scottpiper

I live in SLC, and I saw one of these show up over a year ago. The location was about here: https://www.google.com/maps/place/40%C2%B047'58.0%22N+111%C2...

It was a very well built setup that I assumed (as did everyone) that it was put there by the gov in some capacity, such as for weather observations. It wasn't hidden or hard to find by any means and on a fairly popular trail. I would bet during nice summer weather a few hundred people per week walked past it.

Author here. Thank you. I haven't made the repo for this doc public, but the LaTeX setup is based on an older document of mine here: https://github.com/0xdabbad00/research/tree/master/emet_unco...

Thank you for posting this, but doesn't "Show HN" mean you're linking to something you've made? I'm the creator of flaws.cloud

I live in Salt Lake City, Utah. I do AWS security consulting. I would love this. I've lived all over the US (Boulder, SF, Austin, DC, and more) and because I do remote work I can work anywhere, and I chose to move here as the best place for my interests.

From https://summitroute.com/blog/2017/01/07/news_summaries/ , some have already been mentioned.

- Downclimb (my own), for weekly infosec news summaries: https://summitroute.com/blog/2017/03/12/downclimb/

- Bulletproof TLS, monthly, for crypto and TLS news: https://www.feistyduck.com/bulletproof-tls-newsletter/issue_...

- Mobile security news, monthly: http://www.mulliner.org/blog/blosxom.cgi/security/mobile_sec...

- This week in 4n6, weekly DFIR: https://thisweekin4n6.com/2017/03/12/week-10-2017/

I'm the creator if you have any questions.

Probably just at the end. My goal is disaster recovery (AWS disappears as a service to the world because an Amazon employee accidentally `rm -rf` everything, or my own admin `rm -rf`'s my account on accident) so for those situations, I'm going to need to extract out the data somewhere and then rebuild, so checking at the end of the extraction and unzip is fine for my needs.

I'm the author of the blog post in question (and have no idea why HN won't let me reply to the original post). For some clarity here, the "untrusted" third party is Google, whom I don't want to read my data, but I trust that they will not modify my backups. However, in the article I do gzip the files before encrypting them, and gzip has a CRC-32 check, so if the files were modified, then after decryption when you attempted to gunzip them, it would error.

I used openssl because I find GPG on servers is awkward to use.

The full article is more clear that I have only one private key, and for all the nightly backups I'm generating AES keys and encrypting them with the public key.

These are both accurate.

For 1, I ensure that an attacker can not modify my archives after they've been uploaded by giving the backup service "put" only privileges. This is not possible with GCE from the article unfortunately, as I point out in a warning banner there, but is with AWS that I'll post soon. My use case is primarily to have a backup in the event of a devops mistake, or malicious attacker (ransomware), so I assume if someone has write-access to my archives they would just delete them, so authenticating them isn't as big of a concern, but although this would be a good idea just to ensure the files aren't corrupt in some other way.

For 2, my storage needs currently aren't expensive (100GB archives per day, which means pennies per day for all of them), but eventually I plan on sending just diffs. I also wanted to create and send backups in the simplest possible way to help people get up and running as fast as possible, which meant limiting myself to the "openssl" command and other basic commands. The other, smarter, solutions I'm aware of are either tied to a service (ex. tarsnap) or don't maintain the data as encrypted at the backup location.

If you're doing backups for your business, I've written on how to properly encrypt backups[1] and how to use Google Compute Engine for backups[2]. I'm working on write-ups for AWS and Azure that should post within the new few weeks.

[1] https://summitroute.com/blog/2016/12/25/creating_disaster_re...

[2] https://summitroute.com/blog/2016/12/25/using_google_for_bac...

For static analysis to check for best practices, there aren't any free tools that come to mind that give you easily digestible info without usually doing some manual reversing and a lot of extra knowledge. HBGary once created a tool called FingerPrint that provided some of this extra info but that tool disappeared. I extracted out a lot of what it does into YARA signatures: http://0xdabbad00.com/2011/01/09/fingerprinting-using-yara/

The original purpose of HBGary's tool was for fingerprinting malware, but what it really was doing was just extracting out info from malware author's build environments that could be learned from the executables they created.

Other things you would want to check for though are: - Are the executables code signed? - When run, look in ProcessExplorer (for Windows) to see if it runs with DEP/ASLR/CFG/x64 and ensure every DLL it loads has ASLR and CFG. - Run with wireshark on and ensure any network traffic is HTTPS.

There are thousands of ways for all these checks to give incorrect information with regard to whether the developers follow best practices or not, but if you do enough steps they'll add up to a decently accurate understanding.

Assuming the program has no vulnerabilities, these will do nothing. They are mitigations for memory corruption vulns, such as buffer overflows and use-after-frees. Sanitizing inputs doesn't really help for some of these.

These mitigations are "free" to add to programs in the sense that they are just compiler flags. Usually the reason these aren't being used is because the build process for a tool is really old and isn't using the latest version of Visual Studio or some other compiler. Some examples of this are Google Drive, which is still compiled with Visual Studio 2008, or 7-zip which seems to use VS 2005.

I'm the author if you have any questions

http://highscalability.com/ - For news related to building large web apps and software.

https://summitroute.com/blog/ - (mine) Infosec news.

http://ben-evans.com/#newsletter - Email only newsletter from Benedict Evans of A16Z mostly related to large mobile business moves.

https://www.feistyduck.com/bulletproof-tls-newsletter/ - TLS crypto news (monthly)

http://golangweekly.com/ - Golang links

And go:linkname, go:nointerface, and go:nowritebarrier You can see the lexer for these here: https://github.com/golang/go/blob/88c08b06b97296e41fc3069f4a...

An important consideration when deciding if it is a good alternative is how good is it's security and ability to keep you anonymous? Since that's the whole point of using it anyway.

When evaluating, it's important to look at past vulnerabilities. The following links are to posts from Exodus Intelligence about a vuln they found in i2p in July, 2014. - http://blog.exodusintel.com/2014/07/23/silverbullets_and_fai... - http://blog.exodusintel.com/2014/08/25/tails-from-the-cri2p/

On the one hand you could say it is more secure now because Exodus Intelligence reviewed it, and said "I2P had many cross-site scripting vulnerabilities" of which all were fixed. Also the way in this could be exploited is a little unique (by using XSS to hit the internal I2P router configuration intranet), so it's hard to fault the developers too much for overlooking those XSS problems originally.

On the other hand, there is the view that the more vulns that are found, the more likely it is there are more as yet undiscovered vulns.

KryptosLogic has a good write-up on this showing how it can be detected with Z3: http://kryptoslogic.blogspot.com/2015/01/openssls-squaring-b...

Moyix's Panda will get you most of what you want: http://moyix.blogspot.com/2014/12/reproducible-malware-analy...

The author of that article is also the author of the Goji framework (very nice web framework for Golang): https://goji.io/