The DMZ

AviD

2:00 PM

@RоryMcCune both the red team part, and the lead.

also, Q&A site.

Adnan - Adi

@Xander Nice articles on LinkedIn

Rоry McCune

@M'vy I'm guessing he wants some words he can play back to the customer to justify the creation of accounts during a red-team assessment

AviD

@RоryMcCune I also get very annoyed when the entire difference between a blackbox and whitebox is perceived as " {we were not given any credentials}"

Rоry McCune

@AviD heh, yeah

M'vy

@RоryMcCune BTW Red Leader is Wedge Antilles, isn't he?

Rоry McCune

2:02 PM

@M'vy nice ref.

AviD

@M'vy Gold Leader.

M'vy

:)

AviD

oh! no, I was wrong, you were right!

it was red squadron.

> Denis Lawson confirmed in May 2014 that he was asked to reprise the role of Wedge in the upcoming Star Wars: The Force Awakens; however, he turned it down, saying that it would have "bored him"

wut

M'vy

@AviD Read it as "he does not want part in this upcoming mess"

AviD

no, I think he's pulling an Ecclaston.

M'vy

2:08 PM

@AviD a what?

AviD

Christopher Ecclaston. Ninth doctor? Later disavowed any interest in the series.

M'vy

Eccleston

raz

@AviD Which is lame, because I thought he was awesome.

M'vy

ok

@raz I love him saying "fantastic" :P

AviD

@raz yes he was fantastic.

raz

2:09 PM

Yes!

paj28

hi guys

Rоry McCune

@paj28 watcha'

paj28

do Android devices do full disk encryption?

I had it in my head all smartphones had done this for ages

but now I read...

Rоry McCune

@paj28 shame you didn't make it up to Securi-Tay last week, was a good day

paj28

pcworld.com/article/2891148/…

Rоry McCune

2:11 PM

@paj28 they can but don't by default

paj28

ah, I see

Rоry McCune

and IIRC the SD cards don't even if you do do it to the rest of the system

@paj28 from what I've read there are performance concerns with default enabling

@paj28 but yeah the situation is worse than on iOS or WP8

paj28

gotcha

this explains why some banking apps have their dodgy home-brew crypto

Rоry McCune

@paj28 yeah also they're trying to protect themselves against other apps that are on the system, I think

raz

Well you can't make it mandatory when half the Android phone market is still running crappy hardware.

paj28

2:13 PM

is there anything like a "sensitive area" where apps can put a small amount of data that will be encrypted on all versions?

raz

The higher end phones would probably perform just fine.

AviD

@paj28 actually probably more to do with dodgy in house developers

raz

@paj28 Each app has their own user and group, with their own essentially "home" directory.

paj28

yeah, that's fine for attacks from other apps

but as the whole disk is not encrypted, it's no protection in a lost/stolen phone scenario

raz

Right

paj28

2:14 PM

@RоryMcCune - so how was SecuriTay?

did you have a go at the Pentest challenge?

Rоry McCune

@paj28 was good, decent turn out interesting talks.

@paj28 I didn't get times, between other talks, saying hello to people and doing my own talk, the day flew in ..

paj28

What was you talk?

M'vy

Still no videos from the talks online?

Rоry McCune

@paj28 it's about the lack of security on modern software lib repositories (e.g. Npm, rubygems, PyPi etc)

@M'vy not AFAIK, unfortunately they can be a bit on the slow side (students!)

M'vy

@RоryMcCune ah ah :)

paj28

2:18 PM

Ah, very good!

So, just going back to Android for a minute

If an app does need to store some sensitive data locally

What are the best practices for doing so?

Rоry McCune

@paj28 ah, now you're stepping somewhat off my manor, not done too much with Android App.Sec. From what I've seen there's a couple of options tho. there are some MDM style providers who provide a kind of "encrypted bubble" for apps (e.g. airwatch, good)

and I'm guessing there will be an Android encryption API but I've not seen much on that

Xander

@Adnan-Adi Thanks! I'll pass it on. She's been on quite a tear the last few weeks, writing them.

