cybergibbons
-
Posts
498 -
Joined
-
Last visited
-
Days Won
7
Content Type
Profiles
Forums
Events
Downloads
Gallery
Blogs
Everything posted by cybergibbons
-
Which one is it then?
-
You'd still need a lot of skill from anything I had posted to be able to defeat the anti-codes. On one hand I am being told that these issues I'm pointing out aren't real vulnerabilities, on the other hand I'm being told that they shouldn't be published?
-
Changed to reset, sorry.
-
I've just updated the blog with my findings from the reverse engineering of Technistore, if anyone is interested.
-
The key would need to be longer than the pin for it to be difficult. With it being so short, it's really not hard.
-
Thanks, I guess?
-
So I guess I need to start ripping UDL software apart now?
-
Technistore and one other. Not wanting to name as I can't openly source it.
-
It's a hard one to make better though. If you are limited to 0-9 on 5 digits, it can only be so secure, but a seed at least as long as the reset code would make it better.
-
It's easy to bypass that check with a debugger, and then it just seems to be a 0-255 code.
-
That's interesting. With no seed, the only protection is keeping the executable secret. Technistore allow you to download it from their site, oddly.
-
This is the thing - it is virtually impossible to secure an executable such that you can't get the algorithm out. The security has to be in the key (the secret). If the key is only 8 bits, then guessing it isn't going to be hard. Have their been many changes in anti-codes recently? Do new panels have new decoders? Which standard or body is it that dictates how anti-codes are used?
-
Another question about impressions of security. I'm looking at anti-codes at the moment, which seem common on monitored systems. Typically this takes a 5 digit quote code along with a secret seed, and generates a 5 digit reset code (along these lines, anyway). It turns out for the few decoders I have now looked at, the secret seed can be determined from a one or two pairs of quote/reset codes. If this seed was constant across an entire installer or manufacturer, this could present a risk. What are your thoughts on this?
-
Ifsec Moves To London
cybergibbons replied to AdrianMealing's topic in Site News, Events, and Feedback
It doesn't take me much longer to get from West London to the NEC than getting to Excel, such is the public transport. -
I'm starting to get quite frustrated at the archaic attitudes to disclosure in the physical security world.
-
"What a bored hacker did on a plane?" Despite being innocuous, brave (silly?) for doing this... http://t.co/OLENSXkI9I
-
A lovely weekend! Lunch with sister and mum, ambulance, park, insect hunting, steam museum. So tired!
-
Epic arrogance from a Cisco employee on twitter, calling a customer a “punk ass bitch”.
-
Interesting blog post about a rubidium clock from a plane used for a frequency hopping system http://t.co/enBLZUGJsN
-
RT @mattblaze: At times like this, remember Occam's Razor: the simplest explanation - a giant, invisible all-powerful conspiracy - is usual…
-
Total alarm bell boxes in and on our house = 7. This might be a bit higher than average.
-
Really, why do so many people use crowd funding as an excuse for **** or delayed products? Or poor customer service?