The DMZ - 2011-11-16

« first day (335 days earlier) ← previous day next day → last day (4537 days later) »

2:36 AM

Should we be allowing this question? Seems like it's an active and unauthorized attempt at circumventing an organization's security - not what we're here for.

0

Q: How to listen to all ports (UDP and TCP) or make them all appear open (linux)

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them manually. On my Debian server I would like to listen to all my UDP and TCP ports so I can clearly ...

firewalls ports

6 hours later…

8:52 AM

todays morning comic:

user image

Citogenesis

5 hours later…

1:43 PM

@Iszi I think it's probably ok, just not exactly clear.

At first blush it looks like he's asking for help bypassing the firewall, however he's really just wanting to map out what ports are being blocked at their border firewall.

1:55 PM

Hi all - getting some weird traffic reports spitting out of my firewall - I'm wondering if anyone has got a quick idea of what might be going on. One of our users's is using a macbook with a static IP. My firewall is showing hundreds of unhandled (no policy) packets coming from her IP to the gateway. The destination port is 10101, and the source port seems to be trying every possible port (my logs start at 58*** and are now at 61***). Any ideas what's going on?

Seems somewhat like it might be a sort of malware scanning for holes in our gateway/firewall. She's certainly not a techy enough user to be doing a port scan herself, but it's possible that she's got something malicious that she doesn't know about

@jwegner Google says it's probably either BrainSpy or Silencer. Good luck.

@Iszi, thanks

@jwegner Curious though: How'd they end up with a trojan on a macbook? They running Windows in Boot Camp, or a VM, or something?

2:11 PM

@Iszi, they've got parallels. Doing a bit more research to confirm that it's not Growl or eZMeeting link, but it's likely an issue in their parallels

@jwegner Legitimate software like that shouldn't be doing port scans.

@Iszi, I don't mean to make you do my research for me, I just figure you know a bit more, given that you hang out in this chat.... Will a microsoft security essentials install most likely install/remove Brainspy and/or silencer?

@jwegner It depends. If the system's been root-kitted, then I wouldn't count on it.

In the rare case that I ever actually catch a virus infection these days, I usually just rebuild.

ouch

And then make sure antivirus is the first thing you install. (After, perhaps, MS updates.)

2:15 PM

Sounds like I might just tell her to get rid of her dang personal laptop... We bought her a 27" iMac that she refuses to migrate to.. This may be a good excuse.

@jwegner As good as any, I'd say.

Alright, I'm gonna go see if I can get it removed. Thanks for your help.

3:05 PM

@Iszi @jwegner Almost every application uses random source ports to connect to a destination server. DNS queries, your browser, etc will do the same. 10101 indicates "ezmeeting-2" as much as "Brainspy". Go on her machine and use the Sysinternals tools to determine what application is actually using that. It may have been intentional on the user's part.

@jwegner Also, I accept 27" iMacs as payment for advice :)

2

@JeffFerland I'd generally agree with this, but will ever application keep trying source ports in order until they find one they can get out with?

@Iszi Source port randomization is relatively new. Historically, source ports for new connections have incremented. A changing destination port is a port scan. A changing source port is just plain common. See en.wikipedia.org/wiki/Ephemeral_port (and no clicking on other links... you know how you get).

"Most implementations may simply increment the last used port number until the ephemeral port range is exhausted."

@jwegner the above is useful for you too

3:26 PM

@JeffFerland Tivoli does this, as do various FTP implementations and a host of other 'above board' apps

@RoryAlsop Well, @JeffF got it spot in when he said, "just plain common."

Until recently one assumed that all normal applications did this.

@ScottPack yeah - it has always been a complete PITA

at least proper stateful firewalls can cope

nowadays

Mebbe

I can into an interesting issue with a Juniper SSG a couple of weeks ago.

It was blocking DNS responses

It was not properly detecting the response as part of a related connection to the request.

@ScottPack ahh

Incidentally, you can not create a firewall rule based on source port using the NSM.

ಠ_ಠ

4:28 PM

good evening sec.se folks

@AviD Hello

.... and bears

Afternoon

@RoryAlsop you around? something I wanted to discuss with you...

besides how much I hate Fortify.

well, its not so much hate. It's more that I despise Fortify.

@AviD I'M ESTABLISHED.

4:34 PM

another bear!

