moyix

76 ms·

511.
by moyix 10y ago
Silence on the Wire is a fantastic book that looks at unconventional and underdiscussed aspects of security: interesting timing attacks, subtle information leakage, fingerprinting, etc. It's by Michal Zalewski, who is perhaps better
512.
Jailbreaking the Microsoft Fitness Band(b0n0n.com)
2 points by moyix 11y ago|0 comments
513.
by moyix 11y ago
Oh wow, he used some tools I wrote (and that someone later updated to work with Vista & above): https://github.com/Neohapsis/creddump7
514.
by moyix 11y ago
How many people per year would you estimate ISIS kills? Is it more than 150,000 people [1]? Because that's how many people the WHO estimates currently die right now as a result of climate change. And the number is expected to go up t
515.
by moyix 11y ago
The worry is not that it will throw an error, it's that it will silently link against lower-performance math libraries and make your code inexplicably slow.
516.
by moyix 11y ago
It's neither, I think it's just that different fields operate differently. In CS most papers are published in conferences. Authors do their own typesetting, editing, figure making, etc. Peer review is organized on a volunteer basi
517.
by moyix 11y ago
That's the problem with the current system, though. The authors aren't choosing a journal for the extra services the publishers provide, they're choosing it for the prestige associated with e.g. Nature. It's similar to t
518.
by moyix 11y ago
Oh, fair enough. There are certainly differences; it's definitely not exact same architecture. They are both using Deep Reinforcement Learning, but e.g. AlphaGo benefits from getting an explicit representation of the board state and ga
519.
by moyix 11y ago
I think you're wrong here. From the Nature paper describing AlphaGo: "We also tested against the strongest open-source Go program, Pachi, a sophisticated Monte Carlo search program, ranked at 2 amateur dan on KGS, that executes 10
520.
by moyix 11y ago
And they decrypt one file for free, to prove they can do it. Nice touch. Screenshots of the web UI: https://twitter.com/moyix/status/706577507965870080/photo/1
521.
by moyix 11y ago
The server isn't on EC2, it's hosted on Tor. The malware uses an HTTP-to-TOR gateway service (onion.nu and onion.link) to pull down the encryption key and README file from one of three different hidden services. In theory you coul
522.
by moyix 11y ago
Nice. That matches what I'm seeing.
523.
by moyix 11y ago
VirusTotal has some more info, including the files it writes: https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc... (Look under the "Behavioural information" tab) Written Files and Created Proc
524.
by moyix 11y ago
Another bit of prior work was Tempest For Eliza [1], which generated patterns on old CRT screens to play music (arbitrary MP3 files!) on nearby AM radios. Edit: And here's another one that transmits data over radio by toggling GPIO pin
525.
by moyix 11y ago
Unless this is different from the shellcode they used when taking down Freedom Hosting, I'm not sure what releasing it would do. There are already numerous analyses of the code: - Vlad Tsyrklevich: http://tsyrklevich.net&#x2
526.
by moyix 11y ago
Patching memory at runtime on an iPhone is not in any sense "easy". If it were the FBI wouldn't need Apple's help right now at all; they could just NOP out the code that implements the increasing timeout and erase-on-too
527.
by moyix 11y ago
Yes. I feel like anyone considering such a system should be forced to read "The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection": http://www.raid-symposium.org/raid99/PAPERS&#x
528.
by moyix 11y ago
If you can get a gdb stub onto an embedded system, you can do a lot of cool stuff, up to and including running its firmware in an emulator and forwarding I/O accesses to the real hardware (!), which gives you basically unlimited visibi
529.
by moyix 11y ago
On the downside, if you want more information than "these two things are spatially close to one another", the Hilbert curve makes it difficult. Unless you have a map of the curve in your head, could you tell where in the file some
530.
by moyix 11y ago
> x86 does have a register for defining the location of page tables that it will walk, the it would trap on a miss if the PTE is missing. Idk, if Linux uses this register or not or uses a software defined TLB, or some kind of hybrid appr
531.
I Loved Graduate School(bailis.org)
1 points by moyix 11y ago|0 comments
532.
by moyix 11y ago
Running `strip` on the binary decreased classification accuracy by 12%. They quite correctly point out that this isn't a large drop, but strip is really the lowest of the low hanging fruit when it comes to code obfuscation. I'd ex
533.
by moyix 11y ago
My suspicion is that most of these features wouldn't survive in an adversarial setting -- either by consciously changing your coding style or (better) using automated tools to rewrite your source code before compilation to alter the co
534.
by moyix 11y ago
Out of curiosity, have you looked at raptorial? I don't know much about it (aside from knowing the author) but it claims to be a much faster drop-in replacement for the apt family of tools: https://github.com/dankamongm
535.
by moyix 11y ago
Could have been planted by a different party. It's wildly different in terms of sophistication.
536.
by moyix 11y ago
That would be amazing. Has anyone checked that the new Q is not simply the SHA-256 of "Hack the Planet"?
537.
by moyix 11y ago
> Other research points to similar results. There seems to be a ‘double hump’ in the outcome of any programming course between those who can code and those who can’t. > “In particular, most people can't learn to program: between
538.
by moyix 11y ago
This is an important message to consider, and not just for cryptography. Everyone can benefit from thinking about the moral and social consequences of what problems they choose to work on, who they do them for, and what values the institu
539.
by moyix 11y ago
I thought that Daniel Drezner's rebuttal to this (also in the Washington Post) was pretty good: https://www.washingtonpost.com/posteverything/wp/2015/11/30/...
540.
by moyix 11y ago
I don't think they're talking about the PSN hack, but rather the release of tons of internal company emails. Just to cite one example of how this can ruin lives, Charlie Sheen's HIV-positive status was referred to in one emai

More ›