Secret Club

What a classic! Phrack stopped publishing some time ago but the world of security ploughs on, who can recommend similar modern resources to Phrack? Here's a few I'm aware of: https://www.alchemistowl.org/pocorgtfo/ https://secret.club/

If you're talking about the blog, it's an open source Zola theme https://github.com/not-matthias/apollo (the original site https://secret.club which it's based on/inspired by is closed source though)

Recommended reading for anyone interested in this tecnology. https://en.wikipedia.org/wiki/Next-Generation_Secure_Computing_Base https://secret.club/2021/06/28/windows11-tpms.html https://www.eff.org/wp/trusted-computing-promise-and-risk https://www.diva-portal.org/smash/get/diva2:206552/FULLTEXT01.pdf

There is also a guy from Denmark, he has been writing cool stuff at https://secret.club/.

Also there is https://secret.club/

Yeah fair enough. The login screen should still provide good protection in a TPM-only scenario. (Although it had some vulnerabilities in the past: https://secret.club/2021/01/15/bitlocker-bypass.html)

Honestly if you are running any game on your system, you do not really care about security (because most game devs don't care about security, just performance). https://secret.club/2021/04/20/source-engine-rce-invite.html

You mean pluton is going to give us a smartphone kind of locked ecosystem disguised as a PC. https://secret.club/2021/06/28/windows11-tpms.html

A bit old but there’s this writeup on bypassing BattlEye: https://secret.club/2020/07/06/bottleye.html

The full write up shows that the exploit is based on a integer underflow that would be easily caught by Zig and any other programming language with sane runtime checks. Ironically enough this is the one class of bugs that Rust would not have prevented out of the box since the language defines integers to be wrapping and you need to manually opt into runtime checks. The exploit: https://secret.club/2021/04/20/source-engine-rce-invite.html Wrapping in Rust: https://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-o… https://scattered-thoughts.net/writing/how-safe-is-zig/ I hope that explains how inappropriate is the tone of your comment.

One can wish. The more likely end game seems to be one where no one actually bothers using a real Linux installation, as you can do everything you'd need Linux for on your Windows machine. But your Windows machine has become a 'trusted computing' device that only boots and runs most software if it 'hasn't been tampered with'. Say, by actually installing Linux on it. Edit: Further reading here: https://secret.club/2021/06/28/windows11-tpms.html

Windows 11 maybe? Of course you would see the effects once it is established. Since it was rejected for the most part, this mechanism cannot work. You can deny these fears all you want, but TPM is not for you, the security benefits are negligible. Perhaps put it on your server, but I don't see the necessity either. https://secret.club/2021/06/28/windows11-tpms.html I don't think anyone can make reasonable argument against the problems put on the table here. You can also look up the FIDO group. While they are important to strengthen and develop encryption, there is a reason for its corporate sponsors aside user security. The user is a hostile entity in TPM security schemes.

Funnily enough the same group found a wormable exploit in Valve's Alien Swarm, a mostly forgotten game with a tiny playerbase, and Valve fixed it in 3 months. https://secret.club/2020/10/30/alien-swarm-rce.html Meanwhile CS:GO, their flagship game with over a million daily peak players, has numerous wormable RCEs reported and ignored for as long as 2 years. Valve works in mysterious ways.

> I think Windows' BitLocker already does that. And one day later, it appears the answer is apparently not: https://secret.club/2021/01/15/bitlocker-bypass.html

In practice C code, especially well-written C code, will have most of the same bounds checks. It's not uncommon where a C programmer could safely omit a bounds check, but of course it's too often that the average C programmer mistakenly omits a bounds check or implements a bounds check wrong. See, e.g., the recent HN post, "Escaping VirtualBox 6.1", https://news.ycombinator.com/item?id=25795731 (https://secret.club/2021/01/14/vbox-escape.html).

