david wong

Hey ! I'm David, a security consultant at Cryptography Services, the crypto team of NCC Group . This is my blog about cryptography and security and other related topics that I find interesting.

Procrastination April 2014


I've read a LOT of stuff about procrastination. I have techniques:

I think those are all my techniques, I can't really think of any others.

2 Ideas

A few months ago I started counting my calories intake, and I lost weight! It's magic. As soon as you start counting the bad stuff, you realize how much you're doing of it. I've had this idea for quite a long time, a slack counter, that times how long you slack per day. It compares that to the average. I don't know how to implement that, but a cellphone app would be the best suited I think. We always carry it, so we just have to launch the app and start a timer when we procrastinate. This + a firefox/chrome app that recognizes websites that are "time consumer" to add to your statistics. I'm sure that would help me work more!

When I'm really in trouble, and I can't seem to get motivated, I always take my iPod out and start a 30 minute timer. I do that, and then I find something to work on, anything, and I don't have to be efficient or know right away how I'm gonna work on it. I just have to do it, non-stop, to focus for just 30 minutes. And when the timer stops, I'm usually motivated enough to either keep going, or take a small break and start a bigger timer. I had the idea of implementing a 30 minute timer + a chain system, everyday you can start this 30 minute timer once and if you do work non-stop for 30 minutes while it runs, you will validate a day. Try validating the most days in a row!

Other techniques ?

This article brings 3 good points:

There are two ways to look at any task. You can do something because you see it as a way to end up better off than you are now – as an achievement or accomplishment. As in, if I complete this project successfully I will impress my boss, or if I work out regularly I will look amazing. Psychologists call this a promotion focus

when we say things like “I just can’t get out of bed early in the morning, “ or “I just can’t get myself to exercise,” what we really mean is that we can’t get ourselves to feel like doing these things.

Making an if-then plan is more than just deciding what specific steps you need to take to complete a project – it’s also deciding where and when you will take them.
If it is 2pm, then I will stop what I’m doing and start work on the report Bob asked for.

You have to let go

This article helped/helps me a lot. Every time I fall into a procrastination period (because it's a disease you'll have to live with for the rest of your life :D), I read that article.

I hadn’t figured out the skill that would save me from the procrastination.
Until I learned about letting go.

Learn from the pro

Katia Verresen is a "Mental Energy coach" for CEOs and founders. Here's a nice article about her and interesting stuff she has to say about being efficient, in the zone.

Verresen is a big fan of a tactic called “calendar blocking,” and she encourages her clients to identify the chunks of time on their calendars when they have the most physical energy for work.

The mood you wake up in is critical. Consider it to be the default font for your entire day.

For a marathon runner, people say that the day before and the day before that are the most important. If you mess up with your sleep one day, you'll feel the consequences until two days after.

Verresen actually tells her clients that if they haven’t gotten enough sleep, they shouldn’t take their emotions seriously the next day.

“Mental energy is the ability to separate yourself from your thoughts,” Verresen says. “Everyday, we have millions of thoughts that cause stress, anxiety, depression — that can stall you out in a million different ways — but you don’t have to believe them.”

“The best way to reset your mental energy is to get it up and out into the physical world,” Verresen says. “Screens don’t count. You should put whatever it is that’s bothering you or that you need to get done up on a white board. Write it down and stick it up on a wall.

I sometime stop what I'm doing to do the dishes. It clears my mind.

Verresen advises her clients to block off two slots ranging between 90 minutes to 2 hours every week as mental white space. They need to literally put it on their calendar and make sure they aren’t interrupted or disturbed during this time — ideally they shouldn’t have meetings right afterwards either.

I do this by doing my laundry. I take a paper and a pen with me and I go do my laundry for an hour.

comment on this story

Gröbner basis on numb3rs April 2014

It doesn't seem to be the only appearance of the Gröbner basis on the show:

In the Season 4 opening episode 'Trust Metric' (2007) of the television crime drama NUMB3RS, math genius Charlie Eppes mentions that he used Gröbner bases in an attempt to derive an equation describing friendship.

From wolfram alpha

comment on this story

An awesome explanation of the Fourier Transform April 2014

I've run into this über cool explanation of the Fourier Transform thanks to mtodd's blog

Here's a bit from the introduction:

What does the Fourier Transform do? Given a smoothie, it finds the recipe.
How? Run the smoothie through filters to extract each ingredient.
Why? Recipes are easier to analyze, compare, and modify than the smoothie itself.
How do we get the smoothie back? Blend the ingredients.

