|
myron cope posted:Is this part true? I've used LastPass and 1Password, would be nice to know if I shouldn't be  (might get her a book, that's a darn good idea, even if it's less lazy than plugging in a USB and letting technology do the work)
|
#
?
Mar 24, 2019 23:39
|
|
|
|
| # ? Apr 25, 2024 20:44 |
|
|
OSU_Matthew posted:Not that I’m aware of, but I’ve done a few and collectively this seems to be about as good a place as any to post it. I just did one last week that was a USB pcap and I had to translate the hex into HID keyboard characters to get a pastebin url, which contained the base64 encoded flag. Last one I did before that was at codemash, and you had to find the login for a url and then use the browser tools to find the base64 flag hidden in the header. Once I finish up bandit my next step is hackthebox.eu, so I’m definitely interested in whatever ctf you’re doing. I didn't have a specific CTF in mind when I posted that, but I'm participate in them casually with my school's Cybersecurity club when I have free time. We do hackthebox'es a lot, those are very fun. And Ghidra is great, tho I have yet to completely explore it. The C decompilation is incredible. I have also contributed a little to the radare2 project, which I like alot. I have yet to checkout the Ghidra command line tool, I wonder if its comparable to radare2 - the command-line stuff is what attracted me to the latter.
|
|
#
?
Mar 25, 2019 04:25
|
|
|
Well, this is concerning. https://www.reuters.com/article/us-...eedName=topNews quote:“Based on our analysis, trojanized updates via URIs were deployed by ASUS’ live update server between June and late October 2018. These updates were digitally signed using two certificates from ASUS,” Duffourg said.
|
|
#
?
Mar 25, 2019 17:04
|
|
|
Glad I switched to Clevo!
|
|
#
?
Mar 25, 2019 17:42
|
|
|
I got a haveibeenpwned email, as the dump from the previously announced 500px hack has now turned up.
|
|
#
?
Mar 25, 2019 20:26
|
|
|
bull3964 posted:Well, this is concerning. Here’s a reddit forum from last yearr where ASUS users were talking about a suspicious software update ASUS was trying to install on their machines in June 2018: https://www.reddit.com/r/ASUS/comments/8qznaj/asusfourceupdaterexe_is_trying_to_do_some_mystery/ Awkward
|
|
#
?
Mar 25, 2019 20:30
|
|
|
Cup Runneth Over posted:https://motherboard.vice.com/en_us/article/j573k3/spyware-data-leak-pictures-audio-recordings I'd think an obvious thing to do would be to show the problem to Google & Apple security guys so they can revoke the app -- as just shown with the facebook spy-4-bucks app, they have the ability to pull the master switch on a developer. That wouldn't protect the poo poo that's already in an unsecured webserver, but it would at least halt the damage.
|
|
#
?
Mar 26, 2019 02:29
|
|
|
Klyith posted:I'd think an obvious thing to do would be to show the problem to Google & Apple security guys so they can revoke the app -- as just shown with the facebook spy-4-bucks app, they have the ability to pull the master switch on a developer. That wouldn't protect the poo poo that's already in an unsecured webserver, but it would at least halt the damage.
|
|
#
?
Mar 26, 2019 05:14
|
|
|
Yes, they should go to the FBI. The only way to stop that cache of amateur child porn and intimate secrets from being hosted, when the admins are unreachable and the domain hosts shrug their shoulders, is most likely to have the feds raid it and unplug the servers.
|
|
#
?
Mar 26, 2019 05:58
|
|
|
wolrah posted:It's a tough call, because while that would stop new content from being added they're also trying to not tell the world where to look for this unsecured cache of private data is before it gets taken down. Having Google/Apple throw the master switch would make it obvious pretty quickly. Now that they've published the article about it that's definitely true, but if they'd done it first and then published after? I don't pay enough attention to mobile app news, would a random lovely spyware app getting yanked attract a ton of attention? And that would have at least stopped the ongoing damage. As things are now, when there's no truly effective penalties for exposing non-medical data no matter how private, I almost think that's the best that can be done. Cup Runneth Over posted:amateur child porn  Like, it's real lovely if pictures of kids were being rifled through by creeps, but that's some shaky legal ground there junior g-man.
|
|
#
?
Mar 26, 2019 07:13
|
|
|
Hey, why don't you have a seat over there and tell us more about your theory of how these nude pictures of children technically aren't actually child porn.
|
|
#
?
Mar 26, 2019 07:36
|
|
|
Jabor posted:Hey, why don't you have a seat over there and tell us more about your theory of how these nude pictures of children technically aren't actually child porn. Context. The same image can be CP is one context and innocent in another. Let's not have this stupid discussion.
|
|
#
?
