hdmoore
Joined 12 years ago
Karma
208
Submissions
55
Member since
Oct 4
https://hdm.io/
View on Hacker NewsRecent submissions
Comment · 24 days ago
Hurray for mostly-non-controversial opinions!
Comment · 8 months ago
maybe write these personally in the future vs pasting chatbot output? even if you didn't write the code, it would be nice if you wrote the description and post on your own.
Comment · 9 months ago
Comment · 1 year ago
I was too! The reason is that the Go x/crypto/ssh library was bailing out on the lack of reply to the channel open request, which prevented it from reaching the auth bypass check via exec. I should have an update out soon with this fixed and a RCE check for this issue.
The test server: $ erl -eval 'ssh:start(), ssh_dbg:on(), ssh:daemon(34222, [{system_dir, "/home/otp/ssh/keys"},{user_dir, "/home/otp/ssh/users/otptest/.ssh"}]).'
The exploit: auth.ScrapeExec(options, addr+" "+tname, res, ses, `os:cmd("touch /tmp/HAXXXED").`)
>-rw-r--r-- 1 root root 0 Apr 17 16:14 /tmp/HAXXXED
Comment · 2 years ago
The Secure Shell (SSH) protocol has survived as an internet-facing management protocol for almost 30 years. Over the decades it has transformed from a single patented codebase to a multitude of implementations available on nearly every operating system and network-connected device.
This presentation dives deep into the Secure Shell protocol, its popular implementations, what's changed, what hasn't, and how this leads to unexpected vulnerabilities and novel attacks. An open source tool, dubbed "sshamble", will be demonstrated, which reproduces these attacks and opens the door for further research.
Comment · 2 years ago
The CFAA has not been amended, but there was DoJ policy change on enforcement. So everyone is always breaking the law in the course of normal business, and it's still up to the prosector to determine who to go after:
- https://www.justice.gov/opa/pr/department-justice-announces-...
Comment · 2 years ago
An underrated focus of Metasploit was making defensive tooling more robust. Spoonm's work on SNG (as well as other payload/encoder randomization efforts) was effective at killing static (and arguably ineffective) payload signatures. You can find a related talk on the IDS/protocol side at: https://speakerdeck.com/hdm/thermoptic-camouflage-total-ids-...
Source: co-speaker of the OP referenced presentation
Comment · 2 years ago
The sell-off of captable.io/LTSE Equity was announced to customers a couple months ago, predating the Carta drama (but many folks picked LTSE specifically because it wasn't Carta).
Comment · 3 years ago
The move to make all free instances unauthenticated (and effectively RCE-aaS) put a dent in that use.
Comment · 3 years ago
Erm, qmail had lots of bugs[1], when compiled for 64-bit processors (lots of integer overflows), but djb pushed back and said 64-bit wasn't supported. If anything, qmail is known as the most annoying MTA to package, since no modifications to the source are permitted, and the application has to be built using a massive patch tree instead. The quirky management daemons required to run qmail were also obnoxious and at odds with everything else on the system.
Salient quote below:
>In May 2005, Georgi Guninski published "64 bit qmail fun", three vulnerabilities in qmail (CVE-2005-1513, CVE-2005-1514, CVE-2005-1515):
[snip]
>Surprisingly, we re-discovered these vulnerabilities during a recent qmail audit; they have never been fixed because, as stated by qmail's author Daniel J. Bernstein (in https://cr.yp.to/qmail/guarantee.html):
>>"This claim is denied. Nobody gives gigabytes of memory to each qmail-smtpd process, so there is no problem with qmail's assumption that allocated array lengths fit comfortably into 32 bits."
1. https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-...
edit: added quote from referenced url
Comment · 5 years ago
It is based on peak frequency, you can visually see it here: https://speakerdeck.com/hdm/derbycon-2011-acoustic-intrusion...
IIRC (it has been a bit), there was a specific frequency only used by modem negotiation but not fax machines (3150?).