The DMZ

7:12 AM

Gewd Murrrnin' dear world

deed02392

8:24 AM

@ManishEarth I was just gonna pick your brains on the autocomplete=off change in FF

Q: Any free source of data for web security/database security issues for my thesis?

comments anyone?

-1

I'm still thinking of a topic for my bachelor's thesis. I'm thinking of something like machine learning application on web security/database security. Problem is, in machine learning I need to have data. So I thought I'll base my topic on what kind of data I would get. Example, I found data on we...

hm, if you'd migrate it, it could be discussed as either opinion based/too broad, or even outside of scope on SEC.SE

not sure though :$

@AviD Definitely a product recommendation question.

@TerryChia no no, I didnt mean about migrating it here, I already rejected that. I meant offer him some sources in comments.

yaknow, like the verizon data dump, whid, etc.

@AviD Ah. I'm not signing up for an account there just to comment. :P

8:30 AM

I'm going to start calling "data dumps" as "data poops" instead. I think it goes more to the overall quality of typical incident reports.

Verizon Incident Data Poop

2

@AviD That's pure star bait.

@TerryChia you onhly think that because you have a scatological fetish.

@AviD Have you written a webapp in EmoJS yet? ;)

hehe

no, but I will be in Seattle next week, so anything is possible.

I've heard that some of the best breweries AND best coffee shops are there, looking forward.

oh, and donuts. DEFINITELY the donuts.

Imma get so fat on donuts and beer I will need a 2nd seat on the flight back.

@AviD 'Murica

8:45 AM

@Lighty YEAH, MURICA!!

YOU!! ESS!! AAAAIII!

DONUTS!!!

'MURICAAA, DEFEATIN' ALL DA TERRORISTS BY ROLLIN' OVER DEM WITH OUR DONUTZ! F*CK YEEEAAAAA!

background explosion for effect

@AviD "back"?

@TerryChia yeah, you know when I leave Seattle to come back home?

I'm not moving there.

@AviD Oh no of course not. I was trying to suggest you will already need a second seat on the way there.

Ohhh I see what you did there. rolls eyes

@TerryChia That makes no sense though, seeing as how I am now donutless and beer-free, resulting in an adonis-like svelte figure.

I kid you not.

hmm, svelte sounds a tad effeminate...

meh, screw it, I'm man enough to own that.

2

8:51 AM

@TerryChia I kinda really want ot see anything written in that. ANd I also so much do not want it.

ManishEarth

9:10 AM

@deed02392 Ah, sure, fire away :)

9:59 AM

@AviD beer free? This does not sound healthy.

@RoryAlsop free as in beer!

deed02392

@ManishEarth I reckon I'm all caught up on it now, basically webmasters were abusing autocomplete and being overzealous with it, making autocomplete features redundant, so browsers hit back by starting to ignore it by default. However it can act as a security feature for fields where data is sensitive eg credit card numbers etc. What's the mitigation now for preventing browsers auto completing fields with sensitive data in XSS attacks?

free beer?!

where

@deed02392 "webmasters"? No, it was abused by developers, and corporations, but especially auditors and regulators.

and I'm pretty sure the mitigation is requiring human interaction.

"human"

@AviD Isn't "webmaster" just a developer that got stuck with writing HTML? ;)

10:03 AM

oo thass cold, man, ice cold.

@AviD like some beers :-)

Isn't a webmaster someone who claims to be a Developer Wizard, but is only hired to drink coffee and press a restar button every month?

@RoryAlsop is there any other kind?

@AviD water claiming to be beer coughLightBeercough

@AviD of course. Real Ale should not be cold/chilled

10:04 AM

@RoryAlsop oh? Didnt know that.

A: Why are breweries against freezing pint glasses

The beer cellar should be a cool room, but not chilled at all

5

It depends on the beer style. Craft beers in general were not designed to be served at a near freezing (for water) temperature. Drink an IPA at 35 degrees and 45 degrees and you'll probably find the hop notes more pronounced at the higher temperature. Here is a general guideline: Very Cold: 35-...

It took me a couple of re-readings to understand that he is talking in fahrenheit temperatures.

Muricans.

@AviD aye - dem muricans :-)

Although - a beer at 35 degrees C

I may need to try that

just as an experiment, you realise

@RoryAlsop that is not very cold

you should try beer through a straw

@AviD correct. It sounds like it might be like a mulled wine, only mulled beer...without the mulling

@AviD done that many years ago :-)

10:16 AM

I personally prefer my drinks cold to ice-cold, even certain red Wines hat you should drink on room temperature taste better cold to me (even Rose wine, i really prefer those with ice, and really chilled)

@RoryAlsop you watched Cheers, eh?

@Lighty I like deeply chilling a Murfatlar red - as it is supposed to be, but no - most red#s only develop well at room temperature

@AviD not so much. This was well before Cheers :-)

10:35 AM

@RoryAlsop what age did you start drinking at eh!

given cheers started in 1982

@RоryMcCune i think 720 B.C.E.

@Lighty well Mr Alsop is not doing suppositions about his age much good at this point :)

;P

@RоryMcCune 1245 of the First Age.

we're not calling @RoryAlsop old.... we're calling him ancient

10:42 AM

@RоryMcCune before that :-)

Orkney is a small community

Things are accepted there before they may be accepted in larger communities

Drink is one of them

@RoryAlsop Your mom put a little whisky in your milk to get you to sleep? ;)

@TerryChia nope. I just learned early on that cider was a good thing

As was vodka

And all of the other alcohols

and White Wine? :o

of course

and even red

or rose

or sparkling/champagne/prosecco

i had this really weird, Sparkling white wine in Naples, Italy

it wasnt dry, nor sweet, and the sparkling made it really good

ofcourse, it was really chilled too

i still feel bad for not bringing a bottle home

10:52 AM

@Lighty of course :-)

Q: Sqlmap useragent scanning without permision

eh

0

Does anyone have an idea how to stop sqlmap from scanning useragent when setting --level="5" ON?

web-application

i have no idea what to think of this

its really... err, thin?

11:08 AM

omg, there was a car driving by on the highway next to our office building

a Suzuki X90

which is a "offroader"

that is one ugly cookie-tin

i mean, just look at it

@Lighty Why does that exist?

@raz ask Suzuki what they were smoking

prolly more than tyres

Journeyman Geek

o0

Thats the second ugliest car I have ever seen

and the wierdest

@JourneymanGeek What's the first?

Journeyman Geek

Nissan Juke

The Nissan Juke is a Mini Sport Utility Vehicle (SUV) produced by the Japanese automotive manufacturer Nissan since 2010. The production version made its debut at the 2010 Geneva Motor Show in March, and was introduced to North America at the 2010 New York International Auto Show. On 11 February 2009, Nissan announced that the model would go into production at the Nissan Motor Manufacturing (UK) Ltd (NMUK) plant in Washington, UK, during 2010 following its appearance as the Nissan Qazana concept car at the 2009 Geneva Motor Show. The Washington plant manufactures for the European market, while...

11:27 AM

@JourneymanGeek I prefer the Juke honestly

ManishEarth

@deed02392 It works fine for credit card numbers

We never killed autocomplete=off

We killed autocomplete=off for password fields

because browsers prompt about saving passwords anyway

So giving the website the power to turn off the password manager for the page didn't give any additional security

2 hours ago, by AviD

@deed02392 "webmasters"? No, it was abused by developers, and corporations, but especially auditors and regulators.

also, this

I believe that a lot of official recommendations by idiot auditors was to autocomplete=off all the things, including password fields

yay-got my 4th 10k site today!

@RoryAlsop 10k site? :o

@RoryAlsop Congratulations are in order

@RoryAlsop I'm pretty sure that's not sad or anything...

I guess when you've been around forever it was bound to happen :)

@Lighty aye - sites on SE where one has over 10k rep

11:37 AM

@RoryAlsop really now! congrats there :3

have a digital-ale

@Lighty Oh man digital ales... we should invent those.

@raz no no no - they have been invented. Now just please make one :-)

(and send it to me)

i opt-in for volunteer alpha-tests then :o

is posting p0rn allowed btw? before i send more digital ale to rory

@RoryAlsop There is an app where you can buy people beer...

@Lighty sadly, no

11:46 AM

did you know, in the netherlands, people seem to enjoy more foam on their beer as anywhere else? as in, the foam ontop of a beer can reach to a whopping 2cm

@Lighty When it comes to head on my beer, I go by the 2 finger rule.

when it comes to my beer, i go with the 2 glasses rule

@Lighty You only drink 2 glasses?

2 glasses beer = one beer, which means if i can have a maximum of 10 beer in an evenin, i can drink more if it was 1 glass = 1 beer

In countries where a foam head is popular, glasses typically have space for it. In countries where it isn't, letting foam take the place of beer is a punishable offence

11:48 AM

flawless logiks

Hmmm, looks like there's a new Windows RCE vuln. CVE-2014-4114.

@TerryChia the one russia abused?

@RoryAlsop I think it depends on the style of beer and if it's draft or pull.

heh

reminds me of this weekend

i asked for a glass of water while working on an IP Cam in a bar

they guy walked to the tap/pull and held a glass under it

the tap said "Jupiler Beer"

literal water came out of the tap

well played xD

12:08 PM

@TerryChia from isightpartners.com/2014/10/cve-2014-4114 looks like an OLE thing, so mainly office docs as an exploit vector...

@RоryMcCune Yup, looks bad.

Stefan Esser just hinted at two vuln reveals tomorrow as well.

Looks like one of them may be a SSL vuln. Woohoo!

@TerryChia Protocol vuln, or an implementation vuln?

@raz How the hell would I know?

@TerryChia He could have hinted at a technology

@TerryChia you've not hacked his e-mail...

get with the programme

12:19 PM

@RоryMcCune Hehe.

@RоryMcCune thanks for that link

Someone leaked some Dropbox passwords today as well.

@TerryChia though dropbox say it's not from them, but other services trying account combos there...

@TerryChia i hadn't realised dropbox offers 2FA, until today

@RоryMcCune Aye. Still fun though. :P

12:20 PM

@RoryAlsop yeah so as long as you're happy with Condy and her friends reading your stuff, you're fine :P

This year should make anyone in information security really happy. Job security ftw!

Urban myth: the Ruby developer who managed to download all the Gems they needed within a 24-hour hackathon.

Tweeted by iamdevloper on October 14, 2014 at 9:53 AM

@RоryMcCune @AviD You may appreciate this tweet. :)

@RоryMcCune meh - she gets a sneak preview of latest Metaltech tracks :-)

@TerryChia heh

@TerryChia "You are all a bunch of useless twats. Why should I keep spending money on you, they keep hacking everything."

@Arperum there is that...

12:22 PM

@Arperum Because more things gets hacked if I'm not here? :P

@RoryAlsop see knew there had to be some benefit to having been a member of the Bush government!

@TerryChia "HAh. Says you.Didn't stop them."

@Arperum then be a pen tester :) we don't get into trouble for that ..

@RоryMcCune Aye, or a researcher. ;)

@Arperum And then we say - no, no - look at (bank X) over there. That might happen to us unless you increase security spend....

12:23 PM

No end to crappy software to find bugs in.

I am part of the reason you guys get to keep your job. I just have to keep writing crappy code.

@TerryChia well once all software dev courses have even one module on security, I might start to think we'll see a more secure future!

Hi @Weda. Yes - this hotbed of scum and villainy probably can help you out with AES security questions

@RоryMcCune So... in 2143 maybe?

@TerryChia optimist!

12:25 PM

@TerryChia never happen

@RоryMcCune Only @RoryAlsop will know.

@TerryChia That's crazytalk.

WedaPashi

@RoryAlsop: Thanks Rory.

@RoryAlsop Oi, @Adnan isn't here today.

@TerryChia I was trying to come up with something, but that was the first partial quote that popped into my head

12:27 PM

@RoryAlsop Hehe. It's pretty fitting actually.

