scarybeast

5 ms·

1.
by scarybeast 5y ago
@tptacek -- you're so awesome. I keep meaning to reply on some of these security threads but then I see you've made the relevant points of sanity in a well reasoned manner. For what it's worth, when I was setting up the cultu
2.
by scarybeast 5y ago
The floppy disc controller doesn't have a way of knowing if the write worked or not. There are some corner cases here, like the drive can signal a fault line if it's on fire, but if there's simply a dodgy patch of disc surfac
3.
by scarybeast 5y ago
Do you have any recommendations for any particular techniques or software? I'd gladly try them.
4.
by scarybeast 5y ago
Great that you're working on something similar! How are you finding those tools for handling degraded tape waveforms? I keep bouncing back and forth between hacking up my own vs. wanting to find some existing tool that has some clever
5.
by scarybeast 5y ago
The blog post uses conventions associated with the machine in question, the BBC Micro, which is an iconic 1980s UK machine. It was pretty much "Disc" back then, e.g. the dreaded "Disc error 0E" from the OS, or the spelli
6.
Recovering “lost” treasure-filled floppy discs with an oscilloscope(scarybeastsecurity.blogspot.com)
306 points by scarybeast 5y ago|53 comments
7.
The cleverest floppy disc protection ever? Western Security Ltd(scarybeastsecurity.blogspot.com)
339 points by scarybeast 6y ago|130 comments
8.
by scarybeast 6y ago
I'd personally phrase things a bit differently: an _individual_ was able to pull this off while surrounded by screaming children. A large government, with all its resources and hundreds+ of people, would pull this off regularly and wit
9.
by scarybeast 6y ago
We definitely wanted fun! I guess there are two ways to slice and dice it: 1) fun because the application is exotic / iconic, or 2) fun because the chip is exotic. This is definitely a case of the latter: an exotic chip with interestin
10.
Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA(scarybeastsecurity.blogspot.com)
169 points by scarybeast 6y ago|39 comments
11.
by scarybeast 6y ago
I think this is a bad decision. The "in-the-wild" part is the interesting part because it is not the norm at all and it implies an interesting story.
12.
by scarybeast 6y ago
These are some good hacks and tricks! The good news is that these fun days are still upon us. I'm a member of the Bitshifters collective: https://bitshifters.github.io/ For example, the most recent demo led by VectorEy
13.
by scarybeast 6y ago
That's an interesting story of the 6522 VIA for sure :) I don't think it is what I was hitting though, for a few reasons: 1) "The 6522 has a bug in mode 011, shifting synchronous serial data in under control of external CB1 c
14.
Turning a £400 BBC Micro (1981) into a $40k disc writer (1987)(scarybeastsecurity.blogspot.com)
34 points by scarybeast 6y ago|5 comments
15.
by scarybeast 6y ago
I've also been referred to this which definitely belongs here. It's a write up of fairly advanced weak bits usage on the 1984 Apple II educational title "Kingdom of Facts". https://ia800600.us.archive.org&#x2F
16.
by scarybeast 6y ago
Interesting, I didn't know the Apple II's controller could write the combined data and clock bits. That's unfair :) I was also pointed to this Twitter thread where it is explained that they wrote Mr. Do weak bits with a hacke
17.
Weak bits floppy disc protection: an alternate origins story on 8-bit(scarybeastsecurity.blogspot.com)
65 points by scarybeast 6y ago|11 comments
18.
A wild bug: 1970s Intel 8271 disc chip ate my data(scarybeastsecurity.blogspot.com)
97 points by scarybeast 6y ago|19 comments
19.
Sampled sound 1980s style: from SN76489 square waves to samples(scarybeastsecurity.blogspot.com)
2 points by scarybeast 6y ago|0 comments
20.
by scarybeast 6y ago
I like the framing here, that of seeing this as a showcase of modern superscalar improvements. And yes, it's about single core performance only. What is particularly interesting to me is how thoroughly superscalar "wins". Bec
21.
by scarybeast 6y ago
I was wondering about this. Does LLVM offer facilities expressive enough to model things like self-modification and arbitrary interruptability? I agree it'd be wonderful to see auto-vectorization! Obviously, 6502 code does things 1 byt
22.
by scarybeast 6y ago
A lot of BBC BASIC programs, doing real work (e.g. Mandelbrot drawing etc.), should have a shot at 10GHz. Games are slower because they are hammering hardware registers external to the JIT (sound, graphics, keyboard polling, timing, etc.) M
23.
Clocking a 6502 simulator to 15GHz(scarybeastsecurity.blogspot.com)
176 points by scarybeast 6y ago|74 comments
24.
by scarybeast 9y ago
FWIW, I've been very impressed with how Yahoo! handled this disclosure.
25.
by scarybeast 9y ago
This is YB (Yahoobleed) #2. You might also enjoy YB #1: "*bleed continues: 18 byte file, $14k bounty, for leaking private Yahoo! Mail images": https://scarybeastsecurity.blogspot.com/2017/05/bleed-contin.
26.
Dumping Yahoo authentication secrets with an out-of-bounds read(scarybeastsecurity.blogspot.com)
91 points by scarybeast 9y ago|7 comments
27.
*bleed continues: 18 byte file, $14k bounty: leaking private Yahoo Mail images(scarybeastsecurity.blogspot.com)
4 points by scarybeast 9y ago|0 comments
28.
by scarybeast 9y ago
This is true. But in the case where the malloc heap metadata is under attack, the attacker will usually just allocate exactly the right size to ensure that the off-by-one goes off the end of the chunk, instead of into slack space.
29.
by scarybeast 9y ago
Yeah, good question. The lower bits of ->size are actually masked off when considering a chunk's size, because they are flags: #define SIZE_BITS (PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) /* Get size, ignoring use bits */
30.
Further hardening glibc malloc() against single byte overflows(scarybeastsecurity.blogspot.com)
131 points by scarybeast 9y ago|35 comments

More ›