cybersecurity

[woven robin]

!rule 5

[past star]

Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, be considered malicious/inappropriate or be for graded coursework/exams.

[thorn obsidian]

So, there's a vulnerability in Pillow versions <7.1.0, and versions >7 only work in python 3. What should you do if you have a 2.7 project that can't be upgraded to python 3 anytime soon?

[runic arrow]

@thorn obsidian is there a way to backport the fix(es)?

[thorn obsidian]

@runic arrow Not sure. I've never done any backporting. How does it work?

[runic arrow]

Preferably you'd get the maintainers/developers to backport the fix, bringing whatever is necessary to secure the older versions by way of a hotfix.

[thorn obsidian]

Ahh. I may try opening an issue on their github.

[woven robin]

@thorn obsidian Python 2 is already EOL. If you are concerned about security, you need to move to python 3

[fierce quarry]

Does @anyone have previous work experience in cybersecurity?

[woven robin]

!ask

[past star]

Asking good questions will yield a much higher chance of a quick response:

• Don't ask to ask your question, just go ahead and tell us your problem.
• Don't ask if anyone is knowledgeable in some area, filtering serves no purpose.
• Try to solve the problem on your own first, we're not going to write code for you.
• Show us the code you've tried and any errors or unexpected results it's giving.
• Be patient while we're helping you.

You can find a much more detailed explanation on our website.

[daring sedge]

I'm trying to understand some of the details of SSL/TLS better, I understand private/public key encryption conceptually.

So I have a file called myCompanysCA.pem which is the public key of my company's what? Certificate Authority? And why do I need to manually/semi-manually set that up but not any certificates for just general web browsing?#

also - a more practical question. Is there any specific place the CA.pem needs to live? Like, if I have a docker container that needs it, can I just track it in git and copy it over with sourcecode and have it live alongside sourcecode?

[thorn obsidian]

i created a bruteforce technique with while True

😂

but in the program u just have to type input and it uses bruteforce

users who have no idea about coding will think it's sh*t

[onyx wharf]

im gueesing a public cert in vcs should be fine

[runic arrow]

@daring sedge personally I do a read-only bind mount of the server's certificate bundle into my containers, that way I never have to manage them.

But I've seen people often create an image FROM scratch and just place their certificate into that layer and then do multi-stage builds from there.

[daring sedge]

I don't understand the Docker side well enough. But right now what I'm doing is just building the dockerfile, copying the source over (and the cert alongside it) and manually verifying my outgoing requests against it

so it's literally COPY CACERTS.pem ./CACERTS.pem

and then verifying outgoing requests by pointing it to that absolute filepath - is that horribly insecure or anything?

@runic arrow

[runic arrow]

No, it's not insecure.

[lusty flare]

perfectly legitimate way to do ti

[dark hamlet]

okay so

yeah

@pulsar crystal sorry for the ping but you guys might need to check this out

!modmail

[past star]

Contacting the moderation team via ModMail

@novel cedar is a bot that will relay your messages to our moderation team, so that you can start a conversation with the moderation team. Your messages will be relayed to the entire moderator team, who will be able to respond to you via the bot.

It supports attachments, codeblocks, and reactions. As communication happens over direct messages, the conversation will stay between you and the mod team.

To use it, simply send a direct message to the bot.

Should there be an urgent and immediate need for a moderator or admin to look at a channel, feel free to ping the <@&267629731250176001> or <@&267628507062992896> role instead.

[dark hamlet]

@novel cedar Rick Postma #4202 (in this server) other people have gotten this message spammed

[analog jacinth]

Ironically that site is broken

[daring gate]

Python Help: Available

[thorn obsidian]

@thorn obsidian

What should you do if you have a 2.7 project that can't be upgraded to python 3 anytime soon?
You'd switch to Python 3, considering 2.7 is dead.

@dark hamlet PM Modmail about this

You think I haven't heard that? The other dude told me, too. The matter is out of my hands.

I'm not sure what you're wanting us to say, considering that's the only fix.

@dark hamlet Also, just @ing the Modmail does nothing ( as far as I know ), you'll need to actually DM it

[fast shore]

@dark hamlet Can you DM @novel cedar l as Scott said, and we can try and sort it out

[lusty flare]

that guy was dealt with already, got mass reported. 👌

you guys work pretty quick <3

[fast shore]

Oh nice, so quickly I didn't even see

Ah, I see now

Anyway, please contact @novel cedar in the future for that sort of stuff

[dark hamlet]

@fast shore sorry man, didnt know :p

[brazen seal]

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-10713 fun stuff

guess i'm switching to systemd-boot on prod systems today

[green ember]

I was wondering - many projects from untrusted sources have a checksum you can compare to validate the project is the right one. Is there any way to willingly create a project that generates the same checksum?

[brazen seal]

you could copy-paste their checksum, but it won't match your code ... and no ... if you are able to find collisions in those hashing alorythms, that means the algorythm is dead lol

see MD5/SHA-1 lol

there are a lot of projects that still offer an MD5 checksum though, so technically, you can bruteforce that, but it still sucks to do

and really, it would probably be easier to subvert the OS crypto system than it would be to somehow collide on a one-way hash fuction

[thorn obsidian]

Depends on how important the target is. If you have $100,000, I don't doubt you could find a collision in MD5.

[spiral pivot]

what why would you need money to find a collision?

just brute, finding a collision in md5 is not that hard

given enough time and gpu driven software

[primal ibex]

Computing time = money

[lusty flare]

compute time is also why people may still use md5/sha1 for stuff

[thorn obsidian]

how do i start learning Cybersecurity for python

[spiral pivot]

@primal ibex more like have extra computers at home, start one doing it and forget about it

[primal ibex]

Yea... that costs money.

Someone's paying for the power.

[graceful flame]

@thorn obsidian what do you mean for python?

[spiral pivot]

power does not cost $100k

[willow coral]

The important material and knowledge within cybersecurity is language agnostic

if you want to learn "cybersecurity for python" then you'll end up learning modules and libraries, rather than concepts

[thorn obsidian]

@spiral pivot If you're running multiple systems with multiple GPUs, and you're a nation state, power sure does cost $100K.

Like I said, depends on how important the target is.

[spiral pivot]

i'm talking about doing it at home

[thorn obsidian]

There are a few updates to MD5 collisions. You could probably find quite a few resources, actually.

https://www.mscs.dal.ca/~selinger/md5collision/
**Published Feb 22, 2006. Last updated Oct 11, 2011. **

So yeah, they're very possible. $100K isn't even needed for a nation state, let alone a regular person.

[spiral pivot]

that was discovered on 2005 hardware, with some gpu(s) and good code it shouldn't be any problems right

[thorn obsidian]

Exactly. I had completely forgot how far we'd got in regards to collisions when I threw out the $100K number

[spiral pivot]

altough, sha256 is probably a different story

[thorn obsidian]

SHA256 has specialized hardware through ASICs because it's used for Bitcoin

[lusty flare]

i find it amusing to see "OH SOMEONE FOUND A COLLISION ON X! IT'S BROKEN NOW! PANIC! PANIC!"

and it turns out to be some 300 GPU cluster that took fucking 6 months to do or w/e

[willow coral]

i would argue that is it still cause for concern

[lusty flare]

cause for concern, yes

but not cause to throw out the baby with the bathwater

[thorn obsidian]

if you want to learn "cybersecurity for python" then you'll end up learning modules and libraries, rather than concepts
@willow coral oh I see

@lusty flare Well, MD5 is trivially broken

Using it today for anything above "I made a program in 5 minutes" is heavily discouraged.

