalWave

@D3C4FF Oh gotcha! Yup that's an entirely different matter. The most common location is on "C:\Program Files\Apache Software Foundation\Apache Tomcat [version]\logs" but the location should be defined in the "httpd.conf" or for vhosts (if used) in "httpd-vhosts.conf"... that's for backend... for front end, I have no idea LOL

D3C4FF

06:23

Yep that was my first thought as wlel.

@TildalWave but nope. No joy. They've repackaged the application quite a bit, no default paths!

Surprise assholes!

TildalWave

06:35

@D3C4FF LOL then tell them to text-search for your IP on all files... might take a while, but should return a few log files... if they weren't so smart to disable text indexing as well :)))

D3C4FF

Yeah. That's entirely a possibility. Sigh.

Lucas Kauffman

A good morning to everyone

except Terry

good evening to you

Terry Chia

@LucasKauffman Afternoon actually.

TildalWave

@D3C4FF Then cmd dir /a /s *.log > sendmethisfreakingfile.txt

Lucas Kauffman

Close enough :D

TildalWave

06:40

good [some part of the day] to you all gents ;)

Lucas Kauffman

0

Q: Securing personal web server on static IP

I have an Apache Web Server on linux distribution in my shop. I have purchased the Static IP from my ISP. But I don't know about how I can secure my web server at my shop. I purchased the static IP so that I can access data of my shop at my home. But I am afraid of hacking or some attack at my we...

apache

narq?

TildalWave

He purchased the static IP? WT?

That's the new normal now?

D3C4FF

@TildalWave Ahahaha awesome.

TildalWave

06:56

I still don't quite grasp these DMZ events... I need to register or what? Also... what's supposed to be happening there? Just pinging each other with proposals?

Terry Chia

@TildalWave It's just an alert.

For the what used to be weekly blog post.

TildalWave

@TerryChia and these? Two registered for the upcoming event that I've never seen before

Terry Chia

@TildalWave It's just a reminder/subscription thing.

We don't actually do anything. (That you can know about)

;)

D3C4FF

@TildalWave it would appear that sending this:
action=invokeOp&methodIndex=0&name=jboss.system%253Atype%253DServer

to the url /jmx-console/HtmlAdaptor causes an instant DoS :D

TildalWave

@TerryChia duly noted :) so those registered at some point for all upcoming events, and then either got run over by a van, or they just aren't bothered by all the notifications for events that aren't?

Terry Chia

07:08

@TildalWave I think so. Note that I have never actually registered for any such events.

TildalWave

@D3C4FF Nice! I actually haven't got a clue what that's supposed to do... I don't like beans THAT much ;)

@D3C4FF 1337day.com/exploit/16972

D3C4FF

07:23

Yeah, figures. Having the jmx-console available is ASKING for trouble...

I'll be back in a couple of hours

Lucas Kauffman

@TerryChia I love your sarcasm

Adnan

09:29

Anybody have any idea who said this?

> In God we trust. Anything else we sanitize, escape, validate and log

Adnan

09:49

@TildalWave Don't get me wrong. But did you actually read that question? Because it doesn't look like you have.

AviD

@ScottPack you kidding me? I can't handle even one episode's worth of alcohol!

@AdamMcKissock @TildalWave re financial fraud - are you familiar with BillGuard?

Adnan

@AviD Jesus! Especially the shots!

AviD

very cool app, from a startup that I did some work for. Very impressive, they are getting pretty big in US. I recommend trying them out, though I don't know what its spread in EU is.

@Adnan I know, right?

TildalWave

@Adnan The bad coding practices for JS one?

Adnan

@TildalWave Yes.

AviD

09:55

@D3C4FF a few minutes?? This happened as you were saying goodbye! I still figured I'd fix it, no problem.

@D3C4FF that actually makes sense, but then why cant I boot into the UEFI at all now. I get stuck at the POST/logo screen.

anyway to force it back to a known good config, WITHOUT getting into the bios screens?

TildalWave

@Adnan OP never said he's limiting himself to browser extensions, it's just a specific example of what he's currently analyzing... but the rest of the question (including the title) aren't limiting to extensions only, so I don't see how it applies. The answer I commented on is a pretty good start and certainly doesn't deserve a -1

Adnan

@TildalWave Please read the comments on the question. I specifically asked the OP to narrow it down. Check his reply.

TildalWave

@Adnan I don't see any reply of his to your comments

Adnan

@TildalWave "Please read the comments on the question."

