[QUOTE=DarKSunrise;33451230]That might be true if you were just bruteforcing the password, but that kind of passwords are also really weak against dictionary attacks.[/QUOTE]
Also I don't think hes accounting for the fact that the second one can be bruteforced with just letters versus the first one which has numbers/symbols.
[QUOTE=icantread49;33451146]GUI improvements
[img]http://i.imgur.com/HCN7k.png[/img]
the green button is when you press something ... it looks a little fucked up because i took a screenshot from the simulator and edited out the debug mouse point[/QUOTE]
UI looks awesome, you should move the text labels down closer to the elements that they represent though. Having text labels at equal distance from either element makes it a bit distracting at first glance because you have to register whether the labels represent the element above or below them.
Still though, the UI is nice and simple :D
[QUOTE=high;33451108]Actually finding an exploit in a specific system is a lot more work than just developing a phishing site or malware. From what I have seen, most hackers just test a lot of systems for a specific exploit until they find a vulnerable one. They rarely target a specific one. I know when I was doing some security work it was that way at least.[/QUOTE]
I think it unlikely that I got phish'd. Or any of my friends have, for that matter. I know [i]everyone[/i] says that, and probably goes on about how careful they are, but I genuinely mean it. I'm by no means easy to fool.
I'm also behind a router, on a relatively private network, with no ports forwarded, so my computers aren't really exposed to anything at all, aside from any sites that I actively connect to.
[QUOTE=high;33451108]I mean you would be surprised the amount of information you can steal off a machine silently. Firefox/chrome/opera/IE passwords (if you don't set a master password), steam account (if remember me is checked), etc. Most anything that has 'Remember me' can be stolen. You can either use the session or the hashed password to gain access to the account to change information.[/QUOTE]
The issue, there, is that my WoW login information isn't the same as what I might use to login to Facepunch. It would have to be really targetted data mining for them to get into battle.net accounts so easily.
If I recall correctly, both Chrome and Firefox have some pretty stringent measures in place to prevent cross-site scripting exploits. Stored information is associated with the domain name where it's used. But above all else, I [i]never[/i] save passwords.
[QUOTE=high;33451108]No one would ever do that. Why do you think that was the case?[/QUOTE]
I'm exploring all possible options, and explaining why I think they're either likely or unlikely. I'd ruled out phishing (because I'm not an idiot) and what I'd posted above is my justification for ruling out keyloggers, so the [i]only[/i] option left, as I see it, is either a man-in-the-middle attack (which is by no means easy or profitable) or breaking directly into an SQL database.
Dumping an SQL database has the greatest reward/effort ratio, by far.
[QUOTE=high;33451295]Also I don't think hes accounting for the fact that the second one can be bruteforced with just letters versus the first one which has numbers/symbols.[/QUOTE]
yeah, but it's more about how the first one is a terrible password more than that the second one is a good password.
[QUOTE=Darwin226;33451150]After Jookia just said that seeing bad things happen to null makes his day, I'd say it's warranted.[/QUOTE]
Oh fuck, I can't read. :(
Oh god
[IMG]http://i.imgur.com/lgTAe.png[/IMG]
[media]http://www.youtube.com/watch?v=vMvypCh3D1k[/media]
Oh the made up algorithms that went into this shit....
Hah, about fucking time I figured out how to create a def file for a library without editing it and adding _declspec(dllexport) to every single function and class. I can't believe I forgot about dlltool from MinGW.
[code]dlltool.exe ../../gstreamermm/Debug/*.obj -z gstreamermm.def[/code]
Now only one problem remains.. The def file is trying to export some CRT shit and delete destructors.. Not so easy trying to pick those out of a 500kb .def file that looks like this: :suicide:
[code] ??$?0D@?$allocator@U_Container_proxy@std@@@std@@QAE@ABV?$allocator@D@1@@Z @ 1
??$?0P6APAVMiniObject@Gst@@PAU_GstMiniObject@@@Z@?$allocator@U_Container_proxy@std@
@@std@@QAE@ABV?$allocator@P6APAVMiniObject@Gst@@PAU_GstMiniObject@@@Z@1@@Z @ 2
??$?0VBuffer@Gst@@@?$RefPtr@$$CBVBuffer@Gst@@@Glib@@
QAE@ABV?$RefPtr@VBuffer@Gst@@@1@@Z @ 3
??$?0VBus@Gst@@@?$RefPtr@$$CBVBus@Gst@@@Glib@@
QAE@ABV?$RefPtr@VBus@Gst@@@1@@Z @ 4
??$?0VCaps@Gst@@@?$RefPtr@$$CBVCaps@Gst@@@Glib@@
QAE@ABV?$RefPtr@VCaps@Gst@@@1@@Z @ 5
??$?0VChildProxy@Gst@@@?$RefPtr@$$CBVChildProxy@Gst@@@Glib@@
QAE@ABV?$RefPtr@VChildProxy@Gst@@@1@@Z @ 6
??$?0VClock@Gst@@@?$RefPtr@$$CBVClock@Gst@@@Glib@@
QAE@ABV?$RefPtr@VClock@Gst@@@1@@Z @ 7
??$?0VColorBalanceChannel@Gst@@@?$RefPtr@$$CBVColorBalanceChannel@
Gst@@@Glib@@QAE@ABV?$RefPtr@VColorBalanceChannel@Gst@@@1@@Z @ 8
??$?0VElement@Gst@@@?$RefPtr@$$CBVElement@Gst@@@Glib@@
QAE@ABV?$RefPtr@VElement@Gst@@@1@@Z @ 9
??$?0VElementFactory@Gst@@@?$RefPtr@$$CBVElementFactory@
Gst@@@Glib@@QAE@ABV?$RefPtr@VElementFactory@Gst@@@1@@Z @ 10
??$?0VIndex@Gst@@@?$RefPtr@$$CBVIndex@Gst@@@Glib@@
QAE@ABV?$RefPtr@VIndex@Gst@@@1@@Z @ 11[/code]
Fuck you Microsoft.
[img]http://dl.dropbox.com/u/45554193/images/airedalemap.png[/img]
Dat grass
[QUOTE=Darwin226;33451150]After Jookia just said that seeing bad things happen to null makes his day, I'd say it's warranted.[/QUOTE]
Let's not mention the times where Null has been a dick to Jookia?
The whole unicode thing.
And that argument before that. (Which everyone jumped on him for.)
[QUOTE=DarKSunrise;33451230]That might be true if you were just bruteforcing the password, but that kind of passwords are also really weak against dictionary attacks.[/QUOTE]
You don't understand [i]at all[/i]. He assumes a worst-case scenario, where the attacker [i]knows[/i] that the password is made up of [i]four[/i] words from a [i]specific list[/i] of 'common words', typed [i]entirely in lower-case[/i]. Just saying 'pfft, dictionary attack' doesn't change the numbers.
Run through the math yourself if you don't believe it. When I did it, I got a much, much higher figure, so Randall was [i]really[/i] conservative with his estimate.
You really can't argue against it here because the difference is so outrageously huge.
It's 9:40AM, I shouldn't of bashed Nullsquared like that. I was angry at the time and I don't remember what for, but obviously starting a flame war isn't the way to stop being angry. Sorry.
[editline]27th November 2011[/editline]
[QUOTE=ROBO_DONUT;33451309]Dumping an SQL database has the greatest reward/effort ratio, by far.[/QUOTE]
Not if you do a per-user salt.
[QUOTE=ROBO_DONUT;33451309]I think it unlikely that I got phish'd. Or any of my friends have, for that matter. I know [i]everyone[/i] says that, and probably goes on about how careful they are, but I genuinely mean it. I'm by no means easy to fool.
The issue, there, is that my WoW login information isn't the same as what I might use to login to Facepunch. It would have to be really targetted data mining for them to get into battle.net accounts so easily.
If I recall correctly, both Chrome and Firefox have some pretty stringent measures in place to prevent cross-site scripting exploits. Stored information is associated with the domain name where it's used. But above all else, I [i]never[/i] save passwords.
I'm exploring all possible options, and explaining why I think they're either likely or unlikely. I'd ruled out phishing (because I'm not an idiot) and what I'd posted above is my justification for ruling out keyloggers, so the [i]only[/i] option left, as I see it, is either a man-in-the-middle attack (which is by no means easy or profitable) or breaking directly into an SQL database.
Dumping an SQL database has the greatest reward/effort ratio, by far.[/QUOTE]
No matter how secure you think you are, you can still be hacked. Hacking someone is not just about fooling them.
Chrome has some XSS protection but firefox still has none (noscript does though).
Being phished/keylogged does not require you to be an idiot. Phishing sites these days are extremely convincing also they tend to use exploits to look real. Keyloggers have several ways of getting on your machine [url=https://www.google.com/search?q=adobe+reader+exploit]without you downloading them[/url].
[QUOTE=high;33451544]Being phished/keylogged does not require you to be an idiot. Phishing sites these days are extremely convincing also they tend to use exploits to look real. Keyloggers have several ways of getting on your machine [url=https://www.google.com/search?q=adobe+reader+exploit]without you downloading them[/url].[/QUOTE]
This might be a valid argument if I wasn't utterly paranoid.
I only visit sites I [i]know[/i]. I type always type the URLs manually. I don't enter info into sites that aren't either ridiculously popular or that weren't linked to in print in a manual or letter. I often do dns lookups to make sure that domains are actually registered to who they should be, and I do cross-references with reputable sources whenever possible. If I have any doubts, at all, I use a fake email address and a one-time password, and none of my important stuff shares a password with [i]anything[/i] else.
I'm fucking paranoid. Seriously.
[QUOTE=ROBO_DONUT;33451665]This might be a valid argument if I wasn't utterly paranoid.
I only visit sites I [i]know[/i]. I type always type the URLs manually. I don't enter info into sites that aren't either ridiculously popular or that weren't linked to in print in a manual or letter. I often do dns lookups to make sure that domains are actually registered to who they should be, and I do cross-references with reputable sources whenever possible. If I have any doubts, at all, I use a fake email address and a one-time password.
I'm fucking paranoid. Seriously.[/QUOTE]
Being paranoid doesn't stop exploits that you may not even know exist.
[QUOTE=high;33451710]Being paranoid doesn't stop exploits that you may not even know exist.[/QUOTE]
Hasn't research shown that being paranoid actually ups the chance of something bad happening?
[QUOTE=high;33451710]Being paranoid doesn't stop exploits that you may not even know exist.[/QUOTE]
[QUOTE=Map in a box;33451773]Hasn't research shown that being paranoid actually ups the chance of something bad happening?[/QUOTE]
I wonder if there's a paranoia sweet spot.
Y'know, just enough to make you put in solutions for potential but unlikely issues but not enough to be an inconvenience. v:v:v
[QUOTE=BlkDucky;33451811]I wonder if there's a paranoia sweet spot.
Y'know, just enough to make you put in solutions for potential but unlikely issues but not enough to be an inconvenience. v:v:v[/QUOTE]
I'm paranoid that I'm not in the paranoia sweet spot.
[img]http://dl.dropbox.com/u/45554193/images/airedalemap2.png[/img]
I think all that's left for the base map is some rivers
Any suggestions?
[QUOTE=DrogenViech;33451907]oh
[URL="http://www.google.com/&q=inurl%3AconfAnlage.html"]http://www.google.com/?q=inurl%3AconfAnlage.html[/URL][/QUOTE]
Fixed, you put & instead of ?.
[QUOTE=high;33451710]Being paranoid doesn't stop exploits that you may not even know exist.[/QUOTE]
Yeah, but a general-purpose exploit is [i]far[/i] from being the kind of precise, targeted account hijacks you see in the real world. It's difficult to convey just how ubiquitous and polished this whole process is if you haven't played WoW before. It goes like this:
1. You register for a WoW account
2. Your account gets hijacked within a month
3. You don't lose ANYTHING else
It happens to [i]everyone[/i], and it happens without any sort of collateral damage (usually). The focus is incredible.
Consider the [i]entire[/i] process if it isn't a straight SQL dump. Perhaps that PDF exploit you bring up:
1. Hacker puts a PDF [i]somewhere[/i], hopes that his target audience stumbles upon it.
2. Keylogger records [i]days[/i] of random activity, hacker dedicates a good chunk of his time to decyphering the entire mess looking for [i]something[/i] useful in heaps upon heaps of junk.
3. Hacker [i]maybe[/i] finds what he's looking for.
Now there's three issues here:
1. It's not very focused, the hacker has absolutely no clue whether his target even has an account with the service he wants to get into.
2. It takes a lot of time to go through everything a [i]single user[/i] produces, if he even has the information the attacker wants at all, let alone millions of them. It could, possibly, be automated to some extent, but that implies just a little more sophistication than your average skiddie possesses. It also raises the issue of ubiquity, since it would take such an enormous amount of manpower to steal the sheer volume of accounts that battle.net users have had stolen this way.
3. Most people literally [i]don't lose anything else[/i]. Why would the attacker go through all of this trouble to gain complete access to a machine and not steal Steam accounts, Paypal accounts, or anything else?
Just the sheer volume and precision of all of it indicates to me that attackers are going straight to the service providers rather than grabbing information from individual users (in fact, if they aren't, they're probably idiots for it). I, personally, don't think the service providers would like to advertise these things, and would probably play it down as much as possible. We, as users who entrust our information to these service providers, are probably only ever informed of a small fraction of intrusions.
[QUOTE=DrogenViech;33451907]oh
[url]http://www.google.com/?q=inurl%3AconfAnlage.html[/url][/QUOTE]
[B]Group of hackers bring down power plants around the world[/B]
[QUOTE=ROBO_DONUT;33451956]Now there's three issues here:
1. It's not very focused, the hacker has absolutely no clue whether his target even has an account with the service he wants to get into.
2. It takes a lot of time to go through everything a [i]single user[/i] produces, if he even has the information the attacker wants at all, let alone millions of them. It could, possibly, be automated to some extent, but that implies just a little more sophistication than your average skiddie possesses. It also raises the issue of ubiquity, since it would take such an enormous amount of manpower to steal the sheer volume of accounts that battle.net users have had stolen this way.
3. Most people literally [i]don't lose anything else[/i]. Why would the attacker go through all of this trouble to gain complete access to a machine and not steal Steam accounts, Paypal accounts, or anything else?[/QUOTE]
1. That's the idea. Hit as many random people as you can and get as much information as you can. Targeting people/services specifically wastes a lot of time.
2. Keyloggers are not stupid these days. They can get what you type into a specific text box so they aren't just sifting through raw keyboard input. Also when I say keylogger I don't mean it doesn't do other things. It may keylog and it may read passwords off your computer. I have seen several 'legit' popular WoW programs which also steal account information.
3. They are trying to get as much information as possible but in the end they are only going to use the information that they want to. If you have a plan for stealing WoW accounts and not paypal accounts then you aren't going to use the stolen paypal account information that you get.
[QUOTE=DarKSunrise;33451230]That might be true if you were just bruteforcing the password, but that kind of passwords are also really weak against dictionary attacks.[/QUOTE]
People keep saying this and it's wrong.
Even a dictionary attack has to first try every word, then every word + every word, then every word ^ 3...
Then try with underscores instead of spaces, then hyphens, then dots, then any other seperators it can think of...
the attacker shouldn't know how many words long your password is. This makes it very difficult even for a dictionary attack to work.
Dictionary attacks only really work on one-word passwords
Just to give you an idea of how shitty your saturation would be by going to users rather than content provider:
You want to put the exploited PDF on a reasonably high-traffic public site. We'll choose Facepunch.
Supposing every Facepuncher plays WoW, what percentage of the WoW user base would be covered? 0.4%
What percentage of Facepunchers probably actually play WoW? Maybe 10%
What percentage of registered Facepunchers is online at a given time? 5-10% is probably another high estimate.
How much of the forum could a spambot cover before being caught and ip-banned? Maybe 30%.
How many people are actually stupid enough to click the spambot's link? Maybe 20%
How many of these are likely to have a copy of Adobe Reader which is vulnerable? Maybe 40%
How many are actually browsing from the same computer they play the game one? 60%
How many people won't notice any unusual activity afterwards? Maybe 70%
What percentage of systems are likely compatible with your keylogger? 60%
Grand total: One or two accounts.
Versus the ten million you'd get by breaking into the database.
[QUOTE=DrogenViech;33451907]oh
[url]http://www.google.com/?q=inurl%3AconfAnlage.html[/url][/QUOTE]
I just loaded one of those sites...
[IMG]http://i.imgur.com/h3oY1.png[/IMG]
What are you guys doing?
[QUOTE=ROBO_DONUT;33452453]Just to give you an idea of how shitty your saturation would be by going to users rather than content provider:
You want to put the exploited PDF on a reasonably high-traffic public site. We'll choose Facepunch.
Supposing every Facepuncher plays WoW, what percentage of the WoW user base would be covered? 0.4%
What percentage of Facepunchers probably actually play WoW? Maybe 10%
What percentage of registered Facepunchers is online at a given time? 5-10% is probably another high estimate.
How much of the forum could a spambot cover before being caught and ip-banned? Maybe 30%.
How many people are actually stupid enough to click the spambot's link? Maybe 20%
How many of these are likely to have a copy of Adobe Reader which is vulnerable? Maybe 40%
How many are actually browsing from the same computer they play the game one? 60%
How many people won't notice any unusual activity afterwards? Maybe 70%
What percentage of systems are likely compatible with your keylogger? 60%
Grand total: One or two accounts.
Versus the ten million you'd get by breaking into the database.[/QUOTE]
Making up some statistics when you don't understand the process doesn't prove anything.
Anyways I am done trying to explain this. Its as simple as its much easier to target a wide audience with an exploit/malware/etc then it is to target a single service.
Sorry, you need to Log In to post a reply to this thread.
