The DMZ - 2012-06-12

« first day (544 days earlier) ← previous day next day → last day (4335 days later) »

6:30 AM

@ScottPack ohhh, I was wondering wtf was going on with y'all.

@RoryAlsop that can be easily ~~fixed~~ roried.

Acoustic Kitty was a CIA pet project launched by the Directorate of Science & Technology in the 1960s attempting to use cats in spy missions, intended to spy on the Kremlin, and Soviet embassies. A battery and a microphone were implanted into a cat and an antenna into its tail. This would allow the cats to innocuously record and transmit sound from its surroundings. Due to problems with distraction, the cat's sense of hunger had to be addressed in another operation. Surgical and training expenses are thought to have amounted to over $20 million. The first cat mission was eavesdropping on t...

7:01 AM

@ScottPack so after consideration, I wont be joining in the fun.

Bastard Tigger From Hell is just too much of a contradiction.

also, it took me years to shed the BOFH outlook, after being one for too long. dont want to fall back into that pattern....

too much negativity in the multiverse, I always say.

7:40 AM

@AviD :-)

@AviD >The cat was released nearby, but was hit and killed by a taxi almost immediately. Subsequent tests also failed

@RoryAlsop just proves truth is more f***ed up than fiction.

8:23 AM

0

Q: Security Stack Exchange's Anniversary Competition

July the 12th marks one year since we came out of beta: And we have had continuous growth ever since, steadily gaining new users and questions, and the odd peak where a particular incident or burst of activity has boosted the community. Our birthday is an excellent opportunity to generate anothe...

discussion featured

8:43 AM

@RoryAlsop happy birthday us!

I'm going out on the edge of the envelope's limb, here:

0

A: Security Stack Exchange's Anniversary Competition

Idea for contest: Most significant hack of the SE stack. That's right, calling open season (with appropriate ground rules, of course) on security vulnerabilities on StackExchange sites. The winner could either be decided by SE, e.g. according to the relative risk rating - we could help w...

@AviD hahahahahahahaha - I like it. not sure we'll get approval...

@RoryAlsop doubtful. but would be fun.

and wreak havoc network-wide.

and chess-piece would probably win, since he has the most CVEs ;-)

@AviD :-)

been thinking about the rewards, but we have a problem with that.

oh?

8:55 AM

as a community, and compared to the other SE communities, are there other sites where the populace is so disparate, with regard to the core activities that make them part of the community?

that is to say - sure, programmers on SO are very different, with dozens of different, dissimilar languages. but ultimately ALL programmers, regardless of language, write code. Thats what they do all day.

well, yeah - this is why the core stuff - t-shirts etc - will be easy. But they are low in terms of item value, so you may be right. Would a general - industry conference attendance - be more useful

same with SF - sure, windows/unix/linux/MF servers are all different, but while the techniques are the unsimilar, the core context is the same.

@RoryAlsop possibly. but - which conference?? not to mention location, flights, hotels, etc....

@AviD that's what I mean - it might have to be 'conference up to the value of...'

@RoryAlsop ah. leave the choice of conf to the winner.

still would be pretty pricey, no? compared to the price of the other prizes.

though I would love to be sent to blackhat, expense paid :)

hmm, perhaps the best prize would be a selection of prizes from the other sites... :D

that would be pretty amazing - although aside from the hand shaking and networking, it doesn't have as much going for it as you'd think. I'd rate Defcon much higher!

9:02 AM

yeah, but its fun.

and defcon is much cheaper, once you're there... ;)

in fact I heard that the bsides that is simultaneous with defcon is even better. makes defcon look like what defcon makes blackhat look like...

9:15 AM

hang on, @RoryAlsop, but I feel kind of dumb for not thinking of this earlier.... depending on expected prize value, why not hardware??

I mean, duh.

I guess thats one thing we all DO have in common - we all needs thems 'puters.

either laptop, ipad, monitor.... etc.

omigoodness. I just looked over at Unix and Linux - @Gilles is a superstar. More rep than the rest of the top two rows combined. More bear there than @Thomas is here.

@Gilles - how do you have time to answer anywhere else??

10:03 AM

@AviD he is pretty awesome, isn't he

10:58 AM

So, the highest scoring idea for QotW this week is:

2

A: Vote for your question of the week #30

Are common passwords at particular risk? got lots of votes and some interesting answers. It discusses whether websites should prevent use of certain very-common passwords. Passwords are of broad interest, so this might be a good one for the blog.

any volunteers?

1 hour later…

12:28 PM

Is it just me or is cve.mitre.org worthless as a source of information?

Iszi Rory or Isznti

@ScottPack Glad to know I'm not the only one who's run into this. I like cvedetails.com.

2

12:44 PM

@ScottPack it depends what you're looking for. but in most cases, yes it would be worthless.

@IsziRoryorIsznti thats really nice.

a few years ago I needed to do some research on this for a certain software vendor, looking for relevant issues in "similar" products.

would have come in very handy then...

12:58 PM

@RoryAlsop dya know if @Aarthi is monitoring this....?

specifically curious about my proposal... I assume that even in the slim chance it does get approved, it would take a while to work its why through...

@AviD I suggest a quick visit to TL - I'm just having a sandwich so could do it now if you are busy

@aarthi see above... specifically my proposal here meta.security.stackexchange.com/a/814/33

@RoryAlsop naw, rather keep the discussion here :)

also @Aarthi, curious what kind of budget would be available for prizes?

did you superping her?

@RoryAlsop I did. notwithstanding how crude that sounds.

> dude, I'm gonna superping yo momma!

hurhur

she doesnt seem to be in TL now anyway.

@AviD lol

1:08 PM

@IsziRoryorIsznti Well, here's a fantastic example. The F5 thing that happened last week

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1493

That seems to be my typical level of usefulness from mitre.

@ScottPack that is extraordinarily informative :-)

You thought so too, eh?

Ah, the feeling of a fresh resignation letter.

Yours or someone else's?

@ScottPack why are you complaining? you have the number. what else could you possibly need??

1:17 PM

Mine

@JeffFerland congrats!

@JeffFerland Do you already have something lined up?

@ScottPack Yes, years of frustration! :P

I haven't signed any offers yet, but I've got a place to land.

1:32 PM

@JeffFerland well, congratulations and fingers crossed then

yaknow, with everyone as a BOFH it's getting difficult to tell at a glance who is who.

or is that whom...?

@AviD but they all have different centres

:-)

@RoryAlsop well, other than @Jeff's (which is blank) it's dang hard to tell what it is at that resolution.

@AviD I know - I'll probably get annoyed with it myself in the not too distant future

@RoryAlsop of course you will. Isn't the point of being a BOFH being annoyed by pretty much everything? ;-)

1:54 PM

@JeffFerland Congratulations. With any luck wherever you land will actually turn out better :)

We don't have any good open, or else I'd pimp those.

2:10 PM

@JeffFerland This means you're going to have some free time to jump pass me on the rep boards, doesnt it... :-(

@AviD I was hoping it meant I'd have free time to go play with my motorcycle

Become a stunt driver!

I hear that's awesome, low stress work.

What's with the RoryPhones?

@JeffFerland I'm all for it. just remember that commercial.

@RoryAlsop Sorry, stupidly busy :(

2:19 PM

18

Q: BOFH Gravatar Week

This is your chance to show your true colours... Use the (semi-) official Bastard Operator From Hell Gravatar for a week or a while. I don't think there's any particular reason, it just seemed like a good idea.

discussion bofh

@ScottPack ummm.... because you're laid up in a hospital bed for 3 weeks of every month??

