Top all-time · #4044
NCC Group
Company blog · cryptoservices.github.iosecurity
NCC Group is the company blog at cryptoservices.github.io, writing about security. Since 2014, 19 different Hacker News readers have linked it 25 times, most often “Code Execution in Spite of BitLocker”. The last post was in 2019, but the archive is still widely read.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
Comments cite this NCC Group crypto blog's posts on undefined behaviour in C/C++, full-disk encryption and blockchain consensus. Three comments are job postings for the team's internships.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Code Execution in Spite of BitLocker4 people · 4 mentions · first linked 2014-12-08
- Undefined Behavior Is Really Undefined3 people · 5 mentions · first linked 2018-12-01
- Confidential Transactions from Basic Principles (2017)3 people · 3 mentions · first linked 2017-07-26
- Confidential Transactions from Basic Principles2 people · 2 mentions · first linked 2017-07-29
What Hacker News says?
Cryptography Services @ NCC Group (formerly Matasano Security, iSEC Partners, and Intrepidus Group) - Atlanta, Austin, Chicago, New York, San Francisco, Seattle, and Sunnyvale, CA INTERNS / VISA The Cryptography Services team of NCC Group is looking for a summer 2017 intern! We are looking for you if you’re into cryptography and security! The internship would allow you to follow consultants on the job as well as lea…
Comment linking /challenges/
on “Ask HN: Who is hiring? (November 2016)”Submitted Confidential Transactions from Basic Principles as a story · 144 points
HN discussionCryptography Services @ NCC Group (formerly Matasano Security, iSEC Partners, and Intrepidus Group) - Atlanta, Austin, Chicago, New York, San Francisco, Seattle, and Sunnyvale, CA INTERNS / VISA The Cryptography Services team of NCC Group is looking for a summer 2017 intern! We are looking for you if you’re into cryptography and security! The internship would allow you to follow consultants on the job as well as lea…
Comment linking /challenges/
on “Ask HN: Who is hiring? (October 2016)”Submitted OpenSSL Audit as a story · 139 points
HN discussionCryptography Services @ NCC Group | NYC, SF, Chicago, Seattle, Austin, Waterloo (Ontario) | ONSITE | INTERNS NCC Group Crypto Services is hiring interns for summer 2020! We're a small team auditing applied crypto and doing research in the field. If you like cryptography and security, and would like to pursue a research project in any of the applied crypto areas, such as (but not limited to): - cryptographic implemen…
Comment linking /cryptography/2017/07/21/Sigs.html
on “Ask HN: Who is hiring? (November 2019)”Submitted Undefined Behavior Is Really Undefined as a story · 94 points
HN discussionUndefined behaviour . Here's an article on the topic: https://cryptoservices.github.io/fde/2018/11/30/undefined-be...
Comment linking /fde/2018/11/30/undefined-behavior.html
on “I have no constructor, and I must initialize”Submitted Code Execution in Spite of BitLocker as a story · 33 points
HN discussion> Are we talking actual undefined behavior or just behavior that's undefined by the language standard? 'Undefined behaviour' is a term-of-art in C/C++ programming, there's no ambiguity. > if your environment handles behavior deterministically, and you publish the version of the compiler you're using, it doesn't seem to be a problem for this type of code. Code should be correct by construction, not correct by coincid…
Comment linking /fde/2018/11/30/undefined-behavior.html
on “Challenge to scientists: does your ten-year-old code still run?”Submitted Code Execution in Spite of BitLocker (2014) as a story · 11 points
HN discussionIn case it's not obvious how this can happen, it's because the promotion rules can turn them into signed ints, and if they're big enough the product can overflow that. For more details, see https://cryptoservices.github.io/fde/2018/11/30/undefined-be...
Comment linking /fde/2018/11/30/undefined-behavior.html
on “OpenSSH 9.0”Submitted The public audit of OpenSSL is starting as a story · 6 points
HN discussionBut which chain? From what I read, it's very important to distinguish between the true chain which full nodes can come to consensus on based on proof of work, and a possible attacker chain which is longer, but low effort. https://cryptoservices.github.io/blockchain/consensus/2019/0... And I believe I've read that, when you aren't running a full node, you have to just assume the longest chain is the right one. I mean…
Comment linking /blockchain/consensus/2019/05/21/bitcoin-length-weight-confusion.html
on “I Am Not Satoshi Nakamoto”Submitted Confidential Transactions from Basic Principles (2017) as a story · 2 points
HN discussionThis is a little silly because this assumes that BitLocker is configured for TPM-only rather than requiring a TPM PIN/password. If there's a TPM password, this attack becomes infeasible because the TPM won't release the keys without the password. And you generally can't brute force the TPM without triggering the hardware lockout. The company's IT department can require TPM+Password in Group Policy so that every syst…
Comment linking /fde/2014/12/08/code-execution-in-spite-of-bitlocker.html
on “Break into this CEO’s laptop to steal company secrets and plant malware”Submitted Bitcoin Orphan Transactions and CVE-2012-3789 as a story · 2 points
HN discussion> Especially is not something to be afraid of. Disagree. UB in C can mean your program silently going off the rails in a way that isn't possible in many other languages. UB really can manifest in bizarre and scary ways on real platforms. [0][1][2][3] If it isn't manifesting that way in your case, that's just good fortune. > I still have to find a bug or fail a test because some strange UD I should hope your safety-c…
Comment linking /fde/2018/11/30/undefined-behavior.html
on “How expensive is integer-overflow trapping in C++?”Submitted Confidential Transactions from Basic Principles as a story · 2 points
HN discussion>"this system is even larger than in the past and as such slip-ups are only going to increase.” Yes, the system is certainly larger (as is the internet as a whole) and slip-ups are natural. Luckily these 'slip ups' are typically simple things like certs expiring or supporting outdated cipher suites. These are just minor configuration fixes that things like Lets Encrypt aim to fix (both distribution and configuration…
Comment linking /%E2%80%A6/2015/03/09/openssl-audit%E2%80%A6
on “Unintended Affordances (or why I believe encrypting everything is a bad idea)”Submitted Code Execution in Spite of BitLocker as a story · 2 points
HN discussionNeat! This is actually the fundation of hash-based signatures [1] that are (for the moment believed to be) quantum resistant. I recommend this awesome series of blog posts to learn more about hash-based signatures [2] (Merkle Trees are discussed in the third article). Finally, a shameless plug of a repo [3] where I implement Lamport and Winternitz's schemes for one-time signatures and Merkle trees for many-times sig…
Comment linking /quantum/2015/12/04/one-time-signatures.html
on “Merkle Tree”Submitted Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations as a story · 1 points
HN discussionOh, the diffuser matters a lot actually. Your former colleagues (I think?) proved this by blindly popping calc on a bitlocker-protected Windows 8.1! https://cryptoservices.github.io/fde/2014/12/08/code-executi... With the diffuser, we have ~9 years of conjecture and speculation, with no one overly certain that attacks are possible. Without it, we have calc.exe fairly quickly after someone got the idea to try. You ca…
Comment linking /fde/2014/12/08/code-execution-in-spite-of-bitlocker.html
on a deleted threadSubmitted Confidential Transactions from Basic Principles as a story · 1 points
HN discussion
