| 00:49.38 | *** join/#qi-hardware dandon (~dandon@88.151.72.183) |
| 02:51.21 | *** join/#qi-hardware fengling (~fengling@223.223.187.142) |
| 05:29.26 | *** join/#qi-hardware DocScrutinizer05 (~saturn@openmoko/engineers/joerg) |
| 07:30.06 | *** join/#qi-hardware fengling (~fengling@223.223.187.142) |
| 08:16.02 | kyak | found this http://routersecurity.org/bugs.php while persuading a collegue of mine to wipe out the vendor firmware |
| 08:16.43 | kyak | and use openwrt or derivatives instead |
| 08:17.50 | kyak | all related news are put together for convenience :) |
| 08:40.19 | *** join/#qi-hardware sb0 (~lekernel@2a02:8108:4a40:8b74:8947:6840:92d3:841d) |
| 09:03.50 | *** join/#qi-hardware eintopf_ (~eintopf@unaffiliated/eintopf) |
| 09:43.10 | whitequark | hm, where's joerg |
| 11:35.17 | *** join/#qi-hardware sb0 (~lekernel@217.110.126.230) |
| 11:36.14 | wpwrak | whitequark: he's traveling these days. he may still notice (eventually) then you write something here, though. |
| 11:36.22 | whitequark | ahh 33c3 |
| 11:36.31 | whitequark | then he probably already knows |
| 11:37.01 | eintopf | 33c3 I wish I would be there |
| 11:37.05 | wpwrak | naw, visiting a friend. not 33c3 |
| 11:46.14 | wpwrak | kyak: someone should make a horror movie with this :) |
| 12:22.59 | *** join/#qi-hardware Nik05 (~Nik05@unaffiliated/nik05) |
| 12:37.49 | kyak | wpwrak: and the horror part starts when a guy tries to install openwrt --) |
| 13:05.55 | wpwrak | kyak: ah, you're planning the sort of movie where the heroes die, too :) |
| 13:25.42 | kyak | ^) |
| 13:46.51 | DocScrutinizer51 | whitequark: not 33C3 |
| 13:48.59 | DocScrutinizer51 | what's up? |
| 14:13.05 | whitequark | DocScrutinizer51: https://twitter.com/josephfcox/status/813460065722269697 |
| 14:14.42 | DocScrutinizer51 | sorry, not going to visit shitty twitter on N900 |
| 14:17.11 | DocScrutinizer51 | prolly wou.dn"t work amyway |
| 14:17.32 | whitequark | DocScrutinizer51: then https://mobile.twitter.com/josephfcox/status/813460065722269697 |
| 14:17.42 | whitequark | but anyway the link was https://motherboard.vice.com/read/global-travel-booking-systems-open-to-fraud-and-abuse |
| 14:18.22 | DocScrutinizer51 | well thats german news :) |
| 14:19.05 | DocScrutinizer51 | our TV journalists found it together with Mhackers' |
| 14:20.07 | DocScrutinizer51 | basically brute force cracking of a 'pw' alike 6digit transaction number afaik |
| 14:21.13 | DocScrutinizer51 | they prolly should inastall fail2ban ;) |
| 14:22.25 | DocScrutinizer51 | funny hack but no real big thing in my book |
| 15:02.14 | whitequark | its like BGP |
| 15:02.24 | whitequark | anyone can hijack anyone's flights |
| 15:06.09 | DocScrutinizer51 | well, as long as you cam brute force crack the 6charr(?) transaction token, yes. Under same premise i can root 60 percent all computers on this globe |
| 15:15.27 | DocScrutinizer51 | you 'only' need family name of a customer. rough time window of transaction, and then bruteforce the transaction token. pretty 'insecure' eh? No, they just should throttle bruteforce e.g. by fail2ban |
| 15:16.00 | whitequark | DocScrutinizer51: but that's true, you can intercept 60% (actually might be more than 60%) of traffic with a fake BGP advertisement |
| 15:16.28 | whitequark | and if you know a rough timewindow then you don't even need to bruteforce the entire token |
| 15:16.33 | DocScrutinizer51 | nfc what's that BGP thing |
| 15:17.34 | DocScrutinizer51 | what they told in TV they simply bruteforce cracked the transaction ID |
| 15:18.09 | DocScrutinizer51 | which is... cracking for kindergarden |
| 15:36.44 | wpwrak | kids today ... |
| 15:41.52 | DocScrutinizer51 | yeah, they just repeated it in TV: the hackers brute force cracked the 6char reference ID with a known customer name. So how does that differ from bruteforcing the root password of any arbitrary server? |
| 15:43.10 | whitequark | DocScrutinizer51: who even uses passwords anymore? good luck bruteforcing my ssh key |
| 15:43.15 | DocScrutinizer51 | add reasonable throttling like fail2ban and everything banana |
| 15:43.24 | DocScrutinizer51 | meh |
| 15:43.51 | DocScrutinizer51 | good luck clickbaiting me into this nonissue |
| 15:50.12 | DocScrutinizer51 | poor implementation of an otherwise perfectly secure concept |
| 15:52.04 | DocScrutinizer51 | of course the IDs need to be true random, and auth needs rate limit, just lie any arbitrary other auth system. That they do call it reference ID and not password is a communication failure, not an IT design failure |
| 15:54.23 | DocScrutinizer51 | Nohl is making up big news to give ARD reporters a topic to cover C3 in news |
| 15:55.54 | DocScrutinizer51 | pretty dishonest |
| 16:03.43 | eintopf | :o the channel is alive |
| 16:04.05 | eintopf | btw: my tft power supply with the replaced elkos still works |
| 18:25.28 | *** join/#qi-hardware fengling (~fengling@223.223.187.142) |
| 19:16.06 | *** join/#qi-hardware wildlander (~wildlande@unaffiliated/wildlander) |
| 19:52.08 | *** join/#qi-hardware mth (hrbfmzaq@82-168-42-142.ip.open.net) |
| 20:34.39 | *** join/#qi-hardware sandeepkr (~Sandeepkr@103.49.155.114) |
| 20:39.10 | *** join/#qi-hardware sandeepkr (~Sandeepkr@103.49.155.114) |
| 20:47.36 | *** join/#qi-hardware sandeepkr (~Sandeepkr@103.49.155.114) |
| 20:48.25 | *** join/#qi-hardware sandeepkr (~Sandeepkr@103.49.155.114) |
| 20:50.36 | *** join/#qi-hardware sandeepkr_ (~Sandeepkr@103.49.155.114) |
| 20:56.22 | *** join/#qi-hardware sandeepkr_ (~Sandeepkr@103.49.155.114) |
| 21:09.30 | *** join/#qi-hardware sandeepkr__ (~Sandeepkr@103.49.155.114) |