TildalWave

@Adnan ok ok no need to beat it in me, I reserve a right to vote at my own discretion and the answer I gave +1 was useful to me from the wider scope of what OP later limited his questions' objectives to

Adnan

10:01

@TildalWave Plus, all of bobince's points have little to no impact on the security. Yes, they're bad practice, but they have nothing to do with security. (other than, maybe, eval)

@TildalWave The OP commented before the answer.

@TildalWave Come on. Don't go defensive like that. I'm not attacking you.

Of course you have the right to upvote/downvote, comment, answer, ask, whatever you want.

TildalWave

@Adnan OK but I was more interested in the original form of the question, which wasn't changed, I don't understand what opinion you're trying to force on me now? I'm old enough to make my mind up

Adnan

@TildalWave Wow! wow! Dude, take it easy, alright? Nobody is forcing anything.

Freaking chat! It doesn't convey my actual tone.

TildalWave

The list is maybe not 100% on the spot, but it's still helpful and with a small comment to it that would show less experienced readers what it's supposed to represent, it's pretty good actually

Adnan

@TildalWave Alright. I'll agree with you on that one.

@TildalWave But can you think of any scenario where that list is actually relevant to security. In other words, what do you think can go wrong?

Can you give me one example?

I'm really interested to know.

TildalWave

No @Adnan it's not the chat, it's the length of it... it's just someone trying to be helpful, and I agreed that it was indeed helpful but I never endorsed it as a complete answer to the question either

Well not all of it introduces an attack vector, but given an already injected code, they provide for an easier malicious code deployment... the guy said that and also noted he's ordering them by relevance

Adnan

10:09

@TildalWave But if you can already inject code in the page, what difference does it make if the original page used eval or new or setTimeout?

@TildalWave Just a side note. I've taken back my comment there. I probably was mistaken after all.

TildalWave

eval and settimeout are clearly prone to injections so that's not the case... others can be exploited in other ways, not all are injectable tho... but consider CSRF also, not just XSS... would they be used to interact with the user? They might be. Could they be accessible through, say, URL? Possibly. Could it create problems? Sure.

AviD

@Adnan @TildalWave - you should just assume that if its coming from @Adnan, the tone should be "Sleazy douchebag in a bar".

TildalWave

@AviD stop editing your posts to make my replies irrelevant! :P

Adnan

@AviD Exactly. @TildalWave, trust me. I'm not agitated or angry or whatever. Come on, this isn't the first we talk here. You know I respect you.

AviD

@TildalWave heh. I realized my faulty grammar caused you to feel accused, so I fixed it.

@Adnan "... And he will still respect you in the morning". See?

TildalWave

10:19

@Adnan if I didn't respect you I just wouldn't feel the need to reply... I was taught that by The Bear himself (or is it themselves?)... should we address The Bear in the third person plural?

AviD

@TildalWave the Royal Them?

Adnan

@TildalWave I think it's cultural-dependent. In some cultures, plural is the sign of great respect.

Or it might be in all cultures? I don't know.

TildalWave

@AviD Them might be anti-royalists, you know... them being French and all :)

AviD

goddammit. Who stars my overcrash lament? 3 times??

Adnan

@AviD hehehehe

AviD

10:21

lol, screw you.

TildalWave

We actually have a separate form for that, well two but only one really survived... but I know German has it too

AviD

the good news is, resetting the bios was relatively painless, other than losing everything I already worked through. So, I should save a profile more often.

As the Dalai Lama used to say: Save, save, always save, don't forget to save.

2

TildalWave

@AviD thumbs up

huh who starred my concubines?

4

AviD

@Adnan but noone bothered with my own answer to that...

Adnan

@TildalWave I'll set a little experiment.

AviD

10:24

@TildalWave I didnt even see your concubines!

TildalWave

@AviD I had a small misunderstanding with my ego how many of them I can handle... The Bear was kind enough to provide some guidance. Now I know why he's plural!

AviD

@TildalWave must have missed it. Link?

Pic?

TildalWave

@AviD LOL no pics sry :o just hit the time stamp on the starred post

AviD

obviously, I dont see it.

oh wait, dang it. I do.

seems I even starred it for ya ;-)

wow, senility really dont remember socks. What was I saying?

ahh yeah. your commitment issues.

Funny, You have a problem with over committing, whereas most guys have a problem committing at all.

Like @Adnan.

;-)

TildalWave

@AviD Well we saw the grill... wasn't packed full but still too much for a single person... and it looked clean enough to suggest there must have been some girls around... either that, or he's anal for cleanliness :)

Obviously, when I say girls, I don't necessarily refer to their gender, I wouldn't want to limit @Adnan's options oh no...

Adnan

10:34

@AviD Right where it hurts. Right in the balls.

2

AviD

are you doing this on purpose?

@TildalWave what do you use for tracking voltage usage for cpu and other parts?

Adnan

@AviD I never do anything unintentionally.

TildalWave

@AviD Asus has some tool for that... PCProbe or something... but you should be able to get readings in your BIOS also, in particular for PSU readings to check rail(s) stability

AviD

@TildalWave well after last nights debacle, I dont trust the bios readings.

that is, it might change during use, so I want to see that during all parts of the run, and not just before OS.

I've been using cpu-z, but it doesnt track it, just shows the now.

TildalWave

@AviD Then you want a multimeter with proper connectors (splitters)

AviD

10:41

noooo

I'm a software guy! ;-)

TildalWave

@AviD then you'll have to learn to trust your mobo and sensors it has

AviD

oh, I trust ("trust") the mobo, but my problem is I cant see it during use.

TildalWave

@AviD you don't have some tool for that on the mobo drivers CD?

AviD

for example, right now, its showing me that the vcore is only on 1.128v. @D3C4FF says I should start with 1.300v It froze up last night from giving it 1.135. I dont know what to think anymore....

@TildalWave hmm, yeah, I guess I should use that then... :$

TildalWave

@AviD P-Tuner?

AviD

10:45

its gigabyte, so I think its EZTune.

TildalWave

Oh shoot that's from 2007 :)))))

yeah it might have changed the name by now LOL

AviD

@TildalWave oh that looks nice, just what I would need.

right, if they come looking for me, tell them I'm out on the beach, OCing my rig.

TildalWave

@AviD beach... rig... hmmmm

AviD

haha, close, but not quite

Adnan

@TildalWave Here you go. cc.puv.fi/~e1101411/haxor_me.php

I have a session running there.

The page uses 3 of the "dangerous" things.

You can assume I'm a gullible user. I'll click your links, I'll submit your forms, I'll open your emails, and I'll load your pages.

Go ahead. HAXOR ME!

@TildalWave FYI, the page has set a cookie in your browser to help you test your findings. Check it out.

TildalWave

11:06

oh man, haxor what? there's no interaction with anything there

@Adnan FYI you're required to alert the user you're using cookies in EU! The easiest way to haxor you would be to report you to proper authorities... EU BBQ inspectors in this case... your sausages should be put to trial! :P

Adnan

@TildalWave I can setup some interactions for you. I'll put some back-end processing.

AviD

@Adnan oh yeah baby, I'll do some real back end processing.

Pervert.

TildalWave

@Adnan tomorrow dude... hmmm actually not tomorrow either, my profile should self-update :P

Adnan

@TildalWave Here's my point

TildalWave

@Adnan what is?

I'm just busy getting wasted tomorrow... it's for a good cause ;)

Adnan

11:17

To a little or even no-existent extent, there's no such thing as JavaScript security in that extent.

Rory Alsop

yukianddunx.smugmug.com/keyword/yuki/…

TildalWave

@Adnan well with no interaction I'd obviously just be haxoring myself or my browser... at least by using JS

Rory Alsop

That's a good point...

Adnan

If there's no actual vulnerability in the browser itself and you're handling user input properly on the server, Javascript security is irrelevant

If you're not handling the user input properly, then Javascript security is almost irrelevant.

@TildalWave Then you need a vulnerable server-side code, right?

Oh Jesus Christ! Finally! A relevant answer.

1

A: What are bad coding practices in Javascript that can make the code vulnerable?

In browser extensions, the impact of a vulnerability highly depend on the context and the requested permissions. Static tools (JSHint, AMO validator) to check code exist, but none of them are 100% reliable, especially for obfuscated code. So, I'm not going to show a magic regular expression whi...

TildalWave

@Adnan OK can we close the subject now? He's pretty much repeating what bobince mentioned, plus a lot more info on the wrapper. And yes, it's written a lot better.

Oh BTW... another point nobody mentioned and happened here in DMZ to most of us, albeit it wasn't malicious (but it could've been)... we were pointed to SE chat extension script that most of us blindly added to our browsers and never doubted its intentions... basically merely by trusting the one that mentioned it. Now go to Facebook and start going viral with some cool extension that everyone needs to drag-drop in their extensions page. How convenient LOL

M'vy

11:38

@TildalWave You mean Rebecca's one?

TildalWave

@M'vy Dunno really... yeah it could've been. But you see, I had no idea then who Rebecca was and I still installed it, even knowing all the risks involved. Trust is an easy thing to build when you have good references.

(in this case the reference being, who pointed us to the script)

Anyway... gents, I need to re-stock my beer supply ;) laters!

M'vy

see ya

Adnan

12:01

Damn it! I keep hearing the SE chat notification sound in the back of my head. Either I'm going crazy(er) or somebody in the room is on some SE chat.

Thomas Pornin

12:17

@makerofthings7 SRP is mostly about never showing a hash of a password.

Imagine that Alice and Bob share a common password and want to authenticate each other.

They could try some challenge-response protocol: Bob sends a random c, Alice responds with SHA-256(c || password).

However, if Alice talks to a fake Bob, she just revealed a hash value which can be used by the fake Bob to run an offline dictionary attack (trying passwords on his own machine until a match is found).

So Alice would want to authenticate Bob first. But then the same problem arises, reversed (with a fake Alice).

PAKE protocols (like SRP) solve this problem: Alice and Bob authenticate each other, and even a fake Alice or a fake Bob does not learn from the (aborted) protocol enough information to run an offline dictionary attack.

Antony Vennard

@ThomasPornin I'm sorry but I don't understand this explanation. It doesn't have any chimpanzees or bananas in it.

Scott Pack

Son of a bitch

@AviD Just pretend like it's a Seder and you'll be fine.

Adnan

@ScottPack Same here :(

Antony Vennard

@ScottPack If someone has gone through your profile and upvoted everything they could find, that's quite likely to happen.

AviD

@ScottPack hehe, that is so last two weeks ago.

@ScottPack oo, victim or perpetrator?

Scott Pack

12:28

@AviD Victim.

Is there any way to tell how much I lost?

Adnan

@ScottPack In my case it says explicitly "-60"

Scott Pack

Oh, nevermind then.

Antony Vennard

@ScottPack /reputation might tell you.

Scott Pack

I ended up going way over repcap yesterday, so it looks like I lost upboats, but no rep.

Xander

@ScottPack Lucky duck.

Adnan

12:31

@ScottPack Son of a btich!

@ThomasPornin Forgive the noob question, but how does Diffie–Hellman come into play here?

@ThomasPornin Oh never mind. I see it now. Even if they exchange keys and later establish a safe connection channel, Bob could still be talking to a fake Alice and vice versa.

Xander

This looks off-topic to me. Any thoughts?

0

Q: NO SIM FACTORY RESET PHONE

someone described this set of circumstances is it possible TRYING TO DETERMINE IF PHONE WAS BEING TRACED BY LAW ENFORCEMENT 1. RECEIVED "QUESTIONABLE" PHONE CALL 2.DISCONECTED CALL. 3. REMOVED BATTERY/SIM MICRO SD .REPLACED BATTERY.4. DID FACTORY RESET TO PHONE.5.TURNED PHONE OFF/ON READ "PLEASE...

mobile

Adnan

12:47

@Xander Seems off-topic to me as well.

Xander

@Adnan Ok, thanks. Flagged.

Adnan

@Xander Do you think it's possible to receive calls without a SIM?

Xander

It certainly is on phones that have both CDMA and GSM radios, since CDMA doesn't use SIMs.

I believe that it is, even on GSM only phones. I think you can call emergency numbers without a SIM, so it would stand to reason that phone companies could route calls to the phone as well, if they so desired. I don't recall for sure though. It's been a long time since I read on that topic.

Antony Vennard

@Xander I also believe you can.

I remember reading up on this a while ago - and it wouldn't really make sense for you not to be able to route voice back to the device that's sending it.

Adnan

Yes yes, calling a number without a SIM is very possible. After all, this is how emergency calls work on mobile phones.

But receiving a call. How is that possible?

Scott Pack

12:53

You know you're in a bad way when you get POST beeps that an expert in that hardware doesn't recognize.

Antony Vennard

@Adnan Well, somehow the voice must be routed between the two devices bidirectionally. I assume if you can call out, you must also be able to call in.

Adnan

@AntonyVennard Alright, I'm open for the plausibility. How would that happen?

Providers identify phones using IMEI, and subscribers using SIM.

Antony Vennard

@Adnan At a guess, and this is a guess, SIM=Domain Name, IMEI=IP Address, but for cellular networks.

Xander

@Adnan @AntonyVennard And, MetroPCS does operate a CDMA network, so that's the most obvious cause.

Antony Vennard

I wonder if, in light of this, we should actually answer his question?

Maybe he made an emergency call and they are trying to call him back?

I don't know if that's possible outside of the film I watched last night where somebody dialled 911 and hung up, and they were called back just in time to catch the villain.

Adnan

12:58

Say, I'm here in Finland and I'm powerful enough to ask providers to do what I want. I want to call someone in the UK or US. Let's say I know their IMEI and they don't have a SIM in their phone.

Xander

@AntonyVennard I dunno. It's technically interesting, but not related to IT Security.

Adnan

The only way to send a call to them is to broadcast that call request on all towers and make it so that it carries the phones IMEI

Xander

@Adnan I don't think it works like that. I don't think you know their IMEI. I think their provider knows that. You let the provider know you want to ring them, and the provider can look up their IMEI and connect a call, because their phone is still advertising (albeit IEMI only, and not a number, since no SIM) to the nearest towers.

Adnan

@Xander What provider? They don't have a provider! They're not subscribed.

And why would their phone be advertising the IMEI? To whom?

Xander

@Adnan Ah, yeah, good point.

The phone is advertising to any towers in range.

Adnan

13:06

@Xander Well, that's interesting. So when I buy a new phone, take it out of the box and put the battery and turn it on. No SIM or any subscription of any kind. Does that mean that every provider with coverage in my position now know about this?

Antony Vennard

GSM services

Global System for Mobile Communications (GSM) services are a standard collection of applications and features available to mobile phone subscribers all over the world. The GSM standards are defined by the 3GPP collaboration and implemented in hardware and software by equipment manufacturers and mobile phone operators. The common standard makes it possible to use the same phones with different companies' services, or even roam into different countries. GSM is the world's most dominant mobile phone standard. The design of the service is moderately complex because it must be able to locate a...

Adnan

@AntonyVennard But this doesn't apply here. They don't have a SIM in the phone.

Xander

@Adnan Yeah, I would expect they would.

Adnan

@AntonyVennard Plus, I have some-how basic idea about how GSM works.

Thomas Pornin

@Adnan Yes, each phone makes its presence known to the towers in range, if only to be able to pass emergency calls. The towers will see the IMEI, which is the phone identifier. The phone won't advertise a SIM (it has none) and thus won't subscribe to any call routing service, except the "emergency" routing service which does not require SIM-based authentication.

Xander

13:10

Ha. It's a dupe.

9

Q: Can Android phone running without SIM card be tracked (localized) by police?

I am running an Android phone without a SIM card. I am using it for web surfing. Can the police localize my phone using the cell towers (BTS)? In other words, I know Android phones emit radiations even if there is no SIM inserted. Can the service provider use these radiations to detecte where my...

android phone

Dupe-ish, anyway.

Thomas Pornin

@Xander I notice I said there just the opposite of what I say here.

This is disturbing.

Xander

@ThomasPornin Learn something new along the way? :-)

Thomas Pornin

@Xander It depends on what the phone tries to do, in fact.

Whether the phone, without a SIM, will act as an emergency-only phone, or will just abstain altogether from doing phone-related things (i.e. turns into a suboptimal-sized tablet).

Xander

@ThomasPornin That makes sense.

Aren't there typically legal obligations that they must operate as emergency only phones if the radio is on? (I.E., not in airplane mode) I'm fairly certain that it's law in the U.S., in any case.

Thomas Pornin

I think the law is that cell towers MUST honour and route emergency calls, for free, even for non-subscribers.

Xander

13:23

@ThomasPornin Ah, ok.

Iszi

13:53

Methinks this is ready for some diamond power:

-3

Q: Is receiving a phone call on a mobile with no sim attached a sign of law-enforcement tracing my calls?

Someone described this set of circumstances and I would like to know if it is possible to determine if the phone was being traced by law enforcement? Received "questionable" phone call. Disconnected call. Removed battery/SIM/Micro SD and replaced battery. Factory reset the phone Turned the ph...

mobile

Adnan

@ThomasPornin So a call can still be routed to you if you don't have a SIM?

Transcript for