Hacker News Reader

besselheimon Show HN: A fork of sudo with Touch ID support

One example relating to OS X is that malware running as root can defeat anti-keylogger protections such as this: https://developer.apple.com/library/content/technotes/tn2150...

If you were running your web browser as root, and a malicious website used a vulnerability to drop some malware on your system, then it would have complete power to do what it liked without needing to escalate privilege using another vulnerability.

besselheimon Museu de la Tècnica

This reminds me of the similar joy of stumbling across a pianola museum in Amsterdam.

Always a pleasure to find such a well curated niche set of exhibits.

besselheimon Ask HN: Help me pick out a weekend project.

An online hex editor. Probably could do this fully in the browser.

besselheimon How can you tell if someone is kind? Ask how rich they are

Yet, aren't you also applying similar stereotypes to "leftists" here? Not everyone with a left-wing political outlook has the attitude you have described.

besselheimon What are malicious USB keys and how to create a realistic one?

Another approach - controlling the USB device over WiFi, so it can be remotely triggered at any time: https://www.sensepost.com/blog/2016/universal-serial-abuse/

besselheimon New lower Azure pricing

How do you mean? All current Windows versions and Linux distributions have built in support for running under Hyper-V, which the Azure hypervisor is based upon.

besselheimon Ask HN: How do you pass on your work when you die?

I used to concern myself with this, but eventually realised that it doesn't really matter, as I'll be permanently dead and gone. And in time, so will everyone who ever knew me.

In the grand scheme of things, we're all irrelevant. And in the end, none of this really matters.

besselheimon Windows 10 has an undocumented certificate pinning feature

You can, you just need to have someone reverse engineer the pinning mechanism first to figure out how to disable or bypass it, or alternatively, log the data being wrapped in TLS. Same as has been done on mobile platforms (e.g. HttPeek for iOS).

besselheimon Windows 10 has an undocumented certificate pinning feature

Looking at the list of domains, they appear to be almost entirely unrelated to telemetry.

Most likely this feature is a response to incidents such as this: https://www.wired.com/2011/03/comodo-compromise/ (in which certs for login.skype.com and login.live.com were misissued by Comodo).

Blocking the domains in this list to prevent telemetry, as suggested in other comments, would prevent access to most of Microsoft's online services. This includes third-party websites hosted on Azure that aren't using their own custom domain (.azurewebsites.net), and all software updates, including critical security patches.

besselheimon Skypeopensource2 – Skype client based on reversing Skype 5.5

The site I recall was Blogspot rather than Github: https://web.archive.org/web/20110602182718/http://skype-open...

besselheimon Skypeopensource2 – Skype client based on reversing Skype 5.5

I remember seeing an earlier incarnation of this around five years ago; I'm very impressed with the author's dedication to this project.

I don't know if it is still the case now, but I recall that earlier versions of Skype were quite heavily obfuscated and contained anti-debugging mechanisms. So it would have been quite an intricate reversing effort to get past these, on top of figuring out the protocol.

Over time, Microsoft has changed the Skype protocol significantly since version 5.5 so I do wonder how applicable this work is to the current crop of clients.

besselheimon Show HN: Grumbles.js – Detects when your users swear out loud

Agreed, it's neat to see an anti-feature being subverted such that it becomes a feature.

(The anti-feature being the enforcement of American prudity onto what should be an indifferent API.)

besselheimon New cloud attack takes full control of virtual machines with little effort

I suppose this would still be susceptible to this class of attack: https://www.usenix.org/conference/usenixsecurity16/technical...

Unless you're very careful about which ranges of physical memory are mapped to each VM.

besselheimon Chinese CA WoSign faces revocation after possibly issuing fake certificates

The root certificates trusted by Windows are fetched from Microsoft's servers as needed. You can download all of them using the command:

    certutil -generateSSTFromWU roots.sst

Then if you open up roots.sst (it opens in certmgr.msc) and sort by Friendly Name, you should see the WoSign roots. You can then export these and import them into the Untrusted Certificates store if you wish to block WoSign as a trusted root.

besselheimon Image Kernels explained visually

The previous discussion has some good comments and links: https://news.ycombinator.com/item?id=8966785

besselheimon Microsoft Live Account Credentials Leaking from Windows 8 and Above

Or both. Defense in depth.

besselheimon Microsoft Live Account Credentials Leaking from Windows 8 and Above

Until a fix is released, this can be mitigated by blocking outbound TCP connections on ports 139 and 445.

Individual users can do this using by setting up suitable outbound rules in the Windows Firewall with Advanced Security snap-in (wf.msc).

besselheimon Git for Windows accidentally creates NTFS alternate data streams

Using dir normally does not display anything related to the alternate data streams, but if you use the /r option, their names and sizes will be shown.

besselheimon Ask HN: How should the CLI be designed today?

It has "sls" as its alias, even easier to type.

besselheimon Most Used SDKs in Top 200 Free iOS Apps

Very interesting - does anyone know exactly what techniques they use to gather this data?

I'm guessing to some extent it must rely on a jailbroken iOS to get past the .ipa code encryption, as with this similar analysis: https://medium.com/ios-os-x-development/libraries-used-in-th...

besselheimon Ask HN: How do you view large JSON files?

> Really, the true advantage of a binary format is you generally assume that nobody messed with the data behind your back

I would rephrase that a bit and say the true advantage is flexibility, as you're not subject to the constraints of textual data.

The integrity of the data is a separate matter, and should be carefully verified rather than trusted implicitly. A huge amount of security vulnerabilities, and program crashes in general, come from errantly assuming that user-supplied data is correct.

besselheimon Ebay posts every character a user types into the password box

The passwords are not necessarily being captured in logfiles, that's a huge assumption. We don't know anything about how eBay stores and manages their web server logs.

besselheimon We're the core Urbit team, ask us anything about Urbit

> Sensible?! Hahahaha! This has to be comedy. They are bigint-encoding identifiers? There is no sane reason to do this.

This fixed machine-width type of character encoding isn't unheard of. For example, Windows uses tags of this size to identify chunks of memory associated with drivers: https://msdn.microsoft.com/en-us/library/windows/hardware/ff...

besselheimon How the Windows Subsystem for Linux Redirects Syscalls

You piqued my curiosity - just made one by extracting the syscall dispatch table from lxcore.sys and placing it alongside the Linux syscall list: https://goo.gl/QHGe1U

A lot of coverage there, but interesting to see which ones aren't yet implemented, at least in the recent build 14342.

(I used Filippo Valsorda's work from https://filippo.io/linux-syscall-table as the Linux syscall data source.)

besselheimon How the Windows Subsystem for Linux Redirects Syscalls

If you disassemble lxcore.sys you can still see hints of the Android subsystem project that it grew from: the \Device\adss and /dev/adss devices, the application name Microsoft.Windows.Subsystem.Adss, various function names containing "Adss", and some other textual references to Android.

besselheimon Ask HN: How do you encrypt your laptops?

I had the same issue with a second hand HP laptop. However, I could still log in as administrator on the Windows install, enabling me to dump the flash memory used to store the BIOS firmware and configuration, which included the password hash. Some reverse engineering later, and I was able to brute force the hash successfully. So that could be an option if the password is not stored in battery-backed memory, and you have a bit of time on your hands to get stuck into the BIOS internals.

besselheimon Indefinite prison for suspect who won’t decrypt hard drives, US government says

Unfortunately this won't work on most modern systems where the password hash is held in nonvolatile memory, rather than a battery-backed volatile store.

besselheimon Save Firefox

That's true, they treated Sklyarov most unfairly, given that it was entirely legal in his home country.

besselheimon Save Firefox

If the reversing and reimplementation happens outside of the US you can avoid the DMCA issue entirely. Or take steps to publish anonymously.

besselheimon 1M People Use Facebook Over Tor

Relative to the 2^80 (1,208,925,819,614,629,174,706,176) possible onion addresses, whatever they generated would be miniscule.