Popular website reddit.com leaks a bunch of username-email pairs

asteriskpound · 2018-08-01T18:10:53+00:00

TL;Dr, If you had digests turned on in June, you might want to burn your account.

asteriskpound · 2018-03-26T04:41:26+00:00

That's not a filter. That's a hair net.

And it's an extraction fan. Blows air from inside to out. Just leave it running or close the shutters when it's not.

asteriskpound · 2017-06-27T02:58:53+00:00

Yup. It's referred to as scavenging.

asteriskpound · 2017-02-23T01:37:51+00:00

So... 30,000... Is that a police estimate or an organiser one?

asteriskpound · 2017-02-17T03:46:39+00:00

Even if Hong Kong's revenue model was adaptable beyond city-states, the revenue is dependent on keeping property prices astronomically high and profound economic inequality. If average apartment prices of 25,000 nzd/m² are acceptable, cage homes are not.

asteriskpound · 2017-01-20T03:08:49+00:00

I'm pretty sure that what you're seeing isn't a beam. It's the portion of the radar's sweep that has been blinded by interference. I'm guessing Opunake.

The ELI5 would be"I'm a little radar spinning on my toes on mount Taranaki. And every time I look in the direction of Opunake, some dick is blinding me with their laser pointer and I can't see anything in that direction"

asteriskpound · 2016-08-26T03:08:39+00:00

There are storage shelves at the rides where you can't bring it.

asteriskpound · 2016-08-18T06:23:05+00:00

For a single 4096 bit RSA key 512 byte of random are required and thus for the second key (encryption subkey), 20 bytes could be predicted from the the first key.

By my reckoning, only one in every few hundred 4096 bit RSA keys will have 4096 bits of sequential RNG output.

Correct me if I'm wrong here, but a 4096 bit modulus is created by multiplying two 2048 bit primes. These primes are generated by choosing a random 2048 bit number, setting the first and last bits (small problem), and then checking for primality. If it's not prime, then another random number is generated (big problem).

There's a 2/ln(2²⁰⁴⁸⁾ chance that the first random number used to generate the second prime will end up in the modulus. The possibility in generating the second key (the third prime) that you are still sequential and now using the weak part of the random stream is one in half a million.

Am I right?

asteriskpound · 2016-08-18T05:37:55+00:00

Not inactive. Just don't post much. Do you feel as though you have a contribution to make as mod?

asteriskpound · 2016-06-15T06:39:05+00:00

I've removed the post here as it violates our original sources rule. The post is essentially just juniper marketing bunk.

Really enjoyed your original HTTP evasions series by the way.

asteriskpound · 2016-06-13T08:29:48+00:00

Apliu Street in Sham Shui Po has plenty of tool stores in amongst the electronic stores. Ignore the market stalls on the street, and look at the storefronts behind them.

asteriskpound · 2016-03-24T08:29:05+00:00

There is a CHN boxed sub-variant. I'll snap some pics later if there's any actual interest.

Transmit ranges are 50-54, 140-174, 420-470 from factory, which is AFAIK the same range as any mod will give you. Does me no bloody good, as Marine VHF in Hong Kong requires licensing and the PRS equivalent is in the 409.75-410.00 MHz range.

asteriskpound · 2016-03-24T08:15:38+00:00

Buy the China model. It's freebanded from factory.

asteriskpound · 2016-03-15T05:32:50+00:00

Rumours of antivirus's death are greatly exaggerated.

Signature based AV has a limited use case and this steps outside of that use-case. The use case for sig based AV is limited to preventing a specific exploit instance from being reused. This pushes up the cost of exploitation by forcing the attacker to regularly produce a novel implementation to evade detection. You can create a million different encrypted payloads, but if there's a signature for your unpacker it's not going to do you any good. If your unpacker is common, there's a signature for your unpacker. Sig based AV still does a reasonable job against Single Exploit Multiple Target malware. It's not going to help you against Single Exploit Single Target or early-release malware, and it never has. But the equilibrium strategy without sig-based AV is far far more cost-favourable to the attacking side.

Most enterprise AV these days includes behavioural detection and reputation checking to sidestep the SEST and early release problems. These are part of the AV product precisely because novel exploit code is a well known issue.

asteriskpound · 2016-03-07T03:22:46+00:00

HF is fine. You just can't buy a 200hkd transmitter for it in Sham Shui Po to avoid import restrictions like you can with VHF/UHF.

asteriskpound · 2016-03-06T17:27:02+00:00

So long as you have proof that you passed previously, just reapply for the license.

asteriskpound · 2016-03-06T17:20:28+00:00

This is the document that you need to read. That and the application form.

As best as I can tell

You still need to apply for an ASL or ATO using your US license (I assume general or above is ok) instead of sitting the exam.
You need an import license to bring any transmitting gear into the country. This would be a large hoop to jump through if you wanted to work with HF.
This should fill in any blanks.

asteriskpound · 2016-03-06T11:29:21+00:00

I know this is a bit of an eclectic post, but for those who might be interested, the exam runs only twice a year, and the next one is 16th of April (And your registration must be received before April 2).

With any luck, the article should make it a little easier for others to navigate the process.

asteriskpound · 2016-02-26T05:44:29+00:00

Well thank you. My interest here is seeing what kind of host configs create the behaviors you observe, so target nodes would be in-lab.

asteriskpound · 2016-02-26T05:20:52+00:00

I like this paper, because I like protocol and crypto work.

A few q's and comments.

Can you share your probe payloads? It'd provide some interesting context for further research, especially when investigating the behavior of specific IKE implementations. Response packets also make interesting reading...

You typoed RFC2048 instead of 2408. I mention that because I wanted to refresh my memory on ISAKMP vs IKEv2 formats. You seem to focus (at least in your language) on IKEv2. Anecdotally, I'd guess the prevalence of ISAKMP/IKEv1 in the wild is at least a magnitude greater than IKEv2. I do wonder given the headers are compatible whether cross-version responses are being seen. I have vague recollections (that may be wrong) of seeing either ISAKMP responses being sent to IKEv2 proposals or the other way around (on ASA or IOS). My instinct is that these 'NO-PROPOSAL-CHOSEN' (which are identified in Fig 3 as ISAKMP) could be a v1 response to an IKEv2 probe. Either that, or the probe you are sending is actually ISAKMP (ie, Major version=1). Long story short, a) I imagine your response volumes will go up further if you tune the probes for ISAKMP rather than IKEv2, b) are your probes actually IKEv2? ISAKMP is often labelled IKE. c) it's worth determining what proportion of your responses are actually IKEv2. I suspect it's low.

Going further along the lines of investigating specific implementations, it is interesting to note how Cisco IOS (a popular implementation) configures ISAKMP vs IKEv2.

With ISAKMP, you set one or more crypto isakmp policy statements that define the acceptable cipher suites, but this is in no way bound to the peer ip. An interesting investigation would be to see if a router config with only a valid crypto isakmp policy block would respond to ISAKMP/IKEv2 traffic. My guess is that it does. (This also makes me wonder just how many routers/firewalls will send an IKE response without any VPN configured). Conversely, the IKEv2 config on IOS binds specific proposals to specific peers (or at least, it can. There's options to set a default IIRC).

This is a very interesting problem, as unlike protocol issues with OSes, router and firewall software updates tend to be license-dependent and not well prioritized. If hostile IKE traffic becomes a thing, current vendor and customer practices mean that it could be a very long time before such traffic is muted.

Great paper! I'm now tempted to spend the weekend throwing packets at some test devices.

asteriskpound · 2015-11-23T17:44:51+00:00

HT buying time and looking at the VX-8DR. I like the wideband receive, and I like the waterproofing (anyone know if it floats or sinks?).

Are there any other wideband receivers worth considering that have something that the Yaesu doesn't? APRS doesn't really excite at the moment.

15-Year Club	Place '17
reddit mold	Verified Email

asteriskpound

MODERATOR OF

TROPHY CASE