void-star

Can somebody actually comment/back-up the comments about how open or not this effort is?

I could see legitimate benefits from this kind of collaboration (it's ultimately about the ability to process data, not the data itself, after all) But I do also wonder if this reduces to the banal abuse of personal data that is suggested here.

buy it anyway. it's for a good cause

This is so true. It has been a number of years since I worked with either agency doing computer forensic work, but my experience was pretty much the exact same. While SS consistently made a concerted effort to investigate crimes and build a solid case, FBI seemed often to be interested primarily in raising the public profile of the cases they worked on to get more visibility in the press, often at the expense of (what appeared to me at least) due process.

Whereas SS had a number of excellent specialists who understood acquisition, the FBI seemed to be wearing clown-shoes most of the time. I'm not surprised at all that they botched this case so badly.

It's clear as day that Apple is on the right side of this argument. It's not their job to bail out the FBI for yet another colossal screwup. Especially not when it damages their product so severely.

As to the second point. This "fiddling" with "miscellaneous" input characters could also be interpreted cover brute-forcing login attempts. I'm not sure that's a good precedent...

So... FWIW, I totally don't have these problems with twitter. It's probably because I only check my twitter feed and spout out a few tweets at a time once every two weeks or so and pretty much ignore it the rest of the time.

Full disclosure: I don't use any other social network besides twitter, either. It's because it's so non-committal that I can deal with twitter...

ptrace is actually a more reliable way to get at remote process memory on Android, I think. I'd suspect this before /proc.

Also, /proc nor ptrace is "useless". Both are actually fundamental to several aspects of the underlying system that zygote runs on.

Well... how do you suppose the API gets at all the things? (not everything is done across IPC/binder, much is in process)

Sorry, this doesn't really address the OP question.

But this discussion got me wondering. If Apple's claims that Swift is faster than obj-c actually prove to hold up, would it be possible/worth-it for something like RubyMotion to compile down to Swift/native instead of obj-c (at least for the "good" parts)?

There's a term for that. It's called "having a false sense of security".

You're better off not storing your passphrase in the keychain and just typing it in that one first time, though. But it's still marginally better than an unencrypted private key for automation if you need a 100% unattended setup.

Yep. The general technique of scraping memory for private keys and certificates a pretty well-known and established. Particularly in forensics and malware circles.

I don't point it out to engage in the "who was first" thing. But to point out that this is very much an applied attack in the real world. Real attackers (includes "forensics analysts", incase you don't consider them "attackers" too) have been using this technique in malware as well as countermeasures/investigations for quite a while, now.

See: http://www.trapkit.de/research/sslkeyfinder/

https://github.com/emonti/yara-ruby/blob/master/samples/sslk...

http://volatility-labs.blogspot.com/2013/05/movp-ii-21-rsa-p...

EDIT: actually a much earlier discussion is from '98 by none other than Shamir

https://www.cs.jhu.edu/~astubble/600.412/s-c-papers/keys2.pd... [PDF]

Actually, like I said, I didn't even read the rest... so it wasn't an assessment on the article at all. It was an assessment of the author.

But here's a job tip: Don't talk about women like this. If you get a job, you will actually have to work with some. Also this level of immaturity will make your job search that much harder.

This may very well have been an excellent piece. But, the author lost me no later than 2 sentences in with his immature and sexist "nerdy girl" analogy. I just didn't even bother to read the rest. Working in silicon valley myself, I already waste enough time on people who think this kind of immature male mindset is okay.

Wireshark dissector plugin? taken down? I haven't really followed wireshark goings-on in a while, but wow... just wow... I don't think i've seen this before:

https://github.com/davidgfnet/wireshark-whatsapp

My apologies for the bile, but I can't help but call out my reactions to this news...

1. facebook (you: I expected this from, you we're already #1 on this s#17list) 2. whatsapp (sell-out!) 3. github (highly disappointed watching you just lay down and immediately comply shutting down these repositories)

I'm considering moving all my code off of github over this...

Not exactly. iOS 7+ introduced Cocoa<->Javascript bridging capabilities in the public APIs. Before that, similar iOS APIs had existed as "private" ones (so, very uncommonly used outside of apple's own apps).

iOS doesn't bridge Javascript to _Java_ which is why this particular attack wouldn't work. But the JS<->Cocoa stuff is still pretty young, so wait and see ;)

Numerous App Store apps contain symlinks around the detached codesignature, most likely caused by changes over the years to the codesignature utility. Also in keeping with Xcode semantics, embedded frameworks often contain symlinks as well.

Triple boot to iOS and I'll think about it...

Yea, i'm not sure why they bothered to try to obfuscate the dst address at all, the article mentions siri...

ProTip: when whiting out your wireshark packet captures, always remember your hexdump:

dst=17.130.16.4

    $ whois 17.130.16.4

    ...

