PreInternet01

Joined 3 years ago

Karma

2,490

Submissions

418

Member since

Dec 13

View on Hacker News

Recent submissions

Comment · 1 year ago

"If only they used DC from the wall socket, all those H100s would be green" is, not, I think, the hill you want to die on.

But, yeah, my three 18MW/y racks agree that more power efficiency would be nice, it's just that Rewrite It In (Safe) Rust is unlikely to help with that...

Comment · 1 year ago

> In the line of sight of victim

Yeah, you can actually check out the details in https://www.emvco.com/specifications/contactless-specificati... -- relevant parameter is "Device Estimated Transmission Time For Relay Resistance R-APDU", which is specified as "typically 1.5ms".

That's already hard to achieve reliably (in-store WiFi is right out, but possibly Bluetooth?) but would definitely make the required on-device malware even more complicated...

Comment · 1 year ago

> is that enforced by some certification process

Yes, pretty much any NFC payment solution has to be EMVCo (Eurocard/Mastercard/Visa) licensed, and relay resistance is an explicit part of that.

> seems to be happening in the wild

Nah, NFC is so ubiquitous that would have been a lot more noisy.

Comment · 1 year ago

Sorry, but as someone who is involved with the development of contactless payment terminals, this just isn't a practical attack.

The phase where the relaying is supposed to happen (between the terminal sending its actual challenge and receiving the response) already employs a very short timeout (a millisecond or less, definitely not anywhere near a network round-trip to, well, anywhere).

There is a 'card selection' phase that may take (much) longer, as well as various retries, but the key bits (pun intended) of the exchange are only valid in that very short window.

Also, upwards of 80% of all point-of-sale transactions in some northern-European countries are NFC these days, and if any of this had truly any large-scale applicability, people would definitely have noticed...

Comment · 1 year ago

Oh, nothing gets dropped silently, but bounced right back with `550 5.7.1 Message rejected due to content (Attachment refused: MATCH-code)`.

And for anything oversized, funny or otherwise non-standard, we offer a very convenient file transfer service.

Comment · 1 year ago

> To defend against concatenated ZIP files, Perception Point suggests that users and organizations use security solutions that support recursive unpacking

Yeah, or, you know, just outright reject any ZIP file that doesn't start with a file entry, where a forward-scan of the file entries doesn't match the result of the central-directory-based walk.

There is just so much malicious crud coming in via email that you just want to instantly reject anything that doesn't look 'normal', and you definitely don't want to descend into the madness of recursive unpacking, 'cuz that enables another class of well-known attacks.

And no, "but my precious use-case" simply doesn't apply, as you're practically limited to a whole 50MB per attachment anyway. Sure, "this ZIP file is also a PDF is also a PNG is also a NES cartridge which displays its own MD5" (viz https://github.com/angea/pocorgtfo/tree/master/writeups/19) has a place (and should definitely be required study material for anyone writing mail filters!), but business email ain't it.