Mar 26, 2019 09:16
|
|
|
Klyith posted:Context. The same image can be CP is one context and innocent in another. That works for baby bath pictures, not for 13 year olds sexting each other and the pictures getting sucked in by poorly written spyware.
|
|
#
?
Mar 26, 2019 13:52
|
|
|
Yeah it's amateur child porn dude. These are sexts by teenagers. There's probably adult nudes on there as well, and there's plenty of other reasons it should be taken down, but that's the most salient and easiest to sell to a judge.
|
|
#
?
Mar 26, 2019 14:20
|
|
|
This topic makes me super super super uncomfortable.
|
|
#
?
Mar 26, 2019 14:36
|
|
|
Klyith posted:Context. The same image can be CP is one context and innocent in another. Context: you are a loving idiot.
|
|
#
?
Mar 26, 2019 14:49
|
|
|
CLAM DOWN posted:This topic makes me super super super uncomfortable.
|
|
#
?
Mar 26, 2019 14:57
|
|
|
The app is also marketed to abusive partners, don't worry
|
|
#
?
Mar 26, 2019 14:58
|
|
|
evil_bunnY posted:I mean spying on your kids is insanely creepy to begin with ....yes?
|
|
#
?
Mar 26, 2019 15:06
|
|
|
Volmarias posted:That works for baby bath pictures, not for 13 year olds sexting each other and the pictures getting sucked in by poorly written spyware. Cup Runneth Over posted:These are sexts by teenagers. Ok I'm an idiot, I apologize to the thread. I thought about the one thing, but not about that. (The article didn't say anything about that, I assume if they'd seen one in their random sample the FBI would have been an easy call.) OTOH there is good news, it's down now. https://motherboard.vice.com/en_us/article/7xnybe/hosting-provider-takes-down-spyware-mobiispy
|
|
#
?
Mar 26, 2019 18:34
|
|
|
Hooray, the power of journalistic pressure used for good!
|
|
#
?
Mar 26, 2019 18:56
|
|
|
See I don't know why Trump implied that Huawei is a threat due to state sponsored ties, they could of hammered home how incredibly inept they are. https://arstechnica.com/information-technology/2019/03/uk-cyber-security-officials-report-huaweis-security-practices-are-a-mess/ quote:One major problem cited by the report is that a large portion of Huawei’s network gear still relies on version 5.5 of Wind River’s VxWorks real-time operating system (RTOS), which has reached its “end of life” and will soon no longer be supported. Huawei has bought a premium long-term support license from VxWorks, but that support runs out in 2020. quote:it was discovered that “an unmanageable number” of versions of the OpenSSL library were allowed to be used in products—including some with known vulnerabilities. quote:The lack of consistent software builds means it’s difficult (at best) to determine whether a bug found in one version of software has been fully patched in another build.
|
|
#
?
Mar 28, 2019 20:21
|
|
|
incoherent posted:See I don't know why Trump implied that Huawei is a threat due to state sponsored ties, they could of hammered home how incredibly inept they are. In addition to China having a very difficult to diagnose and remove killswitch in all American 5g deployments and phones, you also have the same killswitch and remote code exploits available to any nation state actor or clever security researcher worldwide!
|
|
#
?
Mar 28, 2019 21:07
|
|
|
incoherent posted:See I don't know why Trump implied that Huawei is a threat due to state sponsored ties, they could of hammered home how incredibly inept they are. Incompetence is just par for the course, though.
|
|
#
?
Mar 28, 2019 21:27
|
|
|
incoherent posted:See I don't know why Trump implied that Huawei is a threat due to state sponsored ties, they could of hammered home how incredibly inept they are. In fairness this is always going to be 100% the case at any large organization. I've literally seen these exact problems at every company I've ever worked with.
|
|
#
?
Mar 28, 2019 21:55
|
|
Cat Army
|
University of Central Florida has their CTF this weekend: https://2019.sunshinectf.org/ My school's little Cybersecurity club 100%'ed UCF's other, continuously-running CTF: https://ctf.hackucf.org/challenges which had some truly inspired challenges. That one would be a great place to start (if not just some guides on Binary Exploitation and Reverse Engineering in general). The CTF's page says that the event is in association with the InfoSec conference Bsides Orlando. Anyway, I'm kinda stoked about this one, like I said my experience with their challenges has been that they are very well thought out but don't always require the most advanced BinEx techniques like advanced Heap exploitation, complex ROP chains, or like defeating aslr and stuff.
|
|
#
?
Mar 30, 2019 04:09
|
|
|
The Scientist posted:University of Central Florida has their CTF this weekend: This is awesome! Thanks for sharing!! I’ll poke into that this weekend. In other news, have more massive data breaches! https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/
|
|
#
?
