Lance R. Vick lrvick

PhysSec Shopping List

Need to get into a building? Start a police car? Borrow a bulldozer? Go to a restricted elevator floor? It is pretty easy with the right tools and sometimes a bit of practice.

Knowing what those tools even are is half the battle. This guide attempts to solve that for you for for free.

Actually obtaining these tools is non-trivial but -all- of them can be obtained

I know exactly what I want in a long term role so I can save us some time.

For me to be willing to change jobs at this point I would expect:

A high level of autonomy where I am allowed to work weird hours.
Have my obsession for auditable everything be humored/tolerated
- I prefer to work with open platforms like RISC-V and OpenPower and open operating systems like Linux, FreeBSD, OpenBSD, Sel4, etc
- I am never asked to rely on any software I can't audit on any of my personal or company devices.
No need to go find clients myself or worry about the business side of the house
Travel/lodging covered for the 2-3 security conferences I try to attend every year.

Distributed Trust Git Flow

Goals

Remove chance of undetected malicious or accidental mutations of code in VCS
The VCS and review tool servers as well as their maintainers must never be trusted.
We must be able to cryptographically prove
- Who authored all commits
- Who on engineering team signed the release candidate tag on a ref
Who on release team signed the release tag for a ref

Hardening Playbook

Threat profile

Attacker has unlimited funding
Attacker has decades of patience
Attacker knows everything you do and more
Attacker has no morals and can break any law
Attacker can compromise any single system
Attacker can compromise any single individual

Random Red Team

Summary

This document seeks to detail intentionally introducing security vulnerbilties into projects to test code review processes and foster a healthy and expected culture of distrust and higher security scrutiny during code reviews regardless of social standing, or experience level of the author.

Motivation

Git 2.11.0

$ git rev-parse HEAD
2e6215c920f384f958dc6dafcbaee5698c965657
$ git diff-tree -p "HEAD^"..HEAD | sha256sum
ae4fc1d2285ab6ac84cdd8ff6235f5534b6ded467dd8f586cbe1bfe885cc1afe  -
$ git diff-tree -p "HEAD^"..HEAD | git patch-id --stable
d9c0bf01265096e69f24b6e10d6c471f92d203c3 0000000000000000000000000000000000000000

	#!/bin/bash

	# Let GPG know about our current terminal
	gpg-connect-agent updatestartuptty /bye

	# Start compositor for faster rendering for terminals etc
	compton &

	# Set wallpaper
	nitrogen --set-scaled ~/.wallpaper/yourcoolwallpaper.jpg

	#include <NinjaKeyboard.h>

	void setup(){}

	void loop() {}

	void payloadA(){
	USBninjaOnline();
	NinjaKeyboard.begin();
	NinjaKeyboard.delay(1000);

	messages = (

	"This is the secret message one. It is the best one",
	"I am typing things to fill up space. La La La LA LAH LAH LAH LAH LAH",
	"Why are the ponies attacking my brain?! I DON'T KNOW!",
	"The chicken crossed the road in order to murder all of the babies",
	"I think the most evil thing is the chocolate on the road that kills",
	"There is a light above my head and it is bright and should die",
	"bunnies are cute and I want to squeeze them to DEATH",
	"All this talk about death is making me hungry. I should find food",