The DMZ - 2015-11-19 (page 1 of 7)

« first day (1799 days earlier) ← previous day next day → last day (3086 days later) »

3:50 AM

Everyone fled when kalina mentioned NSA

Austin Hartzheim

Be quiet. They are listening.

:(((((((((((((

Austin Hartzheim

Let's just link to an image from torproject.org. Then everyone not in US, GB, CA, AU, or NZ gets hit by an XKeyScore rule when their browser fetches the image.

awesome

Austin Hartzheim

4:06 AM

This one seems relatively innocuous: hxxps://www.torproject.org/images/tails_logo.png

Maybe even cute.

user image

Fixed that for you

I accidentally found out the IP address to xkeyscore

(just kidding, please don't kill me, freaky JSOC)

Austin Hartzheim

If you were outside of a Five Eyes country right now, drones would be in route as we speak.

Probably

Austin Hartzheim

@MarkHulkalo Have you made any progress on the unicode extension

I quit

I found something I feel passionate about

working on a video game now

Right now it's just a test, using my own engine... but I know how it's going to work

Making a Fallout Shelter clone. Dunno what to call it

Basically, for the Unicode extension project, you just need to intercept all urls and remove all unicode data that doesn't correspond to ascii. You can also stop it

But it's so horribly documented I don't want to bother

Austin Hartzheim

4:18 AM

Yeah, it's a pretty simple extension. I'll probably throw it together myself sometime in the near future.

hang on I'll give you the code

pastebin.com/kZFG6gb1

But you will want to change httpChannel.redirectTo() to redirect to something like about:gtfo

Otherwise people could exploit the extension to force you to visit a bad non-unicode site

The code is just for demonstration purposes

Austin Hartzheim

Yeah, that could be useful. I'll have to look into how much of the "Services" stuff is being deprecated in the near future.

The exploit would work like this: you attempt to visit bankofamerica.com, but it's a fake one.... so it removes the non-ascii vowels: bnkfmrc.com. Someone would just have to register it and set up a drive-by download festival

and you'd end up on the 'replaced' site

again, it's a demonstration. pretty insecure. use at your own risk =D

Austin Hartzheim

Yeah, I see what you mean.

I was probably going to have it warn rather than redirect. A redirect to a warning page is another idea as it would get you off the offending website.

But, if you don't allow JavaScript/plugins by default, it is much more difficult to exploit that.

Yea

Man I love infosec <3

oh wait. let me fix that code lol

pastebin.com/1PvU5jVy

derped this: return (/[^\x00-\x7F]/g.test(str)) ? true: false;

Austin Hartzheim

4:33 AM

Yeah, that is a bit more explicit.

2 hours later…

6:16 AM

@MarkHulkalo Oooh I wanna help

I don't want to set the world on fire, I just want to start a flame in your heart.

2 hours later…

8:12 AM

Morning

8:28 AM

@LucasKauffman was considering a job offer, wanted to first understand how much of a pay cut it would be...

@RoryAlsop yeah that too. Although EY doesnt really HAVE bad years, and even if they did its not like they wouldnt be able to afford salaries...

8:39 AM

@DavidFreitag Some men just want to see ~~the world~~ your heart burn.

Journeyman Geek

I know where I can get a bag of dried nagas...

@JourneymanGeek silly @Geek, those are mythical.

or did you mean these:

The bhut jolokia (Assamese: ভোট-জলকীয়া), also known as bih jolokia, u-morok, ghost pepper, red naga, Naga Jolokia, and ghost chili, is an interspecific hybrid chili pepper cultivated in the Indian states of Arunachal Pradesh, Assam, Nagaland and Manipur. It is an interspecies hybrid of C. chinense and C. frutescens genes. In 2007, Guinness World Records certified that the ghost pepper was the world's hottest chili pepper, 400 times hotter than Tabasco sauce. The ghost chili is rated at more than 1 million Scoville heat units (SHUs). However, the ghost chili was shortly superseded by the Infinity...

Journeyman Geek

The chillies not the snakes

Yup

but damn, my mouth is tingling just seeing that

jeez

> The ghost chili is rated at more than 1 million Scoville heat units (SHUs).

