Page 3 of 3 FirstFirst 123
Results 21 to 25 of 25

Thread: AVG Ventures Into Linux Malware Protection

  1. #21
    Join Date
    Oct 2008
    Posts
    901

    Default

    Quote Originally Posted by paul_one View Post
    To "circumvent" GPG signatures, you would need to have a copy of the private keys in order to sign the packages.
    .. Either that or invent some way to quickly factor LARGE numbers.
    I still think it takes somewhere in the region of the billions of years mark with most of the computing power of the world.
    Not really, the easiest route is to keep packages already pgp signed with known vulnerabilities locked at the version numbers with the vulnerabilities in your hypothetical hijacked repository, completely "trustworthy" and with very little effort.

    I also take it you haven't considered creating a cluster of nvidia tesla cards to crunch numbers or do anything that is processor intensive. Billions of years? They used to say that about WPA and WPA2 keys and look at how quickly they can be cracked with just a GeForce 8800.

  2. #22
    Join Date
    Feb 2008
    Location
    Linuxland
    Posts
    5,269

    Default

    They used to say that about WPA and WPA2 keys and look at how quickly they can be cracked with just a GeForce 8800.
    Are you referring to the brute-force solution that's just faster on a gpu? With a good password it's still not broken.

  3. #23
    Join Date
    Aug 2007
    Posts
    153

    Default

    Quote Originally Posted by yogi_berra View Post
    I also take it you haven't considered creating a cluster of nvidia tesla cards to crunch numbers or do anything that is processor intensive. Billions of years? They used to say that about WPA and WPA2 keys and look at how quickly they can be cracked with just a GeForce 8800.
    I should note that the current vulnerabilities in WEP are due to correlation between the encrypted packets and the key, and that only the flavors of WPA with the same key init as WEP share those statistical weaknesses. I should also note that only very short keys can be brute-forced within a reasonable amount of time.

    WEP still can't be brute-forced very fast. It requires that statistical analysis in order to pare down the keyspace to something small enough to quickly search. WPA with CCMP is still too big to do a full-on brute-force attack. (And no wonder, either; it's based on AES.)

    tl;dr: You won't be brute-forcing my WPA2 key anytime soon.

  4. #24
    Join Date
    Oct 2008
    Posts
    901

    Default

    Quote Originally Posted by MostAwesomeDude View Post
    WEP still can't be brute-forced very fast. It requires that statistical analysis in order to pare down the keyspace to something small enough to quickly search. WPA with CCMP is still too big to do a full-on brute-force attack. (And no wonder, either; it's based on AES.)
    Actually it can be done quickly under the right network conditions, its dependent on the number of packets being intercepted, but you already knew that.

    The point is that encryption alone isn't the security panacea that people make it out to be. But it works wonders on the psychosomatic level for the people that want to believe that they are secure. Much like deadbolts and doorchains on their front doors.

  5. #25
    Join Date
    Aug 2007
    Posts
    153

    Default

    Quote Originally Posted by yogi_berra View Post
    The point is that encryption alone isn't the security panacea that people make it out to be. But it works wonders on the psychosomatic level for the people that want to believe that they are secure. Much like deadbolts and doorchains on their front doors.
    Agreed, although I'm not going to decrypt my hard drive any time soon.

    http://xkcd.com/538/

    And that's all I have to say about that. :3

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •