Editing 1808: Hacking

{{comic
| number    = 1808
| date      = March 8, 2017
| title     = Hacking
| image     = hacking.png
| titletext = The dump also contains a list of millions of prime factors, a 0-day Tamagotchi exploit, and a technique for getting gcc and bash to execute arbitrary code.
}}

==Explanation==
{{incomplete|Seems pretty complete now. NO, too much trivia and the puns are not proper covered.}}
This comic is referencing an incident on the day before this comic was released, March 7, 2017, in which {{w|WikiLeaks}} exposed thousands of hacking exploits (thus the title) and programs from the {{w|CIA}} (see for instance this article: [https://www.wired.com/2017/03/wikileaks-cia-hacks-dump/ WikiLeaks Just Dumped a Mega-Trove of CIA Hacking Secrets]). Many of the tools that were in the leak were similar to publicly available tools, or not entirely unexpected, with several coming from sites such as {{w|StackOverflow}} and {{w|Reddit}}.

The main joke in this comic refers to the common practice of adding spaces between parts of an email address when publishing them on websites.  For example, "john.doe@example.org" may be written as "john dot doe at example dot org".  The purported goal of doing this is to thwart page scraping bots from {{w|Email address harvesting|harvesting the correct email addresses}} and prevent them from becoming the target of spam or being sold as address lists for email marketers.  

In this comic, [[Ponytail]] tells [[Cueball]] that CIA have a tool which can delete such spaces. Such a tool can fix the space and most likely convert the words "dot" and "at" into their respective symbols. This will overcome the problems faced by harvesting tools, and make these email addresses more prone to receive spam. 

Cueball appears shocked to hear this news, but given the caption below, stating that this was one of the ''less dramatic revelations'' from the CIA hacking dump, this is likely sarcasm by Cueball (and [[Randall]]). In fact, it is quite simple to devise a program which detects and converts/removes such spaces; it's naive to believe that one can prevent e-mail addresses from being harvested just by writing the addresses with space or omitting @ etc.

The title text lists three other undramatic (fictitious) hacking exploits which sound more interesting, but are still more or less useless, and certainly not dramatic news. They are:
#Millions of {{w|prime factors}}: The security of the {{w|RSA (cryptosystem)|RSA cipher}} relies on the difficulty of finding prime factors for a large number. Successfully calculating or stealing a prime factor used in a RSA cipher would allow an attacker to decrypt messages and impersonate the true user.  
#*However, this description doesn't specify whether those "millions of prime factors" were actually used in any ciphers.  Random prime factors are very easy to find but the chances of one matching a number used in a cipher is almost nonexistent.  Thus simply possessing a list of many prime factors would not necessarily be useful at all. 
#*That said, some key generation systems have been shown to re-use prime factors with catastrophic impacts [https://eprint.iacr.org/2012/064.pdf 1] [https://eprint.iacr.org/2016/961.pdf 2] [https://arstechnica.com/security/2016/10/how-the-nsa-could-put-undetectable-trapdoors-in-millions-of-crypto-keys/ 3] so this could be a reference to a list of known shared primes.
#A {{w|0-day exploit}} for {{w|Tamagotchi}}: A 0-day exploit is an exploit of which the manufacturer is not (yet) aware. 0-days are very valuable to hackers since defenses against them have not yet been developed, which makes it easy to catch victims off-guard. 
#*However, an exploit for a Tamagotchi is likely useless because they are very low-end entertainment devices that do not contain microphones or cameras, and usually don't have access to any valuable information that can be stolen.  Modern Tamagotchi devices do have some network functionality, and so may be turned into a botnet.
#A way to get {{w|GNU_Compiler_Collection|gcc}} and {{w|Bash_(Unix_shell)|bash}} to execute arbitrary code: Unintentional execution of arbitrary code is serious vulnerability that allows attackers to do whatever they choose on a victim's computer. However the examples given here merely describe the intended purpose of the tools: gcc is a {{w|compiler}}, so preparing arbitrary code is its main purpose, and bash is a Unix shell, so executing {{w|Shell script|arbitrary code}} is one of its primary functions. 
#*These tools are typically isolated from any attack surface that hackers can access, and utilizing these tools for their intended purpose can't reasonably be called "hacking". 
#*Then again, this could be a reference to {{w|Shellshock_(software_bug)|ShellShock}}, a major vulnerability which allowed the unintentional execution of arbitrary attacker code. Likewise, it could be referring to a [http://wiki.c2.com/?TheKenThompsonHack compiler injection attack] which allows a compiler to inject backdoors via the binary executables in a toolchain and without leaving a trace in the source code being compiled or the compiler itself.
#*Actually... arbitrary code execution in gcc would be rather severe. gcc is expected to prepare executables for execution, _not_ run them, and some people (Intel compile robot listening on linux kernel mailing list) automatically compile code other people post. Arbitrary code execution in bash would be less severe, but still worth fixing.

==Transcript==
:[Ponytail is writing on her laptop at her desk while Cueball looks over her shoulder.]
:Ponytail: You know how sometimes people put a space in their email address to make it harder to harvest?
:Cueball: Yeah?
:Ponytail: ''They have a tool that can delete the space!''
:Cueball: Oh my god.

:[Caption below the panel:]
:Less-dramatic revelations from the CIA hacking dump

==Trivia==
*This is the second comic in a row about how computers can be misused and also the second in a row where Cueball is with Ponytail rather than [[Megan]]. 
**This setup with Ponytail at the computer and Cueball behind has been used several times for instance in [[1513: Code Quality]], part of the [[:Category:Code Quality|Code Quality]] series.

{{comic discussion}}

[[Category:Comics featuring Cueball]]
[[Category:Comics featuring Ponytail]]
[[Category:Comics featuring Cueball]]
[[Category:Computers]]
[[Category:Cryptography]] <!-- Title text on prime numbers related to that -->