If you cancelled out the cyclical/reciprocal debts then you'd still have the same amount of working capital as you'd pay back $X but also get $X back as a creditor.
> Once on a targeted system, RAM scrapers work by examining the list of processes that are running on the system and inspecting the memory for data that matches the structure of credit card data, such as the account number, expiration date, and other information stored on a card’s magnetic stripe.
No hooking, sounds exactly like they're looking through the memory assigned to each process looking for the right looking data.
Occasionally, usually over zealous stripping back of machines in very controlled environments[1].
1. I don't do much work with these kinds of customers any more as I chose not to go for security clearance (on purpose, as this is a convenient way of avoiding these kinds of customers).
I just can't get excited about vim plugins (no matter how good they are, no matter how much I love vi/vim - and no disrespect to their authors). I can imagine how they could increase my productivity (to some extent) but...
I'm old school, I work happily with vi, many of the customers I dealt with going back to the mid-90s never gave me a choice. SunOS 4.1.3U5 (ugh). AIX 3. Heady days of Solaris 2.5. Bog standard vi. vim is a bonus, but I'm far from lost when it's just vi. I love macros, but I can still get stuff done if they aren't available. If there's no vi then I'm not lost either, I can work around stuff with awk/sed/etc.
Fundamentally I don't want to have to ever install a bunch of stuff in multiple places to create a common environment for myself. That's a big problem that hasn't been solved yet. I just want it to be the same everywhere, which is why I don't rely on zsh or even ksh, and I just go for the bare minimum.
I've been to too many customers to know that not being able to do stuff within someone else's environment is really not a good thing. I've seen people escorted off customer sites because they've been ineffectual.
But, the biggest takeway is that I've seen too many new employees/interns that are lost without their expected favoured environment, and it's not getting better. vim plugins aside, there's a growing lack of adaptability.
Indeed. The biggest weakness is that users aren't well trained in ensuring that the page they're typing their username/password into (to access one of the public access points) may not be genuine.
I know I've seen some faked BT Openzone login pages in the UK, luckily the BT Wifi App is clever enough only to attempt to login to the real webpage.
Can't remember the terminology they use but Strava allows you to define privacy areas (within a configurable radius of a point) where no points are shown on your individual routes. Exactly to stop someone working out where you live/work from browsing your history.
Either they haven't honoured this when calculating the global heatmap or, more likely (and harder to fix), such locations are given away by friends uploads (who don't have the same privacy areas defined).
One of the last things I'd want is lots of drivers near me to be even more distracted saying "Hello? Hello?" into their phone and repeatedly looking at it to see if they're still connected or still have a signal.
Also, good luck if you're in an accident as no-one nearby can call the emergency services.
Can't put in words how much better I sleep after moving to decaffeinated coffee.
I do like a nice coffee but I'm content with instant[1] decaf (and even if I have 10 cups a day it's not more caffeine than the equivalent of a single cup of caffeinated coffee).
Not spending £3/$5 a day on coffee helps too. It means I'll pay my mortgage off 2 years early.
It shouldn't be about it eventually being overwritten, sensitive information like that (which isn't needed for runtime) should be actively scrubbed before the block of memory is freed.
You can't, however, get away with not having the private key modulus in memory (in some form) all the time.
Didn't have any spare time to have a go at this, here's how I was going to do it:-
1) Create a VM with the same version of Linux, nginx, openssl.
2) Create a self-signed SSL certificate for the server
3) Verify that the HTTPS server is vulnerable to heartbleed
4) Run a few HTTPS requests against the server
5) Use gcore (or just send SIGABRT) to get a core file of the nginx process
6) Write a tool to check the memory image for remnants of the private key (since I know what it looks like). This may be encoded in several forms: as is from the ssl key file, hex encoded modulus, binary encoded modulus, however the BigNum stuff in OpenSSL stores the modulus, intermediate values used in calculations, etc. I can also check for partial matches since I know what the full key looks like.
7) Run the heartbleed client against the site to extract some chunks of memory, there are various strategies for this:-
a) Repeatedly grab the largest (65535) bytes of memory each time
b) Repeatedly grab different sizes (8KB, 16KB, etc) depending on the bucket sizes for OpenSSL's freelist wrapper around malloc.
c) Vary the request size (lots more headers, etc) to try and get different chunks of memory returned.
d) Occasionally restart nginx
8) Once I can reliably (for whatever value of reliably that is) get the key from my own server, I then modify the test for success from a comparison against the known private key, to a test which involves decrypting a string that was the result of encrypting some known plaintext with the known public key. That'll be slower, but still possible.
9) Run that analysis against real data retreived from the challenge server. The data (using the various strategies in #7) can be obtained in the background whilst I'm developing #1-#8. You can't rely on having sole access to the server so whatever strategy you use may be perturbed by other people performing requests.
10) Repeat #1-#8 for Apache and any other web server that is vulnerable to heartbleed.
This does work on the assumption that the key (in whatever form it is in) will be returned as a contiguous block of memory. Trying to patch together chunks of memory to look for the key will be much much harder unless there's significant overlap and it's easy to detect what/where a key is somehow.
http://www.bbc.co.uk/news/uk-politics-31151821