5 ms·

How hard would it be to do a demo for jurors in a courtroom? Simple proof-of-concept getting all of them to connect to a "wifi" network which is a tethered devi

by pgpd 11y ago

How hard would it be to do a demo for jurors in a courtroom? Simple proof-of-concept getting all of them to connect to a "wifi" network which is a tethered device owned by the lawyer, have them navigate to a regular website, and then inject images for the 2nd go-around to introduce reasonable doubt?

patcheudor 11y ago
Trivial. The way to do this in a courtroom is to demonstrate it to the judge and jury by having a reputable forensics expert certify a computer is free from kitty pictures. Then have the judge connect that computer to a "Free WiFi" network to be used for the demo and have them go anywhere. Just start randomly browsing the Internet. Meanwhile, use an intercepting proxy like The Burp Suite, Fiddler 2, or Charles operating transparently (ergo., port 80 is routed through the proxy) and in every HTTP response replace the close HTML tag with a bunch of 1x1 sized images of kittens playing with yarn or something. After about five minutes of browsing, have the forensics expert look at the computer again and nail the judge for looking at kittens. Using an intercepting proxy which allows scripting, the whole thing could even be done in a way which would very much look like the judge was seeking pictures of kitties playing with yarn, right down to search engine queries. The last time I looked, not a lot of search engines implement cross site request forgery (CSRF) tokens for the entry of simple search terms. It's not like setting up a demo like this is even tough. At most it's a couple hours of work for a basic functional demo. UPDATE: For anyone claiming the forensics expert would find the tampered markup, the no-store cache directive pretty much takes care of that. For all tampered requests, just set the cache directive in the header to no-store and per the requirements of the RFC, the HTML will not be cached to disk. Also, I've encountered very few forensics experts who understand the web enough to grasp what can and cannot be done via the browser.
- LeifCarrotson 11y ago
  > 1x1 sized images of kittens playing with yarn Here's a 1x1 image of this you can use. The yarn is actually very small, clear, monofilament fishing line, but I think it's a nice picture: http://commons.wikimedia.org/wiki/File:Blank.gif http://commons.wikimedia.org/wiki/File:Blank.gif
- hobs 11y ago
  If you wanted to do evil, the NSA has already showed the ability to use the "quantum intercept" (return a response before the initial server does). No need to even have the power of proxy if they are using bare http.

by pgpd 11y ago

patcheudor 11y ago

Trivial. The way to do this in a courtroom is to demonstrate it to the judge and jury by having a reputable forensics expert certify a computer is free from kitty pictures. Then have the judge connect that computer to a "Free WiFi" network to be used for the demo and have them go anywhere. Just start randomly browsing the Internet. Meanwhile, use an intercepting proxy like The Burp Suite, Fiddler 2, or Charles operating transparently (ergo., port 80 is routed through the proxy) and in every HTTP response replace the close HTML tag with a bunch of 1x1 sized images of kittens playing with yarn or something. After about five minutes of browsing, have the forensics expert look at the computer again and nail the judge for looking at kittens. Using an intercepting proxy which allows scripting, the whole thing could even be done in a way which would very much look like the judge was seeking pictures of kitties playing with yarn, right down to search engine queries. The last time I looked, not a lot of search engines implement cross site request forgery (CSRF) tokens for the entry of simple search terms. It's not like setting up a demo like this is even tough. At most it's a couple hours of work for a basic functional demo. UPDATE: For anyone claiming the forensics expert would find the tampered markup, the no-store cache directive pretty much takes care of that. For all tampered requests, just set the cache directive in the header to no-store and per the requirements of the RFC, the HTML will not be cached to disk. Also, I've encountered very few forensics experts who understand the web enough to grasp what can and cannot be done via the browser.

LeifCarrotson 11y ago
> 1x1 sized images of kittens playing with yarn Here's a 1x1 image of this you can use. The yarn is actually very small, clear, monofilament fishing line, but I think it's a nice picture: http://commons.wikimedia.org/wiki/File:Blank.gif http://commons.wikimedia.org/wiki/File:Blank.gif
hobs 11y ago
If you wanted to do evil, the NSA has already showed the ability to use the "quantum intercept" (return a response before the initial server does). No need to even have the power of proxy if they are using bare http.