[lusty flare]

would you say using it to generate random passwords based off the current time / date and a salt is particularly bad?

not in the context of a password manager or anything

i'm just saying that as a tool it's not completely worthless because its use in a security context has failed.

a zip tie can still hold a gate closed if all you want is for the gate to stay closed, rather than the gate be secure.

i think my logic make sense, been a bit fuzzy in the brain pan the past week or so

[thorn obsidian]

Using it today for anything above "I made a program in 5 minutes" is heavily discouraged.
@thorn obsidian md5 is very fast and still the best option for hashes which are not relied on for security, ie checksumming file dumps, backed up files, etc

[jovial heart]

md5 is very fast and still the best option for hashes which are not relied on for security, ie checksumming file dumps, backed up files, etc
@thorn obsidian it is not Think cause as fast as it is formed it is cracked that fast too😐 so it is not the best option I think 😐

[thorn obsidian]

I have no idea what you said

collisions don't matter when you're using it for purposes unrelated to security, because in practicality collisions almost never happen accidentally

[jovial heart]

Lol leave it

I'm just saying that md5 is not the best option

[thorn obsidian]

you're wrong

there's a reason it's still popular

[lusty flare]

@thorn obsidian

you backing me up on this?

root@root:~$ echo gibberish >> date | md5sum```

if i need a long complex password i don't need to remember i just use that

¯_(ツ)_/¯

[primal ibex]

base64 /dev/urandom @lusty flare

[lusty flare]

i'd argue that's less random or secure than salting a time created md5

plus that means i'd have to use a cut -c -32 or something

i'm just saying it's a baby bath water scenario

so i'm 100% behind @thorn obsidian

they do have a seagull after all

[primal ibex]

Yea @lusty flare, you're probably right lol.

[lusty flare]

like kryptonite locks were pretty good

until people realised you can use a bic biro to brute force the tubular lock

my shed has a cheap ass padlock on it, it's called a boulder

threat models and usages

[mortal perch]

realistic security 👍

[thorn obsidian]

@lusty flare

would you say using it to generate random passwords based off the current time / date and a salt is particularly bad?
Yes, considering password databases exist.

@thorn obsidian

still the best option for hashes which are not relied on for security
I really can't say I'd use or recommend MD5 for that.

@thorn obsidian
I really can't say I'd use or recommend MD5 for that.
@thorn obsidian and what do you propose instead?

Other than MD5, you mean?

Well, let's step back. How would you verify a file is legitimate in Linux, or anywhere else, outside of basic hashes?

( There's a point I'm making, just approaching it in a different way )

@thorn obsidian

Anyway,.. the answer is GPG keys. Tails does this, for example: https://tails.boum.org/install/expert/usb/index.en.html
Relying on hashes like MD5 is what Linux Mint did, and it didn't really matter when their server(s) were compromised, did it?

I'm expecting responses of "No one will use that, though". That isn't part of this for me, I'm just suggesting a better system, which signing with GPG is a better system.

[thorn obsidian]

hi!
I made a script using socket with a client and a server.
I can give instructions to the client via the server, like execute this program, or send me this document.
but to send me a document, the client has to use different resources than it uses to run an application. and since the names of applications and documents are variable, I can't do if command == ...
do you have an idea?
I had considered processing by extension (if the command contains ".txt", then send the document, if the command contains ".exe", then run the application, but I don't know if it's possible in a string

@thorn obsidian have u an idea?

@thorn obsidian If a user is uploading files to a server, I'd use Flask + Flask-WTF + Flask-Uploads

https://flask.palletsprojects.com/en/1.1.x/patterns/wtforms/ and https://flask-uploads.readthedocs.io/en/latest/

I had considered processing by extension (if the command contains ".txt", then send the document, if the command contains ".exe", then run the application
Why would you run random .exe files?

nope @thorn obsidian

nope what?

i print in the server "calc.exe" for exemple, and the client run it

So you want to make some kind of RAT?

just in LAN

@thorn obsidian

You don't have to ping me every time

ok, sorry

but i don't know how make a difference between run a program and send a file to server

[leaden blaze]

What kind of application are you trying to create?

[thorn obsidian]

a backdoor

in LAN

in her options :
-run a program on the client
-send client's file to server
-and others

@leaden blaze an idea for make the client can make a difference between .exe files or .txt files? (if it's .exe, the client must run it, or if it's a .txt file, the client must send it to server)

[leaden blaze]

Right, yeah, well, a backdoor is far too close to a malicious application like a trojan for me to be comfortable with on this server

[thorn obsidian]

yes.

and i want to be pentester, so i'm training for coding payloads and others programs running in local area

Well, let's step back. How would you verify a file is legitimate in Linux, or anywhere else, outside of basic hashes?
@thorn obsidian Not what I was saying

nor my point

I think if you're trying to verify a file, you'd use GPG like I said.

al right, it's good, i fixed my problem, thanks all

[spiral pivot]

it's not really possible to fully verify something

because you have to verify the verification

etc

[fluid scarab]

Hello. I'm planning to make a private api which my program can access. It will be a replacement for my client-server architecture. But I have a question - how can I make it private? What stops someone from getting the url throug some packet analyzer then use that api?

for example a post request to my api would be url.com/api/v1/add_user then some payload. I don't want to expose the url but it's in client side

[primal ibex]

Why not use authtokens?

[fluid scarab]

wouldnt be safe to store it in the code

need a way to get it from server maybe but how

[thorn obsidian]

I think if you're trying to verify a file, you'd use GPG like I said.
@thorn obsidian

$ dd if=/dev/block/mapper/product_a of=dump
2711120+0 records in
2711120+0 records out
1388093440 bytes (1.2 G) copied, 4.919688 s, 269 M/s
$ dd if=/dev/block/mapper/product_a | md5sum
2711120+0 records in
2711120+0 records out
1388093440 bytes (1.2 G) copied, 7.566298 s, 175 M/s
9260f8f446368790716e2a823170c7fc  -
$ md5sum dump
9260f8f446368790716e2a823170c7fc  dump

this is the use case I'm talking about

verifying file integrity in a manner which does not depend on it being secure

esp. for large files

[lusty flare]

yeah, which was kind of the thing i was hitting at

i just don't know enough to speak with authority

[thorn obsidian]

@thorn obsidian That didn't seem like what you were hinting at, at all.

[thorn obsidian]

collisions don't matter when you're using it for purposes unrelated to security, because in practicality collisions almost never happen accidentally
@thorn obsidian
@thorn obsidian md5 is very fast and still the best option for hashes which are not relied on for security, ie checksumming file dumps, backed up files, etc
@thorn obsidian

which is literally what I demonstrated

¯_(ツ)_/¯

I was more focused on downloaded files. If you're looking for file integrity, sure, no doubt.

[lusty flare]

yeah, i think we all got our wires collided .

¬_¬

[thorn obsidian]

The streams were crossed

[leaden sage]

prob wrong channel, but can we ban @thorn obsidian hes soliciting people to buy discord accounts.

<@&267628507062992896> ^

[daring sedge]

use modmail @leaden sage

[summer cliff]

thanks, we'll look into it

[leaden sage]

thx

❤️

[summer cliff]

as Charli says, sending a DM to @novel cedar is preferable

[leaden sage]

kk

noted

[meager coral]

hey how to learn about security

i am a newbie

[thorn obsidian]

wwwwwwhhhhatttttttttttttttttttt

[meager coral]

dont make fun dude i want to learn about security

[thorn obsidian]

@meager coral Depends on specifics

[meager coral]

ok

[thorn obsidian]

I have created antivirus on Python with working GUI, scan, full scan, quarantine and update

As well i have web protection on it.

Would it be possible to automaticly detect malware/viruses and quarantine them, like real-time protection.

Would it also be possible to create Ransomware Protection?

[lusty flare]

you could do ransomware protection by monitoring file system behaviour and then going

"oh... hang on... why is this guy encrypting a million miles an hour?"

[thorn obsidian]

How about the RTP then?

Also I think that's more behavior blocker, but its fine.

[lusty flare]

hmmm, i can't really speak to that sorry.

[thorn obsidian]

Alright.

[lusty flare]

our ransomware protection at work is to have incremental 5 minute backups

[thorn obsidian]

lolol

That's good method though.

[lusty flare]

then if dodgy encryption behaviour is noticed it just straight up halts the system and does a roll back

[thorn obsidian]

Rollback is useful.

"Malware actions rolled back."

Im also scripting that kind of stuff,

[lusty flare]

cool project

[thorn obsidian]

I maybe should add the ransomware protection to it as well.

lol yea

I have been working for long time..

[lusty flare]

is this for a linux based system or windows based?

or aimed at both?

[thorn obsidian]

Windows based.

currently

atleast

[lusty flare]

the ransomware product we use basically builds up a model of what resources processes use

and the moment a process starts doing anything out of line of that model

it just kills it and puts it in a bin for further inspection

[thorn obsidian]

or quarantine

thats like perfect behavior blocker

[lusty flare]

yeah, bin sounds more fun than quarantine right now ¬_¬

[thorn obsidian]

lol

disinfection

[lusty flare]

"oyyyy wots goin on eeerrreee den guv?!?!"