And cool examples of what can be done with the Fourier Transform:

  • If earthquake vibrations can be separated into "ingredients" (vibrations of different speeds & strengths), buildings can be designed to avoid interacting with the strongest ones.
  • If sound waves can be separated into ingredients (bass and treble frequencies), we can boost the parts we care about, and hide the ones we don't. The crackle of random noise can be removed. Maybe similar "sound recipes" can be compared (music recognition services compare recipes, not the raw audio clips).
  • If computer data can be represented with oscillating patterns, perhaps the least-important ones can be ignored. This "lossy compression" can drastically shrink file sizes (and why JPEG and MP3 files are much smaller than raw .bmp or .wav files).
  • If a radio wave is our signal, we can use filters to listen to a particular channel. In the smoothie world, imagine each person paid attention to a different ingredient: Adam looks for apples, Bob looks for bananas, and Charlie gets cauliflower (sorry bud).
comment on this story

Diffie-Hellman, ElGamal and RSA April 2014

I'm in holidays for a week, easter I think, anyway, I didn't know what to do so I coded the Diffie-Hellman handshake, the ElGamal cryptosystem and the RSA cryptosystem in python.

You can check the code on github here: github.com/mimoo/crypto_studies

Check the tests.py file to see how the classes are used. Here's an extract:

"""Testing Diffie Hellman
# 1. BOB
bob = DiffieHellman()
# G and g are generated automatically
print("G is a group mod %i and of order %i, and the generator g is %i" % (bob.G[0], bob.G[1], bob.g))
# We generate a secret and a public key

# 2. ALICE
# We already know G and g
alice = DiffieHellman(bob.G, bob.g)
# We generate the secret key and the public key

# Bob and Alice now have the same _sharedkey and the same public (G, g)

As the README says, it might be oversimplified and not totally correct. I mostly did that to do something in Python and also try to memorize how those systems work.

I've also done a lot of Unity this week-end. And also a bit of WxPython but I don't really like it. I think I should focus on QT and C++.

comment on this story

How hard is it to find an internship? April 2014

I've been looking for a summer internship and I haven't really found anything sor far. Although I've had some interviews with some start ups from the Silicon Valley (including TrueVault that really seemed like a good fit for a cryptographer in progress like me :D). But I've been unlucky so far since they're pretty busy, it's demo day-time for those applying to ycombinator there.

Anyway I still have 4 months of holidays this summer and I'm wondering what I'll do if I can't find anything in Mountain View (n_n I really want to go there).

If you know someone, or are interested in a passionate coder and eager learner, you can take a look at my resume here and rush to contact me before someone else does :)

Otherwise I'll spend more time coding personal projects and writing this summer (by the way, Korben, a famous influential blogger in France has written about me and my application 3pages.fr in a blog post. Huge amount of traffic in a few hours, 600 people signing up in a day. I envy his traffic.)


comment on this story

How good is flask? April 2014

I've used Django for my last project and I found the documentation unclear and the list of things I had to do to code simple things and deploy were... a bit too much for a simple project.

I've glanced at the Flask documentation and have found it über-clear. The syntax seems to be pretty straight-forward as well. I'm really thinking about learning Flask for my next project and putting Django on hold. What do you guys think?

There's also a talk on web2py in the current PyCon. I don't know if it's for me but I really need something I can do quick prototypes on.

Sometimes I wonder if I should go back to PHP and try the new Laravel that really looks super cool :)


comment on this story

NAT with iptables : super fast tutorial April 2014

So I know how to use iptables, I know what a NAT is, but I don't want to learn how to exactly do it. Misery... I have to learn how to do it because I have an exam that will probably ask me how to do it in a few days. So I've been looking for a super simple tutorial, a 1 minute tutorial, on how to setup a NAT configuration with iptables in 1 minute. Couldn't really find it so here it is, if this is somewhat useful for someone, you're welcome.

First Step

For NAT to work, you have to allow forwarding on your server. Easy peasy:

$ echo 1 > /proc/sys/net/ipv4/ip_forward 

Also, before adding new iptables rules, be sure to check what rules you already have

$ iptables -L

you should allow some forwarding for it to work (if the policy is default to DROP). But this not a tutorial about iptables.


I have a server with:

  • eth0 connected to the network

  • eth1 connected to internet

Let's modify the PREROUTING part. Traffic coming from internet on our public address (@pub) and trying to reach our machine:

$ iptables -t nat -A PREROUTING -d @pub -i eth0 -j DNAT --to-destination @priv

Let's modify the table nat, append a rule to the pretrouting section : something is trying to reach @pub ? Let's put it in our input interface eth0, jump to the Destination Nat protocol, which tells us to send the packet to @priv.

Now Let's modify the POSTROUTING part. Traffic coming from inside our network and trying to reach something, somewhere on internet:

$ iptables -t nat -A POSTROUTING -s @priv -o eth1 -j SNAT --to-source @pub

If the packet is coming from @priv, let's put it on our output interface eth1 and jump to the Source Nat Protocol that will modify the packet so it has the public address (@pub) as source.

Here! You did it. One private IP address mapped to one public IP address.


Same kind of configuration but now we have several private addresses and only one public address.

$ iptables -t nat -A POSTROUTING -s @priv/mask -j MASQUERADE

We can modify every packets coming from the subnetwork @priv to get masqueraded.

$ iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Or we can just tell all the network to get masqueraded.

And this is it. No PREROUTING Needed.

Again, you're welcome ;)

comments (2)

So... The Heartbleed Challenge has been completed April 2014

A few hours after the start of the Heartbleed challenge, actually, just 3 hours after the start of the Heartbleed challenge. Fedor Indutny seems to have cracked it.

So now, chaos begins. If you own a certificate, you not only have to change it, but you also have to revoke it. I wonder how many will change, and how many will revoke.

You can check that he indeed did it by doing this:

Just to confirm it: put this into your /etc/hosts “ http://www.cloudflarechallenge.com ” and visit “https://www.cloudflarechallenge.com/ “.

here why it works:

Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name.
Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning.
Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.

The Cloudflare team reviewing the attack:


comment on this story

NSA was not aware of the Heartbleed bug April 2014

NSA is not happy. NSA is tweeting, tumblring (is this a verb?) and shouting loud and for all of who wants to hear it : they didn't know about the Heartbleed bug.

by the way they're talking about a "zero day" vulnerability, and now is a good time to learn what it is:

a so-called “Zero day” vulnerability because the developers of the vulnerable software have had zero days to fix it

I'm akin to trust them since... well. So many US websites were using OpenSSL and... it's not really nice if someone else eavesdrop on american citizen...

Anyway, this shows that the NSA has a long way to build trust again.

comment on this story

Bordeaux, one more list April 2014

I don't write enough in the "Life in Bordeaux" section of this blog. So, here I am, trying to write something.

What can I tell you about Bordeaux ?


I ***** love Bordeaux. I love its student life, I love how practical it is for me to see my friends, I really like my campus especially that building with all those free-access computers with double screens and everything already setup on them.

I don't really like the weather though, it's raining quite often, I'd say at least once a week, but when it shines, it shines.

The public transport is the worse part of the city. There is no subway and trams are always PACKED. And when I say packed I mean "you will miss 5 trams in a row because you can't get in" packed. And I have to commute, every day... but I'll survive, it's not Paris and its awful subway :) far from that.

my appartment

The streets are dirty, my apartment is crappy, really, but it's okay, I'm moving in June, hopefully to a better place. Still have to find a new place though, and looking for a place in Bordeaux is HARSH. I shiver just thinking about it.


Girls are pretty :o) and there are many girls. Bad thing is that my part of the campus is full of guys (and sometimes its hard to tell).

I don't know what else I could say. I like it better than Lyon, way better than Hamilton in Ontario, way way better than Paris. It lacks the feeling of "full of opportunities" that Beijing has though. But the air is breathable at least =) so yeah. Later in my life, I will consider settling in Bordeaux. Why not?

comment on this story

Exams April 2014

We've been a group of 4-5 students spending each nights at the Crémi these few last days, this building of three floors where each floor has around 10 rooms full of computers.

We work, we eat, we play, and we crash each other computers.

There are a bunch of games installed on every computers but we mostly play SauerBraten, a quake-like.


My 15-year-old self would have spent most of his days here playing, if only he knew that his future campus would have such a sacred place :)

How do we crash each other computer? We just ssh into their machine and launch a fork bomb:

 :(){ :|:& };:

It operates by defining a function called ':', which calls itself twice, once in the foreground and once in the background.

comment on this story

The Heartbleed Challenge April 2014

Cloudflare's engineers have set up a server vulnerable to Heartbleed, if you find the secret SSL keys and publish your solution you'll get 10,000$. The challenge is here and there's a blog post here.

an attacker can get up to 64kB of the server’s working memory. This is the result of a classic implementation bug known as a Buffer over-read

Apparently it is not known if it is possible or not to find those keys. If it appears to be possible the results would be catastrophic as every single website that has used OpenSSL would have to revoke and ask for a new certificate. And as Cloudflare says:

the certificate revocation process is far from perfect and was never built for revocation at mass scale.

So it would then be very easy for any server to pretend they're someone else.

A heartbeat is a message that is sent to the server just so the server can send it back. This lets a client know that the server is still connected and listening. The heartbleed bug was a mistake in the implementation of the response to a heartbeat message.

This is the code in question:

p = &s->s3->rrec.data[0]


hbtype = *p++;
n2s(p, payload); 
pl = p;


buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;


memcpy(bp, pl, payload);
comment on this story

How we got read access on Google’s production servers April 2014

The team at Detectify found a way to access files on one of google's production server. Thanks to an old google product (google toolbar) that was using a poorly secured XML parser.

They just used a simple XXE attack where they uploaded a poisoned xml files and saw what the application printed back

a xxe looks like this:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [  
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

More on their blog

comment on this story

How Heartbleed works thanks to XKCD April 2014

I found a pretty nice explanation of Heartbleed for the layman in this XKCD comic. Heartbleed is a recent and alarming vulnerability found in the OpenSSL toolkit that serves most of the application/websites today. To quote Schneier:

"Catastrophic" is the right word. On the scale of 1 to 10, this is an 11.

Here's the comic:


And if you want to dig a bit more into it, you can read some more explanations on security.stackexchange.

comment on this story