Q: Clarification about the post: Russian hackers use ‘zero-day’ to hack NATO, Ukraine in cyber-spy campaign

so - is anyone going to pop a bit of an answer on this:

0

I have encountered the following article on Washington post: Russian hackers use ‘zero-day’ to hack NATO, Ukraine in cyber-spy campaign. As always in such kind of articles the publication sounds too scary, and there is almost no information to understand what are they talking about. Can anyon...

attacks zero-day cybersecurity media

WedaPashi

@Rory: I couldn't resist taking a look at the Display Picture first :P Trained Eyes

@WedaPashi I hadn't spotted that

but thankyou

@matthew_d_green SSL3.0 bug is due to be released tomorrow. Let's hope logo and a brand are already done.

Tweeted by umbrquil on October 14, 2014 at 12:21 PM in reply to umbrquil

And a website of course.

I just want to see more of those Sandworm icons

I like Frank Herbert

12:31 PM

@TerryChia Oh goddammit. I was having cases of customers not wanting to use SSL already... Because confidential documents don't need that kind of security.

@Arperum Well yeah they are right...

You should be using TLS instead. ;)

@TerryChia They are going to use some terrible wordpress website. No special security issues taken.

@Arperum Link to site? I like me some confidential documents. ;)

@TerryChia Heh. 1) It currently contains a single pdf file with the content "test", live domain isn't even registered yet.

I think.

Nope, it isn't.

Q: owasp esapi php implementation for xxs attacks

12:55 PM

I'm thinking off topic, but if anyone has useful places to point this person, feel free to provide:

0

I searched extensively for good materials for prevention of xxs attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XXS attacks. Can some one please give me an example how this works.

php owasp

(if it gets a couple of close votes I'll finish the job)

@RoryAlsop OWASP ESAPI is a security API for preventing XSS :)

Q: Why the symmetric key is added to the message?

1:11 PM

0

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid method with a symmetric and an asymmetric key. Alice's and Bob's private Keys are signed by a Cert...

encryption cryptography certificates asymmetric

I feel like their lecturer is doing it wrong.

@raz Or the more likely scenario that the guy has no idea what his lecturer is talking about?

@TerryChia This is also possible

In PGP the random symmetric key is encrypted with the private key and prepended to the start of the message.

@TerryChia That's what I thought

The Internet of Things is another way of saying "whatever crappy protocols we use today, we'll be stuck supporting in 2045".

Tweeted by matthew_d_green on October 14, 2014 at 1:20 PM

1:23 PM

note to self... if you leave burp on 30 min auto-backups with a 300MB burp file, bad things will happen to your disk space

@RоryMcCune Ouch...

VM I hope?

@RоryMcCune If you french fried when you should have pizza'ed, you're gonna have a bad time.

@TerryChia yeah that's why it ran out. only had 40GB assigned

Journeyman Geek

Damn, now I'm hungry.

@RоryMcCune At least it wasn't on the host. That would have been painful.

Xander

1:25 PM

I'm having a hard time getting worked up about SSL v3 allegedly being vulnerable. It feels like I kinda knew that already.

Tweeted by addelindh on October 14, 2014 at 1:09 PM

@TerryChia true true

@Xander "All crappy protocols are crappy, but some protocols are more crappy than others."

1:42 PM

@TerryChia git.openssl.org/gitweb/…

That's a patch to OpenSSL 4 days ago.

Apparently there is some problem with SSL 3.0 + RC4 encryption, and they are disabling it.

@ThomasPornin Interesting...

Looks like a protocol flaw then?

That's a great way to patch stuff.

@TerryChia Might be related to this: tools.ietf.org/html/rfc7366

a new TLS extension to use encrypt-then-MAC instead of MAC-then-encrypt

@ThomasPornin That doesn't apply to SSL 3 though?

@TerryChia Nothing prevents it. RFC don't talk about SSL 3.0 because that's an "historical, foreign protocol"

1:46 PM

@ThomasPornin I thought SSL 3 doesn't have extensions?

@ThomasPornin Was there ever an RFC for SSL3?

It has:
> Forward compatibility note: In the interests of forward
> compatibility, it is permitted for a client hello message to include
> extra data after the compression methods. This data must be included
> in the handshake hashes, but must otherwise be ignored.

I seriously love Cortana on windows phone...
me: "Tell me about Halo"
she: "Halo rings are designed by the most advanced civilization ever, abd they're an awful lot of fun to blow up."

@ThomasPornin Ahhh.

@raz Published way after the fact: RFC 6101

1:48 PM

@RоryMcCune exactly

From the patch, it seems that OpenSSL gleefully accepted the encrypt-then-MAC extension with SSL 3.0 too (and for AEAD cipher suites in TLS 1.2, which already do the MAC properly), and for some reason they should not.

@RoryAlsop hmm, I was reading his question as he's looking for PHP ESAPI examples for preventing XSS, but I read your comment as "you're looking for exploits.."

This probably has something to do with the fact that the SSL 3.0 MAC is not HMAC, only something that "looks like" HMAC (it was designed before HMAC was published).

@RоryMcCune Ahh - I read his question as looking for examples to learn defence, but your interpretation makes more sense

I suppose that the attack setup is actually not very scary; maybe an exploit building on the known RC4 biases, or on length-extension attacks on MD5/SHA-1.

1:53 PM

@ThomasPornin So for some reason encrypt-then-MAC breaks SSL 3.0

@raz That's what it looks like, based on a commit to OpenSSL source code made a few days ago without much explanations.

@ThomasPornin I'm still hoping for something else though. I want SSL 3 to die completely. :)

@TerryChia It bothers me that IE (at least up until IE 10) still supports SSL2

The really good question is: how comes the vulnerability works with SSL 3.0 and not TLS 1.0 (which are very similar).

@ThomasPornin That's what I'm curious about.

@ThomasPornin Also why is it RC4 is called out? if it was AES then it'd be fine?

2:05 PM

@raz From the patch, it seems to be a problem with stream ciphers in general, but that means RC4 since that is the only stream cipher in SSL 3.0.

When using a stream cipher, attackers can do surgical manipulations of the plaintext, since encryption is just a bitwise XOR.

@ThomasPornin right

In fact, it usually goes the other way round: when using a stream cipher, you MUST use a real MAC, and not simply appending a hash of the data and encrypting the whole lot (while if using CBC encryption you may survive).

@ThomasPornin SSL3 doesn't spell out that implementations must first check the MAC then decrypt data does it?

@raz In "normal" SSL 3.0, just like TLS 1.0, 1.1 and 1.2 (except AEAD cipher suites), MAC-then-encrypt is used; so you decrypt, then check the MAC.

RFC 7366 adds a new TLS extension that, if negotiated during the handshake, changes the encryption system to encrypt-then-MAC (so check the MAC then decrypt).

@ThomasPornin Yeah that seems like it should effect things other than just SSL3 then.

2:29 PM

I disagree with the migration of security.stackexchange.com/posts/70622/revisions

@CodesInChaos i also disagree with 404's ):

I don't think people on superuser are the best to figure out if a malicious CD/DVD burner can rewrite data.

@CodesInChaos physics.stackexchange.com would have been better, indeed.

The Bear Has Spoken.

@ThomasPornin Not sure about that either. Physics is part of it. But if you find out that for example you can set bits from 0 to 1 but not the other way round, the implications are non trivial.

2:34 PM

@raz Ah, I was not reading the commit correctly. They disable encrypt-then-MAC for all of SSL 3.0, and also for RC4 on all protocol versions.

@CodesInChaos I like how it was migrated, only to be closed

@ThomasPornin You know that had crossed my mind, but I wasn't sure what the SSL_RC4 macro implied.

CDs/DVDs employ checksums which make manipulation harder and error correction codes which have implications I don't understand.

@CodesInChaos I bet the Internet understands

hey guys, be on the lookout on the suggested edit review queue. Seems we have a user that is doing a lot of poor addition of commas and bolding portions of questions that may not actually be the main part of the question the OP was asking while not altering much more significant grammatical errors

be sure to remember to look closely at edits before approving them

@AJHenderson Lighty?

