.tHE pRODUCT - Security & Privacy Blog
The whole of information/cyber security is founded on the idea that we can defend ourselves into security. But in the history of competitive endeavours nobody has won by playing defence alone. We have this idea that we can wrap our users and systems in enough padding to protect them in a world where guns exist. We’ve leaned so hard into this idea that we’re on the floor and it’s time to look up.…
One of the things that has often confused me is how little good advice there is for reading large files efficiently when writing code. Typically most people use whatever the canonical file read suggestion for their language is, until they need to read large files and it’s too slow. Then they google “efficiently reading large files in ” and are pointed to a buffered reader of some sort, and that’s…
When I got a new MacBook with an M1 Pro chip, I was excited to see the performance benefits. The first thing I did was to fire up hashcat which gave an impressive benchmark speed for NT hashes (mode 1000) of around 9 GH/s, a solid doubling of the benchmark speed of my old Intel MacBook Pro. But, when it came to actually cracking things, the speed dropped off considerably. Instead of figuring out…
tl;dr We reported a long standing PEAP bug in all Apple devices that would allow an attacker to force any Apple device (iOS, macOS or tvOS) to associate with a malicious access point, even if the authentication server (RADIUS) couldn’t prove knowledge of the password. To understand it fully, we go on a deep dive into EAP and MSCHAPv2. Table of Contents PEAP at a High Level MSCHAPv2 Decrypting the…
I’ve started seeing WebAssemly (WASM) stuff popping up in a few places, most notably CloudFlare’s recent anti-container isolated v8 workload stuff and I wanted to understand it a little better, but from a hacker's perspective. Essentially, WebAssembly is a way to compile stuff to a browser-native binary format .wasm, which you can then load with JavaScript and interact with. Simplest C Since this…
Docker For Mac (and Windows) has done some interesting tricks to bring Docker to non-Linux platforms. It took me a while to figure it all out, and even longer to work out how to make change to the kernel and rebuild the VM. This is a write-up of what I did and why. If you just want the results, you can grab them from https://github.com/singe/linuxkit-for-mac . Overview On a traditional Linux-based…
This was an epic week for password cracking, we had lots of new hashes and lots of competition to see who could crack the most the fastest. BLUF: I put together a cracking technique, and tested it against other techniques, generating some insight into the best performing cracking techniques. Rockyou with hob064 rules won, but my technique came a close second, and had a faster crack speed. Get the…
I’ve long been interested in the physics of RF, but never had a chance to play with it until recently. This post covers my experiments with the propagation of 7MHz signals; the equipment, the setup, the code, the results and the science. The Setup My setup is at home, where I’ve got an ancient HF radio ( ICOM 738 ), plugged in to a 20m dipole antenna on my roof and a laptop doing WSPR with the…
After seeing PaulG's tweet on bureaucracy it kicked off some quick thoughts. The dangerous thing about letting your company become bureaucratic is that when the smart people leave, they won't tell you that’s why. https://twitter.com/paulg/status/910519167949971456 The two fastest way to implementing a bureaucracy in my opinion are centralizing decision making and implementing process. Centralizing…
Last weekend was the BSides Cape Town conference, currently ZA’s only hacker con. It’s a cool little con with big dreams that get a little closer each time. This year was a lot a fun and well put together, congrats to all of the speakers organisers and volunteers. SP gave some talks; Charl spoke about where we’re headed in a talk entitled Love Triangles in CyberSpace; a tale about trust in 5…
In 2011 Glenn and Daniel released Snoopy, a set of tools for tracking and visualising wireless client activity. However, the Snoopy project is no longer maintained. This blog entry is about how I got Snoopy-like functionality built into Mana. Snoopy’s core functionality was to observe probe requests for remembered networks from wireless clients, although it ended up doing much more. The problem…
Last Saturday, at Defcon 24, we gave a talk entitled “ Universal Serial aBUSe: Remote Physical Access Attacks ” about some research we had performed into USB attacks. The talk was part of a research theme we’ve been pursuing related to hardware bypasses of software security. We decided to look into these sorts of attacks after noting their use in real world attacks. For example, you have “Apex…
With the recent buzz around the iMessage crypto bug from the John’s Hopkins team, several people pointed out that you would need a root CA to make it work. While getting access to the private key for a global root CA is probably hard, getting a device to trust a malicious root CA is sometimes phrased as difficult to do, but really isn’t. (There’s a brief technical note about this in the caveats…
There's a story that's been doing the rounds in the ZA press entitled; " Your private Facebook messages can be used in court against you even if you were hacked " It details a case "Harvey v Niland and Others" in the South African High Court, Eastern Cape Division where Facebook messages were deemed admissible in a case, despite having been obtained illegally. This is pretty attention grabbing,…
At DerbyCon I made a point about IBM's security response procedures. It's a complex and subtle issue that won't carry well over Twitter. Here's my quick attempt at clarifying my personal view, hurriedly typed on a phone before I catch a flight. IBM responded quickly and proactively to seeing the original HITB abstract (they contacted me). They asked smart questions and got a patch out for NVAS…