AviD

@paj28 @RоryMcCune best practice would be to switch to a more secure mobile OS.

Adnan - Adi

The leader of the True Finns Party (Finnish equivalent of UKIP or the Tea Party) yle.fi/uutiset/…

> I'm surprised more immigrants don't come to Finland

M'vy

hum just read an article about signatures in email.

Then I checked an email from my corporate to personal box. And I have this awful signature added to each and every of my mails... oh god...

Kisunminttu

2:25 PM

@Adnan-Adi I wonder what some of their supporters think about that

Adnan - Adi

@Kisunminttu I just noticed that you changed your profile pic

It's very very similar to the old one

Kisunminttu

@Adnan-Adi Just did

@Adnan-Adi It's a theme, man

Arperum

@Kisunminttu But is it different enough to not be confused with me?

Kisunminttu

@Arperum Yeah I think so

Xander

@RоryMcCune It's an option. I have FDE enabled for both my device storage and the SD card.

Arperum

2:27 PM

@Kisunminttu Yours is clearly darker than mine now.

Rоry McCune

@Xander ahh interesting, how does it work for SD? Can you unlock with a password on another system, or does it essentially force the SD to only work with one phone?

Xander

@RоryMcCune No idea. Never tried it. I just know I can't read it on my PC any more. :-D

@RоryMcCune That is a good question though. I should find out.

AviD

2:47 PM

@Arperum we never confused @Kisunminttu with you. We often confused you with her.

Kisunminttu

@AviD :D

Arperum

@AviD I am many people it seems. There is a theme of people confusing me with others in the SE chats.

Kisunminttu

I hate it that shipping from Finland to anywhere else is so expensive

Rоry McCune

@Arperum don't worry it's not just you. In here we confuse lots of people with other people (or suspect them of sock-puppetry)

Kisunminttu

Tracked shipping to the US? 36 eur. For up to 4.5 lbs. So basically doesn't matter if you send a pair of earphones or a clarinet, it's still 36 euros.

Rory Alsop

2:54 PM

@RоryMcCune - quick off topic query, as I figure you'll have a recommendation:

portable hard drives (2 Tb or more) - any good choices?

I'm planning on picking up a western digital in a USB chassis

M'vy

@RoryAlsop WD is always my go to for HDD

Rory Alsop

googling seems to suggest that's an ok brand these days, but I haven't done any deep research in ages

@M'vy cool

M'vy

@RoryAlsop I recently purchased a "passport" one

Rоry McCune

@RoryAlsop yeah the WD ones I've had have been fine. TBH most brands are ok (although Seagate had some problems with their 1.5TB ones IIRC)

if you're not after speed, the WD green or blue lines should be fine

Red is more for NASs' and Black for speed demons :op

M'vy

@RоryMcCune have been running a velociraptor for years now in my desktop at home. Is black the new gen for these? (10'000 rpms?)

Rоry McCune

2:59 PM

@M'vy hmm not sure they're 10k RPMs but IIRC that's their "fast" line

M'vy

ok

Comparison screen does not state the RPMs. Darn

Rory Alsop

@RоryMcCune For this purpose, speed is not of the essence, so a blue or green is probably the way I'll go

Xander

@Kisunminttu Yikes. That is a lot of money for something small.

3

Rory Alsop

(It's more for a new offsite backup of important stuff - music and pictures)

M'vy

Ok black is 7200 RPM like blue it seems

Xander

3:02 PM

@M'vy 7200 IIRC.

Arperum

@Kisunminttu So if you send earphone,s make sure they are protected extremely well and that the bag contains some specially crafted finish stones as wel.

Journeyman Geek

maybe more cache?

Kisunminttu

@Arperum Just sucks that if I send something small and valuable it will be the same price as something big and valuable. That's so dumb.

throws tantrum

Arperum

@Kisunminttu It absolutely is.

Journeyman Geek

@RoryAlsop: does it have to be WD?

Kisunminttu

3:03 PM

@Arperum The system used to be weight based

M'vy

@RoryAlsop red series seems targeted at professionals (NAS mostly)

Journeyman Geek

Red's got some NAS centric settings

TLER comes to mind

Arperum

@Kisunminttu Yea, but this way they can earn more on the bulk of packages that is super light.

Kisunminttu

@Arperum Yep. And then nobody wants to use their services and the prices go up again

Arperum

@Kisunminttu And everyone who uses it adds extra weight out of annoyance -> even more priceraising.

Rory Alsop

3:14 PM

@JourneymanGeek nah - a quick 2 minute googling suggested they were currently reliable

Journeyman Geek

ahh k

You only have 3 real choices anyway

seagate sucks. Your only other choice is toshiba, who arn't too bad

for 3.5 inch drives tho, HGST is probably the most reliable by far

Rory Alsop

@AviD - Interestingly the Pentagon has office numbers ranging from 100 to 1099. (I was googling 1099)

raz

is it 10 stories tall?

Nope only 7

Rory Alsop

@raz it's a bit huge - 17 miles of corridors

(I was looking at comparisons: Buckingham Palace, the White House and then the Pentagon)

did you know Buck Palace has nearly 800 rooms?

raz

3:31 PM

My palace has 4 rooms.

Rory Alsop

3:45 PM

@raz ...

raz

yes?

Rory Alsop

> palace
ˈpalɪs
noun
a large and impressive building forming the official residence of a ruler, pope, archbishop, etc.
"the royal palace"
synonyms: royal/official residence, castle, mansion, stately home; More
informal
a large, splendid house or place of entertainment.

"large, impressive, official residence, splendid"

just sayin...

;-P

Lucas 'Paul' Kauffman

Riverside groovy duck handlers

Kisunminttu

@Lucas'Paul'Kauffman Says the llama with a UFO as a hat

Rory Alsop

FTFY @Lucas'Paul'Kauffman

Kisunminttu

3:55 PM

@RoryAlsop : D

Lucas 'Paul' Kauffman

LOL

Kisunminttu

IRL lol'd

Lucas 'Paul' Kauffman

@AviD is Checkmarx israeli?

Rory Alsop

@Kisunminttu I just let my brain make up fluffy stuff

Lucas 'Paul' Kauffman

@RoryAlsop like a fluffy llama :o?

Rory Alsop

4:00 PM

like some odd questions:

2

Q: Recreational activities for glass people

This is related to How can Glass people survive?. So, I have glass people in my world. We already talked about how are they going to survive. Now, I want to know what recreational activities could they have? At first, I thought of making them hostile but now I want them to share their culture wi...

Rоry McCune

@Lucas'Paul'Kauffman IANA but yes it is

Adi

So... I've just sent Barack Obama an invitation on LinkedIn

I guess this is goodbye. Bye bye, friends!

Kisunminttu

@Adi :(

Don't go!

Adi

I won't. They'll take me

Kisunminttu

@Adi I have a secret hideout

@Adi Unless of course you want to go...

Adi

4:05 PM

@Kisu You haven't written any answers lately on Bio.SE

Kisunminttu

@Adi I checked the site today. Those questions? Wayyyyy outta my field of knowledge

Adi

@Kisunminttu Said 99.9% of the people who write highly-upvoted answers on StackExchange

Including myself

Kisunminttu

@Adi Dude have you seen the questions? Like 80% of them are about DNA and RNA. Not my field.

Besides. I'm doing spring cleaning.

#sobusy

Lucas 'Paul' Kauffman

Kisunminttu

@Lucas'Paul'Kauffman The last part is hilarious

M'vy

4:13 PM

@Lucas'Paul'Kauffman O_o

Rоry McCune

4:42 PM

ohh can't believe I missed todays easy reptrain!

Lucas 'Paul' Kauffman

@RоryMcCune which one?

Rоry McCune

the "freak" TLS one

Lucas 'Paul' Kauffman

ah

yea

Rory Alsop

@RоryMcCune link? I only see one, which has one answer with zero votes

Rоry McCune

7

Q: In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as I understand it) is that an active MITM can inject packets that will result in a downgrade to the old 512-bit RSA-EXPOR...

tls attacks man-in-the-middle brute-force

raz

4:47 PM

Not only is @RоryMcCune slacking, he's lazy too

Rоry McCune

564 views but looks like a potential train to me

Rоry McCune

6:05 PM

wonder-tonic.com/geocitiesizer/…

schroeder

7:21 PM

hm - it looks like hping3 fell into disuse while I wasn't looking. What do you all use for packet creation/crafting?

scapy looks under active development .... bb.secdev.org/scapy/commits/all

Rоry McCune

@schroeder from what I've seen a lot of people use scapy

I don't do a lot of stuff at that level, but from what I've looked at, it looks pretty cool (even if it is python <shudder>)

raz

@schroeder I've used scapy. Super easy, supports a ton of protocols.

Easy to write wrappers around their stuff for customization. I created a simple ipv6 fuzzer from scapy

schroeder

7:37 PM

cool - I wrote a packet grenade tcl script for hping to be used inside a network to test the firewall rules, but when I tried to install hping in a new environment, I was finding trouble

I might have to port it for scapy

@RоryMcCune if nothing else, Python is a very powerful scripting language with easy to read syntax

I admit that I like Python for that

it's also great for rapid prototyping

but, I won't argue about its limitations and poor implementation as a heavy-lifting programming language

raz

@schroeder yeah when used for production level stuff it doesn't scale well. But I love experimenting with different things using python.

Just quick, easy, and dirty, like @Simon's mom.

5

Rоry McCune

7:59 PM

@schroeder yeah I more <shudder> 'cause I'm a ruby person, and some pythonisms (white space is significant!) seem odd to me

Iszi

@raz Hey, I thought I had exclusive rights to jokes about @Simon's mom. Or are you volunteering to be his new dad?

raz

@Iszi Pfft I break rules like I drop bombs

Simon

8:26 PM

pls all moratorium

2

Rоry McCune

@TerryChia lol Go github.com/golang/go/issues/9637

raz

9:01 PM

@RоryMcCune So they're opting for less security...

to make it more secure

Rоry McCune

@raz yeah silent fallback to an unencrypted protocol never hurt anyone right?

raz

Definitely never hurt SSL...

I'm sorry but these questions make me laugh

-1

Q: How to Recover infected files by CTB-Locker

I have a big problem at my work with a computer infected by CTB-Locker (the whole disk drive files are encrypted) Is there any way to recover the infected files without paying the ransom???!!!!! also there are no available backups

ransomware

Jeff Ferland

9:46 PM

@AviD Yup. No longer at The Book. I'm at a little analytics startup right now and feeling out what I want to do going forward.

Simon

@JeffFerland WAT

Jeff Ferland

9:57 PM

@Simon Yup. That's all of it.

Rory Alsop

11:13 PM

@JeffFerland well, congratulations and fingers crossed, then :-)

Gilles

1

Q: Protecting Registers in Context Switch

I'm working on implementing a cryptographic algorithm. I'm using locked memory pages to keep sensitive data (such as keys and intermediate values) locked in RAM (having them never be written to swap). See mmap(2). Is there any way I can protect the CPUs registers and other "intermediate" memory...

process memory encryption

Stack Overflow or Information Security?

it's intermediate between how-to (if you take the question at face value) and security policy (if you tell him what he needs to know)

Simon

@JeffFerland Best of luck, sir.

Jeff Ferland

Thanks! So far so fun / insane :)

Transcript for