The DMZ

Scott Pack

00:34

@AviD If you people hadn't come up with all those laws.... Do you have any idea how long those begats go on?

AviD

@ScottPack ME people?? I'm married!

Scott Pack

I was referring to the source literature.

AviD

@ScottPack ah, the Leviticus? I'm not a Levite.

Just barely a Levantine.

Scott Pack

Latin Christians from the Ottoman Empire?

AviD

01:26

@ScottPack huh?

ah no, the other Levant.

Scott Pack

Ah, this is what I found

Levantines (Latin Christians)

:This article is specifically about Latin Christians in the Levant. Other ethnic groups in the Levant are covered under their individual names. Levantines or Franco-Levantines (French: Levantines, Italian: Levantini, Greek: Φραγκολεβαντίνοι (Fragolevantinoi), Turkish: Levantenler or Tatlısu Frenkleri) are Latin Christians who lived under the Ottoman Empire. The term is also applied to their descendants living in modern Turkey and the Middle East. Characteristics Levantines were mostly of Italian (especially Venetian and Genoese), French, or other Euro-Mediterranean origin and have been ...

Stack Exchange

05:07

cerebrospinal fluid, pericardial fluid, sputum, aqueous humor, perilymph, chyme, hydatid fluid, interstitial fluid, rheum, and gin.

Rory Alsop

08:51

heh - "...and gin"

Polynomial

09:19

oh man, I just got the best proposal from Hackin9 ever!

> My name is Oli. I am from Hakin9 magazine. Surfing on internet i have found your massage. I am in mind that we could help each other. Subscription to our magazine could be of your interest.

He found my massage?

AviD

@Polynomial was there a happy ending?

Polynomial

@AviD I'm about to email them back to ask if they provide a happy ending.

I plan on trolling the shit out of them for as long as possible.

AviD

@Polynomial PLEASE please please please share the conversation with us.

Polynomial

Of course! It'll all be published.

Rather amusingly, We Are The Champions by Queen came on just as I started reading it.

and all I could picture is Freddie Mercury giving the Hackin9 guy a massage...

AviD

what was the name of that one great article they published? something like DICKS?

Polynomial

09:22

@AviD Yeah, it was an nmap guide, and the technology they talked about was called DICKS.

they didn't even obfuscate the acronym at all. massive bold letters: DICKS

AviD

@Polynomial yeah, that one.

wanna see if you could try that again?

you could talk about Secure Hyper-Integrated Technology Environments.

Secure Health Information Technology Ecosystems.

Polynomial

lol

AviD

Personally Enhanceable Notarizing Information System.

cmon, dooooo iiiiittttt. this could be fun.

Polynomial

Trusted Unified Remote Desktop

2

probably just outside their vocabulary enough to sneak through

Terry Chia

You guys stop trying to ruin a reputable and renowned magazine! </sarcasm>

Polynomial

09:38

> Sounds interesting - it would be nice to get some of my work published. I'm working on some guidelines for securing remote desktop at a commercial scale, if you're interested in that.

It begins.

Rory Alsop

heh

Polynomial

Wow, they're desperate!

> Its wonderful. I gave all information to responsible person. Will contact you soon.

AviD

niiice.

though turd is a bit... tamer than I would have expected from you.

Polynomial

the title is "Trusted Unified Remote Desktop Systems: A guide to Windows cyber-security on a corporate scale".

true, but I plan to sneak some other fun in there

AviD

you're gonna fill it with crap, right?

Polynomial

09:47

of course

AviD

ahem. fill it with teh turds.

Rory Alsop

@aesahaettr - your posts keep surprising me. I haven't yet got used to your user name so I expect the old one on wording like that :-)

Polynomial

most of it will be directly lifted from CyberSzarSays on Twitter.

Rory Alsop

@Polynomial excellent

AviD

@Polynomial not familiar - have a few choice outtakes?

Polynomial

09:47

I'm attempting to come up with backronyms for GOATSE and various other joyful words.

@AviD "It is of the utmost importance to irrefutably invent critical defacements. #cyberdisclosure"

that's his latest

randomly generated cyber-jargon :P

AviD

ah, excellent.

Polynomial

Goals & Objectives, Accessibility, Testing, and Security Enhancements

otherwise known as G.O.A.T.S.E.

Terry Chia

@Polynomial You might wanna include some choice excerpts from Andrew as well.

AviD

Global Online Access and Trust Simulator Environment.

Polynomial

@TerryChia ah yes, good idea.

AviD

09:52

@Polynomial haha, make sure to credit him.

Polynomial

@AviD heh, the Goatse Project

AviD

hmm, change the last two to Security Ecosystem. works better for the OpenSource projects.

Polynomial

Trusted Security Ecosystem :P

AviD

HOW IS THERE NOT A REAL PROJECT LIKE THAT YET??

it's like.... MS ISA in the Cloud!

it's a distributed, cloud-based version of rdp, kind of like a completely remote access protocol.

Polynomial

lol

AviD

09:59

and it uses Personally Ordinated Online Protocol, as a security layer.

I have a feeling your TURD paper is going to be a goldplated heap of CRAP. And I mean that in a good way.

Polynomial

haha

skid marks on the network!

what I have so far: pastebin.com/DZPeXuKR

AviD

bonus points if you manage to work in "skid marks", without an acronym. just a "technical term".

@Polynomial I dunno... it's CRAP, alright, but is it enough CRAP?

so far it reads pretty much like any marketing techpaper I've seen.

it's too good.

I think you need some andrewishness right there in the opening. :D

Polynomial

:P

I'm thinking of reformatting it slightly, but I like putting in all the marketing jargon :P

AviD

10:15

@Polynomial I guess that's the lipstick your pig turd needs to get through....

Can I make a technical suggestion?

Polynomial

indeed

AviD

Instead of focusing on "windows networks", make it about a sort of distributed RDP. I think it fits your TURD and other things better.

Polynomial

fair enough :P

AviD

also, it starts off all cloudy, so you dont need to actually get faux-technical

gives you more leeway to be an arse ;-)

Automatically Resolving Security Enhancement

ohh maaan backronyms are fuuun!

Polynomial

"one of the best way to identify critical objectives is to hold a meeting with important members of staff in your organisation, such as the financial director and his PA."

My name is Estera Godlewska and I am an Editor in Hakin9 Magazine. My colleague, Olga, asked me to contact you.

You wrote to her that you would like to publish your work about securing remote desktop at a commercial scale. Can you please write me something more about it?

Hi Estera,

I've been thinking a lot about a way of doing remote desktop as a service, to ensure maximum security and availability (via the usual cloud stuff). Essentially it's a way of building a trusted network without the hassles and expense of in-house monitoring and regulation, without losing the benefits of remaining ISO27000 / PCI compliant. Essentially the entire remote desktop architecture could be transformed into a distributed system that allows security to be monitored across a range of endpoints with very little end-user effort.

I'm especially proud of the "typo" in the last word.

AviD

10:28

@Polynomial lol I almost missed that

yknow, TURD and CRAP aside - it's actually starting to sound like a good idea....

Terry Chia

@Polynomial Are you sure they recognize ISO27000?

Polynomial

hah

@TerryChia they'll probably google it.

Polynomial

10:53

no email back yet, I hope she didn't catch on that I'm trolling :P

AviD

11:09

Trusted Reliancy Operational Locking Lifecycle

Polynomial

:P

Polynomial

11:31

ROFLROFLROFLROFL

Thank you for your reply. I think you have a really nice idea!

I wonder. Maybe it would be possible to connect it somehow with spyware topic? What do you think?

I'm looking forward to your reply.

AviD

Anti Spyware Scanning Holistic Operational Labratory Environment

Rory Alsop

@Polynomial - I can see another talk you could do at conferences :-)

Polynomial

@RoryAlsop a talk about trolling hackin9? :P

AviD

what the hell.... Obesity now tops hunger as the world’s biggest food problem

Æsahættr

@RoryAlsop Sorry. I'm gonna find some harder glyphs for my next username... promise!

(the post was fine, right...?)

Rory Alsop

11:37

@Polynomial yep

@Æsahættr Oh yes - it got an upvote from me :-) It just amused me that I recognised the style

Polynomial

ohferfucksake... Santrex are bothering me again.

Rory Alsop

@AviD LOLWAT nao? Soon fix that, by running out of food - will get back to hunger pretty soon

@Polynomial is that a sanitary product?

AviD

@RoryAlsop how bout you just put the obese people with the hungry people. it should all balance out.

Polynomial

@RoryAlsop As far as VPS hosting providers go, I'd probably get better service out of a sanitary product.

I asked to close my account due to poor service / bad uptime, so they stole another £16 from me after I told them to close my account, refused to refund me, were rude and they're still sending me marketing emails despite asking to be removed.

Rory Alsop

@Polynomial small claims court :-)

Polynomial

11:42

@RoryAlsop I'd end up spending >£200 for £16.

and time off work, etc.

not worth the hassle. they just need to fuck off and leave me alone.

might start forwarding their emails to the ICO.

they've broken PECR2003 multiple times.

Rory Alsop

@Polynomial ahah - do that

AviD

@Polynomial but its the principle of the thing.

Polynomial

@AviD yeah, ordinarily I might go after them for it, but for £16 I really can't warrant using my limited holiday days and spending extra money

especially when that cash / time off usually goes towards security cons.

Rory Alsop

@Polynomial aye - proper prioritisation :-)

Polynomial

@RoryAlsop yep, gotta make sure I have time to go to Securi-Taaaaaaaaaaaaaaaay (as the guys over at ISD podcast call it!)

It is great, then! I think you have a really nice idea.

Yes, I would like you to start writing. I am attaching you a manual for authors about formatting the article and statement.

When will be possible for you to send me finished article? Will this be possible by 28th December or do you need more time?

Rory Alsop

11:47

hahahahaha

Polynomial

^ we're on.

AviD

excellent.

oo oo, see if you can work a quote from @ThomasPorn in.

Polynomial

heh, they ship you an "Author's Guide" in .odt format

ok, I'm changing the title to Trusted Users and Remote Destkop Spyware

Rory Alsop

Do you guys think this is on topic? I think I'm in agreement with FiascoLabs and Jules here - it is just a set of designations which doesn't offer anything to the security professional:

3

Q: what is the difference between virus, worm, trojan and other malware

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main differences tendencies in work purpose how to protect how it is duplicating

Terry Chia

@RoryAlsop Agreed.

Polynomial

12:01

@RoryAlsop It's on topic, but the answer is "it's so blurry it's not worth even trying to categorise"

Terry Chia

@Polynomial The answer is APT for everything of course.

Rory Alsop

@TerryChia shouldn't that be in @Polynomial's article?

Terry Chia

@RoryAlsop Indeed!

I'm loving how easy it is to root a Nexus device.

Rory Alsop

@TerryChia haven't actually got round to that with mine - probably because I now use it approximately 5% of the time and wife/kids steal it the rest of the time :-(

Terry Chia

@RoryAlsop Heh. It's a one-click process in a nicely packaged GUI.

I'm rooting it so I can test out dsploit.

Rory Alsop

12:06

@TerryChia cool

Rory Alsop

12:31

still two ads here that could do with a vote:

9

Q: Community Promotion Ads - 2013

We never really gave you a proper thread this past year, so your previous thread was exceedingly stale for a while. As such, here comes a brand new, shiny thread for y'all! Community Promotion Ads, let's go~ What are Community Promotion Ads? Community Promotion Ads are community-vetted advertis...

discussion community-ads featured

Polynomial

@TerryChia Advanced Persistent Turds?

they really don't want to flush

AviD

@Polynomial oh, so you read that bit about Zimbabwe?

Polynomial

@AviD huh?

AviD

cracked.com/…

first one on the list.

Rory Alsop

lunchtime - back in a bit

AviD

12:38

@RoryAlsop make sure you read that bit first!

will save you some calories....

Polynomial

yeah, I was eating a Hoi Sin duck wrap as I read that... probably not the best choice of food.

AviD

heh, sorry bout that

Terry Chia

@RoryMcCune You might wanna check out dsploit for your mobile pen-test needs. It does seem to have some useful features in it.

lynks

13:12

im confused about something, but might be being stupid.

so tell me if i am:
how can AES have a key length ( up to 256bit ) *longer* than its block size (fixed at 128 bit)

in terms of shannons theorem(s), it feels wrong. it makes encrypting a single block look like a surjection, rather than a permutation.

Terry Chia

@lynks Maybe you should have a look-see at crypto.se? They might have a question covering the topic.

Don't know nearly enough crypto myself to answer.

lynks

was just passing it by you guys to make sure it wasnt totally stupid. ill go ask the crypto nerds.

Rory Alsop

@AviD cracked.com = blocked here

AviD

@RoryAlsop aww

so here's a preview:

> Zimbabwe Battles a Backed-Up Sewer With Synchronized Toilet Flushing

guardian.co.uk/world/2012/sep/23/…

Rory Alsop

@AviD erm...eh? synchronised with what? (I can look this eve at home)

AviD

13:27

@RoryAlsop with each other.

everybody together.

the whole damn city.

Rory Alsop

oh - very good!

:-)

WHAT???

samuel-warde.com/2012/12/kkk-protests-westboro-church

AviD

linky no worky.

but from the title I can share your response.

Rory Alsop

basically the westboro church have stated they are delighted with the shooting at that school in the US, so the KKK have publicly stated that westboro curch are a danger to the US and will be systematically torn down!

Polynomial

woah, woah, woah

the WBC said they're delighted with the school shooting?

What the flying fuck is wrong with these people :|

Rory Alsop

yep - that it was god's work

Polynomial

13:31

remind me to punch them in their genitals if I ever see them.

2

with a sledgehammer.

Rory Alsop

@Polynomial ^ this

Polynomial

huffingtonpost.com/2012/12/16/…

Great, so now I'm really pissed off at work.

lynks

`nmap -sS -sV -O -T4 godhatesfags.com`
`nessus gothatesfags.com`
or, yes; sledgehammer to the genitals is equally good.

Polynomial

pretty sure Anonymous defaced them over it recently

and started a dox/DDoS campaign on them

the usual stuff

it's one of the few things that still makes me want to break out a copy of LOIC.

Rory Alsop

Reckon anonymous might have another go or two :-)

One of the areas I sort of approve of them

lynks

13:44

LOIC is for the grunts on the ground who can't help any other way. I'm sure your time is better spent, talented hackers are more like the special forces.

In my imaginary gibson-esque world.

Polynomial

I'm aware of how Anonymous operates ;)

spent more than a little time observing in anonops.li

lynks

@Polynomial as a blue? or just out of interest?

Polynomial

@lynks interest.

I've never worked with law enforcement.

lynks

As far as I'm aware, anonymous just recruit gullible 16 year-olds. tell them they're fighting for the greater good, and rotate new ones once they get busted. much like the military.

Polynomial

I have a lot of respect for the passion that Anonymous have for their causes. It's also been one of the few movements that's bought security to the eye of the media.

Nah, they don't recruit. People join in and leave as and when they please, it's not a group model.

You get one or two in an IRC channel who know the technical stuff, and one or two that understand the full situation of the op in depth. They work together and direct everyone else, who are just along for the support.

Terry Chia

13:51

@lynks Hey, I'm almost a gullible 16yo. ;)

lynks

@Polynomial you make it sound honorable, I can't help think there must be some exploitation going on. Why do illegal things yourself when you have a few thousand super1447 skript kiddies willing to install LOIC?

Polynomial

@lynks The people directing are probably more likely to get busted.

the feds might bust one or two people who ran LOIC, but it's expensive to mount a case and most would get a slap on the wrist, maybe a month in juvie hall.

but getting someone on a conspiracy charge means jail time.

Rory Alsop

@Polynomial heh, you said "Juvie hall" - who talks like that

lynks

@Polynomial yeah I think that's what we call 'incitement' in the UK. But who's gonna catch someone if all they do is sit in IRC behind a couple of TOR circuits giving order?

Polynomial

@lynks I'm in the UK, so yes, it's incitement and conspiracy.

@lynks You'd be surprised how easy it is to find the people on there. Not via IP tracking or anything fancy, but just via social media.

@RoryAlsop I couldn't be bothered to type the full word ;)

@lynks though it's not as much of an order as it is a "here's how you can help". they're smart enough to just give the material and let people do it themselves.

here's LOIC, here's the list of IPs, here's a document on how to make LOIC work. put 2 and 2 together and get a DDoS.

lynks

13:58

@Polynomial it sounds a bit more impressive than I had given them credit for.

Polynomial

@lynks I think sometimes the world does need a good kick in the balls, and Anonymous are good at that. They're good at jumping in and making shit happen.

but they're a blunt tool at the best of times. good for mass chaos and brute force but not much else.

Transcript for