    NetRange:       17.0.0.0 - 17.255.255.255
    CIDR:           17.0.0.0/8
    OriginAS:
    NetName:        APPLE-WWNET
    NetHandle:      NET-17-0-0-0-1
    Parent:
    NetType:        Direct Assignment
    RegDate:        1990-04-16
    Updated:        2012-04-02
    Ref:            http://whois.arin.net/rest/net/NET-17-0-0-0-1

    OrgName:        Apple Inc.
    OrgId:          APPLEC-1-Z
    Address:        20400 Stevens Creek Blvd., City Center Bldg 3
    City:           Cupertino
    StateProv:      CA
    PostalCode:     95014
    Country:        US
    RegDate:        2009-12-14
    Updated:        2011-03-08
    Ref:            http://whois.arin.net/rest/org/APPLEC-1-Z

    OrgTechHandle: ZA42-ARIN
    OrgTechName:   Apple Computer Inc
    OrgTechPhone:  +1-408-974-7777
    OrgTechEmail:  droot@apple.com
    OrgTechRef:    http://whois.arin.net/rest/poc/ZA42-ARIN

    OrgAbuseHandle: APPLE11-ARIN
    OrgAbuseName:   Apple Abuse
    OrgAbusePhone:  +1-408-974-7777
    OrgAbuseEmail:  abuse@apple.com
    OrgAbuseRef:    http://whois.arin.net/rest/poc/APPLE11-ARIN

    RTechHandle: ZA42-ARIN
    RTechName:   Apple Computer Inc
    RTechPhone:  +1-408-974-7777
    RTechEmail:  droot@apple.com
    RTechRef:    http://whois.arin.net/rest/poc/ZA42-ARIN


    ...

EDIT:

also

    subject=/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=California/businessCategory=Private Organization/serialNumber=C0806592/C=US/postalCode=95014/ST=California/L=Cupertino/street=1 Infinite Loop/O=Apple Inc./OU=Siri/CN=guzzoni.apple.com
    issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL SGC CA

Not trying to bring up a language war or jump on the wagon berating ruby "magic" (so tired of those conversations. I love the dynamic nature of ruby.

That said... the code examples in this article are exactly the patterns that were leveraged (and are still being leveraged) to exploit the recent wave of object serialization vulnerabilities via YAML/JSON/XML (including the one that popped rubygems.org recently)

see: https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...

Just be super careful when using code like this, it can have very unintended consequences when you bring object remoteing into the mix.

agreed. Squash is finely tuned with a set of features to fill in gaps found in another very popular commercial tool in the same vein.

tl;dr: don't knock it till you try it!

pretty good writeup - miss the days when contrived examples were considered a cop-out though ;)

congrats to bufferbox, and kudos on an excellent slogan: "let us handle your package" <immature snicker>

Wow ok.. I'm going to try to be polite. I don't think _you_ tried it as you suggest I do:

first shot: ~ gcc -o foo -ggdb foo.c foo.c: In function ‘main’: foo.c:31: error: ‘flippedPoint’ undeclared (first use in this function) foo.c:31: error: (Each undeclared identifier is reported only once foo.c:31: error: for each function it appears in.)

Typo fixed: s/flippedPoint/secondPoint

what's the output?

    "{1, 2}{-1, -2}"

EDIT: Yours is actually an interesting example, and you're right, i responded to quick from the typo fix and didn't actually grok it.

But, actually we're both wrong... and right? The real answer turns out to be a bit more complicated. In your example the copies are made (automatically) in the caller (main) which actually passes a pointer to flipPoint. Try disassembling your executable. You'll see what I mean.

This is really far off, actually.

I don't mean to criticize. I think the best advice is to read K&R C again. And, as some other posters have suggested, take a look and at least a passing understanding of the memory model and assembly code generated by C/C++ compilers.

You'll see, for instance, that type information is not stored as a field in a C struct at all, it's purely a distinction for the compiler to use. A C struct, indeed any type of data in C, is _just_data_ in memory. At the machine level, there's no such thing as a type. Just registers, memory, and instructions. The compiler uses type information to generate the right instructions to handle the type.

And to clarify, type metadata _as_actual_data_ can exist in higher level languages, but it's definitely not a C thing.

On the contrary, I think inventing a new class of of "call-by-X" function arguments makes it harder to explain Python to newcomers. I would clarify that I think I'm talking about seasoned programmers, and you probably mean somebody who's a fairly new to programming in general. It's a tough balance to strike, but I still think common semantics are best.

The concepts of call-by-value vs call-by-reference are simple and easy to distinguish once somebody has understood this basic concept in languages. I don't mean to disregard newcomers, though. And in-fact I think that it is doing a disservice to them to make python sound like it is radically different and more complicated than other languages. Instead I think a newcomer is best served by helping them grasp basic, common language concepts as they apply to python as well as other languages.

I really also need call out that there seem to be a lot of inaccuracies with regards to other languages than python on this thread and even some confusing terminology and analogies by the article's author. Specifically there seem to be a lot of misunderstandings about C (and even C++) flying around and being perpetuated here.

For example, you compared passing a python object to passing a struct in C. Passing a C struct to a function does _not_ copy all the fields of the struct. It passes a reference (pointer) to the function, which the function then uses to access the fields (or properties if you will) in the struct directly at their original location in memory.

You do get automatic copies of primitive numeric types when you pass them to functions in C. The reasoning and distinction is pretty simple: they fit in hardware registers.

But, a struct, an array, or a string (or character array) is always going to be passed as a pointer. When you pass it to a function, the only way you get a copy of it is if you explicitly copy the value to a new location in memory and point to it. You can of-course also pass a pointer to a numeric value to a function as well (as in func(int *var)) instead of the actual value (as in func(int var)), in which case the same semantics apply.

This analysis is how I've always understood the distinction between call-by-value or reference.

I think the author of the article is a little confused about C++ as well, or perhaps just doesn't have a firm enough handle on it to be able to articulate the distinction between a location in memory and the value at a location in memory.

So, if somebody sends this link to Donald Trump and he reads it? Is he responsible for full fines from that point on?

I suppose he could actually afford the royalties...

Good to hear news from OLPC. This is an interesting piece, if a little 'fluff'y.

I tried iTerm for about a year. After getting fed up watching it lag or crash all the time. I definitely went back to stock Terminal and haven't looked back.