Author: Baab

Posted on

Group Participation Invite for Def Con Safe Mode 28

My plan is to stay home from work on Thursday the 6th and Friday the 7th, and be as fully immersed in DCSM28 as I can be. It’s been an important part of my life these past few years, and I refuse to just pretend it’s not happening, or “skip a year.” It’s obviously going to be a very different experience this year than in prior years, so I’m staying open to that experience.

To that end, I’m planning on monitoring the DC540 Discord throughout the event, while participating in whatever ways reveal themselves.

Please feel free to join in if you’re so inclined.

https://discord.gg/XsPwt2M

Posted on

Questionable USBs FTW

I bought some used Def Con USB sticks on ebay. They contain official presentations. I didn’t buy them for the presentations, though — those are available online on Def Con’s media site. I bought them because they are pretty cool Def Con branded swag.

Since I won three separate auctions (DC27, DC26, and one from Blackhat), I got a refund from the seller for a combined shipping discount. When I saw the seller’s name, I did a double-take.

I just bought USB sticks from one of the most well-known hackers on the planet.

This should be fun. And not scary at all.

Posted on

Defcon badge info

SO the Defcon Badge deep-dive was well-received during tonight’s Zoom, there were some interesting ideas thrown about. For now, we’re collecting everything we figure out about it in the bad decisions discord. If you’re not on that, ask yourself what you’re even doing with your life.

Posted on

Managing changed SSH keys in CentOS 8

All these years, I’ve dealt with changed SSH keys (you know, you go to SSH into something and you get the “key has changed” error:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.

probably because you rebuilt the target server/vm, or you changed an IP somewhere, or whatever) by removing the entry from ~/.ssh/known_hosts. It’s a few annoying extra steps, but it has always worked for me. Call it “old reliable.”

With the release of CentOS 8, everything changes. Known hosts are now managed by sss. Maybe this happened somewhere else and I wasn’t aware of it, but this is how I was made aware of it:

Message as above, along with:
Offending ED25519 key in /var/lib/sss/pubconf/known_hosts:6

Well that’s new. And you can’t delete from that file, because it’s generated behind the scenes and then comes right back. Generated from ~/.ssh/known_hosts, apparently. And nobody wants to enter a new key manually as it suggests. The answer?

ssh-keyscan -t ecdsa 10.120.x.x >> ~/.ssh/known_hosts

(substituting your target IP, of course). Almost worth aliasing “whoopsienewkey” to it with a variable for the IP.

Anyhow, that’s all, I hope you’ve learned something today to make your day easier and brighter.

Posted on

Defcon28 Badge

Anybody interested in collaborating to investigate the Defcon 28 tape badge to uncover its secrets? Hit me up if you’ve got ideas and cycles.

Posted on

Hackerspace Bookshelf…

The DC540 hackerspace just got a bookshelf. It’d be pretty cool if it had more titles on it that are relevant to this thing of ours. If you’ve got infosec, hacking, telephony, o’reilly books, etc., you no longer need, please consider donating.

Posted on

DC540 hackerspace network infrastructure…

I’ve been working on infrastructure quite a bit lately. As a means of allowing people to become more involved in DC540 projects as they arise, I’ve been working on an authentication and information management infrastructure within the hackerspace. For example, I have Atlassian’s Jira and Confluence for collaboration, project management, and knowledge management, Bitbucket for code storage, and shared NFS file storage. The idea was originally that I’d be able to find some people willing to collab on projects, and the infrastructure would be there and ready for them. Since the pandemic has basically put the kibosh on in-person gatherings, I’m now working on opening that up to members via VPN.

I realize that not everyone has time to collab on projects, or even the interest. But when we find those that have the passion and availability to get involved in that way, it will be ready. I have enough information and projects of my own that it needs to be done anyway.

Users will be able to pound on the CTF vulnerable boxes, review and add documentation, upload 3d-printer files and schematics. I will try to integrate everything I have into the environment so there’ll be much to play with. Perhaps I’ll move the citadel into this environment as well.

Posted on

KiCAD/FreeCAD free course

Did y’all see this?

https://www.eventbrite.com/e/hackadayu-kicad-freecad-tickets-109682641734?utm_source=Tindie+Community&utm_campaign=2db292f858-Community-July2020-1&utm_medium=email&utm_term=0_bb799798bb-2db292f858-87037781&mc_cid=2db292f858&mc_eid=7ed4a54b79

Hackaday U is offering a free KiCAD/FreeCAD course. Full course is four sessions, I’m signed up for what I hope is the first session Tuesday evening at 7. I figure it will mesh very nicely with the electronics course, since that course is mostly taught on Labcenter Proteus ($$$).