3 ms·
Trying (and failing) to hack the Wall of Sheep (2022)
- gryfft 2y ago> They grinned: “it’s just some old software we run.” Ha! There are layers of lessons to be learned here.
- kstrauser 2y agoRight? Huh, we need a tech stack that happily survives one of the most hostile networks in the world. Shall we update to a React SPA? Perhaps not.
- kstrauser 2y agoThe Def Con security conference has open wifi, and people make a game of trying to capture packets of others trying to log into non-SSL websites. If successful, they post the credentials on the “Wall of Sheep”. One year I got the idea to try to exploit the Wall. I didn't succeed but had great fun trying!
- mystraline 2y agoThere was a person who captured a Logitech Starburst V2 packet capture from one of their management machines. Using a tool called JackIt, demonstrated either sniffing all text from a keyboard, OR injection of an emulated keyboard through the dongle. IIRC, the mouse was a clone Logitech that was even plugged in to charge.
- hackernudes 2y agoOk this took me a minute to parse. Someone at DEFCON captured the wireless data from a mouse/keyboard dongle. The dongle was connected to a computer that belonged to the organizers, possibly managing the Wall of Sheep. They were able to capture and/or simulate input from/to the dongle. Nice.
- mystraline 2y agoYep, that's correct. Probably shouldnt post here tired! I saw it on the defcon subreddit. Post was deleted, but IA made a snapshot. https://web.archive.org/web/20220428221916/https://www.reddit.com/r/Defcon/comments/cqsgw4/what_happened_at_the_wall_of_sheep_my_take/ https://web.archive.org/web/20220428221916/https://www.reddi...
- bsder 2y agoQuote of TFA: > I asked the Shepherd how a login goes from being captured to being shown on the Wall of Sheep. Their reply doomed our fun: “I’d type it in.” Oh no. That’s not good. “Isn’t it automatic?”, I asked. The Shepherd paused to rub the bridge of their nose. “Well,” they sighed, “it was until people started sending a bunch of vile usernames and passwords and kind of ruined it2, so now we have to moderate the process.”
- kstrauser 2y agoSome people take pride in ruining it for everyone.
- netsharc 2y agoI guess it shows even mere mortals attend Def Con. Thinking that website authentication is still being done with Basic Auth? Come on...