2:40 PM

yeah

LOL

oh hey, he's in here, that makes life easier to just mention it to him too

lol

awkward....

whistles

in my poor defense, it's not called a review queue to click the accept button

that's actually good, you certainly seem like you are trying to help, and I do appreciate it, but be careful to make sure your edits are significant, complete and valid. For example, it is valid for their to not be a comma before an and

in some areas, it is actually preferable, though I believe that one is a US/UK difference

@Lighty yeah, honestly, the review queue was more my concern, but I'm glad I have a chance to offer feedback to you too

the whole point of the review queue is the idea that newer people on the site don't yet know what a good edit is :)

that's why it's there

2:44 PM

@AJHenderson That and we pronounce it 'erbs rather than herbs

and i appriciate critisism and feedback all alike, because if i screw up and no-one tells me, how am i supposed to know im screwing up?

:18147336 in my defense stuffs donuts in simon's mouth

@Lighty exactly

and I don't mean to discourage you at all. Most of your retags are pretty good

and I'm glad you are putting in the effort

@AJHenderson Why on earth did you delete my message? There was absolutely nothing wrong with it.

@Simon it was rude

3

Because no one ever here was rude. SIgh.

2:47 PM

I honestly almost gave you a short suspension for it. There's a big difference between joking around on casual matters and being harsh on an actual site issue

Have fun.

@Simon you know you could have just used another word in place of that one...

@RoryAlsop And now you are teasing the non-blue people, who cannot read deleted messages.

@ThomasPornin What he said

grabs popcorn

2:50 PM

@ThomasPornin I didn't actively remove that one. That was flagged, and deservedly so

@Simon - you knew that would get flagged. Why deliberately cause friction?

@Simon - just for the record, that wasn't me that flagged or validated that, I was going to let it go personally

@ThomasPornin blue and room owners :op

@RoryAlsop I don't deny that. It was from @Simon so I can imagine it was not elaborate literature.

I agree it wasn't appropriate, but I also don't mind attacks on me personally if people are frustrated

However, discussions about the word-that-should-not-be-named tend to be frustrating to bystanders.

tombull89

2:51 PM

@RоryMcCune ...and those that saw the flag in the first place...

If it was offensive then it deserves to be blasted and then forgotten.

@tombull89 yeah that too

So I go watch a Youtube video in full screen for just a few minutes and the entire room blows up.

3

@TerryChia welcome to the internet

Nah - it's a bit overblown. Sometimes this is why I just edit out an offending word from some folks - see the 5* quote in the star bar to the right :-)

tombull89

2:53 PM

@TerryChia somewhere, in the stack exchange datacenter, a virtual machine explodes

@tombull89 I don't think SE runs VMs? IIRC they just have IIS on a few servers.

As @Thomas said though - it's done, it was flagged, I validated the flag, that line was deleted - let's now move on

@RoryAlsop what and avoid drama...what sort of crazy Internet would that be!

AJ agreed it wouldn't necessarily have offended him, but it offended someone - as swear words often do

@RоryMcCune :-)

@RоryMcCune brb pinging Linus.

2:56 PM

@TerryChia yeah tell him, Richard Stallman and Theo De Raadt that the other two are here talking smack about them

@RоryMcCune Hehe. I actually appreciate Linus' cussing but Theo is on another level entirely.

poeple sometimes tend to say they don't mind swearing, like if you have a bad day, and curse at your PC, aslong as it isnt pointed to someone, or turns into a Call of Duty chatbox, it's fine

right?

anyway, back to the conversation I was having with Lighty. Keep up the effort, just try to be aware of what is a real grammatical issue vs a stylistic difference, try to make sure that if you are fixing grammatical issues, fix as many as you can and make sure to be very, very careful when adding emphasis when you don't know for sure which part was most important to a user. It isn't always the shortest or intro question, but may be that they actually want the details in their final statement

and if you ever have questions about something, feel free to ask in here about it too

all our joking and off topic discussion aside, the primary point of the room is still ostensibly IT Security and helping improve the site

Lighty fixing grammatical issues... Hmm...