@AviD yep - here

@AviD they're taking over the world

@TomLeek @ThomasPornin Same person / puppet, right? That or your writing style is freakishly similar.

well, at least Canada, anyway

and if so, why?

@JeffFerland MY NAME IS LEGION: FOR WE ARE MANY.

4:41 PM

This is just... wow.

Just reset my ISC2 password so I can vote for @wimremes , and ISC2 kindly send me my new password in the clear in an e-mail, WTF!

Tweeted by raesene on November 16, 2011 at 4:38 PM

You'd think (ISC)^2 would be more up-to-date than that.

So yes, same person, sockpuppet and all. Keeping writing style aparts is too much work; but bear #2 tends to be less well-mannered.

@Iszi I always thought that avatar looked suspiciously like Rory.

@Ninefingers Different Rory, but they used to work together.

@Ninefingers Y'know, when I first began to roam security.SE, I just blindly assumed that the two Rorys were the same person.

Team Rory!

4:42 PM

Pretty sure the other one used to hang out here too.

I just don't understand why the second account

@Iszi He did

So he can repcap twice on the same day?

@Ninefingers hahahaha - there are a lot of Rorys

@JeffFerland Mostly for fun.

@ThomasPornin It took me a while to keep them separate

4:43 PM

@JeffFerland he still does occasionally - but he set up his own consultancy as well, and is doing well, very busy

@JeffFerland ALSO TO PWN YOU ALL

@Iszi Actually used to work together in 4 different companies on different occasions

the real question is, who would win in a fight: bear vs. lion?

no frikkin lazer beams, and no sleepy lions allowed.

@AviD with or without lasers

sorry 'frikken' lazerz!

hehe

4:49 PM

0

Q: GPU powered Password cracking machine - buy metal or cloud?

As a IS consulting firm, we would like to have our very own password cracking machine. Great. Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU or rainbow tables). And the questions that we found hard to tackle was what is the best choice -...

cloud-computing

That's a math word problem disguised by security words, right?

Anyone know any news on this?

11

Q: IT Security SE Logo Wallpaper

Just wanted to post here, to officially request something that was mentioned in chat: An IT Security StackExchange wallpaper. I think the main site's "banner logo" (including: lion, shield, starburst, wings, "Tron lines", banner) would look great against its current backdrop color, as a full-s...

feature-request design

@JeffFerland Something along those lines. I voted as off-topic instead of localized.

@Iszi That feature was requested in June, and the last comment from @Jin was in September... :-(

@JeffFerland I reckon so, however I don't think maths.se would thank us for it. Your answer seems spot on.

@RoryAlsop onstartups?

well, I have to brave the storms to go out for a nighttime meeting.

will be my first time seeing rain this year... :-o

hope I dont melt.

@JeffFerland possibly - honestly don't see it as totally on topic anywhere

5:02 PM

@RoryAlsop +1

@Iszi have had no news on it, but I think it would be good to have it as a marketing tool, given the ubiquity of laptops at conferences etc, having a cool desktop attracts attention

@Iszi @jin guessing you are kept busy with new graduating sites, but what do think in terms of timeline?

@JeffFerland Also, free T-shirt

@ThomasPornin hahahaha - you are after 2 free t-shirts :-)

all that work - I knew it had to be for some reason

@RoryAlsop Wonder if those will come before or after the wallpapers?

Speaking of... how's our top users pages doing?

Last user on second page has 779 rep.

5:08 PM

@ThomasPornin Yeah, it looks like a third of the way down is where we drop below 1k.

It is totally arbitrary on my part, but I like to think that the threshold is when the first two pages are all "established" users (i.e. 1k+)

@Iszi I don't know what the criteria are, but mentally I'm thinking first 2 pages over 1k is a good milestone

@ThomasPornin I see your puppet is quickly making his way towards page 1, though.

@RoryAlsop I hereby formally deny any allegation about Rory being my sockpuppet, or vice versa.

2

@ThomasPornin hahahahaha

one single brain cell

5:09 PM

@RoryAlsop Why do I seem to recall mention of the third page being involved in the criteria?

@Iszi could be true - I had a look on MSO and there was never anything concrete. SE like to keep thresholds secret so folks can't target them

At least page 3 is still all >500.

I reckon if Tom Leek gets up to second place we should all change our avatars to bears

@RoryAlsop They like to keep a lot of their special sauce recipes secret, it seems.