Journeyman Geek

lol

My nose burned standing in the same aisle as those.

8:47 AM

okay, this is the way to do it: wearing rubber gloves and a mask, you slice off just a tiny corner. Chop it up, and put it in a big pot, let's say some kind of stew.

Mmmmm - have a tiny vial of dried ghost chillies here. Is good to sprinkle on food

Cook it for a long time and make sure to mix it.

Journeyman Geek

oh this is a quarter kg pack

and I've grown chillies from dried chillies before

DAMMIT HOW IS THAT BURNING MY MOUTH THEY'RE NOT EVEN REAL

aww now I miss my chili plant

that was fun, picking it straight off the branch on to the cutting board and into the frying pan.

plant died :-(

Journeyman Geek

My dad killed ours ;p

Haven't managed to get a new one up yet

9:23 AM

morning

10:16 AM

Morning!

10:30 AM

@Avid if you do decide to sign and its EY tell them I was your referral :p

@kalina Salut

There's a bonus associated

@LucasKauffman pfft too late for that man

they came to me anyway, so its not so much a referral as a sourcing...

Journeyman Geek

theverge.com/2015/11/19/9759762/twitter-cat-fact-spam-snowden

@JourneymanGeek awesome

10:41 AM

user image

10:57 AM

@AviD with Thal's team?

umm... maaaaaayyybe

of course, I cannot comment on possible job offers, which may or may not be pending.

11:12 AM

@LucasKauffman Wait what?

@AviD the no pants hipster with a Big 4?

2

@TerryChia inorite?

btw I like that title you gave me.

@AviD Giving up on the consultant thing?

meh

though ftr EY is also consultants... even more so than me...

@JourneymanGeek This is brilliant.

11:31 AM

@AviD I'm sure EY needs more HR managers...

@TerryChia ?

@AviD You could be following in @RoryAlsop's footsteps.

ah. unlikely.

@Avid what position do they offer you?

@LucasKauffman Kinky.

11:36 AM

Raur

Brewerkz end of December? @TerryChia cc @JourneymanGeek

@LucasKauffman Sounds good. @JourneymanGeek doesn't drink though iirc.

We can also go for sugarcane

Or he can have a soda

@TerryChia what area did you live again?

Journeyman Geek

Yeah I don't

but oh well, gotta get out of the house sometimes. ;p

not drinking is the best

you get to watch other people destroy themselves

Journeyman Geek

lol

I don't drink due to cultural reasons tho

11:50 AM

@LucasKauffman Hougang.

@LucasKauffman I will tell you after I answer them...

@JourneymanGeek I don't drink due to sensible reasons

and not eating meat for sensible reasons too

@kalina so why DO you drink? :P

and no drugs due to sensible reasons

by sensible reasons I mean "because I'm weird, or something"

Journeyman Geek

lol

I'm vegitarian due to religious reasons

though part of that might be pissing off the jains.

(who are actually pretty nice people)

11:52 AM

@JourneymanGeek I'm not vegetarian because I love animals, I'm vegetarian... because I hate vegetables.

actually no, I'm not vegetarian.

well you should be

humanity will be a lot better off if we all become vegetarian

Journeyman Geek

lol

nearafternoon

@TerryChia how long does it take you to go from where you live to raffles? I'm checking out different places to get a flat, but it's quite expensive close to there

@RoryAlsop alreadyafternoon

11:57 AM

@kalina \o hey kalina

o/

@AviD - joining big-4 consultancy? Kinda cool

I'm not just HR - it's now mandatory for all staff here to sit a Tax eLearning module on "customer taxation"

Why? I have no idea

customers are taxing

all that time required to answer them

@LucasKauffman I want to say under 1.5 hours with public transport.

I need an automated booking management system integrated with flights and traffic information

12:00 PM

like I ever have anything to do with tax. Even my own tax is too complicated - I pay an accountant to do all that

@kalina that sounds like an awesome idea

@TerryChia damn that's still long

@avid it better be senior manager or director

@RoryAlsop i have to do mandatory anti phishing and social engineering training...

@LucasKauffman that's fair enough - you're a security person. But tax? Really?

@LucasKauffman can you offer to teach it?

@RoryAlsop I'd charge 1 dollar per participant

Doubt it

you're worth a dollar, I'm in

@kalina lol

12:14 PM

@TerryChia I'm checking bukit panjang now because they have straight busses to raffles using the PIE

quick, @Lighty is here, everybody be afk

@kalina I have no idea how to respond to that

oh no, you can see me?

graphhopper.com/blog/2015/11/18/visiting-every-pub-in-dublin <-- here's something to do if your bored in Dublin. A route to visit all the pubs in dublin in a month

Yes I can, I have x-ray goggles

12:16 PM

you walk around looking at people's bones all day?

@AviD if you do it, don't forget the training/Going to AppSecEU budget!

@RoryAlsop was considerng it, but I dont think Big4 is anything kinda cool... more like the opposite of that ;-)

@AviD it depends 100% on what team. Honestly.

@AviD you have to excuse the elder rory, his sense of balance is off and it's affecting his judgement on coolness :op

I think our team was one of the best ones (although @RоryMcCune may well disagree :-) - but there are teams I would have hated to be a part of

12:18 PM

@RoryAlsop yeah it was a very good team, lots of fun had :)

@RоryMcCune pls, I expect at least one international conference per month.

unfortunately I'd say that was in-spite of, rather than because of, the wider corp

@RоryMcCune (probably true...)

@RoryAlsop no no, EY Israel is the bestest team in EY. Even ask @LucasKauffman.

@kalina He has the kind of goggles that focuses on weens.

12:19 PM

oh look, @Simon is talking about weens again

@RoryAlsop The key bit (for me) is who the senior management in the team are... good people at the top who are team focused, works well... add the wrong people and... well Blowing and goats springs to mind

that level of obsession qualifies you as a nerd

@Simon is a ween nerd

@RоryMcCune so on the one hand, thats a good thing, but on the other hand - why should we have to fight the system? Think how much more awesome that same team could be in a similiarly great corp.

I am what I eat.

wat

@kalina aka weenie

Journeyman Geek

12:20 PM

there is no simon, only triple naught.

@000 T.M.I

@JourneymanGeek no he changed his name to match the number of people who like him

@AviD oh indeed, good corp + good team == loads of fun, but hard to find

pls

he went with three digits because he's optimistic

12:21 PM

@kalina and one zero wasnt enough to express the nothingness of that?

inb4

one day he hopes to have 100 or more friends

100+ real friends would be a pain to handle.

@AviD they're good, bestest I don't know :p they're are other larger teams as well like in SG

@AviD how large are they now?

@LucasKauffman I think around 60?

Pure pentesters ?

I never worked with them they're in a different region

There are not they are

12:27 PM

a life of pure pentesting would be fun

.

@kalina well once you've done stuff from bic to Mont blanc , it can get a bit boring

@RоryMcCune using a bic wouldn't even touch the sides

wat

@000 my reaction exactly

12:29 PM

user image

I was making a joke about testing pens (the things you write with)

so was I

@kalina ah well in that case I think you're wrong you can clearly see the pen nib touch the sides there.

^

you're*

12:37 PM

@LucasKauffman I think mostly pentesters and other types, and about 1/4 other expertises.

@LucasKauffman oh, thought you did... they actually cover EMEA, + some assisting in US etc.

its not a regional office...

@kalina The pen is blue

@RoraΖ The pen is Aqua

@AviD I know they did some testing in EMEA but it's not a lot to my knowledge, the only time I encountered them here was on a project where they were doing QA

That's not even aqua.

Journeyman Geek

Aqua - Barbie Girl

this is aqua

12:40 PM

EMEA is mostly covered by Spain, Ireland, Poland and Belgium

Journeyman Geek

and I'm sorry ;p

user image

There, submitted to Securi-tay CFP, fingers crossed

@JourneymanGeek So much hate

@AviD but they are more active on the us side I think

12:41 PM

@RoraΖ That is the most shady link someone has ever linked to me.

Journeyman Geek

I'm SORRY

@LucasKauffman ah likely

I was surprised to hear how little they do here in Israel.

