BC TRADING
Saved by @Alex1Powell

A thread on the Tasmota TLS MitM attack I found a few months ago since getting a proper blog post about it is taking me forever.

Tasmota is an open source firmware that runs on a number of ESP8266-based IoT home automation devices, which talks to an MQTT broker for management.

 MQTT can be run over TLS to provide confidentiality and integrity, but given the constraints of running on an ESP8266 device, standard TLS certificate validation is rather heavy. As an alternative, Tasmota implements fingerprint based validation, like SSH
The fingerprint validation can do "trust on first use" (TOFU) and just remember the server's public key. This can work well if you're hosting your own MQTT server, and you can just use a self signed certificate. The fingerprint algorithm was even based on how SSH does it.
If you read RFC4253, it describes the RSA key format with the following encoding

string "ssh-rsa"
mpint e
mpint n

where e is the public exponent (usually 65537) and n is the modulus.

Slight problem. RFC4253 doesn't explain what an mpint is.
You have to go dig up RFC4251 for what an mpint is. The precise details don't really matter for this bug, but the critical detail is that an mpint is length-prefixed, which makes it unambiguous where when mpint ends and the next begins.

Tasmota's implementation missed this.
Instead, everything was simply concatenated together with no delimiter. That means each fingerprint actually matches a "family" of RSA keys with identical serialization with the public exponent ending and the modulus beginning in different places.
As an example (with tiny number), we could have e=17 and n=389436408973, with a serialization of "ssh-rsa17389436408973". But e=17389 and n=436408973 gives the same serialization and is much easier to factor - it's 7 * 11 * 13 * 435973.
A quick bit about RSA - keys are normally formed from two large prime numbers that are around the same size, which are multiplied together to form the modulus. The security of RSA depends on it being difficult to decompose the modulus into its prime factors.
The math behind RSA also works perfectly fine with more than two prime numbers - and this is even supported (though rarely used) by modern implementations. The question is, can factors actually be found for collisions of arbitrary RSA keys under Tasmota's scheme?
There are two ways to factor numbers large enough to use as RSA keys - general number field sieve and elliptic curve method.

GNFS's difficulty depends on the size of the number, and these are too big.

ECM, however, depends on the size of the second largest factor.
For a normal RSA number with two primes, GNFS would be faster, but if the primes are small enough, ECM is feasible.

So, then, to attack the key, the family of RSA keys that match the fingerprint are all generated, and then ECM is used to try to factor them.
The ECM attempt can be time bounded. I found a few minutes per key worked reasonably well, and gave about a 99% success rate in finding one usable factorization.
As a "nothing up my sleeve" demo, I picked this key here that covers nsa[.]gov (among other domains):

https://t.co/1AITBNXWIv
I was able to find a colliding key with a factorization of 13, 1,091, 15,032,926,429, and a 340 digit prime that won't fit in this tweet.

The attack also worked just fine on my LAN and I was able to pull off a MitM attack.
I supplied a patch to Tasmota to remediate this. My patch adds length prefixes to the RSA key serialization to make it unambigious, and will automatically update the fingerprint so long as the server's key isn't "suspicious".

https://t.co/quyAT5uzw4
I believe my code made it into Tasmota 8.4.0, so if you're running an up to date version you're protected - though I imagine most folks aren't bothering with TLS on their home networks.

I am the sort of person who thinks that running transport mode IPSec at home is a good time.
This was one of the coolest crypto exploits I've ever written.

I published a blog post a couple months ago about constructing multi-prime RSA keys in python, which was part of my attack for this.
I did need to patch OpenSSL to remove the limits on the maximum number of primes it allowed, but that was pretty simple.

I think that wraps this thread.

More from Trading

Trader knight
Trader knight
@Traderknight007
“In search of the holy grail”

A thread-


Holy grail- A strategy Which can make money all the time.