18 hours ago, by Iszi Rory or Isznti

4 hours ago, by Scott Pack

12

Q: BOFH Gravatar Week

This is your chance to show your true colours... Use the (semi-) official Bastard Operator From Hell Gravatar for a week or a while. I don't think there's any particular reason, it just seemed like a good idea.

discussion bofh

@AviD I drive ambulances. I'm familiar.

@AviD prizes? umm. budget is. well. you bring us a line-item budget and we'll add/remove as needed.

@AviD meh

2:20 PM

hey, we outnumber the BOFHs now

@Aarthi I'm noticing a distinct lack of AarthiPhone

@ScottPack ya, I know. Real Men should just get up and shake it off. Then go have a redbull.

@Gilles And yet.... it doesn't matter, does it? :D

@ScottPack but i'm not a BOFH. i'm much too nice.

@AviD Exactly. You know how those yanks are, though.

2:21 PM

@ScottPack heh.

@Aarthi I'd like to think I'm nice, just snide.

@Aarthi I. see.

so basically, not much in the way of budget.

@Aarthi HI!

@RoryAlsop and I had some ideas, that were probably too expensive then.

@AviD negative! the budget is currently up for negotiations.

2:22 PM

@Aarthi great!

@AviD if you play your cards right, you can have maybe $100

considering my idea would potentially save SEI tens of thousands of $$$, I'd expect the prizes to be in line with that.

facepalm

Unless I find this memory leak in our API, we won't need help from the outside... — Nick Craver 7 mins ago

@Aarthi enough for e.g. full coverage for some high-profile conference?

some nice hardware...?

@Aarthi hehe, nice.

@AviD line item request submission! just email community and cc the other mods. community team will review the prizes, veto anything egregious, and we'll negotiate a bit. :D

2:24 PM

@AviD you know how it is: first you break in and cost them $manyK, then you have a hope of getting a decent security budget

@Gilles lol

@Aarthi okaaay.... that's good for the specifics, but what range are we talking about?

or am I just being a frikken MBA all over your rories?

...what?

@JeffFerland hrw-vip-prod.is.berkeley.edu/psp/JOBSPROD/EMPLOYEE/HRMS/c/…

bluetarp.com/employment/3

@Aarthi Don't rory about it, he tends towards daft.

2:28 PM

er, okay.

@JeffFerland Wow, what don't they want?

heeeeeey it's an SE sysadmin, @PeterGrace

I hear there's troublemakers making trouble in here!

pretty common

@ScottPack Well, I wish they paid more, but they offered it to me.

... and there are huge bonus points for the environment. Very comfortable crowd.

2:29 PM

@JeffFerland I'm not sure they could pay enough for me to be willing to develop the level of ADHD required for that position :)

2

@PeterGrace welcome! and expect the worst.

@PeterGrace what's an AviD gardener....?

@AviD He's an experienced ServerFault User; y'all can't scare him.

Having managed a large security team at my past employer, I'm ready for it.

@Aarthi doncha know it's our jobs to scare sysadmins...?

Just look at that mug. Can you imagine the horrors he's already seen?

2:31 PM

I can't speak for the entirety of the team, but I will politely ask that you guys not add any more work to my kanban board

@ScottPack ah, he hangs out in the Comms Room?

@PeterGrace lol, never. Except when we do.

@AviD Precisely

I tone it down to hang in Comms Room. I'm a /b/ kind of personality.

Ew

@Aarthi for some reason it's been a very rory month in here

2:34 PM

@RoryAlsop :D That's 'cause Rory is a fun word, I think.

@Ninefingers belated hello back!

@Aarthi you note the room tags, yes?

haha i didn't notice til now

But why isn't he Rory Ferland?

Or Rory Pack?

or RorY

Speaking of having a Rory-good time, Kontrol just came up on my DeepHackPlaylist.

where's @IsziRoryorIsznti when you need an example

@Aarthi ask @IsziRoryorIsznti.

2:36 PM

@ScottPack Yay!

I thought you would like hearing that.

2:59 PM

yknow what's cool?

all your tough little bofh telephones, when shrunk to the size of one line, look like little hearts.

2

which makes this room kinda gay.

not that there's anything wrong with that.

just sayin'.

@AviD you really really have to use your imagination, but I like it

@Gilles just have a quick glance. peripheral vision like.

noticed this while I was working on a different window...

3:19 PM

@Gilles somebody declare Tag Wiki Day?

good work, thanks :)

Iszi Rory or Isznti

3:35 PM

@RoryAlsop Say wha?

@IsziRoryorIsznti he just wanted to point at you and laugh.

Iszi Rory or Isznti

3:46 PM

@AviD Ah, right. Well, @Aarthi, apparently you're not generally supposed to be allowed to change your screen name more than once a month. So, once the other guys found out I was stuck as-is for awhile, I suppose they decided it wouldn't be worth the bother.

ah

@Aarthi sorry, we figured it was clear from his name.

besides, we always like pointing at him and laughing.

@Aarthi btw except for quoting @Nick's comment, you didnt actually respond to the main question for which we superpinged you here....

well I guess that and bringing @Peter into the fray...

er sorry, what was it you needed?

3

A: Security Stack Exchange's Anniversary Competition

Idea for contest: Most significant hack of the SE stack. That's right, calling open season (with appropriate ground rules, of course) on security vulnerabilities on StackExchange sites. The winner could either be decided by SE, e.g. according to the relative risk rating - we could help w...

i can't give you permission to hack the site. that's supremely not under my purview

4:00 PM

to find out if the was any chance in bastard hell of actually doing that...

@AviD Well, @PeterGrace basically said, "Don't do that, please."

@Aarthi well, obviously. but what are the chances that those whose purview it is under, would give permission if permission could be given?

@Aarthi heh. true. but I have a feeling that was more like a desperate plea, rather than the official position of the powers that be :)

If you're going to whitehat, I.....can't officially condone that. That's basically the only answer I can give you.

besides, it should be probably be more work for the devs than the sysadmins....

of course whitehat!

I'd have to flag and ban myself otherwise.

:o

4:03 PM

actually, not looking for the answer right now, more of a "can you float this up to whoever can"... :)

in the spirit of openness that SEI loves, I'd say this was long overdue

or are yaaa skaaaarrreed...? ]-)

I can't give an official answer, but I will indicate that since we do process credit card transactions for our careers website, it's not as simple as it seems on first blush to probe our site.

hmm, credit cards. true, didnt consider careers.

'course there are solutions for that too. after all, PCI would require a pentest every so often....

Since everything runs on the same webservers, there isn't a safe way for us to say "Sure, go to town on X website."

Well, I don't want to go into too much detail or discussion about how our environment works as these chats are archived and indexed by google.

but let's assume we can guarantee the "safety" of the credit cards (or at least in relation to this contest)...

@PeterGrace 'course not, that's fair. we'd be talking blackbox anyway, up to the point of SEI's already openness.

Iszi Rory or Isznti

@AviD I'm sure PCI also requires certain service level and non-disclosure agreements with the pentesting organization? Not exactly something you can properly manage in an "open invitation" scenario.

4:09 PM

anyway, @Peter, @Aarthi - just saying think about it. mebbe discuss with mgmt and devs... I said only partly in jest, but seriously, you'd be getting a valuable service, probably worth upwards of 10,000$...

@IsziRoryorIsznti of course. but doable.

I'm asking. I'm personally not in favor of it, but doing my due dilligence all the same.

Iszi Rory or Isznti

@PeterGrace Can you comment on the "Hacker" badge alluded to in the "I Just Logged In As You" blog post that @Gilles linked?

Nope, sorry, I don't know all that much about how the badge system works, that's really a dev level thing. I just keep the lights on.

Iszi Rory or Isznti

Particularly, I noticed no confirmation or denial of its existence in Jeff's blog - not even an acknowledgement of the claim.

@IsziRoryorIsznti It's basically like a unicorn.

It might exist.

I've never seen it awarded, though.

4:14 PM

@JeffA took that code with him when he left.

@PeterGrace I appreciate.

@PeterGrace are you not in favor of security tests in general, or just the current crowdsourced suggestion?

@AviD Let's not forget transaction volume, self-assessment questionnaires, etc.

@ScottPack but of course.

that's why I didnt specify how often, since I dont know how much rory the careers site does.

besides, even with self-?aires, you still have to have the pentests.

every quarter, regardless, if my current memory is correct.

@AviD as I mentioned before, I ran a large security team at my previous employer. I'll be honest. I don't know any of you guys from Adam. How can I have any assurance that promoting this would help my site other than your "I pinky-swear to be good!"

@PeterGrace I don't really know you from Peter, either.

Yes, but, the difference is, I'm not the one volunteering to poke at your systems as a thought-exercise.

Don't take it the wrong way, I love IT security teams. You guys make life easier in a lot of ways

4:23 PM

I don't blame you at all. I would require some pretty hardcore contracts in place before I even thought about allowing something similar.

When we contract a McAffee or a Comodo or some other professional organization to get penetration testing, we get bonded and insured companies handling it so that there's a liability chain of custody.

@AviD I'm looking into the matter; I'll have an official response for you soon. For the time being, let's see if other ideas for your anniversary come up, okay?

Iszi Rory or Isznti

We could all pull out our CVE listings and compare them. I'm sure a certain bird/chess piece would love that.

@IsziRoryorIsznti Authenticating the data would be troublesome at best.

bird/chesspiece?

Iszi Rory or Isznti

4:38 PM

@Aarthi The Sec.SE guys know who I'm talking about.

oh okay

A particularly singular user :)

Iszi Rory or Isznti

I I was being facetious anyway.

Interesting fact I got from HowTooGeek today, by the way: Harrison Ford has both a species of spider, and a species of ant named for him.

huh

Hm. I wonder if we can crossbreed them into a spiderous ant? I've got a bad feeling about that.

2

Iszi Rory or Isznti

4:41 PM

@ScottPack Spiderants! Why'd it have to be spiderants?

Next step: Insult the spiderants, get smacked in the face with a mandible, then sleep with it?

I'm not sure I approve of where this is going.

Iszi Rory or Isznti

@ScottPack Wait-what? I never figured you for an arachno-insecto-phile.

I certainly don't like where this is going.

5:37 PM

@IsziRoryorIsznti AFAIK the Hacker badge is a joke and was never awarded to anyone, but that's from before my time

6:05 PM

This is so distressing: google.com/webhp?q=c%23%20hash%20password%20example

...recommendations to use MD5 all over the place.

Iszi Rory or Isznti

6:47 PM

Well, bummer...

Sorry, we've discussed this internally and it's not something we (Stack Exchange) can sanction. In addition to the legal ramifications, we're not comfortable with encouraging attacks on systems with people's private information. — David Fullerton 1 hour ago

Ping @AviD @RoryAlsop

6:59 PM

You guys got me curious, so I'm firing up openvas on a vps I have. It takes ages to start the server process.

Is there a canonical "What tools can I use when starting vulnerability testing" type question on the site?

@IsziRoryorIsznti heh, fair enough. @PeterGrace I don't "blame" you either, of course it's a tricky situation.

crowdsourcing a pentest is really "out there" to begin with, I had no doubt of that. but, knowing the majority of the community here, I figured it might be doable.

Well, suffice to say it got a significant amount of discussion in our company chatroom.

but the issue of personal data, and credit cards, is a fair problem.

the sides were quite polarized and I wouldn't be surprised if we did have some sort of policy/event that was friendly to your guys ambitions

@PeterGrace :)

Iszi Rory or Isznti

7:02 PM

@PeterGrace I'd love to have that chat log.

@PeterGrace ooo I like the sound of that.

@IsziRoryorIsznti me too!

Iszi Rory or Isznti

Oh, I see we've got SE apps for Chrome, Opera, Firefox, Android, and OS X. When's an iOS app coming?

@PeterGrace on the other hand, perhaps a publicized, 3rd party appsec pentest might be a good play here...

or even - better yet - 3rd party security code reviews etc... under strict NDA, of course.

NO, I am not just pushing my services to grab a juicy project (though that would be sweet) :-)

@PeterGrace in response to your question - there are different levels to that question, and I think some of them have canonical-ish answers.

network level? OS level? application level? and then there's the question of tailoring the toolset to the type of application.

and not to mention the fact that the tools are a lot less important than the skills of the tester, and his/her methodologies.

Can you rories please quiet down. You're ruining the sanctity of my chat room.

3

Can you rories please rory down. You're rorying the rority of my rory room.

7:09 PM

Roryoff

3

@AviD To be perfectly honest, I'm just afraid there's something stupidly simple that would be easily exploited.

Iszi Rory or Isznti

@ScottPack Well, rory you - you, rorying Rory.

2

@PeterGrace Honestly, that's always my fear too.

But I guess if it was, people would already have found it and exploited it.

@IsziRoryorIsznti Let's just please calm the rory down. This is all getting a little out of rory if you ask me.

3

7:11 PM

A lot of people in our organization seem to have a very deep trust in people, and as a sysadmin I have the opposite.

@PeterGrace Goes back to the Network Programming Creedo that my advisor taught: "Be strict with what you send, and lenient with what you accept."

@PeterGrace and you can imagine where we are as security freaks....

personally I like trusting people, especially professionals, but it takes quite a lot till I get to that point. First verify, then trust, I guess.

@PeterGrace tell me, if its not considered privileged information, has there ever been a 3rd party sec audit done?

or even a 1st or 2nd party audit, by a security hat?

more curious than anything else...

@AviD I like trusting people, but what works is trusting people to do the wrong thing :(

@Gilles sad state... but yeah, it really depends on which people.

/me sighs

7:18 PM

in fact I would say I cant trust people, but I can trust persons.

Right, so I think I finally managed to get this guy's init script whipped into something usable.

7:33 PM

@AviD I don't think it's necessarily priviledged, but it's embarassing. Is that a good enough non-answer? :)

@PeterGrace heh. clear enough, sure :)

perhaps after the first time, and everyone can be sure that there's nothing stupidly simple that everyone missed but could be easily exploited, we could reconsider the open season / crowdsourced pentest.

but just think! crowdsourcing pentest... it would be the first of it's kind, ever! would be a great talk for blackhat... ;-)

openvasd.

real 45m26.536s
user 1m37.522s
sys 11m38.996s

It took 45 minutes to load openvasd.

is that normal?

I wouldnt know, sorry.

me, I'm an apps guy :)

windows at most.

What do you use to pen test?

I was gonna grab nessus but it seemed like openvas was more what people were talking about lately

Based on the last time I used openvasd? Yeah, that's pretty reasonable.

Nessus usually takes me about 1 minute to start. For a first run closer to 10-15.

7:46 PM

@ScottPack what's your favorite tool for basic vulnerability assessment/pen testing?

Downloading and processing plugins takes a long time.

@PeterGrace I use Nessus.

@PeterGrace mostly manual. but I do start with either/and any of: appscan, netsparker, and acunitex.

but again, I'm talking appsec.

you're talking net/os, right?

But yeah, my focus has always been more system level and less application garbage.

yeah, with heavy emphasis on web app.

I do like how with the ProfesionalFeed we get access to audits for standards compliance testing. Nice feature, even if their Apache CIS audit is so woefully out of date as to be completely useless.

« first day (544 days earlier) ← previous day next day → last day (4335 days later) »

Transcript for

Jun '1212

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile