Learning from the Enemy: The Gunman Project (2007) [pdf] • Hacker News Board

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#31

Post by markc » Mon, Jul 27, 2015, 2:12 PM UTC

cstross wrote: post #3

JupiterMoon wrote: post #2

Is there anyone else reluctant to open a pdf from the NSA?

(a) It's from their museum facility (if you ever get the chance to visit the National Cryptologic Museum in Maryland TAKE IT TAKE IT TAKE IT )[1], not the NSA itself. (b) It's a scan of a 30-year-old report on a completed project, redacted heavily. Nothing more. (c) If they want your inside leg measurement they've got better ways to find it without feeding you a PDF they overtly created. [1] Where else will you find…

>TAKE IT

Seconded. I went midweek around noon and it was pretty quiet so I got a personal 90 minute tour by an NSA retiree. He was very knowledgeable about crypto history, esp. as used in the cold war and WWII. They had Turing's "bombe", multiple Enigma variants, many lesser-known crypto machines, historic correspondence, a Cray YMP, codetalkers exhibit, spy satellites, and tons of other good stuff. Everything is free - except merchandise in the gift shop, which is also pretty unique.

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#32

Post by fallat » Mon, Jul 27, 2015, 2:20 PM UTC

JupiterMoon wrote: post #29

fallat wrote: post #4

Earlier quoted context omitted.

Download it, block all ports, run pdf reader in a chroot...B)

Or just read it on someone else's computer?

There's a name for that. The Stallman Co-Computer.

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#33

Post by JupiterMoon » Mon, Jul 27, 2015, 2:49 PM UTC

JupiterMoon wrote: post #6

cstross wrote: post #3

Earlier quoted context omitted.

(a) It's from their museum facility (if you ever get the chance to visit the National Cryptologic Museum in Maryland TAKE IT TAKE IT TAKE IT )[1], not the NSA itself. (b) It's a scan of a 30-year-old report on a completed project, redacted heavily. Nothing more. (c) If they want your inside leg measurement they've got better ways to find it without feeding you a PDF they overtly created. [1] Where else will you find…

In response: (a) I wish I could but I doubt I ever will. I've heard so much bad stuff about US border guards being annoying and transiting through the US being slow and painful that I won't even use a US hub anymore. (b) Cool I guess I can't know if this is true without opening it though? This is partly the fault of the pdf spec itself. Maybe a more transparent document format would help (does that even exist)?. (c)…

Wow this got a lot of downvotes. I don't normally comment on downvotes but I'm wondering why so many? What about this is causing annoyance?

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#34

Post by JupiterMoon » Mon, Jul 27, 2015, 2:54 PM UTC

beagle3 wrote: post #22

ptaipale wrote: post #20

Earlier quoted context omitted.

Perfectly common, of course. Usually the way to do this is to use a virtual machine which you then throw away.

but why do you trust your hypervisor? QEMU had a floppy controller escape bug published last month. Xen has one today.

By doing this the chain of things that have to be broken for an exploit to escape is getting longer.

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#35

Post by phkahler » Mon, Jul 27, 2015, 2:54 PM UTC

unbehagen wrote: post #15

"As a totalitarian society, the Soviet Union valued eavesdropping and thus developed ingenious methods to accomplish it." (page 2)

I stopped reading, copied the exact same text to post as a comment and see it's already at the top...

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#36

Post by wglb » Mon, Jul 27, 2015, 2:56 PM UTC

Ah, when your adversary knows more about your stuff than you do.

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#37

Post by leni536 » Mon, Jul 27, 2015, 3:14 PM UTC

JupiterMoon wrote: post #34

beagle3 wrote: post #22

Earlier quoted context omitted.

but why do you trust your hypervisor? QEMU had a floppy controller escape bug published last month. Xen has one today.

By doing this the chain of things that have to be broken for an exploit to escape is getting longer.

So the best thing you can do is to nest different kind of VM hypervisors with different OS guests and read the pdf in the innermost machine.

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#38

Post by reimertz » Mon, Jul 27, 2015, 3:21 PM UTC

JupiterMoon wrote: post #34

beagle3 wrote: post #22

Earlier quoted context omitted.

but why do you trust your hypervisor? QEMU had a floppy controller escape bug published last month. Xen has one today.

By doing this the chain of things that have to be broken for an exploit to escape is getting longer.

https://i.imgflip.com/oqlr6.jpg

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#39

Post by [deleted] » Mon, Jul 27, 2015, 3:25 PM UTC

unbehagen wrote: post #15

"As a totalitarian society, the Soviet Union valued eavesdropping and thus developed ingenious methods to accomplish it." (page 2)

[deleted]

Re: Learning from the Enemy: The Gunman Project (2007) [pdf]

#40

Post by noahshpak » Mon, Jul 27, 2015, 3:26 PM UTC

phkahler wrote: post #35

unbehagen wrote: post #15

"As a totalitarian society, the Soviet Union valued eavesdropping and thus developed ingenious methods to accomplish it." (page 2)

I stopped reading, copied the exact same text to post as a comment and see it's already at the top...

Just did the same thing. I love this place