After going through two phases of a traders journey, the initial success phase, and Only why do i get loss phase, Traders enter the third phase -

THE SEARCH FOR THE HOLY GRAIL PHASE.

This phase has no limits, It can end in 1 month and it may not end till lifetime.

What exactly is this phase?

When a trader covers all the basics, they know how to lower their losses, they know the power of risk management.

And few of them may even develop their edges and systems over time.

But after some time, they feel that they are doing something wrong and there is more to trading than what they know.


THEN COMES THE HOLY GRAIL PART-

Few of them start to Read more books about trading,finding articles about “How to win 100% of the time” and listening to Youtube videos of few big traders who make big in trading.
ALL , TRADING
Gene Kim
Gene Kim
@RealGeneKim
Many of you have seen the famous Westrum Organizational Typology model, so prominently featured in State of DevOps Research, Accelerate, DevOps Handbook, etc.

This model was created Dr. Ron Westrum, a widely-cited sociologist who studied the impact of culture on safety


Thanks to Dr. @nicolefv, I was able to interview him for an upcoming episode of the Idealcast! 🤯

It was a very heady experience, and while preparing to interview him, I was startled to discover how much work he's done in healthcare, aviation, spaceflight, but also innovation.

I've read 4+ of his papers, so I thought I was familiar with his work. (Here's one paper: https://t.co/7X00O67VgS)

I was startled to learn he has also studied in depth what enables innovation. He wrote a wonderful book "Sidewinder: Creative Missile Development at China Lake"


Dr. Westrum writes about China Lake Research Labs: "its design and structure had one purpose: to foster technical creativity. It did; China Lake operated far outside the normal envelope... Sidewinder & others were "impossible" accomplishments,

I love this book because it describes traits of organizations that routinely create and maintain greatness: US space program (Mercury, Gemini, Apollo), US Naval Reactors, Toyota, Team of Teams, Tesla, the tech giants (Amazon, Google, Netflix, Google)
TRADING
Advertisement
Edwin Hayward \U0001f984 \U0001f5e1
Edwin Hayward 🦄 🗡...
@uk_domain_names
Here's how the UK's situation will change after the transition period ends, compared to our former EU membership...

(Come back to this thread. It will keep growing!)

- UK can negotiate its own trade deals
- No more automatic participation in new trade deals reached by the EU

- UK gets to keep fish equivalent to 25% of the catch EU boats previously caught in UK waters, staggered over 5.5 years
- Costly export health certificates for fishery products
- Inbound and outbound customs and regulatory checks (UK side will defer some of these temporarily)

- Stringent rules of origin and local content requirements
- Loss of freedom of movement for UK citizens in the EU and EU citizens in the UK (Ireland excepted)
- No Erasmus programme
- No equivalence decision for financial services

- A border down the Irish sea between NI & GB
- No access to the Galileo military
- Temporary agreement on data, which expires in 6 months
- 2 parallel trademark systems, requiring firms to file twice in the UK and the EU

- 2 parallel product conformity assessment systems (CE and UKCA), requiring firms to file twice in the UK and the EU. One year grace period (with exceptions).
- 2 parallel chemical regulatory systems (REACH and UK REACH), requiring firms to register twice in the UK and the EU
TRADING
Aditya Todmal
Aditya Todmal
@AdityaTodmal
Over the last 18 months, I have scaled my income to around ₹10,00,000 or 10 lakhs per week with drawdowns below 10%.

How?

@niki_poojary taught me how to form a weekly trading plan.

I'm going to share what I've learned in this thread.

Here's the simple 10 step process: 🧵

1. Check on the daily chart if Bank Nifty is in a higher high or lower low:

A higher-high (HH) is a bullish pattern, it signifies that it is difficult for the market to go down.

If that has formed on the daily chart, the market will give all the surprises on the upside.


If the market is in a higher high mode, look for good opportunities to sell puts.

Usually, at a higher high, traders buy on breakouts and also buy the dips.

