kkl

I didn't understand the motivations of virtual ethernet right away but this presentation piqued my interest. If you are (like me) and not a low-level networking person, I found this write-up on switchd to be an good compliment to this presentation:

https://ttboj.wordpress.com/tag/switchd/

Two job titles that come to mind:

* Penetration Tester

* Security Engineer

Those should bring up quite a few results.

This is a great paper. Basically, AES-GCM fails when nonces are repeated. If that sounds like a impossibility, it isn't. The authors found several TLS implementations that had faulty nonce generation algorithms. Notably, one device would send the same 8 bytes of uninitialized memory as it's first and second nonce in a connection.

Signal does not require an Android device.

Some relevant background information on this issue:

https://github.com/LibreSignal/LibreSignal/issues/37

You just sold me on a Pinboard account. That is great.

A number of comments in this thread appear to suggest that Lavabit was end-to-end encrypted. It was not.

https://moxie.org/blog/lavabit-critique/

There are known biases throughout RC4 output. There are really bad biases towards the beginning. A small file would likely be XOR'd with certain bytes or patterns of bytes. If this is not exploitable in your hypothetical scenario, it maybe exploitable in others. I think this is generally unsafe.

I do not know of any attacks against encrypt-then-MAC CBC-mode but I believe at least part of the rationale behind the migration away from CBC-mode is due to increased complexity of decryption. With CBC-mode decryption I have at least one extra step (validating padding), which as the blog post mentions has been troublesome.

Thanks for clarifying. That is a really concise explanation.

To make sure I understand correctly:

Suppose I had the magical ability to find a special value that would equal the IV listed in the link (i.e. 506b0178ff6d1890....) when that special value was applied to SHA-1. I could then use the results from this research to compute a collision using input that is prefixed with that special value?

Neat. I have also seen one of the authors do videos called "Watching YouTube The Hard Way" (unsure of exact title) which is a similar concept.

A somewhat-related honeypot that I have seen:

Include a directory "visiting-this-will-ban-you" in your robots.txt that IP bans whomever visits it.

What great timing. I _just_ finished a Minimax algorithm to programmatically play the game of Rota. I did this as fun project to teach myself Golang. If this article seems interesting to you, I would suggest doing something similar.

Awesome. Thanks for the correction.

The CCC is an fascinating organization that hosts really interesting talks (among other things). Where else can you see talks titled "Mexican Botnet Dirty Wars", "Encrypted Email for Planet Earth", and "Basics of hydroponics" in one place?

I can spend all day just poking around their YouTube channel. https://www.youtube.com/user/CCCen

It is likely in response to this: https://community.rapid7.com/community/metasploit/blog/2015/...

Why would you prefer CTR over CBC (assuming properly authenticated)? The only benefit I could think of is performance.

Company: Praetorian

Location: Austin, Texas

Tags: REMOTE

Positions: Security Engineer (Penetration Tester).

More details at our careers page ( http://www.praetorian.com/company/careers ).

Hello from Praetorian! We are looking for Security Engineers who like to break things. If you consider yourself a builder and a breaker and see an alignment with our vision, please apply.

We recently updated our careers page so all relevant information should be there! Feel free to email me (kelby.ludwig+hn AT praetorian.com) if you have any questions about anything that is not mentioned on the careers page.

To Apply:

Please apply through our careers page and mention this post. Applications sent through the careers page are sent directly to me. For bonus points, please also include a short paragraph or two on what you are passionate about. Part of the interview process involves the completion of one of our technical challenges. If you would like to get a head start, please check out our tech challenges page ( http://www.praetorian.com/challenges/ ).

This! I do not use Facebook but would love if this leads to increased interest in using asymmetric crypto to encrypt automated notification emails.

I wonder if this was inspired by the recent #talkpay trend on Twitter. Announcing your salary on Twitter is not the best idea. It will likely to be found by a recruiter and then (possibly) used against you in negotiations. I support the transparency, but I do not know if this trend is in one's best interests.

What a nifty blog. I find visualizations incredibly useful when developing a deeper understanding of some mathematical concept so I am certainly bookmarking this. Another blog I find useful in this regard is Better Explained[1].

[1] http://betterexplained.com/

I am under the impression that attribution is a very difficult and often impossible process. If that is true, what is the point of including "Russian" in this headline? I would guess the most probable response would be something involving "fulfilling a narrative." Even if that is true, what makes "Russian" hackers more exciting then just "Hackers?"

I am not trying to pose some profound question. I am genuinely confused by this.

Beautiful. This article made me smile. I also like that the author gave a simple "how-to" at the end in case I wanted to try it myself (i do!).

This is a poisonous attitude to have with regards to the security of applications that you built. I hope that you take these claims seriously. Otherwise, I have no desire to use anything that you have built.

This is a fantastic book. I recommend both the section on Google Chrome [1] and GHC [2]. Regardless of your level of interest in web browsers or compilers, they are both really educational and interesting reads.

[1] http://aosabook.org/en/posa/high-performance-networking-in-c... [2] http://aosabook.org/en/ghc.html

I had the opposite experience. My speakers were all the way up and I scared myself.

I'm sure you have checked out the official documentation (http://lcamtuf.coredump.cx/afl/README.txt)?

Fuzzing Python programs with AFL will be hard. AFL leverages a version of the GCC compiler to instrument (add additional code to) the resultant binaries. Because Python is not a compiled language this will be difficult. I'm sure there is something you could do to make it work.

Afl-fuzz is really amazing. The only thing that bums me out about it is that it is not as open as it could be. From AFL's documentation:

"PS. If you wish to submit raw code to be incorporated into the project, please be aware that the copyright on AFL is formally claimed by Google..."

I'm assuming that this would make forks unlikely or impossible?

Interesting. The D-Link security advisory (http://securityadvisories.dlink.com/security/publication.asp...) states that the issue was only partially resolved. What was changed (aside from adding an additional buffer overflow) in the patch that attempted to alleviate these issues?