@ColinCassidy ooh good luck!

I should think about doing that... do they pay travel for speakers?

user image

@ColinCassidy me too :)

FTFY

12:43 PM

@RoraΖ Haha, what movie is this?

@AviD they're not even on my list for EMEIA for pentest tools and licensing and I take care of that for the whole region, so most likely it's a lot more US.

@000 :facepalm: Liar Liar

@000 Liar Liar

o

dammit

12:43 PM

@AviD I have no idea, I'm an hour away by car so it's not an issue for me

I hate you so much right now

I don't think I've seen it but yes, yes lads, I know that I should have seen it.

The time where I anger people the most is when I tell them that I haven't seen a movie.

@AviD curious tho where they are active then, let me know :)

Snobs.

@DavidFreitag I'll let you know when/what I need :D

12:44 PM

OH YOU'VE NEVER HEARD SUBZERO BY BEN KLOCK?

IT IS SUCH A CLASSIC TECHNO TRACK

YOU ARE A BAD PERSON!

yay I paid my tax bill for the quarter. My goddamn ridiculous tax bill.

@AviD I don't think so , but it's a good recruitment opp. for the Big-4 so you may be able to persuade the boss to send you

@RоryMcCune lol

when is it btw?

ohh I should tell Checkmarx to hook that up ;-)

user image

@AviD end of feb 2016

12:45 PM

this is aqua

They love the conferences track, I think they hit up every single one with more than a dozen people.

@AviD securi-tay.co.uk

cheers

also that pen is cerulean :P

@LucasKauffman is EY Israel in EMEA?

12:46 PM

@RоryMcCune oh man its a weekend? I dont do weekends...

@AviD Fri/Sat IIRC

@RоryMcCune EY Israel is like a globabl center of excellence.

or some kinda more corp-ish name.

@RоryMcCune Americas

@AviD sure I was wondering if it fell under emea as the Security practice director for EMEA is a glaswegian

@AviD there are several global centres of excellence

12:47 PM

@AviD I could've given you some appropriate phrases to use if you spoke to him

@LucasKauffman yeah, but then its not "regional"

or do I misunderstand the corporate version of "global"

@RоryMcCune pppffft

You know what else is not regional but global? My ween.

@AviD things "See you jimmy, porsche's are shite, Subaru's are braw, mind"

2

@AviD it's EY :p there are several ASCs Israel is just one of them

@RоryMcCune I will try to remember that.

Is that for all glaswegians, or just that one?

12:48 PM

@RоryMcCune Hey, those are boxer engines, well done!

@LucasKauffman Can't help you on rent stuff. :P Can't say I'm familiar with the market.

@LucasKauffman no, that part I get. I meant the "fell under EMEA"

@AviD just that one, he has/had a red porsche and it was slower (in some circumstances) that @RoryAlsop 's subaru

@RоryMcCune hahaha

@AviD even if you are a gcoe you are still part of a region

12:50 PM

see I dont speek corpish

@AviD I can listen to it, but after 10 minutes it gives me a headache ;)

you should bring your bingo chart

@AviD I don't really know what they do to be fair so I can't comment and I can be wrong :p

anyway the bureaucratic hierarchy is not one of the topics I bothered asking about.

If I decide to take it - aaaaand thats a BIG "if" mind you - I will have them put in my contract that I will be ignoring all the internal politics, bureaucracies, and hierarchies.

Corporate shenanigans, if you will.

yeah that will work

12:54 PM

Super Troopers (5/5) Movie CLIP - Shenanigans (2001) HD

@AviD if you are working under a partner it's his job to keep that pressure away, but there will be politics I think

@kalina did you forget your <cynicism> tag there?

or is it implied

@LucasKauffman must... resist.... laughing....out....loud....

sorry for lack of vocal tone

@kalina it's these text only mediums

pls, I'm sure she could have found a cute cat meme, if she cared.

or a minions one.

12:58 PM

@AviD more like an MLP one

that could work too

and I ain't talking More London Place (that's a little EY humour for you)

does MLP even do cynicism?

« first day (1799 days earlier) ← previous day next day → last day (3086 days later) »

Transcript for

Nov '1519

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile