Did I just win? • Hacker News Board

Re: Did I just win?

#121

Post by ademarre » Sat, May 14, 2016, 7:17 AM UTC

nickpsecurity wrote: post #115

exolymph wrote: post #110

Earlier quoted context omitted.

Websites are made of software.

Lol. I'm not repeating myself twice if you're not seeing the point.

You're failing to see the charm here. Social engineering is a confidence trick that exploits gaps in someone's personal trust system.

Surely you are right that when he presented the challenge he had something different in mind. But that's exactly the point! The winner realized that the website itself might be a gap in the challenger's trust system; a place where he would have his guard down.

Eschewing the implied parameters of a problem and cheating expectations are what vulnerability detection is all about.

Re: Did I just win?

#122

Post by angry-hacker » Sat, May 14, 2016, 8:14 AM UTC

joemi wrote: post #31

Can someone link to context? Without it, I don't see why this is even posted here.

Twitter is horrible for having a meaningful conversation, let alone reading it.

Re: Did I just win?

#123

Post by joepie91_ » Sat, May 14, 2016, 8:49 AM UTC

tstrimple wrote: post #62

1. Create issues for items I need fixed on my github repos. 2. Offer a $100 bounty to people who can trick me into getting some string into my projects. The easiest way to "trick" me of course is to hide it inside of a PR which fixes a real issue. 3. Find and remove the string before merging the PR. I've had one of my issues fixed for free. Rinse and repeat! Bonus Round: Stage an announcement on twitter and have some…

As somebody who knows the person in question: Nice theory, but no. Not everybody has ulterior motives like this.

Re: Did I just win?

#124

Post by demircancelebi » Sat, May 14, 2016, 10:41 AM UTC

hoke_t wrote: post #68

danso wrote: post #60

Earlier quoted context omitted.

Ah, I think my brain got led down a "garden path", a concept I just learned had an official name from yesterday's Parsey McParseface announcement https://en.wikipedia.org/wiki/Garden_path_sentence

Explain please? I cannot make sense of the op's sentence in a way that advocates social engineering.

Interesting. I am not a native speaker and I cannot make sense of the op's sentence in a way you understand it. How did you understand op's sentence in the first place?

Re: Did I just win?

#125

Post by frostymarvelous » Sat, May 14, 2016, 11:10 AM UTC

sc00bz wrote: post #114

frostymarvelous wrote: post #101

Earlier quoted context omitted.

Aren't you the winner?

Yes, I think this counts as proof: https://twitter.com/Sc00bzT/status/731243916951994368 My win was legit, but there's no way for me to prove that. Well if this was a PR stunt then I should of @defcon or at least #defcon to get a larger audience, but in all reality I'm banned from PayPal and haven't used Bitcoin. Which is why I said I'll settle for a beer, but I should of asked for zcoin after it launches... shit now…

Was that all in reply to me or I'm missing something?

I just noticed you have the same handle that's why I asked.

Re: Did I just win?

#126

Post by Magnets » Sat, May 14, 2016, 11:13 AM UTC

tstrimple wrote: post #59

Magnets wrote: post #54

Earlier quoted context omitted.

I don't really see how anyone can win this challenge (other than how already done). The guy will be super cautious of any pull requests.

You could probably hide it pretty effectively during a normal pull request to fix an existing issue. As long as they aren't greping for the string anyhow. If he's going to use tools to to search a PR for the string, you'd have to obfuscate it. There are plenty of string and / or byte array manipulation techniques to sufficiently hide something like this as long as it's masked by an otherwise real PR.

The guy is responsible for a small number of low-activity projects, he's going to go over any new pull requests with a fine tooth comb

Re: Did I just win?

#127

Post by startling » Sat, May 14, 2016, 11:14 AM UTC

hoke_t wrote: post #68

danso wrote: post #60

Earlier quoted context omitted.

Ah, I think my brain got led down a "garden path", a concept I just learned had an official name from yesterday's Parsey McParseface announcement https://en.wikipedia.org/wiki/Garden_path_sentence

Explain please? I cannot make sense of the op's sentence in a way that advocates social engineering.

"It's not clever to hack [with social engineering] something that you can socially engineer"

vs

"It's not clever to hack something [i.e. with technical exploits] that you can socially engineer""

Re: Did I just win?

#128

Post by Magnets » Sat, May 14, 2016, 1:08 PM UTC

Natanael_L wrote: post #76

ultramancool wrote: post #61

Earlier quoted context omitted.

You'd have to rely on a ball of jumbled crap somewhere in the PR though - maybe if they don't wrap lines or something you could slip it in?

I'd be XORing against some existing strings in the code of the same length to obfuscate the content, with some hidden method to invoke the reverse XOR to regenerate this challenge text string.

That sounds very difficult to hide

Re: Did I just win?

#129

Post by dkersten » Sat, May 14, 2016, 1:35 PM UTC

nickpsecurity wrote: post #88

icebraining wrote: post #85

Earlier quoted context omitted.

A website is software that users run.

A website is either data a browser interprets or a combo of it plus software (eg Javascript). This is compromising his software only in most technical, trolling sense. It won't affect his apps at all.

Software is data an operating system and processor interprets. He never specified apps.

Besides, how would inserting the string in his apps have any different affect than inserting it into the website? This is completely within the parameters that were set (because there weren't many).

Re: Did I just win?

#130

Post by nickpsecurity » Sat, May 14, 2016, 4:16 PM UTC

ademarre wrote: post #121

nickpsecurity wrote: post #115

Earlier quoted context omitted.

Lol. I'm not repeating myself twice if you're not seeing the point.

You're failing to see the charm here. Social engineering is a confidence trick that exploits gaps in someone's personal trust system. Surely you are right that when he presented the challenge he had something different in mind. But that's exactly the point! The winner realized that the website itself might be a gap in the challenger's trust system; a place where he would have his guard down. Eschewing the implied par…

I not only see that: I specifically explained the expectation and how it was reframed into a new target above.

https://news.ycombinator.com/item?id=11693426

Your failing to see my actual concern here. I'm one of those old-school types that rate people on impact their work has first and how clever/funny it is second. The first, expected challenge had consequences with impact. Tackling that with effort even close to success would be praiseworthy & even contribute something new to INFOSEC.

The other thing is the kind of shit I do to coworkers and people online all day for fun. One I hadn't thought of and clever for sure but same concept. It's a combo of wit and sophistry that focuses on technicalities of people's statements who aren't thinking carefully about them. Outside policy and procedures, outthinking a statement has no impact at all.

So, as I think along both lines, I recognize it as clever trolling in the second category like I do 20 times a day. Similarly pointless. Just fun and funny. Then, acknowledge that the real target or challenge would've been more valuable. Implicitly encouraging people to go for that one in case we learn something important. You know, relevant to information security. Plus, I give highest props to people that pull off difficult or nigh-impossible feats.