31–39 of 39 posts
> They permit SSL to some known websites (for https), but the moment I try to create an SSL or SSH connection to an unknown server (eg. to the bastion box), their gateway instantly terminates the TCP connection! They are clearly already whitelisting connections, but still allow unidentified connections through?! What sort of logic is that?
I once did rot13 on /lib/firmware/* (not just 13 but 0-255), piped it via 'strings' command and find longest word in English corpus (/usr/share/dict/*). I forget what I found but it's trivial to replicate.
cd /lib/firmware
( find -name '*.xz' -exec xzcat {} \; ; find -type f -a \! -name '*.xz' -a -exec cat {} \; ) |
rot13 |
grep -aEo '\w+' |
awk '{print length, $0 }' |
sort -nsru |
head -20
Edit: The sort -u option hides words of the same length. Removing that option (and the head command) gives more results, but nothing that interesting.
> They permit SSL to some known websites (for https), but the moment I try to create an SSL or SSH connection to an unknown server (eg. to the bastion box), their gateway instantly terminates the TCP connection! They are clearly already whitelisting connections, but still allow unidentified connections through?! What sort of logic is that?
I love this! Using a 2000+ year cipher to circumvent Deep Packet Inspection seems almost poetic. I feel like the article missed out on mentioning one key thing: Using a deny-list doesn’t work. It’s much more viable to default block and allow the stuff you know you’ll allow. Defaulting to allow and blocking stuff you don’t want is how you end up being owned by rot13.
http://www.ranum.com/security/computer_security/editorials/d... "The Six Dumbest Ideas in Computer Security" > #1) Default Permit > #2) Enumerating Badness
I wonder how you might encourage deeper introspection into software infrastructure security vulnerabilities, both from closed source companies and from obscure open source projects, without "spreading breadcrumbs for the roaches"
I love this! Using a 2000+ year cipher to circumvent Deep Packet Inspection seems almost poetic. I feel like the article missed out on mentioning one key thing: Using a deny-list doesn’t work. It’s much more viable to default block and allow the stuff you know you’ll allow. Defaulting to allow and blocking stuff you don’t want is how you end up being owned by rot13.
http://www.ranum.com/security/computer_security/editorials/d... "The Six Dumbest Ideas in Computer Security" > #1) Default Permit > #2) Enumerating Badness
So it may not be an effective security measure but at least it stops your staff from doing online banking or shopping on work devices.
Earlier quoted context omitted.
double rot13 has an unfortunate meet-in-the-middle weakness but triple rot13 was invented for this very purpose. I hope he makes the upgrade.
For anyone not in on the joke, this is a real crypto concept/weakness/attack https://en.m.wikipedia.org/wiki/Meet-in-the-middle_attack (obviously only a joke with rot13). It's most famously the reason that 3DES is a thing, instead of just double.