santaragolabs
Joined 14 years ago
Karma
312
Submissions
56
Member since
Feb 29
Recent submissions
Comment · 5 years ago
This reminds me of the science fiction novel The Water Knife by Paolo Bacigalupi. From the Amazon description:
"In the near future, the Colorado River has dwindled to a trickle. Detective, assassin, and spy, Angel Velasquez “cuts” water for the Southern Nevada Water Authority, ensuring that its lush arcology developments can bloom in Las Vegas. When rumors of a game-changing water source surface in Phoenix, Angel is sent south, hunting for answers that seem to evaporate as the heat index soars and the landscape becomes more and more oppressive."
Comment · 8 years ago
Oh wow, thanks Keith, first of all for mosh! I've been using it daily for several years now. It's been great! Second of all for clarifying and correcting me regarding the algorithm-usage. I don't know where I got it from and I must have just misremembered; it's been a while since I spent a bit of time looking at the source code (and walking away very impressed).
Comment · 8 years ago
Sure. But that's why my point was about mosh (https://mosh.org/). It just uses TCP+SSH for the authentication part and then it sets up an encrypted UDP-tunnel on the server-side with the mosh-client then just sending AES-256-GCM packets back and forth over UDP. To the best of my knowledge it doesn't batch anything.
And compression definitely doesn't always help as some of the attacks on TLS were only able to be done because of compression happening before encryption. Hence why we ended up with the HPACK in HTTP/2 to prevent exactly such type of attacks.
Comment · 8 years ago
That work is great. A related paper on earlier work where traffic analysis on skype was being done and where the researchers were able to extract individual phonemes and then reconstruct speech that way. It's one of my favorite papers. It's titled "Phonotactic Reconstruction of Encrypted VoIP Conversations" and you can find it here:
http://www.cs.unc.edu/~fabian/papers/foniks-oak11.pdf
Comment · 8 years ago
Man, this paper is a classic. I love traffic analysis attacks like this. I did something myself six years back albeit with a somewhat contrived example figuring out what someone is looking at on Google Maps via request and response sizes. Example video here https://www.youtube.com/watch?v=skQNwd9Jij4 and https://ioactive.com/ssl-traffic-analysis-on-google-maps/.
I am speculating that nice traffic analysis attacks can be done on mosh (which is a great tool btw) to, similar to the paper that is in this thread. It's been sort of on my "todo/research" list but haven't been able to sit down for a few days and mess around with it. And I'm sure that QUIC (HTTP/3) will open up some interesting avenues of attack here too.
Comment · 8 years ago
No-one said anything about the president or the NSA being involved. There are tons of ways this can work. And it actually happens.
Just once you're flagged and are inside The Machine you get detained upon entry whilst they confiscate your devices, try to see where you've been etc. Lookup the wikipedia page of Laura Poitras who for years lived in Berlin due to USA government surveillance. And this started way before her involvement with Snowden as a filmmaker.
Comment · 8 years ago
I've done some security contracting work for the folks in Walldorf over the years; I've seen first-hand some SAP FTE's getting insanely frustrated putting in their expenses in their own systems. Which was pretty hilarious to watch. And most folks there fully acknowledge that usability is not their strength traditionally.
Things like uptime, support-contracts, having someone on-site within three hours when your multi-millon-dollar-order-processing-SAP-cluster goes down etc are what matter to their customers more than usability (traditionally).
Things are changing and a lot of effort has been put into getting better at UI/UX though. But I haven't been involved with them for several years now so I don't know where they are at or what their current offerings are (I keep tabs a bit on HANA developments but that's it really).
Feel free to contact me: gvb -at- anvilsecure.com