MagicalTux

7 ms·

1.
Unauthenticated WireGuard Key Registration in PIA Infrastructure(twitter.com)
2 points by MagicalTux 10mo ago|0 comments
2.
Analysis by Claude of Mt. Gox's 2011 codebase(github.com)
4 points by MagicalTux 11mo ago|1 comments
3.
by MagicalTux 11mo ago
So I tried feeding Claude all of MtGox's original (2011) sourcecode, git history and other relevant information, and asked for a report. Here's the result which isn't news for me but covers some elements that weren't pub
4.
by MagicalTux 1y ago
Battering RAM has been demonstrated to work well against Intel's "Scalable SGX" which is also known as SGX 2, and uses static encryption key to allow SGX to use more of the system's memory. For example at VP.NET we'
5.
by MagicalTux 1y ago
The SGX certificate is signed by intel and includes a certification of the hash of the code loaded in the secure enclave ("MRENCLAVE"). When the client connects to the server, the server presents a tls certificate that includes an
6.
by MagicalTux 1y ago
The comment was added before the implementation of the IPC buffer & shuffling and was left there, sorry about that. In an older version packets were sent back in sequence to their original connection to the host, as it was faster. We si
7.
by MagicalTux 1y ago
Similar to TLS, the attestation includes a signature and a x509 certificate with a chain of trust to Intel's CA. The whole attestation is certified by Intel to be valid and details such as the enclave fingerprint (MRENCLAVE) are genera
8.
by MagicalTux 1y ago
Intel SGX comes with an attestation process aiming at exactly that. The attestation contains a number of details, such as the hardware configuration (cpu microcode version, BIOS, etc) and the hash of the enclave code. At system startup the
9.
by MagicalTux 1y ago
This is the server-side part of things. It receives encrypted traffic from your (and other customers) device, and routes it to the Internet. This guarantees that your traffic isn't being linked to you, and is mixed up with others in a
10.
by MagicalTux 1y ago
The way this works is by generating a private key inside the enclave and having the CPU attest its public key. This allows generating a self signed TLS certificate that includes the attestation (under OID 1.3.6.1.4.1.311.105.1) and a client
11.
by MagicalTux 1y ago
Let me clarify, it guarantees your connection is being served by the enclave itself. The TLS encryption keys are kept inside the enclave, so whatever data is exchanged with the host, it can only be read from within the secure encrypted encl
12.
by MagicalTux 1y ago
You're welcome to use cryptocurrencies (we have a page for that), and our system only links your identity at connection time to ensure you have a valid subscription. Your traffic isn't tied to your identity, and you can look at th
13.
by MagicalTux 1y ago
Intel audits configuration on system launch and verifies it runs something they know safe. That involves CPU, CPU microcode, BIOS version and a few other things (SGX may not work if you don't have the right RAM for example). The final
14.
by MagicalTux 1y ago
The US government might be able to pressure Intel into doing something with SGX, but there are way too many eyes on this for it to go unnoticed in my opinion, especially considering SGX has been around for so long and messed with by so many
15.
by MagicalTux 1y ago
Yes crypto payments, a bit difficult to find since you need to look at the bottom of the page however, but we have some plans to improve that in the coming days.
16.
by MagicalTux 1y ago
Intel will not attest insecure configurations. Our client will automatically verify the attestation it receives to make sure the certificate isn't expired and has a proper signature under Intel's CA trust. A lot of people have bee
17.
by MagicalTux 1y ago
The enclave fingerprint is generated as part of the attestation. The way this works is the enclave on launch generates a ECDSA key (which only exists inside the enclave and is never stored or transmitted outside). It then passes it to SGX f
18.
by MagicalTux 1y ago
As far as I know SGX has no 0-day exploits live today. sgx.fail was the largest collection of attacks and have all been resolved. What this tells me however is there are a lot of people trying to attack SGX still today, and Intel has improv
19.
by MagicalTux 1y ago
Seems fairly similar, ARM's response to TEE basically. We started with SGX because it is battle tested and has a lot of people still trying to find issues, meaning any issue is likely solved quickly, however we are planning to also eva
20.
by MagicalTux 1y ago
Not an oversight, one of SGX's features is MRENCLAVE measurement, a hash of the code running inside the enclave that can be compared with the value obtained at build time.
21.
by MagicalTux 1y ago
SGX's original goal of being used for DVD DRMs has been deprecated because it turns out people don't keep their BIOS up to date and didn't all get Intel's latest CPUs, making the use of SGX as a client side feature not u
22.
A privacy VPN you can verify(vp.net)
155 points by MagicalTux 1y ago|154 comments
23.
by MagicalTux 1y ago
At VP.NET we just released the source code of our VPN server. We're using SGX to make it possible to confirm our servers are indeed running the very code you're looking at
24.
by MagicalTux 6y ago
I didn't initially, but if you're reading that far in the comments I guess it can't be avoided. People need to know what CoinLab is trying to do.
25.
by MagicalTux 6y ago
More than the contents, the impact of the news on business is what would be used to decide. If most people think the news is likely fake there's no point giving extra attention to it by suing for libel. If it has enough impact to bring
26.
by MagicalTux 6y ago
The WizSecurity comments are shown as a thread, those are the most relevant imo
27.
by MagicalTux 6y ago
Or maybe suing for libel brings a lot of attention so unless it's very bad most companies will opt not to sue, especially if the target is a major news organization.
28.
by MagicalTux 6y ago
Yep this is indeed me. This article would clearly have its place on PRNewsWire rather than Bloomberg.
29.
by MagicalTux 6y ago
I am sorry for the situation and the way things and have expressed sorrow continuously, starting with the bankruptcy press conference, and on multiple occasions. I have been helping people who contacted me or who posted on reddit, been in t
30.
by MagicalTux 6y ago
Being directly involved in this I'm not going to comment as of the veracity of the article myself, but rather point to a response of when this was posted on twitter (look at the extra responses for some fact checking): https:/&#x

More ›