Re:Exposing Tanium: A Hacker’s Paradise
by geofft on Thursday November 30, 2017 @12:32PM
(#15817584)
> If each workstation is doing data aggregation of the data it’s receiving from its peers, what does that require about its ability to read the plaintext data from its peers?
Uh, nothing? Encryption has existed for several decades?
I mean, I have no idea if they're actually using encryption, but "use logical reasoning" is not an explanation of why they necessarily must not be using encryption.
> As you should have discovered from the previous challenges, it would be impossible for peers to perform deduplication/aggregation with other peers if they were unable to see cleartext/plaintext data.
This is absolutely incorrect.
> The first thing to note is that the "hashing" algorithm appears to be something home grown, as opposed to an industry standard (md5, sha1, etc.).
This needs proof that this is what the actual client does, as opposed to just an example for a human-readable FAQ for readers who don't know what hashing is. (Also, I question the competence of someone who's writing up an analysis and thinks of MD5 and SHA-1 as their first industry-standard hashes.)
(Full disclosure: I am unaffiliated with Tanium and have never used it, but I think a couple of former coworkers from a now-failed startup now work there.)
Uh, nothing? Encryption has existed for several decades?
I mean, I have no idea if they're actually using encryption, but "use logical reasoning" is not an explanation of why they necessarily must not be using encryption.
> As you should have discovered from the previous challenges, it would be impossible for peers to perform deduplication/aggregation with other peers if they were unable to see cleartext/plaintext data.
This is absolutely incorrect.
> The first thing to note is that the "hashing" algorithm appears to be something home grown, as opposed to an industry standard (md5, sha1, etc.).
This needs proof that this is what the actual client does, as opposed to just an example for a human-readable FAQ for readers who don't know what hashing is. (Also, I question the competence of someone who's writing up an analysis and thinks of MD5 and SHA-1 as their first industry-standard hashes.)
> 13.x.y.133 Amazon Corporate Services Pty Ltd
... This is an AWS host. Attributing it to Amazon itself is just incompetent. https://ip-ranges.amazonaws.com/ip-ranges.json
(Full disclosure: I am unaffiliated with Tanium and have never used it, but I think a couple of former coworkers from a now-failed startup now work there.)