@RoryAlsop Hey, let's do that!

Like, for a week or so.

@AviD will be easy to pick out though, 'cause he'll surely be using Winnie the Pooh.

evening all - need to head home and sleep. Had epic gig supporting KMFDM last night so got home at 3, headed off to work at 7 and am exhausted now :-)

catch you tomorrow

5:19 PM

@RoryAlsop Glad to hear things went well! Good luck recovering, I hear that starts to get difficult after a certain age. :)

5:55 PM

This is all your fault, @AviD. All your fault. github.com/ninefingers/pmon. So far, it's just a driver that loads in and loads out without crashing windows - all I've done is set up a simple example and the appropriate key signing stuff to make it work on x64. I need to decide how I'm going to proceed at some point - stage two is just to catch IRJ_* and dump that out to the debug log. Stage 3 is to make it say hi to userland. Actually, I might do that first.

But, I just wanted you to know, I blame you entirely.

6:10 PM

I think I have some way to go yet, but still.

Right, gotta run anyway.

So this makes me happy. Check out his shirt

Brendan Long, Colorado

206 7

hash appsec web-application authentication javascript client-side cryptography

6:36 PM

@ScottPack Captain Hammer?

Yup

2 hours later…

8:13 PM

Stack Overflow Blog: SE Podcast #27 – Dave Winer

Posted by Alex Miller on November 16th, 2011

Jeff & Joel are joined today by Dave Winer, who’s upset that we don’t have a jingle to start the show! He “invented” (well, pioneered, really) the XML-RPC protocol. Dave tells us the story of how and why the protocol came to be.

Right now, Dave’s working on a “magnificent symphony of software” – it’s the communication system he wants to use. It involves a minimal blogging tool with only RSS output (plus a dongle that will push the RSS to twitter, etc), a “River of News” aggregator, and an overarching tool for creating content that can be picked apart and included on other platforms. …

8:49 PM

Ah, this one's great.

in Mos Eisley, Nov 7 at 15:58, by Jeff

This drive-bye posting was brought to you by StackExchange - draining more productive time than TV tropes since 2010

9:01 PM

Or wikipedia

@ScottPack True

@Iszi Thats based on the theory that you would otherwise be productive. Not necessarily a good assumption.

@thisjosh Depending on the individual, I suppose.

@Iszi Yup for moste statements, given enough people, someone will make your statement false. Including this one.

@ThomasPornin Ah thats why I like Bear #2.

@JeffFerland Its an economic question

9:17 PM

@Iszi When trying to understand how a power works, would asking for an example combat round be reasonable on rpg.se

@ScottPack It doesn't seem *un*-reasonable to me.

That implies that you don't necessarily find it reasonable, either.

9:44 PM

@ScottPack Arguably.

9:59 PM

Well, I realize that the purpose behind asking that question would not be to actually find an answer, but to demonstrate documentation to my DM. The rules are pretty clear, he just doesn't like it :).

However, there actually was a related question, that I'm writing up instead. Something that, I have a feeling on the answer, but I don't actually know.

Holy crap, loads of Pathfinder questions now

10:11 PM

evening - I've woken up now

:-)

evenin+/-12

11:08 PM

hey guys, want this question?

0

Q: Cisco IOS IPSEC Site to Site VPN "send errors"

I have a recently setup (never worked) IPSec VPN between two Cisco IOS routers. The VPN comes up fine, both ISAKMP and IPSEC negotiated without issues - the SAs are sitting there waiting. Traffic is matched to the match-address ACL - no problem. However, all packets that are sent do not make i...

thinking its more appropos on SF...but giving you guys first pick

11:20 PM

I think SF is right.

@Scott What do you think?

All the diamonds are sleeping.

@thisjosh that's all right - yous is the 2nd opinion I've got that it's better on SF - migrating there.

thanks for the help - love your site design btw!

Thank @Jin he did an awsome job.

just complimenting you guys on your site, that's all. :)

cheers!

Thanks, cheers!

@ScottPack If it's a DnD 4e question, I might be able to assist some. But, I've let my D&DI subscription lapse. So, you'd have to give me rulebook references and/or citations.

@ScottPack Nevermind. I saw your tweet. Dunno Pathfinder.

« first day (335 days earlier) ← previous day next day → last day (4537 days later) »

Transcript for

Nov '1116

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile