- FOSDEM - lists.fosdem.org

Re: [FOSDEM] CfP for FOSDEM 2017 security devroom
by Siarhei Siniak 18 Nov '16

18 Nov '16

Hello, Nikos! In few words: I demonstrate half-finished exploit of outdated MITM vulnerability in PEAPv0,v1: https://github.com/nartes/hostap-mitm-mschapv2-peapv1 - intermediate code; http://eprint.iacr.org/2002/163/ - vulnerability description. It is based on hostap code. To tell the whole story: There is MITM vulnerability in PEAPv0,v1 if cryptobinding is disabled. 1) The earliest mentioning belongs to the paper "Man-in-the-Middle in Tunneled Authentication Protocols", November 11, 2002, http://eprint.iacr.org/2002/163/ 2) The following draft describes mentioned protocol "draft-josefsson-pppext-eap-tls-eap-05.txt", September 2002, https://tools.ietf.org/pdf/draft-josefsson-pppext-eap-tls-eap-05.txt 3) The following draft desribes the latest version, i.e. PEAPv2 "draft-josefsson-pppext-eap-tls-eap-10.txt", 15 October 2004, https://tools.ietf.org/pdf/draft-josefsson-pppext-eap-tls-eap-10.txt 4) The key differences in respect to the vulnerability is the following: [2] (*10.txt, page10) As a result, where the NAS acts as a "passthrough" it does not have knowledge of the TLS master secret derived between the peer and the EAP server. In order to provide keying material for link-layer ciphersuites, the NAS obtains the master session key, which is derived from a one-way function of the TLS master secret as well as keying material provided by EAP methods protected within a TLS channel. This enables the NAS and EAP peer to subsequently derive transient session keys suitable for encrypting, authenticating and integrity protecting session data. However, the NAS cannot decrypt the PEAPv2 conversation or spoof session resumption, since this requires knowledge of the TLS master secret. [3] (*05.txt, page3) As a result, the NAS does not have knowledge of the TLS master secret derived between the EAP Peer and the backend authentication server, and cannot decrypt the PEAP conversation. In order to providing keying material for link-layer ciphersuites however, the NAS does obtain the master session keys, which are derived from the TLS master secret via a one-way function. In the [2], they added as well as keying material provided by EAP methods protected within a TLS channel. 5) The key idea is the absence of cryptobinding in [2] draft. And if the client doesn't verify cert of the server, then MITM behaviour allows to crack TLS, and proxy any internal Eap Authentication Protocol between the victim and the real server. It works only for those protocols who are unaware of being tunneled within TLS by PEAP. MSCHAPv2 is an example of such a one. 6) The following Presentation from Shmoocon2008 describes cracking of the TLS, then gathering password hashes, and their consequent bruteforcing with the help of asleap utility. http://www.willhackforsushi.com/presentations/PEAP_Shmoocon2008_Wright_Anto… But that's not the exact MITM with Proxying MSCHAPv2. It's just MITM and cracking collected passwords. 7.0) hostap implementation of PEAP protocol corresponds to [3] in many things. Particularly, if the cryptobinding is enabled, then the exploit doesn't work. The absence of server's cert verification doesn't help here. But still allows to obtain [1] behaviour. And to utilize the exploit we need the following casese: * Server: PEAPv1, Client: PEAPv1, Cryptobinding (on both sides): Any * Server: PEAPv0, Client: PEAPv1, or Server: PEAPv1, Client: PEAPv0, CryptobindingServer: NO_CRYPTOBINDING, CryptobindingClient: OPTIONAL or NO_CRYPTOBINDING The default config in hostap is: Server: PEAPv0, Client: PEAPv0 (but setting it to PEAPv1 will result in downgrading to the same PEAPv0, unless the client asks to force PEAPv1 with peapver=1) CryptobindingServer: OPTIONAL CryptobindingServer: CRYPTOBINDING The most interesting is that the server intiates cryptobinding. And having the client OPTIONAL value, doesn't raise any exception if the server has NO_CRYPTOBDING. 7.3) hostap project has the following option -DCONFIG_TESTING_OPTIONS which easily prints any incoming hashes as asleap command. That utility was used in Shmoocon2008 presentation [6]. I verified the option for MSCHAPv2 at least. 8) I decided to implement the exploit according to [1]. Here is the intermediate result: https://github.com/nartes/hostap-mitm-mschapv2-peapv1 I've implemented some kind of MITM protocol which is communicated between MITM Eap Peer and Eap Server. It carries all required information for proxying MSCHAPv2 packets between victim's Eap Peer and real Eap Server. To see what happens, run the follwing: $ git clone https://github.com/nartes/hostap-mitm-mschapv2-peapv1 $ cd hostap-mitm-mschapv2-peapv1/eap_example $ make eap_example $ ./eap_example | less Look for the 'MITM:' messages, they display actions of the attacker. To see default behaviour of eap_example: $ git checkout master $ make $ ./eap_example | less 9) I tried in [8] to do such patches, that are easily portable to hostapd and wpa_supplicant from eap_example. And keeping in mind that Linux and Android in particular are all using this software. There are many examples of real life server even now. And there are still those people who doesn't care for cert verification. Thus they are still under the risk. 10) I hope that commits' messages are informative. best regards, Siarhei Siniak

1 0

Submission deadline extended for SDN & NFV DevRoom: Nov 28th
by Dave Neary 17 Nov '16

17 Nov '16

Hi all, We are extending the deadline for the SDN and NFV DevRoom to get some more diversity in the submissions until November 28th 2016. The call for content is here: https://blogs.gnome.org/bolsh/2016/10/19/fosdem-sdn-nfv-devroom-call-for-co… And you can make a submission here: https://penta.fosdem.org/submission/FOSDEM17 Thank you! Dave. -- Dave Neary - NFV/SDN Community Strategy Open Source and Standards, Red Hat - http://community.redhat.com Ph: +1-978-399-2182 / Cell: +1-978-799-3338

1 0

[CFP] reminder! FOSDEM RTC dev-room talks: deadline tomorrow
by FOSDEM RTC Team 16 Nov '16

16 Nov '16

Reminder: speaker's deadline tomorrow, 17 November at 23:59 UTC The Free RTC dev-room has already received some really exciting talk proposals but there is still time for people to propose talks or encourage friends or colleagues to speak. Many other dev-rooms also have a deadline in the next few days and if your topic is applicable to more than one dev-room, you are welcome to make more than one submission. Please contact us or put a note in the memo field at the top of the talk proposal if you do that. All projects are encouraged to consider making a lightning talk too, it is an excellent opportunity to get exposure for your project: even though you only have 15 minutes, it can be a much larger and more diverse audience than in some dev-rooms. For full details, please see the original call for participation: https://danielpocock.com/fosdem-2017-rtc-cfp We invite all potential speakers and participants to discuss the selection process and other aspects of FOSDEM on the Free-RTC mailing list: https://lists.fsfe.org/mailman/listinfo/free-rtc

1 0

PHP & Friends devroom CfP
by Wim Godden 06 Nov '16

06 Nov '16

Hi, After having a very succesfull PHP & Friends devroom in 2013, 2015 and 2016, we're back in 2017 for another edition. As usual, we've opened up our Call for Papers (CfP). To submit your talk(s), go to https://fosdemphp.cu.be/ CfP closes November 26, sessions will be announced by December 20.

1 0

Decentralised Internet devroom - CFP
by Julien Rabier 06 Nov '16

06 Nov '16

Hi fellow hackers, Open Source and Free Software initial promises were to empower individuals when it came to computing. Three decades later, computing is almost always connected to the Internet one way or another. PCs are less and less used while smartphones are soaring and data is collected and stored on servers on which we have very limited control as users. What happened to our freedom and empowerment in the meantime? The outlook is not so great: we have less and less control over our digital environment. Network Neutrality is in danger and most code we use is proprietary and runs on servers we don't have control over. Fortunately, FOSDEM 2017 will host a "Decentralised Internet" devroom \o/ We invite projects/individual working around these issues/topics to submit proposals according to this schedule: CFP DEADLINE: 04 December 2016 SPEAKERS NOTIFIED: 11 December 2016 All submissions are to be made in Pentabarf : https://penta.fosdem.org/submission/FOSDEM17 When submitting your talk in Pentabarf, make sure to select the "Decentralised Internet" devroom as the Track. Of course, if you already have a user account, please reuse it. Topics could include all layers of the stack, from network, hardware, OS, platform, apps and services: * Community-driven networks, DIY access providers, * Self-hosting software and distributions, * Software aimed at keeping control over personal data, * Community-hosted alternatives to GAFA * … If you have any questions, please send an e-mail to fosdem2017(a)lists.ffdn.org. See you soon in Brussels! taziden, for the Decentralised Internet devroom orgs.

1 0

Open Media devroom FOSDEM 2017 - Call For Participation
by Christophe Massiot 04 Nov '16

04 Nov '16

Hi all, Following a successful Open Media room at FOSDEM 2015 and 2016, we are organizing another Open Media room at FOSDEM 2017, and we are looking for propositions of talks and panels. FOSDEM is one of the largest (5,000+ hackers!) gatherings of Free Software contributors in the world and happens each February in Brussels (Belgium, Europe). This year, the Open Media devroom will take place on: Sunday, February 5th, 2017. # About the Open Media devroom The Open Media room will focus on all Free & Open Source media projects, including software and hardware, spanning from building audio & video applications, through standards, formats, codecs, video analytics and search to Web video, IPTV, broadcasting and radio practices and much more. If you're interested in video, image or audio technologies, and the breadth of available open source technologies and communities for media - the Open Media room is for you! For more information about the previous year sessions: https://archive.fosdem.org/2016/schedule/track/open_media/ <https://archive.fosdem.org/2016/schedule/track/open_media/> # CFP Guidelines The deadline for submission is: December 1st 2016 (Thursday). * To submit your proposal, visit: https://penta.fosdem.org/submission/FOSDEM17 <https://penta.fosdem.org/submission/FOSDEM17> * A typical presentation will last for up to 20 minutes, with an additional 5 minutes Q&A and 5 minutes for speaker switching/prep in between. Panel discussions may last up to 35 minutes. (Feel free to ask if you want to have a longer or a shorter slot.) IMPORTANT: Please make sure to select **”Open Media devroom”** track for your submission. * You will need to create an account (or use your account from previous years) and then go to "create event”, and add the details of your presentation. * Selected talks will be notified by December 11th 2016. * All sessions will be recorded and be made available under CC-BY licence by FOSDEM at https://video.fosdem.org/ <https://video.fosdem.org/> . # Your submission must include the following information * The title and subtitle of your talk (please be descriptive). * select **”Open Media devroom”** as the track. * 1 paragraph detailing what the talk will discuss, and why attendees should attend it. * A longer description if you have more details to share. * Links to related material/websites/blogs etc. # Community The official communication channel is the Open Media devroom mailinglist. Join the list at: https://lists.fosdem.org/listinfo/open-media-devroom <https://lists.fosdem.org/listinfo/open-media-devroom> You may also be interested in joining the Open Source community from the European Broadcasting Union on: https://tech.ebu.ch/groups/opensource <https://tech.ebu.ch/groups/opensource> And please don't hesitate to contact us for more information! Christophe, Adi, Frans and Kieran, On behalf of the Open Media devroom.

1 0

Free Java DevRoom @ FOSDEM CFP now open
by Mario Torre 25 Oct '16

25 Oct '16

We are pleased to announce the Call for Participation in the FOSDEM 2017 Free Java DevRoom! This year FOSDEM Free Java DevRoom will take place during one day between the 4th and 5th February 2017 in Brussels [1], Belgium, with the usual events and meetings surrounding the main show on Friday, Saturday and Sunday; please, refer to the FOSDEM website for the schedule of the whole event: https://fosdem.org/2017/ The Free Java DevRoom has become unique in that it has attracted hackers from very different Free Software Java projects, giving the opportunity to bring together companies of various sizes, different project communities, mainstream core Java developers, alternative Java language implementations and runtimes, and everything that form the Free Java Universe, everybody participating to share their knowledge in an atmosphere of cooperation and friendly competition. The Java Community has never been more vibrant than now, and the final preparations of Java 9 with Jigsaw are bringing in more contributions and interesting discussions. A Java 10 project has also just been proposed, those are exciting times! Every piece of the puzzle seems to be falling "in its right place", so, what better opportunity to come and share your experiences than the Java Dev Room at FOSDEM!? As always, check out our wiki for more details on the conference: https://wiki.debian.org/Java/DevJam/2017/Fosdem And join the Free Java DevoRoom mailing list: https://lists.fosdem.org/listinfo/java-devroom *** IMPORTANT *** Fosdem organisers have expressed the desire to record and stream everything, and we will do our best to ensure this is respected. We will use the same format as last year, so please submit one (or more) 25 minute talk proposal(s) by the 1st of December 2016, 23.59 CET on the mailing list. If your speech requires more time, and it's of a general importance to warrant that, please state so in the description. A template for submitting a talk can be found at: http://wiki.debian.org/Java/DevJam/2017/Fosdem/CallForParticipation Tracks will be announced around 10th of December on the mailing list. Please join us! --The Free Java DevRoom Committee [1] Please, refer to the website for the exact day of the Free Java DevRoom. -- pgp key: http://subkeys.pgp.net/ PGP Key ID: 80F240CF Fingerprint: BA39 9666 94EC 8B73 27FA FC7C 4086 63E3 80F2 40CF Java Champion - Blog: http://neugens.wordpress.com - Twitter: @neugens Proud GNU Classpath developer: http://www.classpath.org/ OpenJDK: http://openjdk.java.net/projects/caciocavallo/ Please, support open standards: http://endsoftpatents.org/

3 2

[CFP] FOSDEM 2017 - Testing/Automation Devroom
by R. Tyler Croy 24 Oct '16

24 Oct '16

This is the fifth year for the Testing/Automation dev room at [FOSDEM](https://fosdem.org/2016). This room is about creating better software through a focus on testing and automation at all layers of the stack. From creating libraries and end-user applications all the way down to packaging, distribution and deployment. Testing and automation is not isolated to a single toolchain, language or platform, there is much to learn and share regardless of background! # What Since this is the fifth year we're hosting the Testing and Automation dev room, here are some ideas of what we would like to see, and what worked in prior years, they're just ideas though! Check out the [2013](https://archive.fosdem.org/2013/schedule/track/testing_and_automation…, [2014](https://archive.fosdem.org/2014/schedule/track/testing_and_automation…, [2015](https://archive.fosdem.org/2015/schedule/track/testing_and_automation…, [2016](https://archive.fosdem.org/2016/schedule/track/testing_and_automation… schedules for inspiration. ### Testing in the real, open source world * War stories/strategies for testing large scale or complex projects * Tools that extend the ability to test low-level code * Projects that are introducing new/interesting ways of testing "systems" ### Cool Tools (good candidates for lightning talks) * Explain/demo how your open source tool made developing quality software better * Combining projects/plugins/tools to build amazing things "Not enough people in the open source community know how to use $X, but here's a tutorial on how to use $X to make your project better." # Where FOSDEM is hosted at [Université libre de Bruxelles in Brussels, Belgium](https://fosdem.org/2016/practical/transportation/). The Testing and Automation dev room is likely slated for Building H, room 2213, which seats ~100. # When * CFP Submission Deadline: **23:59 UTC, 15 December 2016** * Schedule Announced: **20 December 2016** * Presentations: **5 February 2017** # How Please submit one (or more) 30-40 minute talk proposal(s) OR one (or more) 10 minute lightning talk proposal(s) by **23:59 UTC on November 30th 2015**. We will notify all those submitting proposals about their acceptance by December 20th 2016. To submit a talk proposal (you can submit multiple proposals if you'd like) with [Pentabarf](https://penta.fosdem.org/submission/FOSDEM16), the FOSDEM paper submission system. Be sure to select `Testing and Automation` otherwise we won't see it! You can create an account, or use an existing account if you already have one. Please note: FOSDEM is a [FLOSS](https://en.wikipedia.org/wiki/Free_and_open-source_software) community event, by and for the community, please ensure your topic is appropriate (i.e. this isn't the right forum for commercial product presentations) # Who * [R. Tyler Croy](https://github.com/rtyler) - JRuby/Jenkins hacker * [Jeff Weiss](https://github.com/jeffweiss) - Process automation developer For more/update-to-date information, please see https://fosdem-testingautomation.github.io - R. Tyler Croy ------------------------------------------------------ Code: <https://github.com/rtyler> Chatter: <https://twitter.com/agentdero> % gpg --keyserver keys.gnupg.net --recv-key 1426C7DC3F51E16F ------------------------------------------------------

1 0

Go devroom Call for Proposals
by Luna Duclos 24 Oct '16

24 Oct '16

Original post: https://forum.golangbridge.org/t/fosdem-2017-call-for-proposals/3716 The past three years there has been a Go room at FOSDEM, it's been a huge success so far, hence, it's happening again this year. The format of 20-30 minute talks has been fairly successful the past, hence I see no reason to want to change it and we'll be going for the same format again. Please submit talks at https://penta.fosdem.org/submission/FOSDEM17 The deadline for submissions is the 12th of December. If you have an account from last year, you can reuse it. We'll also need volunteers to help manage the room and the cameras, please reply here if you'd like to help out. I'm very open to suggestions about changes in the format, requests for a specific talk or any other topic, please just reply here. The Go devroom will be taking on the community code of conduct throughout, anyone found in breach will be warned or may be asked to leave (depending on severity) The CoC can be found at https://golang.org/conduct Kr, Luna Duclos

2 1

CFP for Mozilla Devroom
by Francisco Picolini 24 Oct '16

24 Oct '16

Hello everyone, We have published our call for papers in our Discourse platform: https://discourse.mozilla-community.org/t/fosdem-2017-call-for-papers-talks… Below the whole message: *This is a call for all mozillians (staff and volunteers) to propose your talks for FOSDEM.* If you want, you can propose a talk for the other dev-rooms in pentabarf <https://penta.fosdem.org/submission>. *The topics that we want to cover for this next edition are*: * Rust/Servo * Privacy tools * Diversity & Inclusion * IoT/Connected Devices * WebVR * WebCompat * Addons * Firefox for Android / iOS * HTML5 games * Firefox However, we will accept any other topic, but ideally these are the suggested ones. *Important Information* Duration of the talks: 30 minutes including Q&A Deadline: December 1st. Acceptance notifications: December 15th. Presentations will be recorded and streamed, so sending your proposal it will imply that you accept and give permission for this. Note that recording will be published under the same license as all FOSDEM content (cc-by), however, exceptions could be requested. To submit your proposal, visit : https://penta.fosdem.org/submission If you have previously sent a proposal for FOSDEM, you should probably have a pentabarf account. So we kindly suggest you to not create a new one. If you forgot your password, please reset it. If this is your first time using pentabarf, go ahead and create an account. After you have your account configured (you will receive a confirmation email), create the event, and click on "Show all" in the top right corner to display the full form. When submitting your talk in pentabarf, make sure to select "Mozilla DevRoom" as track, and include the following information: * The title and subtitle of your talk * A short abstract of one paragraph * A longer description if you wish to do so * Links to related websites/blogs etc All contributors who will be selected for a talk, will be sponsored for travel and accommodation. Regards, -- Francisco Picolini Community Events Coordinator @MozParticipate

1 0