Charcoal HQ

SmokeDetector

20:13

[ SmokeDetector | MS ] Bad keyword with email in answer, pattern-matching email in answer: Using Disqus / reCaptcha in a Meteor Application by Database hackers on stackoverflow.com (@quartata)

tpu- by John Militer

Mithrandir

@quartata huh?

What's that command format?

SmokeDetector

[ SmokeDetector | MS ] Bad keyword with email in answer, pattern-matching email in answer: how to create a user programmatically using comment_presave hook? by Database hackers on drupal.SE

[ SmokeDetector | MS ] Bad keyword with email in answer, pattern-matching email in answer: How do I add venue location automatically when user selects a venue? by Database hackers on drupal.SE

Mithrandir

SD 2k

SmokeDetector

[ SmokeDetector | MS ] Potentially bad keyword in answer, username similar to website in answer: How to pull Amazon keyword list with rank/search volume? by Pawan Purohit on stackoverflow.com (@quartata)

quartata

@Mithrandir Smokey doesn't care about any non alphanumeric characters after the command

Mithrandir

20:21

!!/blacklist-keyword worlddatabasehackers@gmail\.com

SmokeDetector

@Mithrandir That pattern looks like it's already caught by Pattern-matching email in body and Pattern-matching email in answer; use !!/blacklist-keyword-force if you really want to do that.

quartata

So I change it up to keep people on their toes

!!/location();

SmokeDetector

@quartata ArtOfCode/EC2

Thomas Ward

@quartata what if we don't have toes

what then hmmm?

quartata

@ThomasWard Fine servos

Thomas Ward

20:22

what if we don't have any servos

what if we're amorphous noncorporeal blobs of energy :p

quartata

You could probably grow a pseudopod if you wanted to

So how about "limbs"

Mithrandir

SD 2- k

Thomas Ward

what if we don't have any limbs because we're noncorporeal?

sorry i'm bored, deal with it :p

SmokeDetector

[ SmokeDetector | MS ] Mostly non-Latin answer: How to implement full text search on complex nested JSONB in Postgresql by すずきはやと on stackoverflow.com (@quartata)

Mithrandir

SD n

quartata

20:26

sd n

!!/test? hackers@

!!/test? hacker@

sd 2poof

Mithrandir

!!/wut\!!

quartata

Weird I thought I blacklisted that

SmokeDetector

@Mithrandir Whaddya mean, 'wut'? Humans...

Mithrandir

!!/test [email protected]

SmokeDetector

> Bad keyword with email in body, bad keyword with email in title, pattern-matching email in body, pattern-matching email in title
----------
Title - Keyword *hackers* with email [email protected]
Title - Pattern-matching email [email protected]
Post - Keyword *hackers* with email [email protected]
Post - Pattern-matching email [email protected]

quartata

20:29

I was almost positive I blacklisted hacker@ as its own keyword

tripleee

@quartata there was a commit by Doppelganger on Jul 3 which removed some FP-prone patterns related to that

Mithrandir

*greener

tripleee

yeah, my bad

quartata

Ah that's OK

I had a better pattern

tripleee

not sure if that's what you were thinking of

quartata

20:34

\b.*hackers?@.*\..*\b

tripleee

pushed some watchlist additions, CI in progress

quartata

44/45 TPs when I last checked

tripleee

the unbounded regex is going to get you into trouble, don't use .* in these patterns

SmokeDetector

[ SmokeDetector | MS ] Bad keyword in title: JOIN THE GREAT ILLUMINATI BROTHERHOOD BE RICH AND FAMOUS by Ramsey Noah on history.SE

tripleee

@SmokeDetector k

quartata

20:36

Sorry that should be .*? but I don't think MySQL regex liked it

SmokeDetector

CI on 3174726 succeeded. Message contains 'autopull', pulling...

[ SmokeDetector ] SmokeDetector started at rev 3174726 (tripleee: Watch bitfinex\.com --autopull) (running on ArtOfCode/EC2)

quartata

This was the regex that crashed MS one time haha

SmokeDetector

Restart: API quota is 12287.

tripleee

!!/watch 738398822

SmokeDetector

@tripleee Added 738398822 to watchlist

tripleee

20:37

@quartata even then that is going to skip word and paragraph boundaries in order to get a hit if one is possible. You really can't use .* here, you have to constrain it to something like .{1,20} if you really have to have a "anything" character

quartata

@tripleee When you merge the bad NS thing will there be a corresponding blacklist command?

tripleee

@quartata at this point it's just a hardcoded single domain name but I suppose it could be extended

SmokeDetector

CI on 1c6a31e succeeded. Message contains 'autopull', pulling...

quartata

@tripleee It won't skip a word boundary since there's one at the end and its reluctant

tripleee

I really don't expect there to be more than three or four active at any point and creating one requites significant research

SmokeDetector

20:39

[ SmokeDetector ] SmokeDetector started at rev 1c6a31e (SmokeDetector: Auto watch of 738398822 by tripleee --autopull) (running on ArtOfCode/EC2)

Restart: API quota is 12275.

quartata

It's just supposed to spot email addresses with hacker(s) before the @

@tripleee fair

tripleee

@quartata your pattern matches "shackers@really anything where there is a period eventually. like this"

quartata

And probably not something any code admin should be able to do

tripleee

@quartata dunno about "should" but I don't realistically think there will be a need

quartata

Just mean that it takes enough research to warrant a review before merge

Something that the blacklist commands were made to avoid

tripleee

20:40

looks like they are moving to Cloudflare more and more which we can't block (but maybe somehow leverage otherwise)

Halflife routinely does an NS query (and soon I hope whois) so I have a pretty good picture of what they are using now

I hope to be able to make it visible to others here soon, but not sure in what form exactly

quartata

If you're concerned about the Whois data you could post hashes instead

Of names

tripleee

a chat reply to selected Smokey posts would be elegant but probably hard to tune (should we report on everything? probably not) so I'm thinking exposing Halflife's logs to a broader audience would be a nice start at least

@quartata it's all public data and not mine in the first place, why should I be concerned?

here's a snippet to whet your appetite

quartata

I mean I don't know I just kind of took it that way when you said "make it visible to others"

Sorry

tripleee

halflife:2017-08-26 20:21:11,732:Post 82293 below auto (51) 0:00:14.731999 ago
halflife:2017-08-26 20:21:12,659:82293: pawanpurohit.com is not blacklisted or watched
halflife:2017-08-26 20:21:12,659:82293: pawanpurohit.com: ns ['ns1.pawanpurohit.com.', 'ns2.pawanpurohit.com.']
halflife:2017-08-26 20:21:12,659:82293: pawanpurohit.com: ip 162.144.55.190 (162-144-55-190.unifiedlayer.com.)
halflife:2017-08-26 20:21:12,660:82293: pawanpurohit.com: 0/3 over 7 days, 1:08:48

quartata

It would be nice if MS offered us a better way of viewing info on specific blacklisted keywords, this is the kind of thing that could be included with it

tripleee

20:45

godaddy.com/whois/results.aspx?domain=pawanpurohit.com would be nice to add but as you can see (once you click past the CAPTCHA) there's nothing there to see

@quartata I'm thinking domain names should be a record type in Metasmoke actually

@quartata it just runs in my screen on a shared server right now so only Undo has any chance of seeing the results

if it could publish those to a websocket, people who want to see what it's doing could easily review information about recent posts

but of course the code is in Github so you could run it locally if you wanted to

it's only two simple dependencies, plus you need a Metasmoke API key

... or it could post a detailed stream to a dedicated chatroom I suppose, but I really like the websocket idea because that should make it easy for others to build additional tooling on top, or whatever (userscripts, anyone?)

quartata

@tripleee Yeah, I agree

Thomas Ward

@tripleee "there's nothing to see" how?

just saying there's info in there.

quartata

In fact

tripleee

@ThomasWard it's anonymized so very limited interest

quartata

Jan 9 at 23:22, by quartata

@ArtOfCode You've pobably considered this before but should keywords (or groups of related keywords) have separate reason weights?

tripleee

20:53

domains by proxy IIRC (just closed the tab)

quartata

Different reasoning for implementation, same concept

having entries for domains

Thomas Ward

@tripleee hmm... true. That said, I see useful data on some deep digdowns with some of my specialized tools, but eh

tripleee

I'm thinking we should extend the data model, now it only has posts and reasons (and user names and a few other tables) but having domains extracted and indexed and annotated with metainformation would add the ability to reason about domains and check how many hits we have for each, when they started, etc

this information is awfully hard to extract and manage right now

so more of a Metasmoke change and less of a Smoke Detector change

@ThomasWard what sort of data?

Thomas Ward

related DNS records by IP address of existing nameservers, etc.

can't share beyond that right now though.

wish I could :p

quartata

mod agreement?

tripleee

20:59

basically passive DNS?

Thomas Ward

^ that

SmokeDetector

API quota rolled over with 12142 requests remaining. Current quota: 19999.

math: 32
stackoverflow: 16
superuser: 7
askubuntu: 6
physics: 5
meta: 5
apple: 5
history: 4
mathematica: 3
unix: 3
android: 3
serverfault: 3
graphicdesign: 3
mathoverflow.net: 2
academia: 2
stats: 2
english: 2
salesforce: 2
aviation: 1
civicrm: 1
parenting: 1
music: 1
drupal: 1
diy: 1
law: 1
photo: 1
webapps: 1
codereview: 1
movies: 1
ru.stackoverflow: 1
tex: 1
workplace: 1
wordpress: 1
interpersonal: 1
bitcoin: 1
gaming: 1
webmasters: 1
crypto: 1
es.stackoverflow: 1
dba: 1
anime: 1
raspberrypi: 1

tripleee

passivedns.mnemonic.no/search is fun, and a lot faster now than last time I had a reason to use it

SmokeDetector

21:16

[ SmokeDetector | MS ] Username similar to website in answer: Genetic Algorithms for computer security by Techtweek on stackoverflow.com (@quartata)

quartata

sd k

!!/watch techtweek\.com

SmokeDetector

@quartata You don't have code privileges, but I've created PR#1039 for you.

[ SmokeDetector | MS ] Blacklisted user: Volatile integer and computer security by Techtweek on stackoverflow.com (@quartata)

quartata

lol

sd k

tfw spammers can't even markdown

SmokeDetector

21:33

[ SmokeDetector | MS ] Username similar to website in answer, blacklisted user: general security questions " potential hackers where my computer is." by Techtweek on stackoverflow.com (@quartata)

quartata

ok I guess we don't really need a watch anymore

!!/blacklist-website techtweek\.com

SmokeDetector

@quartata You don't have code privileges, but I've created PR#1040 for you.

quartata

!!/whois code_admin

SmokeDetector

@quartata I am aware of 17 code_admin. Currently in this room: Mithrandir, tripleee, John Dvorak, ArtOfCode, Undo, Ferrybig. Not currently in this room: Thomas Ward, doppelgreener, angussidney, Yvette Colomb, ProgramFOX, Ashish Ahuja, Magisch, Kyll, Andy, Glorfindel, NobodyNada.

quartata

@tripleee

@SmokeDetector k

SmokeDetector

21:46

Merged SmokeDetector #1040.

CI on f8189a2 succeeded. Message contains 'autopull', pulling...

Restart: API quota is 19737.

SmokeDetector

22:39

[ SmokeDetector | MS ] Link at end of answer: Changing a macro's default icon by Aaliya Zehra on stackoverflow.com (@quartata)

[ SmokeDetector | MS ] Manually reported answer: Changing a macro's default icon by Aaliya Zehra on stackoverflow.com (@quartata)

ArtOfCode

@tripleee chuck me an issue for that. It's not actually too difficult to do.

quartata

Interesting, that's been up for a month

It got naa'd previously

Wait, actually..

no

It got posted by someone else

Not sure how we missed that

!!/watch officesetup-com\.com

metasmoke.erwaysoftware.com/post/78392

SmokeDetector

@quartata You don't have code privileges, but I've created PR#1041 for you.

Merged SmokeDetector #1041.

CI on 6840959 succeeded. Message contains 'autopull', pulling...

[ SmokeDetector ] SmokeDetector started at rev 3b6354a (metasmoke: Merge pull request #1041 from Charcoal-SE/auto-blacklist-1503787315.0800962) (running on ArtOfCode/EC2)

Restart: API quota is 19389.

[ SmokeDetector | MS ] Bad keyword in answer, bad keyword with email in answer, pattern-matching email in answer: Discussion Board close thread by nabilmubarak on sharepoint.SE

tpu- by ArtOfCode

tpu by ArtOfCode on Changing a macro's default icon [MS]

ArtOfCode

22:57

\o/ 40k autoflags

5

and I'm also about to cross 2k autoflags from my account

SmokeDetector

[ SmokeDetector ] SmokeDetector started at rev 0ff8011 (SmokeDetector: Auto watch of CarnoSyn by NobodyNada --autopull) (running on Henders/EC2)

Restart: API quota is 19999.

Henders

Mine died because I'm an idiot.

sigh one day I'll learn

!!/location

SmokeDetector

@Henders ArtOfCode/EC2

[ SmokeDetector ] SmokeDetector started at rev 0ff8011 (SmokeDetector: Auto watch of CarnoSyn by NobodyNada --autopull) (running on Henders/EC2)

Restart: API quota is 19990.

Henders

!!/location

SmokeDetector

@Henders ArtOfCode/EC2

@Henders Henders/EC2

Henders

23:09

!!/standby Henders

SmokeDetector

[ SmokeDetector ] SmokeDetector started in standby mode at rev 0ff8011 (SmokeDetector: Auto watch of CarnoSyn by NobodyNada --autopull) (running on Henders/EC2)

Henders

!!/location

SmokeDetector

@Henders ArtOfCode/EC2

Henders

Got there in the end...

Transcript for