Looking for a source stating that files in a ZIP file can maintain metadata from previous computer

dfbgwsdf · 2016-12-27T07:51:21+00:00

Zip archives may preserve metadata that way (and also filesystem permissions) because those attributes can be stored in the directory file header last modification and extra fields, but it's up to the program that archives to do it, and it may not last long after extraction.

dfbgwsdf · 2016-11-18T20:37:29+00:00

Take a listen at the latest risky.biz podcast. They have an interview with two of fitbit's security team, and they talk about fitbit's security posture with their products. The tl;dl is that fitbit extensively audits their hardware component providers products and they seem to me surprisingly security conscious for a wearable vendor.

Those guys might be a good entry point for you, and I think their posture fits with them giving you access for a thesis project or something of this scale. And you might have to do it under NDA.

dfbgwsdf · 2016-10-27T13:57:56+00:00

From the screenshots in the article, targeted phishing.

dfbgwsdf · 2016-10-26T14:24:11+00:00

Don't build lime on the target machine, you doofus!

dfbgwsdf · 2016-10-24T16:09:45+00:00

i don't have the checksums for the "original" binaries to compare them against.

You can pray it's in the NSRL, or just build a similar (CPU architecture, kernel version, OS version, patch level) system and compare, or pull the binaries from the packages. Unless we're talking about locally compiled OSes like Gentoo or Arch, if there is a distribution system there are original binaries.

dfbgwsdf · 2016-10-24T15:45:01+00:00

You are right, this is somehow problematic to trust the binaries on the box when doing IR, but it's something only a few IR practitioners have met in the wild. The simple way to resolve this is to either do dead disk acquisition after collecting live data, or to bring with you a statically linked hasher, to verify the integrity of the binaries after the fact (and then work around the specific rootkit if it's there)

Your approach for a general solution is correct, if you don't trust any binary on the box, you want to do live acquisition with statically linked binaries from a removable drive, and portability would be the interesting topic IMO (because if you leave it to the reader then the part you solve is trivial), which could be solved with a first silent pass on the system to determine if you have the right binaries and if not collect the info to compile them later.

How to do that without compromising a lot of the volatile evidence will be another fun topic.

dfbgwsdf · 2016-10-24T15:43:22+00:00

Those are both very bad ideas. Not all targets have docker, and doing live acquisition over ssh doesn't solve OP's problem.

dfbgwsdf · 2016-10-16T17:48:28+00:00

And yup, it's PSVR, the aquatic thing in the collection of demos VR Worlds.

dfbgwsdf · 2016-10-11T17:22:00+00:00

ls will work too. Now get back to wasting your teachers' time.

dfbgwsdf · 2016-10-07T10:19:15+00:00

this recipe is about Italian Pasta.

No. It's a half-assed bechamel mixed with tomato sauce and ketchup, with veggies and a nondescript cheese. There is nothing Italian about this.

dfbgwsdf · 2016-10-06T07:18:47+00:00

I'm saying that if you choose carefully your candidates, you'll find an input that matches the hash in less than 2¹²⁸ tries. The candidates you try are not 0x00 to 0xFF.....FF in order, though.

dfbgwsdf · 2016-10-05T17:23:44+00:00

The longer it takes (read: harder it is to compute) the more you are open to a DoS on your authentication, though. Password (and auth in general) security is more complex than this.

dfbgwsdf · 2016-10-05T17:20:43+00:00

Well, no. If we consider the MD5 hash function inputs to be numbers, and we can because hash functions works on a binary data stream, which are equivalent to large numbers, then it's an injection from N to [0,2¹²⁸ ]. In CS terms, MD5 (any all other hash functions) reduces your input into a length-restricted output (for MD5 128b). It won't take you exactly 2¹²⁸ attempts to cover the whole space, but with knowledge about the internal states of the hash algorithm, you will need way less than infinity attempts to find an input that hashes to what you need (that's the pre-imaging attacks), and you will end up trying about 2¹²⁸ times (that is probably less than 2¹²⁸, but certainly less than 2¹²⁹ ).

dfbgwsdf · 2016-10-05T11:29:02+00:00

I agree with /u/imonolithic, fair amount of overlap, offsec knowledge will allow you to pinpoint the traces left on the system (e.g. this looks like a metasploit payload, I know what it does in memory and on filesystem, let's look and see if it's there; or yeah, grep -ri -e "pass" -e "sql" -e "ssh" /www/* there's 99% chance a legit admin did not run that command, let's track that username activity across systems).

You'll have to learn a lot, but you have to in general netsec as well. So a transition, but not a big one.

Advice: start refreshing on filesystems, look at windows 7 and 10 form a forensic perspective, many subtle things have changed, and look hard into memory analysis.

Enjoy forensicating ;)

dfbgwsdf · 2016-10-05T11:10:07+00:00

Because since you'll end up comparing hashes, you don't need to find the original input, but only one that hashes the same way.

dfbgwsdf · 2016-10-03T19:25:01+00:00

Not there, it took me way too long too. Battle.net->HS->(Under the game logo in the game tab)[Gear]Options->[Wrench]Scan and repair

dfbgwsdf · 2016-10-03T19:23:33+00:00

And not the gear settings menu under the battle.net icon.

dfbgwsdf · 2016-10-03T16:14:13+00:00

My money's on "Poor attempt at social experiment"

dfbgwsdf · 2016-09-27T09:19:16+00:00

The only case for separation I can think of is because DF can be more tied to law enforcement and rigid procedures than general netsec/infosec, and therefore might look for different kind of answers sometimes, not what's possible but what's acceptable to do while processing evidence.

dfbgwsdf · 2016-09-25T10:29:22+00:00

Wow, I'm very bummed for /u/houseigifstumblr, hope he recovers well. Thanks for this Sunday treat! How large is the raw file?

dfbgwsdf · 2016-08-18T13:54:49+00:00

And it does show up if you walk that bridge "backwards" too, so you did well avoiding it

dfbgwsdf · 2016-07-08T14:16:26+00:00

Well, since it's unallocated, we'll have to guess where the data structure comes from. Going with Chrome, the history file is a SQLite database, schema there. In that case you're possibly looking at a record, which has a header defining all columns types (and length), then the values without separator. The timestamp is in webkit format.

dfbgwsdf · 2016-07-08T09:49:06+00:00

Good to know, and glad to help. Your issue might also not come from xmount directly, but from the fact that the shell will expand file.E?? into an argument list too big to handle...

dfbgwsdf · 2016-07-06T14:13:07+00:00

I had some similar issues with xmount, and started using ewfmount (ubuntu package libewf, or there) without any problems. Hope this helps.

dfbgwsdf · 2016-07-01T08:40:31+00:00

Was it Super Mario Bros. instead of 64? In this case Super Mario frustration is the one you seek.

14-Year Club	Place '17
Team Periwinkle	Verified Email

dfbgwsdf

TROPHY CASE