3 ms·

This is an interesting idea, but don't try and expect humans to notice some random string (i.e. fingerprint, checksum). Instead, using something like OpenSSH's

by pdkl95 12y ago

This is an interesting idea, but don't try and expect humans to notice some random string (i.e. fingerprint, checksum). Instead, using something like OpenSSH's "randomart"[1]. It can be made such that any small change makes a totally different blob pattern (BIG bonus points for using COLOR!). Possibly, this could even be chained into the background of the main OS load sequence, such that you see something like a Perlin-style colorful noise pattern during the longest part of the boot sequence. This could even hash other parts of the loader besides the BIOS, too. The idea being that you (probably) won't notice if 801EF9B138222F39EB2907634BC7FD47F9151919 changes to 40AE7CE2796FB14526ABB92B67BC0F1423B85B96 Almost everybody would notice if the boot sequence wallpaper that you've seen for months/years http://cs263.markaoyama.com/img/p5_abs_perlin_5_gens.PNG http://cs263.markaoyama.com/img/p5_abs_perlin_5_gens.PNG changes into http://cs263.markaoyama.com/img/p5_perlin_5_gen.PNG http://cs263.markaoyama.com/img/p5_perlin_5_gen.PNG (images taken from a very brief GIS of random Perlin noise articles) There are many alternatives. The key here is to engage the human visual system. Proof of why this work: the popularity of font-lock-mode. [1] http://superuser.com/questions/22535/what-is-randomart-produced-by-ssh-keygen http://superuser.com/questions/22535/what-is-randomart-produ...

Taek 12y ago
This is nearly a good idea, except that by adding a random string and hashing it a few times, you can get an image that is approximately the same. Its might be reasonable to assume the NSA gets 100,000 to 1,000,000 attempts at low expense, of which at least a few hundred will be a similar color, and one of those will have a similar-enough pattern that people are less likely to notice. It does create another level of protection for the user, and another hurdle for the attacker, but it still requires user diligence.
- pdkl95 12y ago
  Seeing as we are starting from 0 (no verification at all), any improvement would be a benefit. This would simply be a cheap and easy way to catch "some" attacks. Also, see my response to halfcat in a neighboring post.
sergeykish 12y ago
Hello, I've put quick ASCII to Pixels converter http://sergeykish.com/randomart http://sergeykish.com/randomart Already looks fun, yet image magic depixelizer makes it awesome. I think once converted to custom tag it may gain adoption <fingerprint>05:1e:1e:c1:ac:b9:d1:1c:6a:60:ce:0f:77:6c:78:47</fingerprint>
halfcat 12y ago
TBH, I don't think this would be very effective at all. I manage hundreds of servers for businesses, and if I ever see a Dell splash screen it's purely by accident. With basically everyone using virtualization, it's a long time between reboots for physical servers to begin with. And when I do need to reboot the physical server, I'm usually sitting at home in my underwear, not looking at the console. We can manage most of the BIOS-level settings through Dell-provided tools, so even when we change BIOS settings, we don't go into the BIOS. In my IT experience, anything requiring manual human checking basically doesn't get done after the first handful of iterations. If it needs to be reliable, it needs to be automated. My best guess is, you can install a package from Dell to enable BIOS info to be pulled via WMI (Dell OMCI I think). You can set all of your BIOS asset tags to some unique value (per machine) and if it changes, your monitoring software will see it and alert you. I'm not sure how easy this would be to spoof though. It might be trivial. Fortunately, most of the models they mention have been out of warranty for some years now, and most businesses choose to upgrade to a supported model. For businesses who chose not to upgrade to supported models, it's usually a reflection of the immature management in charge of the business, meaning they make poor decisions in many areas, so a BIOS hack is way down the list of potential problems for them.
- pdkl95 12y ago
  > In my IT experience, anything requiring manual human checking basically doesn't get done I fully agree - that why I like this idea; it doesn't rely on humans actively doing something, and instead engages the subconscious. Because our brain is constantly making predictions about everything we perceive, we tend to notice (without trying) if something subtly violates those predictions. We see this effect when people describe how they felt something was "off" or "wrong" before some big event. They probably did see something important, but not enough to recognize it or parse it consciously. Engaging the warning system that our fight-or-flight reflexes - which is very effective at processing visual sense input - is probably one of the more practical ways of getting past in this "humans won't bother" category. Also, a visual-hash isn't really trying to be perfect anyway. It's just a trick that would be very easy to implement. It won't get anywhere close to catching all attacks. It would probably catch more than our current strategy of doing nothing. When you start from 0, any improvement helps. The only reason not to do this kind of scheme would be if it raised the costs, but I doubt that would be a problem given how much headroom we have in modern hardware.

by pdkl95 12y ago

Taek 12y ago

This is nearly a good idea, except that by adding a random string and hashing it a few times, you can get an image that is approximately the same. Its might be reasonable to assume the NSA gets 100,000 to 1,000,000 attempts at low expense, of which at least a few hundred will be a similar color, and one of those will have a similar-enough pattern that people are less likely to notice. It does create another level of protection for the user, and another hurdle for the attacker, but it still requires user diligence.

pdkl95 12y ago
Seeing as we are starting from 0 (no verification at all), any improvement would be a benefit. This would simply be a cheap and easy way to catch "some" attacks. Also, see my response to halfcat in a neighboring post.

sergeykish 12y ago

Hello, I've put quick ASCII to Pixels converter http://sergeykish.com/randomart http://sergeykish.com/randomart Already looks fun, yet image magic depixelizer makes it awesome. I think once converted to custom tag it may gain adoption <fingerprint>05:1e:1e:c1:ac:b9:d1:1c:6a:60:ce:0f:77:6c:78:47</fingerprint>

halfcat 12y ago

TBH, I don't think this would be very effective at all. I manage hundreds of servers for businesses, and if I ever see a Dell splash screen it's purely by accident. With basically everyone using virtualization, it's a long time between reboots for physical servers to begin with. And when I do need to reboot the physical server, I'm usually sitting at home in my underwear, not looking at the console. We can manage most of the BIOS-level settings through Dell-provided tools, so even when we change BIOS settings, we don't go into the BIOS. In my IT experience, anything requiring manual human checking basically doesn't get done after the first handful of iterations. If it needs to be reliable, it needs to be automated. My best guess is, you can install a package from Dell to enable BIOS info to be pulled via WMI (Dell OMCI I think). You can set all of your BIOS asset tags to some unique value (per machine) and if it changes, your monitoring software will see it and alert you. I'm not sure how easy this would be to spoof though. It might be trivial. Fortunately, most of the models they mention have been out of warranty for some years now, and most businesses choose to upgrade to a supported model. For businesses who chose not to upgrade to supported models, it's usually a reflection of the immature management in charge of the business, meaning they make poor decisions in many areas, so a BIOS hack is way down the list of potential problems for them.

pdkl95 12y ago
> In my IT experience, anything requiring manual human checking basically doesn't get done I fully agree - that why I like this idea; it doesn't rely on humans actively doing something, and instead engages the subconscious. Because our brain is constantly making predictions about everything we perceive, we tend to notice (without trying) if something subtly violates those predictions. We see this effect when people describe how they felt something was "off" or "wrong" before some big event. They probably did see something important, but not enough to recognize it or parse it consciously. Engaging the warning system that our fight-or-flight reflexes - which is very effective at processing visual sense input - is probably one of the more practical ways of getting past in this "humans won't bother" category. Also, a visual-hash isn't really trying to be perfect anyway. It's just a trick that would be very easy to implement. It won't get anywhere close to catching all attacks. It would probably catch more than our current strategy of doing nothing. When you start from 0, any improvement helps. The only reason not to do this kind of scheme would be if it raised the costs, but I doubt that would be a problem given how much headroom we have in modern hardware.