« first day (1317 days earlier)   

2:22 AM
@LucasKauffman Cool thanks!
 
 
2 hours later…
4:07 AM
 
 
5 hours later…
8:44 AM
Morning all
Another glorious bright day in Scotland
 
@RоryMcCune Morning.
 
@TerryChia hows tricks?
you merrily developing stuff, or just getting drunk with @LucasKauffman ?
 
@RоryMcCune Just had beer with @LucasKauffman actually.
Home now fighting with Python packaging.
Packaging is the worst part of the development process.
 
@TerryChia if it's anything like Ruby packaging I know what you mean. I read a whole book on ruby gem management and still not sure I get all the nuances
for me its Friday which generally is report day :o(
so Word-tastic
 
@RоryMcCune It's stupidly annoying. And that's even when I can ping a core developer of the packaging tools if I get stuck.
If only everyone is comfortable with pulling stuff from git.
 
8:55 AM
@TerryChia yeah that's become a thing in ruby gem land you can put a git repo into the Gemfile and it'll go get stuff from there. Nice from a functionality perspective, really makes me shudder from a security perspective
the number of projects that are one github account compromise away from security problems is likely very high....
 
@RоryMcCune That's basically how Go's dependency manager works.
 
@TerryChia given the quantity of hacking there is these days it's astonishing that as time goes by that's becoming more of a thing...
 
The base tool always pulls down from master, which leads to all sort of versioning nightmares as you can imagine.
People actually had to develop an ecosystem of versioning around it.
@RоryMcCune Yeah. We (cryptography) at least sign our releases with GPG. Pulling smaller projects from GitHub can be a security nightmare.
 
@TerryChia yeah not every project handles the use of master consistently, that could be horrible!
 
Goddamit Gmail! Stop tagging my GitHub notifications as "Promotions"...
@RоryMcCune Just curious, have you done much work with Android apps?
 
9:06 AM
@TerryChia not a lot. did a one day training course on them a couple of weeks back but not been asked to professionally review one yet :)
it's the big thing at the moment in security testing in the UK , partially I think 'cause there's so many holes to poke in it ..
 
@RоryMcCune Yeah, I was poking around a little and I was surprised how easy it was to get back code from an apk file.
It was literally running a single script.
 
@TerryChia yeah zip+dex2jar+jd-gui are your friends :)
and because APKs can be signed by any key there's no problem repackaging after modification
 
afternoon
 
if you want a HUGE list of reading I put something on the transcript yesterday with android papers
 
@RоryMcCune Yeah, I did see that.
 
9:13 AM
@LucasKauffman Wathca'
 
@RоryMcCune had beers with Terry, then went to a bookstore and went on a spending spree
 
> 0 > null false > 0 >= null true > 0 == null false > 0 <= null true > 0 < null false "JavaScript: A Great Place To Work"
 
never seen such a large bookstore
 
@LucasKauffman I'm surprised you bought books from a bookstore. I usually ship stuff from Amazon.
The free shipping with an $120 order really makes them the best place for books even for Singapore.
 
@LucasKauffman next time you're in London go looking for Foyles. I went once and they had racks of books on subjects I didn't even know existed..
@TerryChia uk has £79/Year unlimited free shipping, which is nice :)
 
9:17 AM
@RоryMcCune Yeah, we don't get anything like that here so I usually wait till I have a significant number in my cart.
 
@TerryChia well helps cut down on impulse buys I'd bet :)
 
@RоryMcCune I'm usually pretty ok with splurging on books.
I still have 2 I need to go through though, so that helps cut down the spending.
 
@TerryChia I got there and it was just so insanely large
3
I couldn't resist
 
9:32 AM
Hmm, I just bought a $40 mechanical keyboard. I hope the quality is decent when it arrives.
 
9:51 AM
omfg
you guys are the worst
 
You brought that one on yourself.
 
@LucasKauffman you're just lucky I didn't pin it :op
 
10:23 AM
@RоryMcCune Tu quoque Rory infosec frateris mi
 
@LucasKauffman huh?
 
@RоryMcCune He's drunk probably.
 
@TerryChia this did occur as a possibility...
 
10:42 AM
@RоryMcCune It's latin you goose
 
@LucasKauffman not according to google translate it ain't :op
 
@RоryMcCune I might have fucked up the causus tho
should have been frater instead of frateris
it means: "you too my infosec brother"
it comes from the quote of caesar when he got stabbed by brutus
 
@LucasKauffman I guessed that might be the case..
tu quoque, Rory, fratres mei infosec
 
@RоryMcCune fratres?
mmm I really should revise my latin :p
I only did two years though :(
 
@LucasKauffman I only did one and it was many years ago...
 
10:59 AM
How do I unsubscribe to these "event notices" that keep dropping down on my screen?
An event is starting in 6 minutes in The DMZ - "QOTW Published"
I'm not even registered for the event.
 
11:26 AM
anyone looking for a job in as a pentester in Zurich?
@skullpatrol but you are we organized it specially for you :(
 
@LucasKauffman ok, np
 
@skullpatrol there will be drinks and ballons and pary hats
 
11:43 AM
@LucasKauffman It might be cool for the Europe section of EY to get Singapore students as interns actually.
 
@TerryChia we used to do this actually
well not singaporean but from other EU countries
 
@LucasKauffman Ahh. Well, my school does send several students on overseas internships every year -- either Interpol in France or some place in Japan.
I'll bet if EY is willing it will be quite easy to get students as interns.
 
@TerryChia I could see if we can arrange something, but I know for us the internships are aimed at selecting candidates for working at EY
and it's hard to get that sold if the students return afterwards
 
@LucasKauffman Yeah, that may be a problem but maybe offer them contracts in EY Singapore for example? I dunno. Just an idle thought. :P
I can point you to some people if you like, but it doesn't really affect me since I already graduated. :P
 
11:59 AM
@TerryChia well I should take this up at some point as it might be interesting, unfortunately I'm still too low up the foodchain to step into Ken Allan's office with this :p
Partners won't go for it locally as it's not their pot of gold that will be affected positively if they do internships here and get a contract in SG
so it needs to be pushed out by global first
 
@LucasKauffman Yeah possibly. I actually do think EY (or another one of the big four, I can't remember) takes interns from my course locally.
 
@TerryChia normally they should, interns locally is something we all normally do
 
Holy shit, this is probably the stupidest bug I have seen in a while. github.com/pyca/cryptography/pull/1282
 
@TerryChia stupider than PHP?
 
@AviD This is a stupid bug. PHP is just stupid.
 
12:04 PM
@TerryChia You don't think PHP is a bug?
 
@AviD No. PHP is a feature.
 
just a really big ball of bugs.
 
How else can we get job guarantees?
 
by building good stuff?
whoa. that was a very delayed ping.
the audio part, I mean.
 
@AviD So, got your new Macbook and iPad yet?
 
12:08 PM
nevar! I aint no hipster!
on the other hand, I did get a really crappy flight.
or, flightS, I should say.
 
@AviD That's a bit much considering the recent news. ;)
 
each flight is fine, its the sheer number of them that is the problem.
@TerryChia yeah.... just as I was going to book my excellent flight on Delta - they go and cancel all flights.
 
@AviD what's your route?
 
And Elal decided to profiteer, and bumped their anti-missile-protected flights up by 50%.
@RоryMcCune urggh. As @RoryAlsop said....
I'm taking BA to London. But BA doesnt fly direct to SF - so from London I'm going to Philadelphia. And from there a connecting US airline to SF.
coming back its not much better, either...
dammit! shooting rockets at us is one thing, but affecting my comfort and luxuries, thats just too much!
 
@AviD business or cattle?
 
12:12 PM
@RоryMcCune Heh. Cattle.
 
@RоryMcCune some/some.
different legs, different levels.
 
@TerryChia I've done cattle class to Australia was ... not fun
@AviD it's not too bad if the long ones are business
 
not "Business", anyway - I think they call it "Economy Business"or sthg like that.
@RоryMcCune THEY ARE ALL VERY LONG
 
@AviD TWSS
 
actually the good thing is they are all broken up, I think the longest one is like 7hr and a bit.
 
12:14 PM
@AviD my fav was when I went to defcon, the airline had cancelled the route, so they moved me to other flights but the long leg was first class, it was ..... nice.
 
@RоryMcCune thats cool
the other good thing, is I like flying BA. much better than most airlines.
 
@AviD yeah my connection was delayed and I was worried I'd miss it. 'cause I was first class they had a personal rep meet me on arrival and walk me through the airport with a variety of tickets to make sure I had one that would work. brief view of how the other half live :)
On another note, I really hate CVSS scores!
 
@RоryMcCune excellent!
@RоryMcCune oh yes, me too.
they seem to be good for like OS and that type of products.
sooo dont apply to applications, let alone custom dev.
 
@AviD one of our customers that we do sub-contract work for decided that they want them on all reports. I'm trying to explain why there's no CVSS for "hasn't implemented HTTP Security headers" and why making SSLv2 a medium finding makes no sense
 
why you dont like SSLv2?
 
12:23 PM
@RоryMcCune SSLv2 is a "wtf, why are you doing this?" finding
 
@AviD no but it's not a serious issue, when in the history of the Internet has someone exploited SSLv2 when if you're MITM to the connection there's way better stuff to do
the only time I rate SSLv2 as serious is when there's a compliance req. or it's something like Financial services
where someone might actually do that
 
okay, that I agree with. but low is TOO low, given @terry's "WTF".
 
but nessus/CVSS rates all SSL related issues as mediums or worse
@AviD yeah maybe for SSLv2 but stuff like SSL MITM DoS comes out as a medium in CVSS land
and in a lot of cases it comes out higher than XSS
I know (in almost all cases) which one I'd be more worried about :)
 
@RоryMcCune that makes no sense
@RоryMcCune on the other hand, the oh-so-very-common taxonomy of "damageXprobability" is also a joke.
 
@RоryMcCune No, I'll say SSLv2 is definitely a problem in today's context.
 
12:29 PM
I had looked at FAIR in the past, and I liked it in principle, but its usually too much of an overkill. DREAD is a nice compromise, but I still feel it's lacking.... something.
 
@TerryChia hokay I'll bite, how would an attacker exploit SSLv2 on a web site in a situation where a customer is accessing it using a standard web browser?
 
@TerryChia a problem yes, but not a critical OH-EMM-GEE-STOP-EVERYTHING-VEEEETOOOOO
 
I'm not aware of any exploit code, so they'd need to right their own
and someone who writes SSL exploits is really not going to have a better attack vector?
 
the bigger problem with SSLv2 is that it signifies a huge process/awareness problem. so more a symptom than a vulnerability.
 
@AviD oh absolutely it screams "we don't patch properly and don't update our systems" but in and of itself, I'm not aware of any time its actually been exploited...
 
12:31 PM
@AviD Definitely not a critical problem, but medium is a fair rating imo. Although I'm not really into the whole "ratings" thing. Just fix that shit goddamit!
 
@RоryMcCune right. and I dont always set the severity / risk based on exploitability alone. there are other factors to consider.
 
@RоryMcCune Assuming I have MITM I can force a downgrade and use broken ciphersuites?
 
@TerryChia ah, see I used to be like that, when I was young and naive.
 
@TerryChia Assuming I have MITM, just sslstrip the whole connection and have done with it :)
 
"fix that" is always a question of "instead of what?"
other bugs? new features? It really is a tradeoff, and fix only what is worth it to fix.
 
12:32 PM
@AviD which is why I don't like CVSS it takes away the consultants ability to use their judgement...
 
@RоryMcCune absolutely!
and again, it does not apply to non-standard products with no additional context.
the factors dont even apply to custom dev.
 
@TerryChia my point being no-one would be likely to actually do that if they had the pre-reqs for an attack, because there would be better options available...
 
I had to do that once - attach the CVSS score for internal reviews I was doing. Hated it so much.
half of the calculation did not make any sense.
 
also physical path disclosure is a medium on it's own?!? In CVSS it is
 
disclosure or tampering / injection?
it all comes down to this:
 
12:35 PM
@AviD disclosure..
 
if you insist on making it repeatable and "standard", you are losing out on all the juicy context that makes these things important.
 
@AviD in conjunction with something else like directory traversal that could be really bad, but on it's own in seems a bit steep (bearing in mind that would be a fail on PCI)
 
you are optimizing for low-quality staff, instead of assuming you have the right people to make the judgement calls.
 
@RоryMcCune Sure. No arguments there. But really, in 2014 you have to be doing something out of the ordinary to still support SSLv2.
 
@TerryChia heh, you've not worked in many corporates have you....
 
12:37 PM
@TerryChia no, you just have to have servers untouched since 1998.
which, sadly, is more the ordinary than out of it.
 
@AviD And that's not out of the ordinary?
@AviD Heh.
 
@AviD hell ~3 years ago SSLv2 was on by default on Cisco Wireless management kit
 
why do you think everyone with some experience is so damn cynical? We're jaded for a reason.
 
they had an option to disable it, but it was unchecked by default..
 
@RоryMcCune Well... I am young and naive. ;)
I'm actually very pleased that almost every single HTTPS website I visit nowadays support a ciphersuite with PFS.
 
12:40 PM
@TerryChia heartbleed actually did a good job of making people look at the area of SSL config, which before that was generally ignored..
 
@RоryMcCune Nah, it wasn't heartbleed. It was the whole Snowden thing.
A lot of people were pushing for PFS after that.
 
@TerryChia hmm well that's an opinion :)
 
@RоryMcCune Heartbleed was more of a "we need to pour more money into critical software" thing.
And I'm very hopeful that in a few years Linux will have a getrandom() syscall thanks to Heartbleed.
 
no, this all comes down to the fact that @TerryChia only uses websites that were created in the past 2 years. Hipster.
Well, except for 4chan obviously.
 
@AviD Facebook and Twitter isn't created in the last 2 years. ;)
Neither is Google.
 
12:47 PM
I've come along a few hipster programmers when doing code review, strangely enough they were all a LOT better and more secure coded than what I normally see
 
thats because you usually see neckbeards.
 
@AviD or dinosaurs
 
@LucasKauffman Nowadays you have to be trying really hard to introduce SQL injections actually.
Except for PHP of course, but no self respecting hipster uses PHP.
 
@TerryChia tell that to the devs
I've seen things man
you wouldn't believe possible
 
10 mins ago, by Terry Chia
@RоryMcCune Well... I am young and naive. ;)
 
12:49 PM
@AviD Well, I did mean with hipster frameworks.
 
11 mins ago, by Terry Chia
@RоryMcCune Well... I am young and naive. ;)
 
@AviD Psssh. Fine. I'll bring my optimism elsewhere.
You old neckbeards have fun reminiscing. ;)
 
hey no, I am an optimist. I believe it can be better. But before one can be an optimist, one must be a realist.
you cannot improve that which you do not see its true reality.
 
JNK
1:14 PM
Hi security folks!
 
1:28 PM
@JNK Hello, what can we do for you?
 
2:03 PM
oooh
they've started to call it Gazacaust in the Belgian media :/
 
JNK
@TerryChia I was hoping for some advice/input on advertising a job in networking security
my company has an opening and I didn't know if there was a venue that (serious) security folks frequent
 
@JNK Linkedin?
your company's website?
Headhunters
 
Twitter
r/netsec
 
xhamster
 
tut tut no one suggesting careers.stackoverflow.com/uk
 
2:09 PM
@RоryMcCune considering the man is a mod, I supposed he would have known about careers :p
 
@jnk BTW at least one of my fellow DMZ denizens may be commenting post some drinks and may therefore not always be making the most sensible suggestions... see if you can work out which one :)
 
@RоryMcCune now you've ruined the surprise :P
and I haven't been drinking a
 
@LucasKauffman ya reckon
 
well two glasses of wine
 
@LucasKauffman and beers with Terry
 
2:12 PM
@RоryMcCune Careers is really more programmer oriented though.
 
@TerryChia true but I'm sure I've seen some security postings there...
 
@RоryMcCune yea there are a few
even for compliance and audit
 
JNK
@LucasKauffman yeah it's posted on careers already
and yes careers is more programmer oriented
We did mark it as a sysadmin type job but that's about as far as you can go
Thanks I really appreciate the feedback
 
BSD users' favorite lyric from Frozen: "Yes, I'm alone; But I'm alone and free."
 
2:27 PM
@JNK you may want to ask when a couple more of our american types are about they may well know of more US focused venues. look out for @ScottPack , @tylerl or @aj-henderson, they're on here reasonably often...
 
JNK
@RоryMcCune Great, thanks
 
ok, sanity double check, the world hasn't completely changed on me since I last looked right? Have a significant number of viruses started coming out that can passively become active?
 
@JNK I was going to suggest here, but then you said "serious"
@TerryChia thats not accurate at all.
or well, it is "oriented", but not exclusively so.
ftr, I kinda-ish got my new job via there.
@AJHenderson no, but some uberbugs in wordpress plugins are making the rounds. So, same as any day.
 
2:48 PM
cool! looks like guardians of the galaxy is going to be good :) rottentomatoes.com/m/guardians_of_the_galaxy
 
@AviD ok, I didn't think I was going crazy, but I've been catching a lot of flack on my answer about the (relative) safety of having a virus as a data file on your system
granted, that isn't too surprising as I'm covering a lot of territory in a fairly short post for the amount I'm covering
and people tend to forget that while there are edge cases examples of exploits that can do code execution from a passive state, there are also (roughly as many?) cases of demonstrated vulnerabilities that may allow escaping a VM
which was the main "solution" offered
which yes, is a good step, but also isn't surefire
so yeah, wanted to make sure I wasn't losing it
I haven't played extensively with viruses in a few years
 
3:11 PM
@AviD Oh, what exactly will you be doing?
 
@TerryChia security research
 
@AviD Ah. That's pretty vague. :P
 
okay, now I know that I am a hipster. I'm registering on Yelp.
@TerryChia yes, yes it is :-)
you can go on sourceclear.com to get a better idea
 
@AviD I usually prefer foursquare tbh.
 
software security research?
secure coding research?
 
3:15 PM
@AviD Oh, you are doing marketing I see. ;)
 
@TerryChia isnt foursquare just "I AM HERE"?
 
@AviD You will be surprised, but they have rather useful reviews and tips.
Very good for finding new places to go nearby.
 
well I'm only doing it because I've been looking for kosher food places there. very useful.
 
@AviD That website shows an iMac and a Macbook. When are you getting yours? ;)
 
3:19 PM
@TerryChia nevar!
> (Tagging as cybersecurity because that term seems sufficiently meaningless as to cover my broad question.)
+1 for that.
 
hahaha
TL;DR ran through it diagonally
 

« first day (1317 days earlier)