[thorn obsidian]

I mean is it possible to delete files based on MD5?

using script

[lusty flare]

since the majority of infections relate to human error, there's only very little you can do after the fact.

just hash every file and if it matches your nasty drop it?

[thorn obsidian]

wdym

welp

the full scanner will detect it

i think so

36 million detections

and web protection could catch it also

[lusty flare]

atm in a couple of our larger businesses we're seeing a move to whitelisting for protection

[thorn obsidian]

whitelisting eww

no thx

[lusty flare]

well, for a business environment it makes sense.

[thorn obsidian]

true

[lusty flare]

there should only be a set number of executables running

[thorn obsidian]

mm

[lusty flare]

one we checked out we basically set up one user with a machine with this software on

it built a model of the computers resource usages

then we deployed that model

[thorn obsidian]

o_o

[lusty flare]

combined with whitelisting

[thorn obsidian]

lmao i think this would cause false positives

[lusty flare]

no more people playing peggle

[thorn obsidian]

but every file automaticly scanned

with virustotal

would cause a lot

of

false positives

[lusty flare]

well, these people are smarter than me and their solutions work

[vital gyro]

hey what is the difference between cracking and hacking

[thorn obsidian]

crack is mostly fake software

but im not sure if u mean

it

[lusty flare]

awkward question because they have different meanings

[thorn obsidian]

yea

[vital gyro]

could you pleace elucidate in detail about cracking and hacking

[lusty flare]

"hacking" isn't always a bad thing.

[vital gyro]

i know

[thorn obsidian]

yea

[lusty flare]

i took apart my hoover and replaced the bearings in it

so it worked better

[vital gyro]

i want to know about cracking

[thorn obsidian]

making malware isnt always a bad thing either

if u dont spread it

[lusty flare]

that's hacking my hoover

[thorn obsidian]

i used hacked client on minecraft

killaura

[vital gyro]

what is cracinfg

[thorn obsidian]

thats hacking

[vital gyro]

cracking

though

[lusty flare]

cracking is usually more about the breaking of encryption schemes

[vital gyro]

what is that

[thorn obsidian]

RSA

AES

like ransomware

[vital gyro]

what schemes
and what do u mean by encryption

[thorn obsidian]

cracking jigsaw

do you know ransomware

what it is

[vital gyro]

no

i dont know anything about cracking

[lusty flare]

oh man i need to send out my xx becon

[thorn obsidian]

it is malware what basically encodes ur files

[vital gyro]

thats why i am here

[thorn obsidian]

and asks you to pay

for key

[vital gyro]

lik

[thorn obsidian]

what unlocks

ur files

[vital gyro]

like

[thorn obsidian]

usually we want the key without paying

so we try to crack the software key

and open our files

it may be used to make decryption software as well

[vital gyro]

ohhhhh

and

[thorn obsidian]

like jigsaw decryptor

flytech found jigsaw's key

when he cracked it

on visual studio

and then made decryption software

[vital gyro]

who is flytech

[thorn obsidian]

one youtuber

[lusty flare]

@thorn obsidian to the rescue

or @thorn obsidian

[vital gyro]

oh yeah

[thorn obsidian]

h

[vital gyro]

@thorn obsidian is a penestration tester isnt he

he would know

hey @thorn obsidian

[lusty flare]

they're doing the cracking vs hacking thing

[vital gyro]

could u explain

crackiiing

[thorn obsidian]

i already did

explain

ransomware cracking

but what else?

[vital gyro]

u made it a little comlicated

[thorn obsidian]

software cracks?

oh m y

[vital gyro]

complicated

[thorn obsidian]

just read my all messages carefully

or google

[lusty flare]

just wait for xx to talk please.

[thorn obsidian]

true

wait

bypassing a software's license protection/drm/whatever OR brute forcing hashes = cracking in the most common use of the word

cracking is often done as a part of, well, hacking

but the two can be entirely separate as well

[vital gyro]

what do u mea n by software liscence drm

[lusty flare]

as with my hoover hack.

[thorn obsidian]

i tried download keygen

crack for malwarebytes

and ended up getting trojan

lol

[lusty flare]

!rule 5

[past star]

Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, be considered malicious/inappropriate or be for graded coursework/exams.

[vital gyro]

nobody is doing that

[lusty flare]

just a reminder.

[thorn obsidian]

yes

i dont make malicious things

i investigate

[lusty flare]

softwares may require a license for you to use them. if you bypass that, you have cracked the software.

[vital gyro]

reminder that is

[thorn obsidian]

ok i have to admit

i made ransomware'

[vital gyro]

oh

[thorn obsidian]

lol

[vital gyro]

i though cracking was like cracking accounts

[thorn obsidian]

thats called hacking

mostly

[lusty flare]

it could be

[thorn obsidian]

or cracking

password

thats also

[vital gyro]

cracking passwords of account

[thorn obsidian]

cracking

yea

[lusty flare]

okay if you could talk slower

this would help

[vital gyro]

thats what i thought cracking was

[thorn obsidian]

well its not only

[vital gyro]

thats what i thought cracking was
cracking passwords of account

[thorn obsidian]

usually cracking password is hard

if the password is long

[lusty flare]

say you're a naughty person and you manage to get your hands on a big list of usernames and passwords, but unfortunately the person who made the database of user credentials hopefully encrypted them.

[thorn obsidian]

hashed

[lusty flare]

my bad

now you have the username, and no usable password.

so you'd have to crack the hash to get back the plain text password and use it

[vital gyro]

but didn't xx say that cracking was bypassing software liscence but is cracking passwords bypassing software liscence

??

[thorn obsidian]

its more like cracking key

like ransomware

then bypassing

the software license

[lusty flare]

https://tenor.com/view/vettel-in-wall-hit-the-wall-gif-11905373

[thorn obsidian]

using the key

[lusty flare]

i give up.

[thorn obsidian]

welp

[vital gyro]

oh

[thorn obsidian]

they're different types of cracking

they just unfortunately have the same name

[lusty flare]

they are ambiguous words.

[vital gyro]

but why do u keep on saying ransomwarre

[thorn obsidian]

i mainly know about cracking malware

so i talk alot

about malware

yeah I have no idea what randomware has anything to do with this discussion

ransom, even

[lusty flare]

as i said, i hacked my hoover by modifying some of its parts to perform at a higher rate.

[thorn obsidian]

alright i gotta go

[lusty flare]

it'll probably burn the motor out faster but it picks up hair off the carpet better.

[thorn obsidian]

need to review support tickets

so cya

[vital gyro]

oh i get it cracking is cracking key and then using the key to bypass software liscence

thx guys

[thorn obsidian]

uhh

ok

🤔

[vital gyro]

isnt it

or am i wrong

[thorn obsidian]

cracking is multiple things

that is one of the cracking things

[vital gyro]

multiple things like maybe some examples:??

maybe

no

[vital gyro]

cracking gmails and facebook account passwords are included in password cracking and
what is included in software cracking

[lusty flare]

bypassing the security checks in the software that check to see if it's a legitimate copy.

in the old old olden days you could just open the binary in hex and flip a 0 to a 1

[vital gyro]

OK!

[vital gyro]

hey

peoplpe

what is a dork

[thorn obsidian]

bisk

[vital gyro]

a kid said that "cracking means getting accs through dorks and dumping them"

[lusty flare]

dorking is using clever google queries to get datasets that really shouldn't be on google in the first place

recently an insurance company (i believe) had their entire customer sent in documents indexed by google

[vital gyro]

is the definition righ

right though

[lusty flare]

so using a well crafted google search, a dork, you could get links to those files

[vital gyro]

hey bisk is the defetionion tight

right

[lusty flare]

if kid said "cracking means googling for data dumps" the kid is wrong

[thorn obsidian]

@vital gyro bisk is the what?

[vital gyro]

LOL
the way u said it is halirious

[lusty flare]

xx is a professional security and has just explained a bunch of stuff

and it's almost as if you've got glue in your ears

[vital gyro]

i am sorry but i just have a lot of stupid question

[lusty flare]

and some people here, who have knowledge, have answered them.

[vital gyro]

yeah

thankyou

i am grateful

[thorn obsidian]

http://www.digitaljournal.com/tech-and-science/technology/cosmetics-firm-avon-leaks-19-million-customer-records/article/575553

[lusty flare]

woah

they got technical logs

they must've been in pretty deep

[vital gyro]

cracking uses brute force right
but then what does hacking use

[thorn obsidian]

Hollywood magic What do you mean?

