Recent content in DarthNull.org - David Schuetz Rambles about Stuff on Darth Null
I’ve been listening to the Accidental Tech Podcast for years. They recently had a members-only special about the technology they use for their personal websites. Building customized, Rube Goldberg-esque systems for managing a website is a time-honored time sink for many, myself included. And since an earlier version of this site used a system developed by one of the podcast’s hosts…
This is a quick update. Yes. I know I say that a lot (or at least, I certainly think it when I start a post). This one really will be quick. 
 First, background. My main computer, a 2018 Intel Mac Mini, has been having its internal drive fill up. Regularly. To the point that apps crash without warning overnight, backups fail, Mail stops working, etc. In February, I traced the main source of…
A few days ago, as I write this, Kelly Guimont posted the following question : 
 Let’s say you have a data set made up of a selection of songs by one artist.
Let’s also say you want to slice and dice information from said dataset like how many songs come from each album, or average song length. 
 As of now what I want to know is the easiest way to “ask” my data…
Disk Usage Woes: Day… whatever . How long has it been since I installed macOS Sequoia? 
 I’ve been struggling with the disk constantly filling up on my Mac Mini. See my last two posts for a deep and wonky dive into the situation, and lots of data collection to confirm my suspicions (or not). 
 At this point, I’m still continuing to collect data, but it’s more in…
My main day-to-day machine is a 2018 Mac Mini. Over the last year, and especially the last 6 months, it’s been a struggle to keep adequate space free. About two weeks ago, I’d had enough, and went on a deep dive to figure out what was wrong. In my last post , I described the journey I took to identify the likely problem. 
 Simply identifying a “likely” culprit…
My everyday desktop is a 2018 Mac Mini. Last summer, I started noticing that some apps would crash overnight, mostly Ivory (my Mastodon client). 
 I assumed it was a memory thing. My disk space wasn’t great, but I had like 5 gigabytes or so free on the 256 gig drive, and wasn’t seeing any “your disk is full” errors. I wasn’t getting crazy “Your system is out…
Nine years ago, I migrated all my local house storage from a massive Dell with Debian and software RAID, onto a tiny little Synology NAS. Well, not exactly tiny, but probably 1/3 of the volume of the Dell. It serves as a file server, Time Machine target, and destination for various rsync and other low-level backup tasks from the rest of the network. At other times, it’s run a Plex server,…
A few days ago, I wrote about what GreyNoise have been calling “Noise Storms,” extended periods of high-volume ping traffic detected by many of their sensors, coming from…many different sources. The most intriguing of these were packets with the word “LOVE” in plaintext in the ping payload, and in my post, I offered a possible explanation of that traffic. At least,…
Earlier this month, I attended BSidesNoVA in Arlington, where the keynote was presented by Andrew Morris of GreyNoise. Using sensors distributed all over the world, GreyNoise collects…background noise…on the Internet. Basically, they watch and monitor activity that hits lots of hosts randomly – network mapping, port scanning, doorknob rattling. If you see someone trying to…
Back in 2018, I was fortunate enough to join a company called Expel. It had a great culture, friendly management with a real desire to do what’s right for customers and employees, and a product that seemed to fill a real need – and to fill it well. 
 Being remote friendly even in 2018, we were ready when the pandemic hit, and it seemed like we made it out the other side unscathed.…
I’ve been building a light-up keypad for home automation devices (and Zoom sessions). Last time, I gave an 

