72 Hours of Pwnage: A Paranoid N00b Goes to Def Con • Hacker News Board

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#11

Post by wyldfire » Fri, Aug 19, 2016, 1:31 PM UTC

    > “Aren’t those the people who break into computers?”
    >
    > “Yes—also phones, cars, airplanes, and human bodies.”
    > 
    > “I thought that stuff was illegal.”

While I think they're truly innovative and inevitable, the advent of "secure CPUs" [1] over the last decade or two will eventually become the norm. And once they do -- lookout, brother. The woman who was having this conversation scoffs at how Def Con can even take place if the subject matter is what she thinks it is. In a short time, the computer attacks which cause embarrassing leaks and expensive losses will add up to legislators deciding something must be done. At that time, the number of us who will still like and prefer to be able to run whatever code on whatever processor we care to will be so small that it won't matter.

[1] by "secure CPUs" I'm referring to ones that support signed bootloaders, facilitating good things like more-difficult-to-pwn-by-attackers and bad things like DRM and limiting code to proprietary walled garden app stores.

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#12

Post by dec0dedab0de » Fri, Aug 19, 2016, 1:31 PM UTC

u02sgb wrote: post #10

dec0dedab0de wrote: post #5

Earlier quoted context omitted.

You can do that with the routing table.

Interesting - links/details?

Have the default route point to your VPN client, and a static route for the VPN server pointing to the internet. Most VPN clients do this already.

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#13

Post by spydum » Fri, Aug 19, 2016, 1:48 PM UTC

dec0dedab0de wrote: post #12

u02sgb wrote: post #10

Earlier quoted context omitted.

Interesting - links/details?

Have the default route point to your VPN client, and a static route for the VPN server pointing to the internet. Most VPN clients do this already.

I think OP means prior to connecting to VPN so you are minimally exposed during the interim VPN setup.

Same technique could work, just more annoying (static route for VPN provider IP to your LAN gateway, and static routes for your trusted DNS provider, then only allow a default route to be established once VPN is connected).

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#14

Post by stephancoral » Fri, Aug 19, 2016, 1:54 PM UTC

tacostakohashi wrote: post #6

a2tech wrote: post #2

He should have gone to BlackHat if he wanted to see anything really interesting. Def Con is mostly a big party with life style talks and people talking about old stuff. Thats not to say there isn't neat stuff to do at Def Con (I've seen plenty of neat talks) but its mostly a big party. There's nothing really scary going on there.

I went to HOPE a few weeks ago, after having been to such things before, but not for a few years. I had exactly the same impression - mostly a lifestyle / social / political thing, pretty light on in the way of talks with actual technical detail. Kind of like TED talks - well presented, entertaining, but not really actionable. In years gone by, I went to some excellent events, with talks on really specific, useful th…

What talks did you attend at HOPE? There were tons of hard technical presentations. The two guys who cracked the Iridium satellite network in particular were amazing, going into deep detail on the techniques and methods used to decode the frequencies. The talk on medical device hacking was also awesome - I mean they showed you how to get on a radiology machine and other exploits. And after I saw the talk on hacking your cars internal computer I was able to go home and start futsing around with that stuff on my garage (after buying some hardware).

Maybe they don't do a lot of talks on the intricacies of C anymore (which is a bummer) but there is still a lot of technical knowledge going down at these events. I had s great time and learned so much

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#15

Post by ianpurton » Fri, Aug 19, 2016, 1:55 PM UTC

If you can't afford Def Con or can't be arsed then https://www.reddit.com/r/netsec is fun.

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#16

Post by Vexs » Fri, Aug 19, 2016, 1:57 PM UTC

pmorici wrote: post #9

tronje wrote: post #4

Earlier quoted context omitted.

It sounds weird that they're selling key-logging sticks for $50 and spoofing routers for $100 at a convention where you'd think everyone can build that stuff by themselves for a much lower price. Just to add to your point, I suppose.

Even if you value your time as worthless then maybe you could build a hardware key logger for less than $50 in parts but I really doubt it.

You can buy them from china really cheaply for a couple bucks.

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#17

Post by theossuary » Fri, Aug 19, 2016, 1:58 PM UTC

u02sgb wrote: post #10

dec0dedab0de wrote: post #5

Earlier quoted context omitted.

You can do that with the routing table.

Interesting - links/details?

This is a must read if you're interested in non-standard Linux networking: http://lartc.org/lartc.html

Look for "Split access", it's pretty similar to what you're talking about. Basically you'd just send all your traffic on your default routes table to 127.0.0.1 (nowhere), and all the traffic on your VPN routes table to the VPN. That way when the VPN isn't active all your traffic gets blackhole'd, when your VPN is active it'll all get sent over the encrypted tunnel though.

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#18

Post by brotoss » Fri, Aug 19, 2016, 1:58 PM UTC

Really boring article

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#19

Post by marcosdumay » Fri, Aug 19, 2016, 2:12 PM UTC

tronje wrote: post #4

a2tech wrote: post #2

He should have gone to BlackHat if he wanted to see anything really interesting. Def Con is mostly a big party with life style talks and people talking about old stuff. Thats not to say there isn't neat stuff to do at Def Con (I've seen plenty of neat talks) but its mostly a big party. There's nothing really scary going on there.

It sounds weird that they're selling key-logging sticks for $50 and spoofing routers for $100 at a convention where you'd think everyone can build that stuff by themselves for a much lower price. Just to add to your point, I suppose.

I'm sure a lot of people there has better projects to spend their time on than rebuilding commodity hardware.

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#20

Post by raesene6 » Fri, Aug 19, 2016, 2:36 PM UTC

a2tech wrote: post #2

He should have gone to BlackHat if he wanted to see anything really interesting. Def Con is mostly a big party with life style talks and people talking about old stuff. Thats not to say there isn't neat stuff to do at Def Con (I've seen plenty of neat talks) but its mostly a big party. There's nothing really scary going on there.

hmm not sure I'd say that Blackhat would in any way be a better option for "something interesting", it's a very expensive corp. focused conference these days.

Last time I went most of the interesting Blackhat talks were getting re-run at Defcon, so really not a lot of point in paying out for the Blackhat option, just go to Defcon and see them there.