If you want a good Risk-Reward, you can sell puts on a dip. (Only if it's showing some reversal)

2. Take High Probability Trades

Simply knowing a higher high or lower low does not make money. It gives you a bias for the week.

Still, you should try to take higher probability trades that align with your view of the market.

This will get you consistency and a good mindset.

3. Support & Resistance

I would say Support Resistance is the most important and favorite thing for @niki_poojary.

She keeps updating these levels with charts on her Twitter handle during live markets daily.

Attaching some examples will do a detailed thread on this later.
ALL , TRADING
Sohaib Albadawee
Sohaib Albadawee
@albadawee
Everyone should own a digital asset that earns $2,000 per month.

Here are 10 dead-simple ways you can make your First $1 online (from people who actually did it):

🐦 Analyze viral Tweets

1. Get Twemex (free chrome extension)
2. Find influencers with viral tweets
3. Identify why they went viral
4. Put your analysis on a document.
5. Upload it to Gumroad
6. Sell it

H/t @BrianFOConnor

🔢 Extract data from yellow pages into excel

1. Find a B2B/B2C niche that needs offline data
2. Choose a digital platform (Excel, Airtable ..)
3. Move the data to the digital platform
4. Hire someone on Fiverr to do it
4. Sell it on gumroad

H/t @SachinRamje

🎨 Design flyers and graphics

If you are good at designs:

1. Find a niche (ex: Vegan resturants)
2. Create a profile on Upwork
3. Upload a portfolio
4. Start with a low charge per hour/design
5. Steadly increase your charge

H/t @abdussalampopsy

🏋️ Become a coach

1. Decide on a target persona
2. List down your achievements
3. Update your social profiles
4. Create a calendar account
5. Create content with CTA to book a call

H/t @OllieEmberson
TRADING

You May Also Like

Dr. Jane Clare Jones
Dr. Jane Clare Jones
@janeclarejones
So, on the subject of bonkers hyperbolic pretzeling over the Bell judgement, Grace 'destroy books I don't like & make inappropriate jokes about sterilising teenage girls' Lavery has some thoughts.

Tell me why my feminism is wrong Grace.

Oh

Well, if anyone thought the Bell judgment was going to make TRAs reconsider making massively overblown claims with no evidence backed up with nothing but a thick wadge of emotional blackmail.... HAHAHA, no one thought that.


A high court in the UK made a delimited judgment about teenager's ability to consent to puberty blockers. This puts all trans people everywhere in the world at risk.

Because if any human anywhere has any thoughts that deviate in any way from the rote line dictated by

the trans rights movement, this puts all trans people everywhere in mortal danger.

Let's be honest Grace. It doesn't put trans people at risk. It puts trans ideology at risk. Because trans ideology depends on the idea of innate gender identity, and the trans child is the

necessary material evidence of the ontology of gender identity.

That is, children are being medicalised to provide evidence to underwrite adults identities.

Nothing to see here.
LAW
Kirsti Miller
Kirsti Miller
@KirstiMiller30
@FionaPearman @ScottMorrisonMP Morrison is our statue of unempathic neoliberalism - erected by evangelical and corporate Australia to celebrate their victory over compassion, equality and secular humanism. 

Hopefully it gets pulled down like the statues of dubious heroes of oppression from an earlier age.


@ScottMorrisonMP The two-party-preferred system in 
Australia politics isn’t working for people, and it sure isn’t working for the planet.

@ScottMorrisonMP My collapse of faith in our democracies isn’t an accident. It’s one of the central victories of the neoliberal project, delivered through two generations of privatisation, outsourcing and deregulation, underfunding of government services (locked in by tax cuts),...

@ScottMorrisonMP restricting freedom of information, targeting whistleblowers and raiding the media who report on them, delegitimising and gagging public interest advocacy, and criminalising protest.

