« first day (51 days earlier)      last day (3742 days later) » 

12:32 AM
@GrahamLee So, depending on how they measure block, it could still be a really big honkin range.
Strictly speaking, there are only 5 homes on my block. However, throw an apartment building into the mix...phew
@nealmcb I wouldn't go so far as to say "all about" but having certain pieces of PII dating might be easier....
 
@packs Well, the quote from Wikipedia suggests that it is explicitly about dating: "information that can be used to uniquely identify, contact, or locate a single person". [hmm - where is the emoticon for "/me ducks"]
@Iszi In my defense, I'll note that Iszi's comment about "interesting notation" prepped me to be on the lookout for strange wording when I read that snippet....
 
12:48 AM
Typical IT male. Blame it on the female contingent.
 
@packs et al - stalking
to be fair, it should be pretty easy to find anyone
if a zip code gives the rough area, their facebook account will have pictures of the house :-)
as an example - see what happens when you google your name, city and state
 
Oh yeah, check out pipl
It's a nice aggregator of a lot of public record documents
 
yeah just discovered pipl
 
Apparently, my name is common enough that it can make sussing out the information a bit tricksome, but still fun.
 
and then of course there is the information leakage through spouse's online presence
@packs - have you looked at your top google result
scary innit?
mind you - my Pipl page has everything!
 
12:55 AM
Yeah, that's what I noticed. I couldn't find anything about me, but she showed up.
 
even has my terrible Edinburgh marathon time (I was injured, okay)
 
There was a pretty neat tool that was shown during the Offensive Security training. What was that...
/me looks
 
Maltego?
It's pretty good fun - the plugins already written do everything
 
Yup, that's it.
 
It is good at showing just what you can get out of a social network like facebook without really being allowed to - the API is so open
 
1:00 AM
You saw the news about that dating site right?
 
LOL - aye
 
That gave me a good chuckle
 
1:12 AM
It'll be interesting to see what HBK actually wants to do.
 
@packs - yeah, it doesn't sound like something a pen tester would want to do... sounds more like script kiddy. Hopefully I'm wrong and it is just a badly worded question
 
I can see that kind of thing in an educational setting, pushing the boundaries of what can be done and all.
But, as you said, I smell carp.
 
1:58 AM
@RoryAlsop OMFG... don't get me started on that.
@packs ?
 
 
12 hours later…
1:31 PM
@Iszi We were talking about this question
0
Q: Disabling windows firewall remotely

HBKi use metasploit for pentesting windows 2003 sp2 server but when windows firewall is on i am not able to perform pentest successfully is there any way to disable firewall remotly?

 
 
3 hours later…
4:23 PM
@RoryAlsop I think a pen tester might want to do it, but I think it is an admin (SF) question, not security.
 
@nealmcb - I think you may have a point
 
 
1 hour later…
5:44 PM
@nealmcb Again, context does matter.
Security Version: Can we disable the remote host's firewall without the admin's involvement.
 
Of course we can! Just need a 0-day :)
 
SF Version: Our pentesters want us allow carte blanche access through firewalls from their scanner, how can we do this remotely
 
@packs well stated
 
@nealmcb Linguistic dispute :) I'm using "Can we" to mean "are we currently capable of doing so with the tools and mechanisms currently at our disposal"
The SF version is very familiar to me. We (the security office) perform frequent vulnerability assessments of the servers on campus, and will often have the scanners given that kind of access so that we can get a better picture. Compensating controls be damned!
 
Alternative for security version: What indirect attacks does a firewall not address?
 
5:49 PM
@nealmcb Excellent!
I.e., can we make use of the fragments issue in iptables do what we want?
 
good! "What indirect or stealthy attacks does...."
 
This is feeling very Socratic.
 
lol
 
6:08 PM
@packs Same in my shop - Foundstone can't run a proper credentialed scan without disabling Windows Firewall and Simple File Sharing first.
 
With nessus, the firewall doesn't need to be disabled, it just needs the various and sundry wmi ports open.
That part can be automated fairly easily with GPOs.
 
@packs Yeah, we probably don't need to disable the firewall entirely either, but "that's the way it's been done" and it minimizes headache.
 
I actually went through a lot of headache with the Windows guys to get past the "We'll just turn it off and stop trying to fiddle."
 
Well, we do turn it back on when we're done... if it was on to start with.
 
On the linux side there's a script that sets up the firewall, scanner account, sudoers, etc, etc, and sets a timer to turn it self back off. So it works out a bit better.
@Iszi I notice your qualifier :) That was a hard fought battle, but one I'm proud of. Any system that has a host firewall has it enabled with sane rules.
Again, it was a big headache to get going, but I'm particularly proud of it.
 
6:13 PM
@packs That battle is above my pay grade right now.
 
I mentioned this to Avi a little while ago. I think I ended up getting really lucky. It has worked out that of all the groups within IT, the sysadmins are the ones I (at least) work the most with.
It's really helped with getting procedures like that through.
Usually there's less of me laying down the Security Hammer, and more us just figure out how to get it done.
I blame it on judicious use of post-work beers and completely non-work lunches :)
 
@packs Wish that happened around here more often. Any major changes like this one usually cause a bit of a stir that has to be run up the ladder.
 
That sucks.
 
We have several groups of sysadmins we work with though, so there's varying degrees of cooperativeness. Fortunately more groups are gradually starting to better about it. Gotta go easy on them though, if we want to keep it that way.
 
Especially the crotchety old unix beards.
Is your primary job duty computer or information security?
Not like audit, or just part time or something?
 
6:21 PM
@packs Oddly, I think I can say the "old unix beards" are probably the least of our problems.
@packs Mind spelling that out for me? I'm not sure I fully recognize the distinction.
@packs We're mostly a compliance shop, roughly split into two halves. One half mostly facilitates documentation of the security plans, the other half is the more technical side - doing hands-on validation, incident response, etc. I'm in the latter group.
 
So take your typical information assets, HR files, financials, student records, etc. Depending on how your department is scoped you may only be involved in protecting those assets as far as they relate to computer files (whether at rest or in transit). Or you may be scoped to protect them no matter where they exist, whether on a file server or in a file cabinet.
 
@packs Thought that was what you meant - just wanted to be sure. Yeah, we're pretty much focused on computer security.
 
Normally that's where you could draw your distinction. Now days the Venn diagram is usually pretty heavily weighed towards computers, even if you deal with the other stuff.
When dealing with other people in the field, I actually tend not to draw a big distinction. The biggest difference being that I might be more interested in lock picking than you are :)
I like the way you guys are split up, that definitely helps with the focus.
 
@packs Actually, that and hot-wiring are sort of on my "bucket list" - skills I'm (perhaps oddly) interested in learning, regardless of whether I'll ever actually use them.
 
Unfortunately, we're scoped to broadly to really split up duties that well, which definitely has it's downsides.
We don't have the same guy both review/approve a design and validate it, but we're on the same team.
Not ideal, but it's about the best we can manage with our staffing.
 
6:33 PM
The split also helps make finding Juniors a bit easier, when the time comes. One person on the other side of the house was essentially an Admin Assistant before she joined our group, and I pretty much came straight from desktop support.
 
Are you guys part of IT?
 
@packs Depends who you ask.
 
Lovely :)
 
Technically, we report directly to the top - separate from the sysadmin groups. Often times though, it's as if we answer to the same management as them.
 
I can see how that culture could hinder getting certain policies through.
 
6:36 PM
@packs Oh, you mean like host-based firewalls? ;-)
 
@Iszi Mebbe :)
 
It also doesn't help that we did at one point fit into the same report structure as the sysadmins.
 
We are a part of IT, which helps with the whole notion of 'one of us'. But the sysadmins, desktop support, networks, etc are all separate departments and all of our 'Directors' report to the CIO. So there's really not any of that weirdness about reporting.
My boss is an equal to the boss of ${random_sys_admin}, etc.
@Iszi So clearly the reorg helped clear things up for you guys
 
Loads.
 