 overview of the project . This entry will detail the hardware itself, completing a basic remote-only setup, while the next post adds more advanced features and connects it to a server. You can browse the entire series from the link in the header, or by clicking here .
I use Zoom. A lot. Obviously, a whole lot more since we all started working from home. It’s not a big deal – I’ve gotten pretty used to it, and it’s a good system. So much better than the PictureTel VTCs I occasionally used in the early 90’s. 
 What’s annoying, though, is when someone asks a question and I’m on mute. Suddenly, there’s a scramble…
Codenames is a word game where players try to collect all of their team’s cards from a board, by having their Spymaster give one-word hints which describe one or more cards on the table. Which cards belong to which team is determined by a random draw of pre-printed game maps, showing which positions belong to Red, which to Blue, and which is the Assassin card (the black card –…
It occurred to me sometime after I’d finished my talk that I should have a single post that pulls all the elements together. So here’s a complete walkthrough from Master Password all the way to decrypted Vault Item. 
 If you’ve missed the first parts of the series, here’s a good starting point . 
 General Process 
 First, let’s review the overall sequence…
Thanks to BSides Delaware for the chance to go super-geeky about how 1Password works. Here are the slides from my talk, which give a basic introduction to how it all works. See this extended series for super-detailed technical information and examples. 
 Click on the link above to download a copy of the slides.
Thanks for reading! I hope you’ve enjoyed this deep dive into how 1Password works. 
 We’ve covered a lot: 
 
 Why I even went down this path 
 Unlocking macOS clients and the 2SKD process 
 Unlocking Windows clients 
 Decrypting data in the cloud-based vault system 
 Unlocking and decrypting local vaults 
 
 But there’s actually quite a bit I…
To conclude (for now) this extensive look at 1Password, we’ll go back a little to see how local private vaults work. Initially, local vaults were all you had (though they could be synced over Dropbox and other methods). These are documented separately from the cloud based “Teams” system. Now, local vaults are basically being discouraged in favor of the cloud system. 
 But you…
We’re back with part three of a close look at how 1Password works. So far we’ve seen how the Two-Secret Key Derivation (2SKD) process is used to unlock macOS clients , and how the Encrypted Master Key (EMK) does the same under Windows . In both cases, we end up with a decrypted master key, the “sym key” in the account’s first keyset. As I’ve said in both prior…
I’m taking a detailed look at how 1Password works, originally to help examine potential risks when used in a corporate environment, and eventually because I’m just a nerd and love All Things Crypto. (See this page for an introduction and background). 
 Last time , I explained how the 1Password Two-Secret Key Derivation Process (2SKD) works. Briefly, it takes your email address, master…
I’m taking a detailed look at how 1Password works, originally to help examine potential risks when used in a corporate environment, and eventually because I’m just a nerd and love All Things Crypto. (See this page for an introduction and background). 
 We’ll start out by looking into how you unlock the client on macOS. 
 Introduction – Using 1Password on macOS 
…
Earlier this year, I embarked on a deep dive into how 1Password works. In particular, I wanted to understand what could happen if an attacker managed to collect a user’s Master Password – how hard would it then be to get all their passwords? 
 As part of this quest, I’ve explored the 1Password vault structure, read their security white papers, asked for help from engineers in…
Encryption, once you have a safe and well-implemented algorithm, is all about the keys. Lose control of your keys, and it’s “Game over, man!” What if we could put our keys somewhere completely out of reach, where even their owner can’t get to them? Yibikeys and HSMs can provide that security, but they’re external devices. However, recent iOS devices and MacBook Pros have something just as…
My first infosec con was the first ShmooCon, in 2005. Then I went to Black Hat and DEFCON. Then ShmooCon again. Then Vegas again. And before long, I had a whole lot of badges cluttering up drawers. 
 
 
 Probably a code violation. (Circuit breakers are behind these doors). 
 
 

 In 2010 I won, as part of the ShmooCon crypto contest, a stuffed moose head for the wall…
Technology today is flat-out amazing. When I was a kid, walking uphill through the snow to get to school, cordless phones were massive (and amplitude modulated near the broadcast band), and video recorders had wired remotes. If you could quantify it, I’d venture that today’s capabilities are 3 or 4 orders of magnitude above what we had 30 years ago. 
 And at some point, almost…
Scene: February, 1979. My fifth grade classroom. A large-for-the-time 17" or so black-and-white TV (the kind with a faint greenish tinge) sits on a cart. Everyone watching a total solar eclipse happening live in the Pacific Northwest. I don’t remember the mood in the room, but I suspect it was a mix of breathless, half-bored, and “meh.” I do remember, very clearly, learning that…
Earlier today, it was reported that a hacker/researcher called “xerub” had released the encryption key, and tools to use it, for the firmware that runs the Secure Enclave Processor (SEP) on iPhone 5S. Reporting was…breathless. Stories suggested that this move was “destroying key piece of iOS mobile security,” and that we should “be on the lookout for Touch ID…
A few years back, I moved from a fairly generic Wordpress-based blog to a statically-generated system based on secondcrack . It was a fairly simple system, that I immediately hacked up to add different post types, lists, and other taxonomy-like things. And I pretty much stole the look and feel of the primary site secondcrack was built for . 
 It worked out pretty well, overall, but I did…
A few months ago, I set up my computer on a counter-level table in the home theater for a few days, to see what I thought of the idea of a standing desk. I liked it, but definitely didn’t want to be standing all the time. I needed something adjustable. 
 Then a couple months later, The Wirecutter posted a review of standing desks , and their top pick was the Fully Jarvis Bamboo desk.…
Shall We Play A Game? 
 It’s been a long time since I did a big puzzle solution post, and even longer since I played a crypto contest at ShmooCon. That’s about to change. :) 
 After winning three years in a row, and running the ShmooCon contest for four years after that, I finally stepped away from the fray in 2016. But I did help out a little, commenting on the puzzles they…
Belay It 
 1: Total Control 
 Look Around

* pictures on con signs outside rooms *
 
 
 
 
 
 
 
 2: Pseudo-random 
 /oneyamasoon

go to /oneymasoon, see text "Setec Astronomy".
 
 3: Stonecutter 
 
 4: Scrapple 
 
 5: Who you gonna call? 
 whoyougonnacall.mp3 
 6: Boring Compound 
…
Thanks so much to BSides Rochester for giving me a chance to talk about iOS encryption. I was happy to see such a good audience with plenty of very good questions. We discussed how the overall iOS encryption system works, how passcodes are used to secure it, and what attacks, limitations, and weaknesses still remain. 
 Click here or on the post title to download a copy of the slides.
Introduction 
 A few years back, after I won my first crypto contest, the contest author, G. Mark Hardy, suggested I read Between Silk and Cyanide . Written by Leo Marks, it’s a first-person account of the difficulties managing cryptographic communications with field agents in Europe during World War II. 
 Much of the story centered on the “poem codes” used by the agents,…
Apple and the FBI are fighting. The {twitter, blog, media}-‘verses have exploded. And FUD, confusion, and conspiracy theories have been given free reign. 
 Rather than going into deep technical detail, or pontificating over the moral, legal, and ethical issues at hand, I thought it may be useful to discuss some of the more persistent misinformation and misunderstandings I’ve seen…
Yesterday, the information security company Trail of Bits announced a new service, called Tidas . The service is intended to make it easy for developers to include a password-free authentication experience in mobile apps on the iOS platform. They’ve provided some sample code and a developer Guide / FAQ , and I’ve spent some time looking at it to try and understand how it works. Here…
For the last several years, we’ve tried to keep a big “snow stick” out on our deck to capture images of big snowfalls. In particular, the winter of 2009-2010 was exceptional for this, with no fewer than 3 very large storms in our area (including the crazy storm which happened at ShmooCon 2010). That storm dumped nearly 30" over two days at Dulles Airport, just a few miles away…
I just finished presenting this at ShmooCon, and wanted to get the slides out quickly before it got shoved aside by the next crisis. :) I’ll replace this with a blog entry that’s actually useful later. 
 The short version is this: 
 
 I do a lot of application testing, for web and iOS / mobile apps 
 Many (most?) of those apps rely on some kind of authentcation to a…
[ Note : Yes, I understand the point of DLP. Yes, I’m being unrealistically idealistic. I still think this is wrong, and that we do ourselves a disservice to pretend otherwise.] 
 The Latest Craziness 
 It is happening again . A major computer manufacturer (this time, Dell, instead of Lenovo) shipped with a trusted root TLS CA certificate installed on the operating system. Again, the…
For the past year or so, I’ve been thinking about the information security research space. Certainly, with the mega-proliferation of security conferences, research is Getting Done. But is it the right kind of research? And is it of the right quality? 
 This has recently become a hot topic, since .mudge tweeted on June 29: 
 
 Goodbye Google ATAP, it was a blast. 
 
 
…
A new service was just announced at the RSA conference that takes an interesting approach to hashing passwords. Called “Blind Hashing,” from TapLink , the technology is fully buzzword-compliant, promising to “completely secure your passwords against offline attack.” Pretty grandiose claims, but from I’ve been able to see in their patent so far, it seems like it has…
A bit of a hack I did in 2010, tweaking some rainbow table tools to work with old-school UNIX password hashes. Includes very rough code samples.
It’s been a fun week for information security: 
 
 
 @yawnbox - A Bad Week 
 
 

 Arguably one of the more interesting developments (aside from the SIM thing, which I’m not even going to touch) was the decision by Lenovo to pwn all of their customers with a TLS Man-In-The-Middle attack. The problem here was two-fold: That Lenovo was deliberately snooping on…
Introduction 
 Last Saturday, I gave a talk at ShmooCon detailing the results of a short survey of iOS applications, and the way they handled (and secured) network-based authentication. For a quick summary of my talk, read on. If you’d like to follow along with the slides, they can be downloaded here . If you’d like a very detailed white paper explaining everything I said in the…
Slides from my DerbyCon 2013 talk about building a car media center on Raspberry Pi, and how to make that appear as a native application on Apple TV. 
 Unfortunately, the method I outlined here was blocked days later by Apple. Current Apple TV development requires specific configuration profiles signed by Apple. 
 See also the Github for example code. 
 Slides: Click here 
Video:…
Apple released iOS 8.1.1 yesterday, and with it, a small flurry of bugs were patched (including, predictably, most (all?) of the bugs used in the Pangu jailbreak). One bug fix in particular caught my eye: 
 
 Lock Screen 
 
 
 Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later 
 
 
 Impact: An attacker in possession of a…
I just voted, even though pundits and statisticians have proven fairly definitively that my particular vote won’t matter. My district has had a Republican congressman for 30 years and his hand-picked heir is likely to win, and I don’t live in one of the 6 states all the news organizations tell me will decide control of the Senate. I voted because it’s the right thing to do, and…
In June of 2013, a few videos started circulating showing people unlocking cars without authorization. Basically, people walking directly up to a car and just opening it, or walking by cars on the street. One of the more interesting videos (watch at about 30 seconds in) showed a thief walking along the street, grabbing a handle in passing, and stopping short when the car unlocked. (interestingly,…
Lots of discussion the last few days about Rite Aid and CVS (and possibly other merchants) actually disabling existing NFC point of sale functionality simply because they were suddenly getting used (by Apple Pay). 
 NFC payments are nothing new – Android has supported them for a couple years now (on select phones, though not without some complicated political shenanigans between…
The recent release of iOS 8 brought with it several cool new features, especially some which more tightly integrate the iOS world with the OS X desktop world. Some of these are limited by physical proximity (like handing off email drafts among devices), while others are require being on the same local subnet (forwarding phone calls to the desktop). 
 However, one feature apparently Just Works…
Recent reports (and a slew of tweets) have circulated about the new Spotlight search on OS X Yosemite. Rene Ritchie at iMore explains the concerns, facts, and back-and-forth of the situation pretty well. 
 Especially damning was this lede from The Washington Post: 
 
 Apple has begun automatically collecting the locations of users and the queries they type when searching for files with…
I’m lucky to live near a really good information security group, NoVA Hackers . We meet once a month, and usually have 6-10 speakers of all levels, speaking on just about anything they’d like. 
 I thought this might be an audience who’d be interested in learning how the recent iOS security changes actually worked, and so threw together a quick talk based mostly on my blog…