@ScottMorrisonMP Politics in Australia today relies hugely on the fact that most people don’t know most of what’s going on so as to get away with stuff that couldn’t be done under real scrutiny we have seen a clear example of this with the National Coronvirus Cabinet.
FOR LATER READ
Advertisement
Alex Oluwatobi
Alex Oluwatobi
@alexlobaloba
According to psychologists, there are four types of intelligence:

- Intelligence Quotient (IQ)
- Emotional Quotient (EQ)
- Social Quotient (SQ)
- Adversity Quotient (AQ)

1. IQ is the measure of one's ability to comprehend, solve maths; memorize things & recall subject matters.

2. EQ is the measure of your ability to maintain peace with others; keep to time; be responsible; be honest; respect boundaries; be humble, genuine, and considerate.

3. SQ is the measure of one's ability to build a network of friends & maintain it over a long period of time.

4. AQ is the measure of your ability to go through a rough patch in life and come out without losing your mind. It is a new paradigm and can be used to determine who will give up in face of troubles and may abandon their families.

Now to the very interesting & analytical part👇

People that have higher EQ & SQ tend to go further in life than those with high IQ but low EQ &SQ.

Most schools capitalize on improving IQ level while EQ & SQ are played down.

A man of high IQ can end up being employed by a man of high EQ & SQ even though he has an average IQ.

Your EQ represents your character; your SQ represents your charisma. Give in to habits that will improve these three Qs but more especially your EQ and SQ.

EQ and SQ make one manage better than the other.

Try not only to have a higher IQ but also to have higher EQ and SQ.
ALL
ArmaniTalks \U0001f399\U0001f525
ArmaniTalks 🎙🔥...
@ArmaniTalks
Your Most PRECIOUS Currencies:

-Energy

-Time

-Attention

-Trust

-Love

-Loyalty

-Respect

Only give these currencies to high value people. Never spend these currencies on low value shitheads eg: trolls, weasels, snakes, naysayers etc.

'Wait, I thought money was the most important currency?'

Nah.

Once you adopt abundance mentality, you realize their is no shortage of money.

Making the dollars your most important currency will have you leading an empty life.

Time to flip your perspective.

👇

▪Energy

When you strip yourself to the core, you are an emotional creature.

Emotions are your internal worlds energy.

Harnessing that energy is crucial for leveraging yourself to obtain whatever you want.

You have a finite amount everyday, so spend it wisely.

▪Time

A second that is lost will never be returned.

You start valuing the hell out of this currency the more you mature.

As the years start adding up, you realize time is precious.

You must always have a scarcity mindset towards time.

Once you do so, you will not be lazy.

▪Attention

You can be here, but not present.

Attention is completely mental.

Giving someone your attention means you are clearing up mental bandwidth to make room for them.

Only give your attention to people who help you grow.

For the negative ones?

Ignore their existence
LIFE
Melissa (she/her)
Melissa (she/her)
@LiteraryMouse
In regards to the #CapitolCoup, I’m in a unique position. I monitored forums ahead of time and then was present for the coup itself.

These are my observations based on what I saw and the evidence that’s been collected so far. I reserve the right to adjust my analysis as needed.

Let’s talk about the organization of the coup first. Seeing some people insist that the coup must have been highly planned and coordinated.

Yes and no. This was a #StochasticCoup. We’ll see little evidence of direct communication between Trump and the insurrectionists.

Within the insurrectionists, there was not one group that executed the storming of the Capitol.

Rather, there were a number of smaller groups working independently towards the same goal. I expect you’ll see little evidence that these various groups communicated with each other.

What you will see is detailed planning and coordination within these small groups.

Then there were the joyriders, those Trump supporters who weren’t directly involved in any plotting but who were more than happy to go along for the ride once the coup was in motion.

After four years, the insurrectionists were carefully attuned to Trump’s messaging.

Every tweet and statement of his was treated as marching orders and carefully dissected for meaning.

It’s why shutting down Trump’s Twitter account was so important.
POLITICS , INSURRECTIONISTS


Category Partner: Enkryptopedia