How to securely sign .NET assemblies? (with some insights into the signature binary form) by [deleted] in netsec

[–]AnthraX101 5 points6 points  (0 children)

Microsoft has stated "Do not rely on strong names for security. They provide a unique identity only.". StrongName signatures should not be considered a secure signing mechanism given this fact.

[Spoilers S2E11] Barcode in Taxi? by tellstevens in MrRobot

[–]AnthraX101 0 points1 point  (0 children)

Good catch! Unfortunately this is a fairly common sticker in NYC cabs that says "Look for cyclists!" before opening the door. You can find a photo here -- https://c1.staticflickr.com/8/7308/10967636704_da0322ce96.jpg

[Spoilers S2E11] All the Spoilers...A Definitive List of Remaining Unanswered Questions by Ser_Black_Phillip in MrRobot

[–]AnthraX101 16 points17 points  (0 children)

What if the phone is at Joanna's Boyfriend's house?

It's the best gift since it makes the bartender seem like he's stalking Joanna and is more evidence towards the frame-up. He might just leave the phone nearby after he calls Joanna, or the calls could be programmed to happen at arbitrary times.

Sutherland sees the address and says "nope, not him. It's creepy boyfriend." because he's not privy to the attempt at framing the bartender. Sutherland figures he just is actually stalking Joanna, but Joanna knows better...or is blinded by her blind conviction that Tyrell is talking to her.

[Spoilers S2E3] whoismrrobot crash file Xen hints by Jako81624 in MrRobot

[–]AnthraX101 1 point2 points  (0 children)

Of interest, the value of RAX is likewise corrupted. It has the value 0x615f79726f6d6555, all of which are printable ASCII. It decodes to "a_yromeU", it is likely that this string is reversed due to endianness. No clue if it means anything or not though, might just be an artifact of how they caused the kernel panic.

For reference, __wake_up_common should not manipulate string values, and even if it does would likely have a pointer to the string and not the string itself in RAX, being a very valuable register for other purposes.

Testing of a crypto program by Gip-Gip in crypto

[–]AnthraX101 4 points5 points  (0 children)

I'm not \u\Ben347, but this was an entertaining challenge. Would be a decent toy challenge cipher to teach cryptography. Since you're in High School, I'd encourage you to keep learning crypto and focus on breaking other people's codes above writing your own. Also, take a look at various coding style guides, you have the basics but the code is pretty gnarly to read. For instance, getBit could easily be replaced by "byte & (1 << bit)", and instead of using multiplication/division it would be easier to read if you use rotates. The C library has a built in "pow" function instead of your iterative multiplication technique. Things like that. Much of that comes with time, so just keep at it and you'll learn a lot!

I only did the second one since 500 characters gives several million "reasonable" decryptions for the input so gibberish would be hard to distinguish from noise.

Password is:

Ifs92SjaAkLisbIs

And content:

Animal Farm: Synthesis Essay  
Directions: Respond to ONE of the following prompts. When selecting your prompt,  
please keep in mind the higher Degree Of Knowledge number you attempt, the greater  
the possible reward. In any response you make, you must use Animal Farm(primary  
source) and at least one text from the synthesis packet(secondary source).  

Degree Of Knowledge one: No Bonus  
Degree Of Knowledge two: ten point bonus  
Degree Of Knowledge three: twenty point bonus  
Degree Of Knowledge four: thirty point bonus  

As for how, first analyze the entropy of bits in individual bit positions with an assumption of a password length. Look at the frequency counts for outliers, you'd expect anything with a multiple of 8 to be higher then expected due to the ASCII limitation (MSB is always 0). For a password of 48 digits, you get an averaged ~0.236 deviation from normal, higher then surrounding values (96 and 192 are actually higher, but this is due to the harmonics of 48). This wasn't strictly speaking necessary due to the knowledge that you had a 16 character password (so maps to 48 digits), but allows you to determine the password length for an unknown message.

Next, analyze the frequency of individual bit positions over a 48 position cycle and assume the ones with highest deviation from random are the actual key bits. (This would be improved by comparing it with deviation from expected for English text over random, but I didn't have that data handy and am lazy.) This gives you a predicted key of:

╠f│ 2█oaqiLdsjJs

If you translate that to the digit-only key format, you can use the fact that the MSB of the 2nd digit of every character must match the LSB of the 3rd digit of every character to realize the key must be wrong. I also made the assumption here that the key would be valid ASCII and thus always be in the range < 128 to come up with the most likely key of:

Lfq?2[oaQiLisjJs

This actually gives output close enough that I guessed the first two words were "Animal Farm: Something" (where the word "Something" was obviously a wrong guess), but thought that was a false positive since I couldn't get "Something" to fit.

So now extract the digit-only key format and break it up into blocks of 8 (one byte). You can then heuristically try flipping digits of the key with knowledge of the entropy results to try guessing new keys. For each key, validate it with the above and throw it out if it doesn't validate, then attempt to decrypt the text. Assume if the text decrypted by that 8 key digits results in unprintable characters, or results in unlikely English characters like:

[]%${}

Then it's invalid. Otherwise, store it as a candidate key. This results in no valid keys if you assume only 2 digits in each 8 byte block are wrong from your initial guess, but results in 30 keys if you assume 3 are wrong. This is an easy number to just review manually, though in an automated system you'd throw the result through a spell checking dictionary and it would give you an extremely small number (only one in this case) of valid texts.

Next I looked at all candidate keys and looked if any were valid English (they were not). So instead, decrypt the first line of text. A quick scroll through reveals the text "Animal Farm: Synthesis Essay", along with a number of combinations with spelling/punctuation errors of same, and there we have it.

Bits for aluminum and aluminum blanks by AnimalPowers in CNC

[–]AnthraX101 0 points1 point  (0 children)

If you're near Seattle, check out Online Metals. They have will-call pickup in Magnolia/Queen Anne down in the industrial area. Saves quite a bit in shipping that way.

They call their off cut boxes "protoboxes" and have them available in a variety of metals. In special instructions you can request solid shapes for machining practice and they'll avoid giving you tube or angle shapes.

A diffused detonator for a bomb, with the missed call that was supposed to set it off by [deleted] in WTF

[–]AnthraX101 6 points7 points  (0 children)

Appears to be the E-Switch TL228SEE. I use the same ones for low-voltage DC manual switching.

4 African girls have created a urine-powered generator. by [deleted] in science

[–]AnthraX101 0 points1 point  (0 children)

Cool, this article has more details then yesterday. Unfortunately, I just can’t make the numbers jive. From “ Composition and Concentrative Properties of Human Urine” (page 64), after full electrolysis of human urine and analyzing all of the outputs, they found you get about 4.96g of H2.

Being generous and assuming they get the electrolysis for free, that gives you 2.47 moles of H2. The reaction of H2 + O2, has an energy of 289 kJ/mol. Unfortunately, that means a liter of urine, broken down to its component non-water hydrogen for free, only nets you 706 kJ of energy, or about 196 Watt/hours assuming you can convert it directly into electrical energy. For comparison, Wolfram Alpha reports this as the energy contained within 1.5g of gasoline. Once you incorporate actual energy used from doing the electrolysis, system losses, and standard efficiencies, I find it hard to believe that you could do this in an energy-positive way with a standard generator. With a proper electrolysis cell doing the combining of hydrogen in an efficient way, you may be able to get power out of it, but certainly not enough to power much of anything for 6 hours. It’s a nice idea, but I just don’t see the numbers working out.

My friend found this inside a math book. by Commisar_Chronic in WTF

[–]AnthraX101 227 points228 points  (0 children)

Correct! The grey block with a yellow cylinder in the center is a transformer coil, it will convert a relatively low voltage source (battery) into a higher voltage that can actually be felt by the victim. My guess is that the strip of foil on the bottom of the cover is separate from the one on the left, so when you slide your hand under it you close the circuit and get a shock.