@vital gyro Do you mean breaking into a system as hacking?

[faint heart]

prob

[vital gyro]

i got my answer np

[thorn obsidian]

Alright, cheers 👍

[faint heart]

yee

[late hill]

Anyone here?

[thorn obsidian]

hello!

[late hill]

Wanted to ask a clichéd lame question

Can I?

[lusty flare]

yes.

[thorn obsidian]

somebody know how i can use sockets in WAN?

i want make a connection with sockets between 2 computers

[lusty flare]

what's your intention?

like, the end goal?

[thorn obsidian]

xx is a professional security and has just explained a bunch of stuff
@lusty flare i am a professional security

Level 3 security

top class in the secure

[lusty flare]

yes

you're my personal professional security

[south seal]

What would be the most secure way of creating a username/password based login? Link me to any relative articles if you like

[thorn obsidian]

@south seal Depends on the framework(s) you're using, and what you consider secure

[south seal]

I am using flask for instance

I consider secure anything that can't be broken by the vast majority of the users

[thorn obsidian]

I'm going to head to sleep, but I'll ( try to ) ping you tomorrow about this when I'm not busy. If I haven't 20 hours from now, ping me please.

[south seal]

Alright thanks!

[mild pier]

the owasp cheat sheets are great reads if you're going to be doing anything with auth/password storage

https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

[south coral]

so there is a Matryoshka trojan called the xhelper or something for Chinese android my question isif someone is effected is he being attacked personally or is just a victim of a widespread virus

here is the link

https://securelist.com/unkillable-xhelper-and-a-trojan-matryoshka/96487/

by attacked personally i mean will there be a dude in black hoody literally watching the cam footage from his system or is it just another compromised] device in a list

[thorn obsidian]

antivirus scans .py?

[thorn warren]

I'm trying to test the Python code snippets that control Zumi's self-driving AI program-control and find code vulnerabilities by generating insecure code scenarios.
Most of their code modules are pretty straight forward and nothing much complicated. I would appreciate it if anyone can create and manipulate a security vulnerability in the below code. Is there a way we can tweak the code and make the robot to malfunction?

from zumi.zumi import Zumi
import time

zumi = Zumi()

for i in range(1000):
ir_readings = zumi.get_all_IR_data()
front_right_ir = ir_readings[0]
front_left_ir = ir_readings[5]
back_right_ir = ir_readings[2]
back_left_ir = ir_readings[4]

if front_right_ir < 100 or front_left_ir < 100:
zumi.reverse(duration=0.5)
elif back_right_ir < 100 or back_left_ir < 100:
zumi.forward(duration=0.5)

I need help on this please. If anyone can help I will appreciate. Thank you!

[lusty flare]

@rose pewter #cybersecurity is not a meme dump. nor are the off-topic channels.

[narrow laurel]

!warn 173823631376252928 We aren't a meme server.

[past star]

:incoming_envelope: :ok_hand: applied warning to @rose pewter.

[thorn obsidian]

@south seal Alright, were you able to get your question answered?

There's quite a few things, such as
https://flask-security-too.readthedocs.io/ - Security
https://flask.palletsprojects.com/en/1.1.x/patterns/wtforms/ - Forms!
https://werkzeug.palletsprojects.com/en/1.0.x/middleware/proxy_fix/ - Ensuring proper IP is sent to Flask
https://flask-login.readthedocs.io/ - Logins, logouts, etc
as well as knowing that Jinja templates only sanitize by default, certain extensions:

autoescaping is enabled for all templates ending in .html, .htm, .xml as well as .xhtml when using render_template().
from https://flask.palletsprojects.com/en/1.1.x/templating/

Probably missing something here too 😄

[thorn obsidian]

https://docs.google.com/document/d/1oxFkQfxSh5rnb6oGS2ufsZw0U0Lf7c8RTeESuhPK8pI/edit?usp=sharing Any thoughs or flaws?

Its a group based end to end encryption method for sending data between members

@thorn obsidian Can you post it here rather than a Google Doc?

Oh hello elliot. lol

Pretty Good Privacy Protocol
[e-mail]


1. Introduction


Currently on the internet free speech is closing due to censorship. This document will contain a full set of instructions to bypass this censorship. In no ways do I support any criminal activity caused by this protocol.


2. Verification


This segment will detail how a user can verify themself. In order for a user to verify themselves they must submit a decrypted message to the server in the form of a token. First the user sends a request to the server wanting to join.


After this the server will send the user a token that is PGP encrypted along with the PGP keys. In order to decrypt this message they must use the private key and the passphrase to decrypt the message. The passphrase is sort of a group-wide password. A certain group or server has this password and sends it out to members in person or other secure means. If the user sends the server the token in clear text then the server can verify the user is a part of the group and is assigned a UUID.


3. Sending and Receiving 


To send data to the group or a specific UUID it must be encrypted and decrypted by the sender and receiver. Using the keys that were used during verification the sender encrypts their data or message and sends it to the receiver. The receiver decrypts the message by using the keys that were used in verification and the passphrase that the key is connected to.


4. Possibly Vulnerabilities


 There are possible vulnerabilities with this protocol. The user is a weakness because if they expose the passphrase and or leak it this can compromise your server. However this can be avoided by changing your keys and passphrase often or trusting your members. The other possible vulnerability is the passphrase getting brute forced. This can be solved by blocking the attackers IP address or using a strong password to prevent brute force attacks.```

I will add more meat in my file compiled version

But first I want some recommendations or any flaws notified

Currently on the internet free speech is closing due to censorship. This document will contain a full set of instructions to bypass this censorship.
and not once did you mention Tor

eh

its more for communications

I'm curious of the usecase(s)

Instant Messaging

Data Sharing

Is this for protests or for larger distances?

No.

I mean, which one is it?

I just got banned a few months ago from discord for sharing my political thoughs

It's either shorter distances like protests, or for larger distances, like across town/etc

It can be scaled to any degree

Notibly for smaller groups

First the user sends a request to the server wanting to join.

After this the server will send the user a token that is PGP encrypted along with the PGP keys.
So, the server provides the PGP keys?

Yea

Not something I'd use. You need to generate keys on user devices.

I suppose

Signal is something I'd suggest using. They're also working on moving away from phone numbers. Have you looked into them already?

Hm

No

Let me see

https://signal.org

Oh nice

Right now I just created it

https://signal.org/bigbrother/eastern-virginia-grand-jury/ They've also been subpoenaed in the past

I am looking twards morphing this into a decentralized peer to peer model

Damn

You might like Briar too

https://briarproject.org/

I trust Briar considerably less than Signal though, just a heads up.

[thorn obsidian]

Is iOS more secure than android?

Out of box

That's a rather loaded question

How do you define secure?

It also depends on which device you're talking about

@thorn obsidian

Like outside hacker or from physical access both

Like if they want to access my phone and data

Is it more costly on which platform?

Alright, which device are we talking about here?

iPhone vs OnePlus

iPhone what? OnePlus what?

iPhone 2? OnePlus 3?

iPhone 11 vs new OnePlus

So you want to know how latest iPhone stacks up against the latest OnePlus?

Yes 😬

Considering I haven't touched either, I can't give too much of an in-depth analysis.
But iPhone-wise, you don't (yet?) have to worry about the issue that came out that effects older iPhones.
Not sure on latest OnePlus. Bootloader issues could exist, and OnePlus is pretty good when it comes to support.

So you could run a custom recovery without needing to flash anything pretty easily

Just boot recovery <recovery.img>, like TWRP for example

So the answer is: "We can't know for sure in regards to devices this new."

I see ok fair point. But generally speaking like from what you hear is one more secure or no?

Outside of personal preference? No

Like so many times we hear iPhone is not cracked by police

Like I am no criminal 😆

Just curious

You don't need to be a criminal to encrypt your systems. My computer(s) always have full disk encryption on them.

Yeah I just like privacy

But no, I don't have evidence/proof that suggest one or the other is better

But in recently I have gave up little on privacy because it’s impossible and very hard for usability

How so?

For example Netflix, is better, google maps is better, YouTube is good, WhatsApp is everyone using. I download signal but no one is joining from friends

Like most alternatives are better for not so privacy friendly

Well, you say Google Maps, so I figure you have an Android device?

iOS

Ah, one sec

But is better than Apple maps

[primal ibex]

Google maps is better than Apple maps, agreed.

[thorn obsidian]

https://apps.apple.com/app/apple-store/id934850257 Check this out

I will have to try because where I live google maps is very accurate

It's what I suggest for maps. Uses OpenStreetMap and it's all offline

[primal ibex]

OSM is great

[thorn obsidian]

You download the maps to your system

@primal ibex Yeah, OSM is fantastic 😄

Oh I never heard of it I will have look

[primal ibex]

Honestly I actually prefer OSM maps to default Google maps most of the time

[thorn obsidian]

And When people are trying to crack phone what is makes the process so expensive?

I don't use anything else anymore, so, ¯_(ツ)_/¯

@thorn obsidian crack phones?

[primal ibex]

Are you mostly Google free? ^^

[thorn obsidian]

@primal ibex I didn't install GApps, if that's what you mean

[primal ibex]

I meant in general, do you avoid Google

[thorn obsidian]

I try to limit attack surface

@thorn obsidian crack phones?
@thorn obsidian like when police pay so much money to crack phones. Companies like elcomsoft (Israeli company) charge so much

Having extra stuff is just unnecessary

@thorn obsidian Because it's specialized stuff. Cellebrite comes to mind as well.

This is one of the issues with the NSA, for example. These companies keep these bugs to themselves and don't get them patched

So it causes everyone issues

Ah i see so they don’t tell anyone

Yep, because if their bugs get patched, they see it as losing money. They don't care about you or I

What is best way to reduce attack surface? Install as little as possible?

And to block ads?

Well, that.. that requires some detailed answers.

Really depends on your threat model

Who're you defending against? What're you defending? What happens if what you're defending gets out?

( I mean, I don't need to know your threat model, but it's something to keep in mind )

I wouldn’t say government because this is very difficult with a smartphone, especially when I hear about stuff like SS7 attacks. But this is very targeted you can say.

I would say I just want to protect my data as best as I can. Not from government but if possible with minimal impact on usability then yes, because it’s my data.

SS7 attacks are less of an issue if you don't rely on regular calls/texts

The normal people I meet don’t know anything to do with IT so it’s not people around me I fear

Signal actually approaches SS7 attacks in a highly intelligent way

As long as you've connected to them within the last 7 days, you can't re-register that number through Signal

So as long as you don't specifically go into Signal and disable Signal messages, you're good.

😄

Nice I didn’t know this, and on WhatsApp I have the 2FA as well which maybe helps

I don't use WhatsApp, since it's a Facebook company.

So not something I can comment on

Yeah but I have no choice in my country

So currently I have Freedome VPN
DNS Adblock for iOS (Adguard) - Russian company but is open source
I have Touch ID, 9 digit passcode.
Reset phone after 10 attempts.
USB accessories can’t be connected to phone if not unlocked.
iMessage, FaceTime, and only WhatsApp is Facebook app I have.
No backups to cloud for anything.

Is this good level you think?

Give me about 30-45 minutes, having to deal with an issue

[thorn obsidian]

Yes ok whenever you are free, i am always here 😄

[thorn obsidian]

Sorry, that took longer than I would have liked

A lot of what you have is iOS, whereas I use Android.

[vital gyro]

hey where can i get a list of hashes and passwords

anyone know

i tried searching it in github

but i couldnt find it

[spiral pivot]

for what purpose?

there is rockyou.txt

should probably cover most usecases

[vital gyro]

yea

but like my pc cant open it cause it too slow

fo

for what purpose?
@spiral pivot for educational puropose

[spiral pivot]

alright, you dont need to open a wordlist though

they are used to brute stuff usually

[vital gyro]

well i do need password list and hash list don't I a person told me to make my own but i dont know how

[spiral pivot]

why would you need that

and hashes in what schedule?

[silent plank]

Are you looking for a rainbow table?

[vital gyro]

what do u mean why would i need that

i a trying to convert a hah into its og format

so i would need hash list and pass list

would i

and what is a rainbow table

[spiral pivot]

yes you are trying to decrypt hashes

ok

md5?

[vital gyro]

yep

[spiral pivot]

a rainbow table is a precomputed lookuptable

[vital gyro]

using

python

[spiral pivot]

are you using windows?

also this is not #cybersecurity

[vital gyro]

yes it is

and yes i am using windows

what do u mean by rainbow table could u elucidate

[spiral pivot]

do you know what a dict is?

and no making a lookuptable for hashes is unrelated to security

its basically just a python project with hashcat/john

[vital gyro]

well what is a dict

and isnt cracking related to security

[spiral pivot]

a = {
  'wow cool': 'yes',
  'not so cool': 'well idk'
}

print(a['wow cool'])

[vital gyro]

that i knew

but how is this related to dict attack

[spiral pivot]

so basically what a rainbow table is, you have the hash as an entry and the key as the, well in this case probably password

and yeah sure cracking is, but cracking is a very broad subject

you can do cracking trough reverse engineering and exploiting bad software

or patching binaries, etc

[vital gyro]

well i am talking about password cracking which i think is related to secutity

[silent plank]

Do you have a specific security challenge that you're working on?

[vital gyro]

kinda but not really i am just trying to convert hashes into password form

[spiral pivot]

https://crackstation.net/

that takes the most stuff

also i dont see how this is educational

[vital gyro]

why not

[spiral pivot]

because what do you gain?

i mean if you actually implement md5 from scratch etc then i say absolutely, great

[vital gyro]

knowledge

hey @spiral pivot u are also in JHD discord

[spiral pivot]

uh yeah i might be idk

im in pretty much all ctf discords

[vital gyro]

i ca check mutual servers thats why

u arent in try hack me

[spiral pivot]

whats that?

[vital gyro]

server

for pentesting and stuff

[spiral pivot]

oh, yeah i dont do pentesting i guess. I'm a pwner

[vital gyro]

oh

[thorn obsidian]

Gusys, did any of u recieved an invite from a disc bot called free nitro, be carefull, ITS AN SCAM! Srry for non appropiate server!

[thorn obsidian]

😂

[nimble isle]

Shot in the dark but does anyone know how EwsIds are generated?

[brittle summit]

Ewslds?

[woven robin]

ew, salads /s

[nimble isle]

Exchange Web Service Ids

[opal copper]

so im doing a bit of programming for someone and i dont really want to send him the source code so can anyone link me some simple and easy to use obfuscators ?

[lusty flare]

you could compile it to byte code

https://docs.python.org/3/library/py_compile.html

that'll produce a .pyo which will run like your script without containing python code, but it can still be reversed

[spiral pivot]

Bytecode can be reversed to identical source code

Well you can start with making everything a function

Make addition a lambda etc

And change all names to some random chineese character

[lusty flare]

general point is: no, you can't "protect" your python code

:D

[opal copper]

well you can

the guys not going to know how to reverse it

just simple obfuscation would solve it all

[spiral pivot]

well just use https://liftoff.github.io/pyminifier/

in that case

or you can make it into bytecode and then add code that is never reached that makes the decompilers stop working

[sage stream]

https://www.wsj.com/articles/nsa-warns-cellphone-location-data-could-pose-national-security-threat-11596563156

I’m surprised why they are just now issuing this warning to their staff.

[lusty flare]

there have already been multiple cases of military personnel getting their information jacked through 3rd party apps

like finding out the outlines of a secret military base because someone was recording the GPS data of their daily jog

[primal ibex]

I remember that, it was actually a couple people IIRC

[thorn obsidian]

@lusty flare Wasn't that Strava?

https://www.theregister.com/2018/01/29/strava_heatmap_military_base_locations/ Sure was 😄

[buoyant bison]

does obscuring the salt in a database help against bruteforce attacks?
more specifically put them in a format like {beginning of the salt}{the hashed password}{end of salt}
in a way only the program (and the one who coded it) knows where the salt ends and the hashed password starts

[primal ibex]

That's security by obfuscation, not a great idea. If someone just took a look at the program they could easily figure out how it was reading the db in, I imagine.

[woven robin]

the point is someone can't use a precomputed rainbow table to brute force the hash

[eternal veldt]

@opal copper look into pyarmor

[opal copper]

i was but it wasny working for some reason

[eternal veldt]

well pyarmor is probably your best bet if you can get past the problems. you can also compile your program and sent it as an exe so they don't need python / dependencies

[thorn obsidian]

@buoyant bison Obscuring a salt doesn't do too much, no.
You want to use different salts for each password.
https://passlib.readthedocs.io/en/stable/lib/passlib.hash.argon2.html handles that for you

[buoyant bison]

@thorn obsidian @primal ibex @woven robin thanks for the responses but you see, my goal is to not only protect the password from rainbow tables, lookup tables. but to also protect it from dictionary attacks. I thought if I could obscure the key but wcshamblin has a good point it would be easy for them to crack if they know how the program works

[thorn obsidian]

Argon2 is designed for passwords, so even dictionary attacks would be slower.

As opposed to something like SHA256, or MD5, or something equally as bad.

I'd suggest reading into Argon2

[buoyant bison]

I see. thanks. I will

[gentle hornet]

How can I tell if the code I have running on my computer has a keylogger, leaks or anything that would allow someone to know what I'm doing within the code or in my computer?

[eternal veldt]

Are you talking about a python program or just executable in general

[gentle hornet]

A python program

@eternal veldt

[eternal veldt]

Well you would need to be able to understand the code. If you can't understand the code there's really know way to know it's not malicious.

[gentle hornet]

Good point. I'm two months into learning programming/python which makes it very hard for me to trust opening python programs on my computer.

I don't understand most of what I find.

Are there any key things I can keep an eye out for? Or is this something that can be really well hidden?

[echo herald]

look for external network requests in the code

[eternal veldt]

Well viewing code poses no risk to you, even if it is malicious. Just don't run it. But if you don't have much experience it can be very hard to know what to look out for. So if it's just some code you found online think twice before running it. But generally speaking big projects on github will usually be safe to use.

[gentle hornet]

@echo herald Does that mean things like API?

@eternal veldt Yeah that's a good rule of thumb. Unfortunately the area I'm venturing into in python has very little stuff out there which makes everything seem untrustworthy since I can't understand most of it.

I'm a trader looking to back test my strategies.. Specifically options strategies. Some experienced developers have expressed interest in sharing their code so that I may test my strategies.

Which makes me doubt whether or not by testing my strategies on their code will allow them to see what my strategies are.

These are rather large python programs with hundreds of lines of code.

[eternal veldt]

If you are worried it will do something bad on your computer, you could always go through the trouble of running it within a VM

But if you're worried about them seeing your own strategies, then that might not matter as much. If you really wanted to run their code you can either trust them, try to understand the program, or get someone else to check it out first.

[gentle hornet]

@eternal veldt Solid advice. I'm going to spend some time analyzing the code as that itself should also help me get better at programming. If after doing that for a few hours/days I find there are still things that confuse me, I'll ask someone to check it out.

It could be naive of me or maybe not but I feel this code which is hundreds of lines of code, almost 1000, could be done in substantially fewer lines of code, around 100 to 200. Perhaps it is not too out of reach for me to make my own back tester with some effort.

[eternal veldt]

Yeah definitely. At the very least it might could you in the right direction

[gentle hornet]

Yeah you're right. I closed my eyes a few minutes ago and just tried to process how I would put the pieces together and it doesn't seem too complex. At least, for the sake of the simplicity of my strategies, I don't think I need a huge program. I can make something smaller that will do what I need and as I learn more I can add more functions to it

@eternal veldt

My main issue right now is that I haven't built anything class based which seems to be the typical format for programs of this nature. I'll either learn how to work with classes and make a simple version with classes or instead make it functional and at least have a working solution until I learn to make it class based.

[eternal veldt]

That's alright. There's nothing wrong with only using functions. Like you said, you can always convert it to object-oriented down the road.

[gentle hornet]

@eternal veldt Thanks. I guess that's what I'll do. Since at my level I feel much more comfortable with functions. All the small things I've done such as calculators have been functions. 🙂

[eternal veldt]

good luck with it!

[slim plaza]

https://www.dealabs.com/bons-plans/udemy-ceh-1944000 100 % free

[thorn obsidian]

English?

[slim plaza]

yes is in english .
It only lasts 35 min.It is not very extensive but it can be interesting for people

[thorn obsidian]

I asked because the description looks to be in French

[ember osprey]

I highly recommend zSecurity, or Zaid Sabih on ethical hacking courses on Udemy. He's really good

[brazen seal]

what i remember of the CEH was that it was a lot more about staying out of jail than anything of worth lol.... OSCP was better about actually having to learn things

[pliant elk]

certifications are all about legality

[brazen seal]

not sure I follow exactly, but the CEH does fit that description

[pliant elk]

but certified teachers does put boundries on what you get to learn

[thorn obsidian]

hiya folks I was just wandering if you know a simple way to create a password hashing script in python. I am building a site and would like to know a way to hash passwords. Thanks!

[remote prairie]

Are you using a web framework to build the site?

django/flask/etc?

[thorn obsidian]

flask

flask for hosting

html css ect for the pages them selfs

[thorn obsidian]

@thorn obsidian https://passlib.readthedocs.io/en/stable/lib/passlib.hash.argon2.html

[untold oar]

hello

whats better to start getting into coding? powershell or python?

[analog jacinth]

Powershell isn't really coding

It's scripting

But hugely useful in IT work

If you want to code, python would be a better introduction

[untold oar]

thank you!

[untold oar]

im trying to get in to IT as career any advice would be greatly appreciated. just trying to get my foot in the door

[mighty bison]

As the Cat said before, if you're getting into IT, Shell and basic CMD would be the way to go first off

Then you can begin integrating js and py in to code logs and stuff like that

[analog jacinth]

I would google for like help desk/technical support jobs and see what they are asking for

and then focus on those areas

or noc jobs or whatever you specifically are interested in

[snow oxide]

Consulting can also be a good way to get started

[lusty flare]

1st line tech support is a good way into IT, providing you can meet the insane requirements of having 2 years experience in the job.

make an inventory of your computer skills, just a big ol' list, like can you use linux? done any active directory stuff? can you do hardware stuff? etc etc

and if you have a hard time getting the full time roles, don't miss a part-time or short term temp job

i built up the experience to have my CV taken more seriously by doing temp contracts. like ~3 months a time each one. also gives you a bunch of exposure to different IT systems and their workings.

[analog jacinth]

I got a tech support job with just an AAS and an A+ cert, and 4 years of food service experience

[lusty flare]

i had spent my entire life using / working with / fixing problems with computers

hosting servers, reselling website space, that sort of shit since i was a kid

but your word vs something that goes on a CV, big difference to some people

[static thunder]

could someone try to help me with my encryption software. it is supposed to encrypt any text of your choice. but i am stuck on making it encrypt spaces and decrypt correctly.

[analog jacinth]

Post your code

What library are you using

[brazen seal]

Sounds like bad encryption lol

Or really good, not sure which lol

[spiral pivot]

Could be a padding problem for like AES?

[grand current]

Hello all. Any suggestions for a book/course for cyber security with python for beginners?

[brazen seal]

@grand current there are some good ones at https://www.cybrary.com

[grand current]

Thank you.

[thorn obsidian]

#discord-bots

[brazen seal]

Just being lazy? @thorn obsidian

[tropic bay]

could someone try to help me with my encryption software. it is supposed to encrypt any text of your choice. but i am stuck on making it encrypt spaces and decrypt correctly.
@static thunder wait i am confused, why does it sound like veracrypt/bitlocker does everything you want your program to do..?

[analog jacinth]

What if they want to immediately send the encrypted data over a socket

And also what if they just want to learn how to do it

[buoyant bison]

How do I use a key generated by argon2 to encrypt or decrypt using fernet? it gives an error 'Fernet key must be 32 url-safe base64-encoded bytes.'

I think maybe increase the digest size to 32 and use it as a key?

I think maybe increase the digest size to 32 and use it as a key?
yeah I'll try that

[dull geyser]

Hi guys

is it dangerous sharing your uuid with someone else?

[brazen seal]

UUID for what?

your Discord UUID?

[thorn obsidian]

@dull geyser Depends what the UUID is

[dull geyser]

the one that appears using wmic csproduct get uuid command on cmd

[brazen seal]

I have no idea what that is lolol

[candid mesa]

What?

[thorn obsidian]

https://www.reddit.com/r/netsec/comments/i80uki/theymozilla_killed_entire_threat_management_team/
sigh

[tribal vigil]

👎

[primal ibex]

Does anyone know if there's a specific reason for this?

https://blog.mozilla.org/blog/2020/08/11/changing-world-changing-mozilla/

[thorn obsidian]

is this stuff with mozilla good for privacy or no?

i left chrome long ago but idk maybe go back?

i know chrome is not good for privacy but with the security is good

[thorn obsidian]

It's a matter of waiting and seeing

My english is little bad to understand the text, but they are saying that they want to move away from keeping data private? correct?

No, that's not what they're saying

oh

[brazen seal]

I use Brave for the time being ...

[thorn obsidian]

I'm sorry to hear that

[primal ibex]

Quite unfortunate

Hold on. I looked up Brave's controversy with affiliate link injection, and I saw this

https://latesthackingnews.com/2020/06/14/brave-browser-lands-in-hot-waters-for-mistakenly-redirecting-users-to-affiliate-links/

Mistakenly?!

You can see the fucking commit in which they put it in

[thorn obsidian]

"Oops, didn't mean to commit that, or get it verified, or get it pushed out to the final release. Our bad!"

[primal ibex]

Common slipup, I can see why

[tall haven]

I vaguely remember Firefox doing that once too

Something along those lines

Can't find anything about it though

[thorn obsidian]

If you're talking about the add-ons, that's entirely different

[midnight lava]

DuckDuckGo : )

[primal ibex]

DDG is great, but sometimes it just.... doesn't work? Like, the results aren't even close

And their crawlers are quite slow to index new sites

[tall haven]

I meant something regarding adding (undisclosed?) advertising somewhere that got removed after backlash. Maybe it was related to add-ons;I don't really remember anymore.

[thorn obsidian]

The Mr. Robot thing?

[tribal vigil]

@primal ibex not really. I was searching for a video of a national park and the first result was like 5 hours old. Not even from a major publication, just a guy on YouTube with 7 views being exactly wear I was looking.

[lusty flare]

https://www.theregister.com/2020/08/13/pentest_networks_fail/

The crews found that bugs in web apps for which patches exist yet were not applied were a particularly easy way to break into networks. In 77 per cent of the cases, web app vulnerabilities and configuration flaws allowed the red teamers to crack a company's defenses

PATCH YOUR SHIT

What's more, in most of the cases, an attacker did not need to do much, beyond gaining an initial foothold, to command full internal network access: in 68 per cent of the trials, the infiltrators only needed to take one or two steps to have the entire organization

smh my head

[cloud fiber]

What's the example of Avalibility breach in CIA Traid?
does DDoS count?

[daring sedge]

that sounds like a homework question - one which you would probably benefit from figuring out yourself

[cloud fiber]

yes it is. haha

so i have read so far. Availability is unauthorized block of access or deletion of data

if im not wrong

so im just wanna make sure it's DDoS, before i look into real-world case study

[sage stream]

Yes you can read into DDOS

[rocky gorge]

Can someone teach me ethical hacking?

[spiral pivot]

the best teacher is yourself

[drifting elk]

Right @spiral pivot

[tribal vault]

is there a way to by pass this voting system? https://superseed2.gobi.vc/championship-standings/?utm_source=Alfred.&utm_campaign=a27484e3a6-EMAIL_CAMPAIGN_2020_08_13_10_16&utm_medium=email&utm_term=0_0a7b9a6642-a27484e3a6-410958577

it requieres an sms verification

[tribal vigil]

You want to rig the vote for something you received in your email?

Pretty sure that's not allowed here

[thorn obsidian]

@tribal vault

Is there a way to bypass this voting system
That's not something we'd entertain here

[main sequoia]

I was installing some stuff on my router the other day, and nmap'ed it realising that the firewall opened 2 ports. It seems a bit odd to me. Could this be a security issue?

[thorn obsidian]

@main sequoia What'd you install on your router? What are the ports?

[main sequoia]

It was from the entware package, but the open ports were localized as "blackice". I read that they quit a long time ago

And they run on port 8400 something, I don't have the scan available atm

[thorn obsidian]

What router is this? Did you have DDWRT, OpenWRT, Lede, or something else installed to it?

[main sequoia]

Asus RT-AX88U

And I'm running the Merlin software

[runic arrow]

Did you try seeing what connecting to those ports returns?

[main sequoia]

No I didn't. And also I can't even see them as open anymore (no settings changed).. My net is no good..

The modem got hijacked a while back, and my ISP refuses to change it's admin password. to allow me on.. So I need this Asus one to at least be as safe as possible

[lusty flare]

what was the actual nmap result?

are they actually open?

are you running it against the public IP address?

what is your network topology? are you still using the ISP router but double NAT'ing with a 2nd router?

i think we'd need more information before we can discuss this in a productive manner is what i'm saying.

[main sequoia]

Yes, I am using the ISP modem (not router) in NAT because it does not support bridge.
The nmap scan was from local IP, but I can try the public one too.
One thing I know for sure is the modem is hijacked and its password is leaked, and I have been messaged about that. Resetting the modem doesn't return it to default admin/root password, so I do not have access to all services.
The Asus is running on merlin version 384.18_0

[past star]

Hey @main sequoia!

Uh-oh! It looks like your message got zapped by our spam filter. We currently don't allow .txt attachments, so here are some tips to help you travel safely:

• If you attempted to send a message longer than 2000 characters, try shortening your message to fit within the character limit or use a pasting service (see below)

• If you tried to show someone your code, you can use codeblocks
(run !code-blocks in #bot-commands for more information) or use a pasting service like:

https://paste.pythondiscord.com

[main sequoia]

I'll sent the nmap scan in parts:

▶ nmap -T4 -A -v 192.168.50.1
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-13 23:10 CEST
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 23:10
Completed NSE at 23:10, 0.00s elapsed
Initiating NSE at 23:10
Completed NSE at 23:10, 0.00s elapsed
Initiating NSE at 23:10
Completed NSE at 23:10, 0.00s elapsed
Initiating Ping Scan at 23:10
Scanning 192.168.50.1 [2 ports]
Completed Ping Scan at 23:10, 0.02s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 23:10
Completed Parallel DNS resolution of 1 host. at 23:10, 0.04s elapsed
Initiating Connect Scan at 23:10
Scanning RT-AX88U-5E28 (192.168.50.1) [1000 ports]
Discovered open port 443/tcp on 192.168.50.1
Discovered open port 53/tcp on 192.168.50.1
Discovered open port 445/tcp on 192.168.50.1
Discovered open port 139/tcp on 192.168.50.1
Discovered open port 80/tcp on 192.168.50.1
Connect Scan Timing: About 47.40% done; ETC: 23:11 (0:00:34 remaining)
Discovered open port 8081/tcp on 192.168.50.1
Connect Scan Timing: About 78.30% done; ETC: 23:12 (0:00:30 remaining)
Completed Connect Scan at 23:13, 208.00s elapsed (1000 total ports)
Initiating Service scan at 23:13
Scanning 6 services on RT-AX88U-5E28 (192.168.50.1)
Completed Service scan at 23:14, 22.05s elapsed (6 services on 1 host)
NSE: Script scanning 192.168.50.1.
Initiating NSE at 23:14
Completed NSE at 23:14, 8.60s elapsed
Initiating NSE at 23:14
Completed NSE at 23:14, 0.05s elapsed
Initiating NSE at 23:14
Completed NSE at 23:14, 0.00s elapsed
Nmap scan report for RT-AX88U-5E28 (192.168.50.1)
Host is up (1.0s latency).

[lusty flare]

right, that looks like a local side nmap scan

[main sequoia]

I'll try to nmap my pub ip

This one is long too...

[lusty flare]

!haste

!paste

[past star]

Pasting large amounts of code

If your code is too long to fit in a codeblock in discord, you can paste your code here:
https://paste.pydis.com/

After pasting your code, save it by clicking the floppy disk icon in the top right, or by typing ctrl + S. After doing that, the URL should change. Copy the URL and post it here so others can see it.

[lusty flare]

so i had a look through those results

while there seem to be some services open on your public IP, i'm not sure they're publicly accessible.

[main sequoia]

For example the ssh part is the modem, not sure how much I like that

[lusty flare]

is the ISP modem an actual modem? single port in, single port out, direct connection to the internet?

or is it just a router?

[main sequoia]

It's a 2in1 router and modem.. I think it's an inteno DG400 running on Iopsys system

[lusty flare]

okay, so if you're double NAT'ing, none of the stuff you see on your public IP matters to the 2nd NAT state

since you've got another router/firewall in the middle that can accept / reject traffic as it pleases

by pushing the ISP router LAN -> WAN of another router, you get another layer of abstraction which gives you more control

over your bit.

e.g. anything out the ISP router -> your router, you have control over now

as opposed to just directly connecting a switch to the ISP router

[main sequoia]

I may be a bit paranoid, but I've tried to monitor the network with wireshark in between as well, showing some kind of ARP. I think what I'm mostly scared of is MITM on the ISP modem

[lusty flare]

hmmm... little you can do but to remove the ISP's router from the equation then.

[main sequoia]

PPPOE.. They don't own the network, so I can't get the info

[lusty flare]

or set up a VPN and tunnel through it

[main sequoia]

It helps a bit tho with the info, so thanks a lot! At least the emails about stolen accounts stopped after I set up the asus

[lusty flare]

that's really the only way to handle untrusted networks, btw

VPN through them

yeah, not sure about the stolen accounts email stuff, but glad i was of some help.

btw "double NAT'ing" is usually called "Carrier Grade NAT" if you wanted to look up more about your network topology, but this is drifting into networking channel talk ¬_¬

[analog jacinth]

your isp modem requires nat?

[main sequoia]

I'll have a look at it 😛 Can probably read the documentation for it

Yes it requires nat, at least with the access I have to it

[lusty flare]

i feel router / modem talk can easily get confused due to the combined nature of the device now.

[analog jacinth]

yeah if it implements NAT its both a modem and a router

[lusty flare]

or just a router.

[main sequoia]

This one is both, but yeah it's easy to mix

[lusty flare]

yeah, my fibre line has a dedicated modem that i could configure to and directly expose a PC to the world on that public IP

the only way you can do that through most combined router / modems is through a DMZ or some such

[main sequoia]

I've been thinking of another solution to it, but I don't know if I'm even allowed to ask for advice on how here

[lusty flare]

or 1:1 NAT forwarding

yeah, we can't discuss breaking into your ISP's router.

:3

[main sequoia]

😛

That's fine tho, but it would for sure fix the problem

[analog jacinth]

have you tried asking your isp

[lusty flare]

hah

a generic hah, but a hah nonetheless

[thorn obsidian]

@main sequoia

The modem got hijacked a while back, and my ISP refuses to change it's admin password.
How do you know the modem was hijacked?

If you have a compromised upstream modem, it doesn't matter what else you use on the network.

[lusty flare]

great question about a point i completely missed.

[thorn obsidian]

You still have a compromised device on the network

[main sequoia]

Wireshark (ARP), received mail about it, getting a warning whenever I log on, and I've seen weird connections besides that in my network both from iptables logs and using "my little snitch" to monitor connections on my mac

I've also been going through a lot of the SSL keys checking whether they are valid and not, and while more are, there's quite a lot which are not

[lusty flare]

a device from the local side can only report on local traffic.

[analog jacinth]

Well another router would at least create a different network, offering some protection, right? @thorn obsidian

[lusty flare]

double NAT'ing would be more like abstraction than real security

[main sequoia]

I'm taking logs from both the Inteno, the Asus and multiple devices at home

[lusty flare]

if the ISP router was compromised having another router/firewall between it and your LAN somewhat protects you

http traffic could still be intercepted, anything unencrypted

[thorn obsidian]

@analog jacinth If you have two devices, and the one is compromised, you still have a compromised device

[lusty flare]

DNS requests, etc

since they have to be forwarded to the upstream router (/modem)

[thorn obsidian]

With it being an ISP-provided device, it's probably locked down too. Do you know for a fact these connections are not being siphoned off to some third-party? No.

[lusty flare]

ISP's often fill their little white label boxes with holes so when you call for support they can jump in

still not sure why TR-069 isn't the standard choice for that but oh well

[main sequoia]

I called them asking for help either to connect to it or help connecting to their PPPOE, both refused saying that if they give me that information, they may as well give me the information of their other customers

[lusty flare]

i mean, they might not be wrong depending on their network topology and protections

a friend in rural America was on a WiFi beacon sort of platform

[thorn obsidian]

or it was a cheap excuse of "Yeah that's not gonna happen"

[lusty flare]

so you'd have a central tower in your area and you'd beam from your dish to that

she connected directly with a computer rather than ISP modem once and got a DHCP address in a private (LAN) range

ran an nmap scan and saw all the other modems (routers) in the area light up on it

¯_(ツ)_/¯

that was a carrier grade NAT scenario though, and probably poorly thought through

[main sequoia]

Generally speaking, I'm also still on the copper net, so I bet the chances are they didn't really think it too through

[lusty flare]

nah, ADSL / Copper infra is better thought through than some of the modern solutions. we've had like 3 decades of ADSL.

at the end of the day, if you can't trust your ISP you can either ditch them or be paranoid while using the internet and being mad at them

[main sequoia]

There is no other ISP in the area.. So I'm only left with one choice lol

[lusty flare]

well, that sucks.

i assume they're a reasonably large ISP too?

[main sequoia]

Actually no, they've just taken over the ADSL network after the company that owns it stopped supporting it

[thorn obsidian]

Can't you just buy your own modem and use that instead?

[lusty flare]

would need the PPPoE details, which they wont give out

not uncommon. SKY started doing that in the UK a lot

[thorn obsidian]

Name and shame, then.

[lusty flare]

but people figured out that the PPPoE password was related to modem / router MAC address

so you could just run a script against the MAC and get your PPPoE pass

great

[main sequoia]

Lol I wish I could do that here.. Maybe

[thorn obsidian]

If you know your modem is compromised and can prove it, let others know, publicly.

[main sequoia]

I have the mac address of the Inteno anyway tho, maybe I could set up the Asus to copy it somehow

[lusty flare]

know carries a lot of weight there. at the very least you could figure out a better line of questioning with your ISP

[thorn obsidian]

Copying a MAC address != PPPoE credentials

[lusty flare]

"why are these ports open on my router?"

[thorn obsidian]

@lusty flare There's plenty of ISPs that have ports open on routers

That's not news

[lusty flare]

oh sure, but asking them why can lead to some interesting results

[thorn obsidian]

But to know and prove it's compromised, totally different story.

Not necessarily

I assisted someone years ago with just that. The ISP didn't care.

[main sequoia]

I should have some logs laying around. But I've tried to talk to them about it and they don't give a fuck

[lusty flare]

i mean i think trying to nail down the ISP's response to your questions is important

gives you an idea of what their behaviour is like

i guess if you know what sort of response you expect

[thorn obsidian]

@main sequoia What country/state is this?

[main sequoia]

Norway

[thorn obsidian]

Huh. Not the response I expected at all.

[main sequoia]

Yeah I know.. I've not really dealt with many companies like this

[thorn obsidian]

Oh, I certainly have 😄

[main sequoia]

Where are you from?

[thorn obsidian]

U.S.

[main sequoia]

I bet there are a few more over there 😛

[thorn obsidian]

Quite a decent amount, that's for sure.

I can only give you my opinion on this, not a lawyer and all that.

[lusty flare]

i can see no reason to doubt a major norwegian ISP

[thorn obsidian]

But yeah, I'd be trying to get a new modem ASAP

[lusty flare]

then again, i only know one man who has worked for a norwegian ISP

smash it with a hammer and tell them you need a new one

¬_¬

[thorn obsidian]

If it's truly compromised, and you can prove it's compromised, get a new one yesterday

@lusty flare and then pay the $500~ for destroying their property, sure.

[main sequoia]

They did offer to send a new modem, but still won't give admin, so I don't see the point

I believe it's one of their admin passwords being breached as well

[thorn obsidian]

Eeeeehhhhh....

Can I PM you for some details?

[main sequoia]

Yeah of course

[lusty flare]

i know what it's like in the US Scott, and i don't know what it's like in Norway, but those routers are gifted out like trash here

and often, on ADSL lines, just get the PPPoE info off the ISP and use your own hardware.

if i was using a BT Home Hub or w/e and it "broke" (yes a hammer is excessive) they'd just replace it

the cost of the router is included in monthly payments so unless you're breaking a shit load a month you're still making them money

wtf does one of those zyxel shitboxes cost wholesale anyway?

US ISPs seem much more insane in their profit extraction over set-top-box rental and the likes

because of the whole monopolistic market and that

[main sequoia]

Zyxel routers are given out here too as the trash they are..
The people on the support line for my ISP doesn't even know what PPPOE is...

[thorn obsidian]

@main sequoia So, I'm not going to link it.. but I've found evidence to suggest that the specific make/model you have has an RCE in it.