I am the only one to think that the real issue is Windows using an unsalted, single-round hash in 2023. With salt, it would have taken 18k longer to crack 18k passwords. 5k rounds like Linux or MacOS makes it another 5k times slower, 90 million times slower in total
We have finally published Tproxy (objectifsecurite.gitlab.io/t…) our generic TCP interception proxy (think Burp for TCP): TLS handling, wireshark dissection, intercept and modify by hand or with scripts in GUI or CLI.
There is a complete doc with demos (objectifsecurite.gitlab.io/t…)
My favorite demo is piggy-backing on NFSv3 messages
(objectifsecurite.gitlab.io/t…) to read arbitrary files, even when operations are signed with RPCSEC_GSS.
Schrödinger's @Snowden. SCSD web site still says he will give a talk swisscybersecuritydays.ch/pr… while SCSD tell's the press that he wont.
This annoucement did not age well: netzwoche.ch/news/2021-02-23…
I used this 25 years ago to make one of the first webcam software that was able to push video streams in a webpage (en.wiktionary.org/wiki/Citat…, web.archive.org/web/19970214…). Feeling old (probably am)
Just stumbled upon this header and wanted it document somewhere: reddit.com/r/Slackers/commen…
Didn't know that you can render parts of a HTTP response, each having its own content-type.
If only @Microsoft would listen....
All our tables are belong to you
We've just released ophcrack pro tables for free as a torrent...
objectif-securite.ch/2019/09…
hashing biometric data usualy makes unusable, as scans are never identical (hashes would be totally different). But at least, they could have encrypted it.
Major #breach found in #biometrics system used by banks, UK police and defense firms theguardian.com/technology/2… Instead of saving a hash of the fingerprint, they reportedly stored the actual fingerprint. Biometrics firms should be held to a higher standard, IMHO. c/o @joshgnosis
Philippe Oechslin retweeted
On behalf of the Swiss Confederation and the Cantons, SCRT are organizing the Public Intrusion Test (PIT) of the Swiss Post e-voting system. Register now! More info at onlinevote-pit.ch #evoting #e-voting #eVoting
In Switzerland, Internet Voting providers are required to run a public intrusion test. You can register here pit.post.ch/en to try to hack the system of Swiss Post.
Ethical hackers should be allowed to probe unconstrained the security of our elections systems, says @weldpond bit.ly/2Devmz0 - It's a point he and multiple experts made to me for this story: apnews.com/f6876669cb6b4e4c9…
Online NTHash demo: 99% of 8 char and some probabilistic passwords 9-12 char in 50s avg. On a $3000 machine objectif-securite.ch/en/ophc…
Philippe Oechslin retweeted
Cyberattaques: «Les services secrets américains ont une part de responsabilité», explique @tradeoph
letemps.ch/economie/2017/05/…
Philippe Oechslin retweeted
Dear security companies: if you elaborate or provide necessary context around critical vulnerabilities, your whole business will unravel.
Phasing out my 14 years old key (0x022AAB8C) #PerfectForwardSecrecy #getoffmylawn Maybe should change passphrase too..
Verifying myself: I am tradeoph on Keybase.io. M_ySqygg5MH_NwTrntAEkjJ_zN5FIGKtJfHM / keybase.io/tradeoph/sigs/M_y…