The video game anti-cheat world has been playing this cat and mouse game for a while. A few months back I saw an interesting article [0] describing some of the detection methods being used. It's fascinating to think about how much effort gets put into this. [0] https://secret.club/2020/04/13/how-anti-cheats-detect-system-emulation…

The problem is that the rhetoric around this law from its promoters is that of an app ban, not a business sanction. And indeed, the app is being banned from Apple and Google's app stores despite it being free to download and use. The government currently lacks the ability to yank a binary from computing devices en masse, but the technology to do so is already mostly in place. (See Apple’s notarization escapades in the EU, for example. And I think Microsoft is working in a similar direction: https://secret.club/2021/06/28/windows11-tpms.html) I have a sickening feeling that this is only step one, and that the government will eventually mandate the ability to control and curate all software running on desktop and mobile devices within the country for “security” reasons. National security goons are salivating at the prospect, to say nothing of US corporations that are getting clobbered by foreign competitors.

The author seems misinformed about the purpose of TPM to DRM schemes. The purpose of a TPM, in this case, is not to provide encryption, but instead to provide so-called ‘authenticity’. A TPM with its attestation capabilities can allow a remote validator to attest the operating system and system software you are running via the PCRs which are configured based on it, with Secure Boot preventing tampering. [1] Google tried to implement APIs to plug this into the Chrome browser, which was later abandoned after backlash. [2] In this case, the TPM can allow services like Netflix or Hulu to validate the hardware and software you are currently running, which provides the base for a hardware DRM implementation as stated in the article. Don’t be surprised if your non-standard OS isn’t allowed to play back content due to its remote validation failing if this is implemented. TPMs also have a unique, cryptographically verifiable identifier that is burnt into the chip and can be read from software. This allows for essentially a unique ID for each computer that is not able to be forged, as it is signed by the TPM manufacturer (in most cases Intel/AMD as TPMs on consumer hardware are usually emulated on the CPUs TEE). If you were around for the Pentium III serial controversy, this is a very similar issue. It's already used as the primary method of banning users on certain online video games, but I wouldn’t be surprised to see it expand to services requiring it to prove you aren’t a “bot”…

The arguments in the article seem to be... problematic. > Unloading kernel drivers is as easy as stopping the registered service for them, which you can do by using the command sc stop <driver>. This of course relies on the fact that the driver has set its unload routine in kernel. And if it hasn't? That seems like a glaring issue, and good reason to be skeptical of installing kernel drivers willy-nilly. > Almost all commercial anti-cheat solutions, this includes BattlEye and Easy Anti Cheat, utilize kernel components to ensure the integrity of the user experience, but do not receive the same backlash as Vanguard. Both of those receive lots of backlash for the exact same reasons that Vanguard receives backlash. To my knowledge, Valve Anti-Cheat (VAC) requires no such kernel-level access (it definitely doesn't on Linux, judging by lsmod, but I can't attest to Windows since I haven't ran Steam on it in years) and still (last I checked) manages to be good enough. > I know that this goes against the current opinion that having a driver load on boot is bad, but if you want to prevent widespread hacking, this is exactly how you do it. Sure, until cheaters start running hypervisors and interfering with even in-kernel anti-cheat approaches. Sure, the vast majority of readily-available hypervisors (of the sort capable of running Windows) are trivial to detect (as secret.club's blog already describes:…

patched: https://hackerone.com/reports/470520 https://hackerone.com/reports/1070835 https://secret.club/2021/04/20/source-engine-rce-invite.html https://secret.club/2020/10/30/alien-swarm-rce.html https://threatpost.com/dark-souls-servers-down-rce-bug/177896/ https://blog.thalium.re/posts/achieving-remote-code-execution-in-steam… https://www.pcgamer.com/garrys-mod-cough-virus-is-cured-but-it-could-h… you can buy these games in their unpatched state today, and download a poc for them from github too: https://nvd.nist.gov/vuln/detail/CVE-2018-10718 https://nvd.nist.gov/vuln/detail/CVE-2018-20817 frankly playing video games on a dedicated device and network is the reasonable response to reading this shit