On another note, have fun at your dance?
 
6:41 PM
@packs Yeah, a bit.
First stop was pictures, then food. After that, we went to the cafeteria for the actual dance. Two seconds inside of that door, my daughter ran off as if I didn't exist.
 
Yeah...I'm looking forward to that..?
 
She came back after a bit. And then she was off again, and back and forth like that most of the night. We did dance together for a few songs somewhere along the way.
@packs You've got a little girl? Or just planning on one?
 
I have one, she's nearly 2. Still young enough to enjoy my company, except for when she wants her mother :)
 
Yeah, fun times ahead...
 
I figure I have between 9 and 12 years before everything goes to shit, so I might as well enjoy them.
 
6:53 PM
Heh... by that math, I've still got 4-7 years.
 
oh noes
 
She still thinks I'm the best daddy ever... even if I don't deserve it.
 
Ah, then you probably do still have that much time left :)
 
@packs One can only hope and pray.
 
 
1 hour later…
8:23 PM
@Iszi Speaking of which, someone just woke up, and it doesn't sound happy. This should be fun :)
 
Posted by Jeff Atwood on February 5th, 2011

The Stack Exchange engine draws inspiration from a number of sources.

We continue to be great admirers of Wikipedia, but we’ve always missed out on one crucial aspect of their system: we never allowed anonymous users to edit content. No, that requires earning some priviliges through participation — specifically, the retag privilege at 500 reputation and the full editing privilege at 2000 reputation.

Well, as of today, I’m proud to announce that we allow anonymous and new users to edit content in our system! The surface area of this change is huge — it means the millions of drive-by anonymous users that visit our sites every day can submit an improvement or correction to a post or wiki. Furthermore, you can earn up to +1000 reputation (but no more) for submitting valid edits. …

 
9:01 PM
Evening all
 
/me waves
 
/me waves back - interesting update, this low rep user edit review - which can give users with below 1k rep the opportunity to rapidly uprep without posting questions or answers
hopefully it will work out well - so far the number of things popping up in my approve queue has been easily manageable. I feel sorry for the guys over at SO or the other trilogy sites. Some have hundreds in their queue every day!
@nealmcb - liked your comment on my education question. Wish I had an answer - part of me thinks I should arrange a different approach for every industry, but I'm hoping that at such an early point in their careers it should be similar education and buy in required for most if not all.
 
9:27 PM
@RoryAlsop Here's a brainstorm. Kids seem to like games. Can you fund the development of some good games or courses on games or who-knows-what that really emphasize at least the highly-unusual job of developing something with security from who-knows-what attack? Have teams of white hats and black hats with the white hats trying to develop and protect something of value. The mindset in security is so different from most dev tasks, and it seems like it would fit into a game-oriented world.
 
@nealmcb Those kinds of war games do happen at some of the cons. I imagine that it could work well, but the implementation would be pretty hard. I can see it being real easy to mess that up pretty bad.
I'll have to talk to my boss about something like that. He's been approached a few times by the department chair that teaches IT about teaching security like courses.
The biggest hurdle would be finding a way to balance the teams in some meaningful way, unless you used it repeatedly (changing up the team memberships) over the course of the term.
 
9:53 PM
Yeah - I'd imagine you'd want to change the teams around.
 
10:26 PM
It would also have the benefit of providing something approaching actual experience.
I think I would probably enroll in that class.
 
Off-topic, does anyone know if anyone makes SOHO VoIP/Wireless routers anymore?
 
Nice quote from Ben Adida: "Security is about stopping the bad guys from stealing your data. Privacy is about controlling the good guys’ handling of your data. (Ron Rivest is said to have phrased this most eloquently, but I can’t find his quotation.)"
 
10:48 PM
@nealmcb There was a good article in New Scientist on exactly this. Turning everything into games. See the popularity of achievements in things like Foursquare etc. The problem with the capture the flag events that the big cons have is as @packs says - you would often have one team which would be ahead of the others and that lead would grow, so mixing it up would be necessary
 

« first day (51 days earlier)      last day (3742 days later) »