28C3 Scariest Talk of the Day

Wednesday, December 28, 2011

We attended Effective Denial of Service attacks against web application platforms by Alexander “alech” Klink and Julian | zeri where they described a really, really easy to implement denial of service attack that exploits an artifact of hash checking which is computationally intensive when the hash table is filled with hash collisions. It is fairly easy to find 2-4 character hash collisions for a given hash functions (and there are only a few variations in use) and as hash operations are performed by default on all POST and POST-like functions, which take (by default) from 2-8MB of data, one can easily tie up a computers CPU effectively indefinitely.

The researchers tested the attack on most web languages in use (and all in common use – only Perl is deployed safe (since 2003) and Ruby 1.9 has a patch available. Every other OS is vulnerable. Today. The attack is only a POST option with a table of delimited hash collision values. You could copypasta a working exploit, it is that easy. The vast (vaaast) majority of sites on the web run PHP, and 1 Gbps of attack vector bandwidth could take down 10,000 cores. With ASP.NET, that 1 Gbps can hold down 30,000 cores cRuby 1.8 (not patched, about half of Ruby installs): that 1 Gbps can keep a million cores tied up.

Yow.

Posted at 18:32:59 GMT-0700

Category: EventsTechnologyTravel

You can’t read this at the Westin

Monday, December 26, 2011

Oddly, this server is blocked by the network at the Westin Grand, Berlin. Everything else seems to work, even www.dis.org (which is blocked by sites that subscribe to the Barracuda filter list, cause any site with information on radios is frequented by hackerz). It does not seem to be a national level block as I get plenty of visitors from Germany.

Easy enough to get around by VPN, but odd. Very odd indeed.

Posted at 09:02:40 GMT-0700

Category: HotelsSelf-publishingTechnologyTravel

Rose Picture

Sunday, December 25, 2011

Not sure why the roses are blooming xmas eve, but they’re pretty in the sunset light.

DSC07338.JPG
Posted at 00:55:06 GMT-0700

Category: photo

huh… MITM or switching mafia allegiances

Sunday, December 18, 2011

Certs are so fail for authentication.

cert_patrol_Facebook_change.jpg
Posted at 21:34:27 GMT-0700

Category: Media