4 of mallace

Tool: transfer data through sound, including INAUDIBLE frequencies!

Use it here: chirp.hex.dance

Works offline, data not sent to any server: it’s an in-browser modem supporting frequencies between 18k and 19k Hz, which most humans can’t hear (but your cat can!)

Added encryption: Since sound is broadcast, how can i get only two devices to communicate?

You can now enter a pre-shared key on both ends.

Ofc the sound can be saved and key brute-forced, so 600,000 iterations of pbkdf2 to derive a 256-bit key make offline attack slower.

We’re witnessing an exponential surge in capabilities, and the pop cyber takes today are:

- phishing works
- don’t put it on the internet
- patch the cve

We have cyber superweapons, and an opportunity to contribute and harden? Best we can come up with is tepid takes that didn’t even work 20 years ago?

Your architecture should be secure by design, your identities should be defined with boundaries, your reviews should be automated, your patches auto-generated and vetted, all your alerts continuously monitored and tweaked, continuous threat modeling and verifying assumptions and reviewing identity-based access etc.

And all we can say is take it off the internet and patch the vuln and don’t click the link? 0 innovation

Does your hacking model NEED to know the year Zimbabwe experienced hyperinflation, or the nuance between Lebanese and Egyptian shawarma? At some point it’s detrimental?

“Attacker has to be right only once” take is so pedestrian.

Defenders have the opportunity to layer many different controls. In fact THEY have to be right only once, and the attacker has to never get caught.