Apr 2, 2019 01:03
|
|
|
Are there still any Blackhat zines or forums around? I'm not a Blackhat by any means, it just makes for interesting reading.
|
|
#
?
Apr 4, 2019 06:47
|
|
|
The Scientist posted:Are there still any Blackhat zines or forums around? alt2600 can still be bought at barnes and noble lol
|
|
#
?
Apr 4, 2019 08:04
|
|
|
The Scientist posted:Are there still any Blackhat zines or forums around? Manyhats.club discord might be a good place to look. Also i think one of my coworkers gets a quarterly mini magazine with interesting hacks or something like that... I’ll see if i can find a link
|
|
#
?
Apr 6, 2019 06:32
|
|
|
Anyone wanna group up and do some CTFs together? PlaidCTF is coming up in a few days http://plaidctf.com/ and the DEFCON Quals are coming up soon, also. https://www.oooverflow.io/dc-ctf-2019-quals/ Should be pretty fun.
|
|
#
?
Apr 6, 2019 23:50
|
|
|
OSU_Matthew posted:Manyhats.club discord might be a good place to look. Also i think one of my coworkers gets a quarterly mini magazine with interesting hacks or something like that... I’ll see if i can find a link Cool, just joined, thanks. The mini-magazine that you're describing sounds like 2600, which RFC2324 mentioned. Its good stuff, and I have read it off and on for years. EDIT: if anyone else is looking for discords to join, checkout the r/reverseengineering discord: https://discord.gg/VpYAn8w Although I do not condone anyone viewing reddit in lieu of SA. CygnusCyg posted:Anyone wanna group up and do some CTFs together? I will definitely be participating in this Plaid, though I'm not sure how well I will do. I have heard from experienced CTF's that this is a good one, but I bet will be challenging. We could use an existing discord server or something to live chat while we're working on them. As for the DEFCON one, lol, doubt I'd get a single challenge. Might just spectate whose tuggin fucked around with this message at 04:30 on Apr 7, 2019 |
|
#
?
Apr 7, 2019 02:50
|
|
|
I really want to do more CTFs, but I really need to brush up on my pen testing skills
|
|
#
?
Apr 7, 2019 03:27
|
|
|
I've done a bunch of Netwars and they're awesome fun
|
|
#
?
Apr 7, 2019 03:29
|
|
|
CommieGIR posted:I really want to do more CTFs, but I really need to brush up on my pen testing skills I’m currently working through this for personal edification at this point, but this is a good resource for OSCP, which is all the hacky bits: https://www.abatchy.com/2017/03/how-to-prepare-for-pwkoscp-noob E: The Scientist posted:Cool, just joined, thanks. The mini-magazine that you're describing sounds like 2600, which RFC2324 mentioned. Its good stuff, and I have read it off and on for years. Lmfao, RFC2324 is apparently HTPCP, or Hyper Text Coffee Pot Control Protocol https://tools.ietf.org/html/rfc2324 I love engineers 
Catatron Prime fucked around with this message at 06:07 on Apr 7, 2019 |
|
#
?
Apr 7, 2019 05:34
|
|
|
OSU_Matthew posted:E: I'm still disappointed that none of the internet enabled coffee pots actually use it
|
|
#
?
Apr 7, 2019 08:40
|
|
|
Username/av/post combo on point
|
|
#
?
Apr 7, 2019 15:32
|
|
|
CommieGIR posted:I really want to do more CTFs, but I really need to brush up on my pen testing skills Thats what I use CTF's for! The challenges are usually really fun and if you dont know how to do something, they encourage you to learn how (usually)! There were a few of the 50 point challenges from CSAW last year that were teaching basic Pwnables and basic RE. Given, if you are new to the material it IS still a lot to take in, but if you are interested in it and want to learn CTFs can be a great way to get there.
|
|
#
?
Apr 7, 2019 17:24
|
|
|
OSU_Matthew posted:I’m currently working through this for personal edification at this point, but this is a good resource for OSCP, which is all the hacky bits: Gonna try this, I've been playing with Metaploit/Rapid 7s Metasploitable, but that's a CTF on EASY mode, you can get root right off the bat, and its open to every exploit under the sun. I've got a virtual security lab with a bunch of flavors of Windows and Windows Server plus some RHEL and Debian boxes segregated by a PfSense VM and a Virtual Switch.
|
|
#
?
Apr 7, 2019 17:40
|
|
|
|
| # ? Apr 25, 2024 20:44 |
|
|
CommieGIR posted:Gonna try this, I've been playing with Metaploit/Rapid 7s Metasploitable, but that's a CTF on EASY mode, you can get root right off the bat, and its open to every exploit under the sun.
|
|
#
?
Apr 7, 2019 18:50
|
|
