Ubuntu pollen. You send it a "challenge" string. It responds with SHA512 of that challenge. Then responds with SHA512(challenge, tag, random_bytes). The "tag" parameter is sent along with the challenge. I'm not sure what it's used for.

Is pollinate as brainless as it seems?

The server script is all just one short file. The client is a shell script that uses curl.

@FutureSecurity What, compromising a mobile device via baseband?

It's certainly possible, though newer devices use an IOMMU-like device to attempt to isolate the baseband firmware (which is usually based on L4, and apparently many devices actually use seL4!), but vulnerabilities in the non-kernel code still exist.

It's harder to compromise than it used to be with e.g. GSM basebands, but still possible. I would definitely not use a cell phone for anything extremely sensitive.

@FutureSecurity Yes. Yes it is.

@FutureSecurity I'm not an expert in GSM or old mobile cell communication protocols, but I don't think there is any standard, supported "reverse dial with no ring". There are silent SMSes which can be sent that are received by the device but ignored, with the user not being alerted, and there are "pings" that let a cell tower triangulate / trilaterate a device's location. And all phones are required to give up their location for e911 (whether by pings or GPS). The e911 spec was leaked some time ago.

And, of course, a RCE exploit could turn a phone into a remote listening device.

Those signature scheme questions are less annoying than the authenticated encryption ones from last week, mainly because they are relatively well written. But it's still someone abusing the site as an oracle to break half-baked ideas. :-/

Hopefully it'll pass.

Thanks at @J.J ; I think everybody is grateful to the work @e-sushi did here - all the more reason to thank him separately. The least we can do is to fill his mailbox to the brim yet another time :P

Mod-position, although I think he might spend some less time here.

And yes, I asked him the same...

That's kind of the point, yes.

Well, if the degree of the polynomial is at most 9 and you know which field it's defined over, you shouldn't have a problem.

@J.J which CTF

Baseband. Can never remember that term. Also had difficulty finding Hayes command code. I strongly suspect I heard a rumor in Schneier blog comments. I need to unlearn those things.

I saw a command described as make call with (modem) speaker disabled. Most of those codes look like they're used for debugging purposes. Don't know if "modem" means the phone speaker itself or if it primarily refers to dial-up internet or fax machines.

I did more searching related to CSRNG bugs. I saw someone responding to the Android 4 SecureRandom bug. "SecureRandom has been around since jdk 1.3" (No... it was 1.1) "If that bug went around undetected for all these years who knows what other bugs there are."

It's pretty aggravating. Programmers don't fully understand the difference between implementations and specifications. The Android SecureRandom bug was due to Google copy-pasting Java code. In this specific case it came from Apache Harmony.

But I guess this person thinks "Before jdk 1.3 is insecure" (because of one implementation's bug) "After jdk 1.3 is probably insecure because there are likely still bugs." "Therefore never use SecureRandom and instead hash the current time, environmental variables, and other silly things and make your own userspace RNG..."

urgh

that's all I can think to say about that

I guess not: if they're willing to do that work, why don't they help work on SecureRandom and fix bugs so that everyone benefits.

Contributions from those type of programmers is probably the origin of those bugs.

does nobody review their contributions before merging them? That would be insane, especially for security related code

But it's SecureRandom. How could there possibly be a security issue?

@EllaRose @Maeher I loved the fact that somebody pasted code at Android Snippets where SecureRandom was used for key derivation from the seed. And then Android switched to an implementation where the seed was just added to the entropy pool of OpenSSL. LOL.

To be fair, it was a very good way of keeping the plaintext confidential :P

Oh, and Android switched to OpenSSL for the algorithm "SHA1PRNG" because everybody was using that. Talking about misinformation.

I did not understand the attack point in bleepingcomputer.com/news/security/…

How an attacker can use this attack, if I only connect to a USB charger?

@MaartenBodewes Who needs completeness when it's secure?

I would be okay with SHA1PRNG not using SHA-1 and just use it as a legacy alias for a default. Like arc4 in Open BSD.

@kelalaka They cannot, but they can leave their own charger laying around. Also works with Apples and other laptops that charge through USB :)

@kelalaka "These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations."

I.e. you have to connect to their USB charger.

Maybe pickpocket a person's original charger and reverse-pickpocket an identical looking malicious charger in its place.

But yeah, somebody left an Apple charger in a shared office...

No need, if people will find a lone charger they are happy enough to connect to it.

It's only charging after all, and they borrow chargers from their family / friends all the time.

Depends on if you're targeting people or person. Some people you would want to hack wouldn't trust it.

Does operator can send this commands?

Cell Operator

@kelalaka why do you want to migrate this question?

I see no reason why it should be off-topic here

it's a simple question of password-based key confirmation

which is entirely done using cryptographic operations in "a protocol" between the user and a future version of said user

@SEJPM let me correct once for all. Where is the borderline of this type of questions?

@kelalaka what do you mean "this type"?

password protocols, entropy of passwords,

@kelalaka passwords and their protocols in general are on-topic

usually questions which relate more to database issues are for infosec

or where it's a more general question of user authentication

I see, What about database integrity etc..

so maybe a better phrasing: Questions which can't be immediately answered using only a combination of cryptographic schemes but also require policy decisions should be migrated

@kelalaka if the Q is very crypto-heavy (eg asking about cryptDB or something or some specific scheme), then it can stay, if it also needs to consider bugs and other "pesky implementation details" it should be migrated

Then I can post/and answer about how much we can provide integrity/authentication etc. for the databases.

@kelalaka oh, you can always answer questions. If they're off-topic and need migration the answer will be migrated as well.

@kelalaka well, if the question is very crypto-heavy, yes.

thanks.

When in doubt about this particular issue post on InfoSec and they'll user-migrate it over here if they feel it's too heavy

too heavy, lol

It is much clear now :)

or say, if you need more MathJax then belongs to here :)

I'm pretty sure that security.SE also offers MathJax though.

Nope

@kelalaka Thanks, resetting memory... rebooting in one minute.

?

Back again, yes, security.SE of course does not use MathJax.

If something malfunctions you reset it.

Actually, I was once in a hospital at the neurology dept, and there was a girl who's brain actually reset. Result: collapse and relearn how to walk, thank you very much. Apparently a badly wired brain does have a reboot option. Very scary stuff.

I could use more of a brain reboot than sleep provides, but not that extreme.