The InfoSec Megathread - The Something Awful Forums

The Something Awful Forums > Discussion > Serious Hardware / Software Crap > The InfoSec Megathread

Syano: Jul 13, 2005

CloFan posted:

To expand on my background, before I got a job at the bank I worked as an IT tech at a college for three years. Little bit of everything there, but mostly networking- I can easily see how my background there has helped the transition.

This is really not as uncommon as you would think. A lot of verticals like to hire folks that have good knowledge of the associated industry first and IT knowledge second instead of the other way around.

# ? Feb 20, 2013 14:17

Adbot: ADBOT LOVES YOU

# ? May 21, 2013 02:28

Powercrazy: Feb 15, 2004; *~I'm Back Boyz~*
_{If you can read this your style sheet is a PoS.}

Also real networking already deals with security on all levels except the specific application User credentials. nothing irritates me more than "security" guys who don't know networking, seems like it should be a prerequisite.

# ? Feb 20, 2013 17:29

CloFan: Nov 5, 2004; In case you haven't noticed, I'm a pilot.

psydude posted:

What are some industry publications y'all read? It'd be nice to stay on top the flavor of the month for different types of attacks.

http://www.bankinfosecurity.com/

Scroll all the way down and there some other *infosecurity.com sites they run.

# ? Feb 20, 2013 18:29

Drunk Badger: Aug 27, 2012

"Data Breach Today" sounds like something that would run after the farm report on PBS.

# ? Feb 20, 2013 18:43

JawnV6: Jul 4, 2004; so hot...

Jabor posted:

I guess the processor MMU could gently caress around with physical addresses to do something, but I don't know why it would - that's literally why virtual memory exists. Are you aware of any existing processors where the MMU screws with addresses before the virtual memory remapping?

You're missing a chunk of the processor picture. There's a couple things you're clubbing together as "the MMU". I'd break it up as the MMU on the core itself and the Memory Controller (MC) on what used to be the Southbridge. The MMU is responsible for translating virtual addressing to physical addresses (and guest physical/host physical). Once you're outside the core, every address is physical. This includes memory transactions from agents besides the core (PCIe cards, graphics, USB devices, etc.) that the System Agent is also shuffling around. The MC takes physical addresses and handles the scheduling and address translation to the DIMMs. The DIMMs don't really care about how they're addressed, as long as you're accessing the same bank/rank, you're hitting the same data. So the MC is completely free to assign whatever physical address to whatever location on whatever DIMM that it wants.

This can impact performance in a major way, imagine a workload that's just reading and writing sequentially. If the MC put adjacent addresses on the same DIMM, any refresh kills you for however many ms. If adjacent addresses are spread over both DIMMs, a refresh only blocks half of your transactions and the rest can keep chugging along. I'm handwaving a little here, but the point is that the MC can arbitrarily assign PA's to DIMM locations and does.

If you're booting on the same system it would solve some of the problems, but if you're at the point of bringing up an OS that implies some memory map munging that might not be trivial to undo. This is why I thought it was possible the attack relied on techniques similar to HDD recovery, where you're taking some data and assuming the metadata is missing but still trying to reconstruct.

OSI bean dip posted:

RAM does not necessarily flush out the contents after power-down but it "degrades" as soon as no more electricity is fed to it. In the case of a cold boot attack, you are unlikely to power the machine down without using normal OS means, so you end up with a more or less static snapshot of what is in memory at that time. The reason why you're freezing the memory is to slowdown the degradation of whatever is left in memory but you can still have success if you do it without cooling the chips down, it's just less likely.

When you swap the module into another system (or the same one too) after having done so and then power it on, it still has the chance of having a good sizeable chunk of data that is accessible. It is at this point that you can use a minimalist operating system to read the data and dump it into a file that you can then later look at. The memory is stitched together as a typical memory dump albeit with likely errors.

I'm very familiar with the electrical side of DDR, was just trying to give enough info for people to recognize the type of attack I meant. The "stitching together" looks like a non-trivial problem, but it looks like nobody's even trying to do that in the first place.

OSI bean dip posted:

It is quite a lot of work to remove the modules and then swap them into another machine and it does require a lot more intrusion than it might be worth. If I were to go about performing a memory dump, I'd instead consider looking something that uses DMA like firewire.

I would look at this tool if my answer didn't help:
http://www.mcgrewsecurity.com/tools/msramdmp/

DMA avoids the problem entirely, you're coming in as a device speaking physical addresses, the MC choices I'm thinking of won't be visible from that approach. I'm also getting the impression the original Princeton attack was geared towards recovering a specific encryption key. Seems like that's an easier problem than trying to recreate something that might span a couple pages.

Thanks for the answers

# ? Feb 20, 2013 19:24

Varkk: Apr 17, 2004

Lets take a moment to remind ourselves that law enforcement still don't understand computers or data security
http://www.stuff.co.nz/national/cri...ks-secret-files

quote:

One document, an affidavit supporting a High Court application for search, seizure and surveillance warrants, records the details of an informant considered particularly reliable because of his role in an earlier case that led to the conviction of a senior gang member for violent crimes.

Those details are blacked out in the pdf file the police provided, but text under the black screen placed over it is revealed by the simple process of copying the file into another document.

How many times has this happened now? Also it is not just electronic security they have blundered. I remember a case a couple of years ago when some officers served a search warrant on a house. Then when they finished they left behind a paper notebook containing all kinds of confidential information including the name/contact details for the anonymous informant who supplied the evidence to get the warrant in the first place. Of course the guy whose house it was that got searched did the first thing any criminal in that situation would do and passed it on to a newspaper reporter.

# ? Feb 20, 2013 21:16

Ninja Rope: Oct 22, 2005; Wee.

I don't know that rank/bank matters so much for passwords, as something like 'strings -n 8 /dev/kmem' would probably work pretty well. It would gather a ton of other data but but the number passwords to try would still be less than ~95^8.

What is the stripe size, so to speak, for DIMM ranks/banks? Is it tied to the platform page size? Passwords are pretty short and probably wouldn't span pages, though if you're serious there's no reason you couldn't find the same model chipset to put your stolen DIMM into.

# ? Feb 21, 2013 01:09

Drunk Badger: Aug 27, 2012

Anyone given this a try?

http://www.symantec.com/theme.jsp?t...iness-challenge

There's one coming up in my area soon, if nothing else it seems like a good reason to skip class for a day.

# ? Feb 21, 2013 16:33

Syano: Jul 13, 2005

Drunk Badger posted:

Anyone given this a try?

http://www.symantec.com/theme.jsp?t...iness-challenge

There's one coming up in my area soon, if nothing else it seems like a good reason to skip class for a day.

No but any Symantec presentation that does not end in that HORRID Gangnam Style dance by their employees should not be attended.

# ? Feb 21, 2013 17:53

ming-the-mazdaless: Nov 30, 2005; Whore funded horsepower

Drunk Badger posted:

Anyone given this a try?

http://www.symantec.com/theme.jsp?t...iness-challenge

There's one coming up in my area soon, if nothing else it seems like a good reason to skip class for a day.

Oh, a Sun Tzu quote. Nothing says we don't understand security or Sun Tzu like using Sun Tzu quotes to advertise security.

# ? Feb 21, 2013 20:22

Martytoof: Feb 25, 2003; Awesome.

Awesome to
the MAX.

Powercrazy posted:

Also real networking already deals with security on all levels except the specific application User credentials. nothing irritates me more than "security" guys who don't know networking, seems like it should be a prerequisite.

I've been going to a lot of security meetups lately trying to get a leg up in making some contacts, and you'd be absolutely baffled how many times I've gotten a "wow, you've got a CCNA? it's awesome to see someone interested in security who also knows networking!". It's a small internal struggle not to make a

face. I'm seriously hoping its just the meetups I've been going to and not indicative of the actual state of security professionals in the area.

I mean not to poop on a CCNA because I guess I do know a fair bit about a bunch of stuff now, but I've never really thought of it as anything all that impressive.

# ? Feb 21, 2013 20:40

XakEp: Dec 20, 2002; Amor est vitae essentia

Martytoof posted:

I've been going to a lot of security meetups lately trying to get a leg up in making some contacts, and you'd be absolutely baffled how many times I've gotten a "wow, you've got a CCNA? it's awesome to see someone interested in security who also knows networking!". It's a small internal struggle not to make a face. I'm seriously hoping its just the meetups I've been going to and not indicative of the actual state of security professionals in the area.

I mean not to poop on a CCNA because I guess I do know a fair bit about a bunch of stuff now, but I've never really thought of it as anything all that impressive.

Ok, so this brings up something I've been wondering about. I'm wanting to transition from Network Engineering to Penetration testing. What are some good regular meetups to go to? I'll probably start going to my local ISSA chapter, but I'm not sure where else to look. Thoughts?

# ? Feb 21, 2013 20:42

OSI bean dip: Aug 5, 2004; So why'd you collect 30,000
gigaquads of data on
the subject?

ming-the-mazdaless posted:

Oh, a Sun Tzu quote. Nothing says we don't understand security or Sun Tzu like using Sun Tzu quotes to advertise security.

Relevant:
http://attrition.org/security/rant/fsck_sun_tzu/

# ? Feb 22, 2013 00:10

psydude: Mar 31, 2008; Perry'd.

Martytoof posted:

I've been going to a lot of security meetups lately trying to get a leg up in making some contacts, and you'd be absolutely baffled how many times I've gotten a "wow, you've got a CCNA? it's awesome to see someone interested in security who also knows networking!". It's a small internal struggle not to make a face. I'm seriously hoping its just the meetups I've been going to and not indicative of the actual state of security professionals in the area.

I mean not to poop on a CCNA because I guess I do know a fair bit about a bunch of stuff now, but I've never really thought of it as anything all that impressive.

Are you willing to relocate to DC and obtain a clearance?

# ? Feb 22, 2013 00:21

GOOCHY: Sep 17, 2003; In an interstellar burst I'm back to save the universe!!