72 Hours of Pwnage: A Paranoid N00b Goes to Def Con • Hacker News Board

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#41

Post by wcummings » Fri, Aug 19, 2016, 9:24 PM UTC

tacostakohashi wrote: post #6

a2tech wrote: post #2

He should have gone to BlackHat if he wanted to see anything really interesting. Def Con is mostly a big party with life style talks and people talking about old stuff. Thats not to say there isn't neat stuff to do at Def Con (I've seen plenty of neat talks) but its mostly a big party. There's nothing really scary going on there.

I went to HOPE a few weeks ago, after having been to such things before, but not for a few years. I had exactly the same impression - mostly a lifestyle / social / political thing, pretty light on in the way of talks with actual technical detail. Kind of like TED talks - well presented, entertaining, but not really actionable. In years gone by, I went to some excellent events, with talks on really specific, useful th…

Get-drunk-in-shitty-hotel-con isn't really about the talks, it's about goofing off in NYC w/ friends from IRC.

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#42

Post by nickpsecurity » Fri, Aug 19, 2016, 11:19 PM UTC

wyldfire wrote: post #11

> “Aren’t those the people who break into computers?” > > “Yes—also phones, cars, airplanes, and human bodies.” > > “I thought that stuff was illegal.” While I think they're truly innovative and inevitable, the advent of "secure CPUs" [1] over the last decade or two will eventually become the norm. And once they do -- lookout, brother. The woman who was having this conversation scoffs at how Def Con can even take pla…

Those are just restricted-boot CPU's, not secure CPU's. I agree secure CPU's will make attacks more difficult. Here's you a few examples of them with various tradeoffs:

http://www.crash-safe.org/assets/ieee-hst-2013-paper.pdf

https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

https://web.archive.org/web/20150315020829/http://palms.ee.p...

https://theses.lib.vt.edu/theses/available/etd-10112006-2048...

Original one that ran businesses which is still immune to lots of attacks vectors and reliability issues:

http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr...

So, spread word on things like those, esp CHERI given FreeBSD support, instead of that DRM garbage that uses the word security but is more about marketing & control. ;)

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#43

Post by nickpsecurity » Fri, Aug 19, 2016, 11:28 PM UTC

jjnoakes wrote: post #3

There ought to be a way, at the OS level, to configure a machine so no network traffic goes in or out over an unsecured link except for the VPN application's traffic. Then, if you configure secure links to be WPA at work, WPA at home, and your VPN, there should be little risk to joining an open network to bring up a VPN.

In high-assurance security, they go further by putting that functionality into a dedicated device with minimal components, a separation kernel (or RTOS), and strong isolation of networking. Idea being it always, by static design, forces networking traffic to go through the encryptor with almost no attack surface from external network. External network stack usually in own partition, too.

Examples:

http://www.friendsglobal.com/papers/High_Assurance_Wireless_...

http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=BF0...

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#44

Post by u02sgb » Mon, Aug 22, 2016, 9:44 AM UTC

theossuary wrote: post #17

u02sgb wrote: post #10

Earlier quoted context omitted.

Interesting - links/details?

This is a must read if you're interested in non-standard Linux networking: http://lartc.org/lartc.html Look for "Split access", it's pretty similar to what you're talking about. Basically you'd just send all your traffic on your default routes table to 127.0.0.1 (nowhere), and all the traffic on your VPN routes table to the VPN. That way when the VPN isn't active all your traffic gets blackhole'd, when your VPN is ac…

Thanks

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#45

Post by outworlder » Mon, Aug 22, 2016, 5:41 PM UTC

I can't find anywhere in the article that says those photos were taken with permission.

I was under the impression that photographs were not allowed.

Re: 72 Hours of Pwnage: A Paranoid N00b Goes to Def Con

#46

Post by wonkaWonka » Tue, Aug 30, 2016, 1:49 AM UTC

phaemon wrote: post #34

rhaps0dy wrote: post #32

Earlier quoted context omitted.

>Do they just turn off the "I'm a noob" angle, assume the standard authoritative tone they always use and cover other topics with just as flimsy of an understanding? Yes. See [Murray] Gell-Mann Amnesia: “Briefly stated, the Gell-Mann Amnesia effect is as follows. You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the jour…

Rather ironically, you can get the same effect reading Michael Crichton ;-)

At least it's supposed to be fiction.