The DMZ

Stack Exchange

04:16

I lead a small but extraordinarily persuasive religion whose only members are door-to-door proselytizers from other faiths.

Stack Exchange

08:59

Stack Exchange Security Blog: Misadventures with tcpdump Filters

scottpack on August 31, 2012

For quite some time I’ve been running into a tricksome situation with tcpdump. While doing analysis I kept running into the situation where none of my filters would work right. For example, let’s presume I have an existing capture file that was taken off a mirrored port. According to the manpage for pcap-filter this command is a syntactically valid construction:

tcpdump -nnr capturefile.pcap host 10.10.15.15

It does not, however, produce any output. I can verify that traffic exists for that host by doing: …

adric

11:48

Wow, very cool blog @scottpack, thanks!

Polynomial

12:00

agreed, a great read.

I wonder if it'd be possible to get around source address blacklisting using that bug.

adric

if the filtering device isn't vlan aware, could be ... ponders experimental design

Polynomial

though you'd have to assume that the firewall doesn't drop "IPv8" packets ;)

adric

hehe, yeah. Mike Poor was talking about that on my iPod on the drive in. Some tool named like isac used to fuzz IP version in IP floods .. used for IDS,fw testing

Scott Pack

Thanks guys. That post got less ranty with revisions. I we feeling a bit...bent when I finally figured it out.

@adric podcast?

Poor's a pretty fun guy to listen to.

adric

class recording of SANS SEC503, day 3 .. Yeah he's been awesome so far.

Scott Pack

12:09

Im doing that class right now too.

Day 2 is much slower than day 1.

adric

Day 2 is much more binary and hexxed than Day 1, aye.

It's neat actually trying to learn skills from one of these, rather than just learning knowledge and structure .. and I'm trying to practice and fiddle outside of "class" to see if any of it is sticking.

Which is why that blog post was great for me, cheers!

Now if I could only get scapy pdfdump to work :/

Polynomial

by the way, if you've not been listening to the LiquidMatrix security podcast, you should do: liquidmatrix.libsyn.com/rss

adric

That looks neat @polynomial I'll have to try and catch a few of those after I get done with my class ... adds to hmtasks

Scott Pack

@adric Day 1 worked out to be so much refresher that I left it playing while I was doing other work. Then day 2 happened :)

I may unsubscibe to ISD.

Polynomial

it's basically Dave Lewis (gattaca), Matt Johansen (mattjay), and a couple other dudes chatting about security.

btw, those names in brackets are Twitter handles.

adric

12:23

@scottpack Lots of refreshment in Day1 but plenty of funny stories and header weirdness to enjoy.

Scott Pack

12:55

@Polynomial Incidentally, putting a NIC in promiscuous mode captures the packets before they hit the netfilter layer. So if you're trying to exploit a bug in your collector app......

Also related. Yesterday I learned that attempting to use pcap-filters on a pcapng capture doesn't work out so well

Iszi

13:10

So. U.S. finds in favor of Apple, Japan finds in favor of Samsung. Anyone else's B.S. meter going crazy, here?

It may or may not be worth noting that the cases appear to have involved different patents.

Scott Pack

The fact that people who didn't have basic understanding of patents determining patent law is at least as troubling.

Polynomial

►

^ nuff said.

internet law is being made by people who know nothing about the internet.

Iszi

@Polynomial Holy bumbling, stuttering politician, Batman!

Polynomial

"my staff sent me an internet yesterday... I didn't get it until this morning!"

Scott Pack

13:26

The tubes!!

Andrew Smith

13:52

@Polynomial it's always like this. Think tv remote control - same story

@Polynomial this kind of the smart stuff is done by ppl who are clueless about this stuff

@Polynomial I got job now, so I'll not be so much spamming

Polynomial

@ScottPack Which byte was the IP header version in the VLAN packets actually being read from?

Andrew Smith

@Polynomial I work for company smarter than Google

however IMHO they havent met with me yet

Polynomial

@ScottPack you said "in the vlan header", but what's the actual field?

Scott Pack

@Polynomial Yeah, that was a problem with the pictures. I couldn't find a good image of the ethernet frame format, with VLAN headers, that I liked and felt comfortable using.

Polynomial

is it something you could feasibly set to 4?

Scott Pack

13:56

Just a sec and I'll find one and I'll post it here

Polynomial

(or 6 in a pinch)

Scott Pack

Fuck me, I just realized that I did something wrong in the blog post. I'll have to fix that.

I thought the VLAN tag header was inserted after the length field.

So, what happens is the 3rd byte of the VLAN tag header is now in the same byte offset position that libpcap expects the IPVersion to start in.

Polynomial

so the type/length fields get read from the TPID field

Iszi

@Polynomial Anyone else just want to read that acronym as Toilet Paper IDentifier?

Polynomial

I read it as teepee, like the tents.

Scott Pack

14:02

Yup, then IP version comes from the 4 bits that make up the vlan priority/CFI

And the TPID, for some reason I don't actually know, always contains 0x8100

Polynomial

is it possible to set those bits such that the version gets read as 4?

Scott Pack

Which is why I wrote up the IPv8 thing

I don't know. I don't know what priority and cfi normally contain.

Fuck.

Polynomial

priority = 2, cfi = 0 gives ipv4

Scott Pack

yeah

Polynomial

you can edit the blog post, I believe.

Scott Pack

14:04

And the length will be all kinds of wonky, since it'll be reading the VLANID

I can

I'm now 4 minutes late for my staff meeting, followed by lunch

So I'll have to do it this afternoon

Polynomial

what's the VLANID? could it be set arbitrarily, or is it enforced?

Scott Pack

But, I'll be able to read up on the priority and cfi flags during that time.

Polynomial

sorry, I'll let you go :P

Scott Pack

Np

The vlanID is the numeric ID that the network administrator sets to that VLAN.

Polynomial

I'll look into it too. Could be an interesting IDS / firewall rule bypass.

Scott Pack

14:05

So, yes, it's an arbitrary number based on network design

Polynomial

hmm, so depending on the VLAN ID, it'd be possible to pad the payload and trick the analyser.

btw, if you get chance, I'd love to get hold of that offending pcap file

Rory Alsop

14:30

@ScottPack bugger - my proofreading skills didn't stretch to that

Iszi

14:53

@RoryAlsop Regarding physical layer DoS on Wi-Fi, do you have any thoughts on making the network and devices dual-band capable? I'm kind of surprised nobody's suggested that, as it would be much more difficult for an attacker to dominate both the 2.4 and 5 GHz bands entirely and simultaneously.

Does anyone else feel just a little mod-like when their close vote is #5 on a question?

Polynomial

hehe

Terry Chia

@Iszi I need 200 more rep to feel that way. :(

Iszi

@TerryChia Oh, right. Hang on...

Terry Chia

cybersecuritysingapore.com.sg/presentationslidesdownload.html

Some slides from the last conference i attended. Some pretty interesting stuff in there.

Iszi

15:10

Wow. Going through your posts, @TerryChia, I'm pretty sure I found an answer that is almost exactly the same as one of your other answers. Not gonna chase the other down right now though, but it makes me wonder if the threads should be filed as dupes?

Terry Chia

@Iszi yeah there was one where i just mostly copied another answer as it is almost the same thing. a password question if i'm not wrong.

AviD

@Iszi I feel all normal-like when that happens to me.

That doesn't happen often...

also, it gives me a satisfying feeling of having the community "grow up" enough to be largely doing it themselves.

yknow, kinda like when your kid doesnt need you to wipe their butts anymore.

Terry Chia

@AviD Gross analogy.

AviD

@TerryChia Thank you.

'course you'd understand if you had kids.

(was gonna go for the "you're a baby too" remark, then thought better of it. Still, had to share the opportunity.)

Y'all have a good weekend now, heah?

Polynomial

indeed.

still, 44con looms. so I'm gonna be excited about that for a while.

makes weekends kinda boring :P

Rory Alsop

15:19

@Polynomial as long as you can tell us all about it without gloating, that's fine :-/

ooh - you could blog about it if you wanted... (hint)

AviD

@RoryAlsop @Polynomial DOOO EEEET

Polynomial

44con? now that's a cool idea

I will.

I'll take my notepad

Rory Alsop

@Polynomial and a pencil

AviD

@RoryAlsop hmm, maybe I will try to do the same for OWASP IL.

Rory Alsop

@AviD you moved to Illinois?

(sorry - has been a long day)

AviD

15:20

will try to make it less boring writeup than last time.

Polynomial

I'll liaise with t'other Rory about it, since he's going.

Iszi

@TerryChia Yeah, something about salted hashes.

AviD

@RoryAlsop hahaha, typical self centric american.

Rory Alsop

@AviD Da, that's me, tovarisch

:-)

AviD

@RoryAlsop in general - think its better to have a loooong post, with short blurbs about each talk? Or individual posts about the interesting ones? Or what?

hehe @Iszi @JeffFerland @RoryAlsop - re being the 5th to close, that firewall bypass q, that 3 mods decided not to close? Just been five'd.

oo, really gotta go. Later, weekenders.

Rory Alsop

15:24

@AviD I dunno - I quite like a daily update - maybe with extra posts about anything really interesting

@AviD have a good one

Polynomial

@AviD I think we should do short blurbs in a single post, then expand on one or two of the best talks as extra blog posts.

Rory Alsop

@Polynomial yup ^ we concur

Polynomial

that gives us some time to do our own research too

Rory Alsop

like @JeffFerland's BSidesLV posts: security.blogoverflow.com/2011/08/bsideslv-2011-day-1 and security.blogoverflow.com/2011/08/some-more-bsideslv-and-defcon

wonder if there is a badge for highest scoring answer on a closed post - @Poly:

1

Q: How can attackers bypass firewalls?

I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system. We all know it happens but what methods make it possible to do that?

firewalls

Polynomial

@RoryAlsop If there is, I haven't had it pop up.

flagspam!

Iszi

15:43

There we go.

@TerryChia You're welcome.

Terry Chia

@Iszi Awesome! Thanks!

3k is really the most interesting privilege for a long time.

Looking at the user charts, it will be less than a week before @Polynomial surpasses a Rory in total rep.

Iszi

@TerryChia Yeah, it's like I said somewhere before. 3k is to an SE user, as 21 is to a young adult in the U.S. - there really isn't much to celebrate after that for a long time.

Rory Alsop

@TerryChia this is what happens when you are a mod and the site grows - your rep time turns into flag/mod/review time

Terry Chia

@RoryAlsop I said a Rory. Not THE Rory. :P

It will be a long time before he surpasses you.

Even at the rate he is going.

Polynomial

@TerryChia Wait, what? Don't you mean for this year?

oh, wait, yeah

other rory

eep, yeah, I'm doing pretty well.

Terry Chia

15:50

You will have access to mod tools by next month eh.

Polynomial

lol

well I'll be less active during 44con

Terry Chia

Enthusiast badge in meta. Hadn't realized it was separate from the main site.

Polynomial

and I've got a tonne of work to do next week

Terry Chia

Just one more day before i receive my first gold badge. :)

Polynomial

night all.

Terry Chia

16:01

@Polynomial Good night. :)

Jeff Ferland

16:36

@AviD But I didn't want to close it! That means I have to edit it so it's not crap... which I'll do because it's clearly a case of, "I have a firewall, how'd I get hacked?" We need to answer that question, unfortunately. It just needs better wording.

Thomas Pornin

16:52

@TerryChia The Fanatic badge ? When I got it, I was not sure about what it said about me. At least I knew I had to bypass my instincts to get it (this involved using a smartphone to connect to a WiFi spot in an inn lost deep in a natural park).

You could have another gold badge (Electorate) with relatively little effort.

With 40 votes per day, almost any body can get that badge in a fortnight.

Iszi

@ThomasPornin What were you doing in the inn? Foraging for porridge? That... would be an odd reversal.

@ThomasPornin And yet, nobody has.

Strangely, I think the trick is actually getting your question votes above 25% of your total.

I've got more than double the total requirement.

Gilles

@Iszi I've never understood why that was a problem. Why do some people never vote on questions?

Iszi

@Gilles Answers are, by their nature, more valuable.

Gilles

@Iszi This is already expressed in making answer upvotes give twice as much rep

Iszi

That doesn't necessarily answer "Why do some people never vote on questions?" but it does answer the related "Why are people much more likely to vote on answers than questions?".

Gilles

17:04

There's no reason to be stingy with question votes

Iszi

@Gilles No, but it's a psychological thing nonetheless.

@ScottPack You're usually the guy with the SE database queries, as I recall. Is there a way to query my vote distribution? I'm curious to know how much solid voting on questions I'd need to hit that gold badge.

Gilles

there are several sites where I've voted on more questions than answers

@Iszi it's in your profile

and not on SEDE, because it's private information

Iszi

@Gilles Guess I'm just missing it?

Gilles

@Iszi bottom right of security.stackexchange.com/users/953/iszi and you can see the details on security.stackexchange.com/users/953/iszi?tab=votes

Iszi

@Gilles Ah. I was looking for it on the detail page. Didn't notice the section in summary.

Yeah, my Answer/Question voting ratio right now is greater than 2/1.

Gilles

17:08

looks like Sec.SE is the site where my question/total vote ratio is the lowest, at least among the sites I frequent: only 37%. I wonder why.

Iszi

Wait a sec...

Oh! There's my problem.

It's not percentage, it's the total number of votes! There isn't a requirement for a total overall number - it's total number of votes on questions?

Gilles

@Iszi yes, the badge is for 600 question votes

it comes up again and again on MSO, people don't read the description carefully

Iszi

So, my ratio is right - better than the requirement, even. But, I need to vote on 165 more questions.

@Gilles Yeah, I was about to go there but wanted to double-check myself first. That's how I caught it.

How is it that I've reached my daily vote limit at <40?

Gilles

@Iszi because the limit is 30, and there's a complicated extension that lets you vote up to 40 times but you need to have voted on enough questions

e.g. you can vote for 10 questions then 30 answers, but you can't vote for 30 answers then 10 questions

Iszi

@Gilles Oh. Link to extension details?

Gilles

17:12

@Iszi I'm sure it's linked from the FAQ on voting on Meta Stack Overflow

or search 40 on the list of feature changes

Iszi

@Gilles Does SE have an aggregated change log?

Gilles

@Iszi hahaha. It's community-maintained: discover a change, edit the changelog

288

Q: Recent feature changes to Stack Exchange

This is the official list of new features and various changes to Stack Overflow and the Stack Exchange network. It is jointly maintained by the community and Rebecca Chernoff (a Stack Exchange, Inc team member). RSS feed for this question Return to FAQ index

support faq featured

Thomas Pornin

@Iszi nine users have the Electorate badge: security.stackexchange.com/badges/28/electorate

Iszi

Oh, hey. It looks like our own @Hendrik posted the canonical question on this.

36

Q: Cannot vote on question although 40 votes limit not reached

I've hit the 40 daily vote limit wall and yet can see on my profile I have 7 votes yet to give to actually reach that ceiling. The votes remain and I am unable to cast them. According to a recent blog posting: The daily vote limit used to be 30 votes per day; we’ve increased that to 40 votes...

bug status-bydesign questions voting

@ThomasPornin Yeah, I just realized a bit ago that I was reading the page wrong. Thanks.

Thomas Pornin

@Iszi And you voted on "only" 435 questions. You must vote on 600 questions to qualify.

(Rules are distinct from the silver badge, where you just need 300 votes. For Electorate, that's 600 votes on questions.)

Iszi

17:18

@ThomasPornin Welcome back to the conversation. :-P

Scott Pack

@ThomasPornin That's because only 9 people care about the community. Clearly.

Thomas Pornin

@Iszi Scrolling is painful here.

Scott Pack

@ThomasPornin Embed glass in the wheel?

Thomas Pornin

@ScottPack It is not the wheel, it is the transoceanic cables. They are not large enough.

Scott Pack

@ThomasPornin Transoceanic? You go back to the motherland?

Thomas Pornin

17:20

I am currently using a Firefox running within a RDP session on a machine 6000 km from my physical location.

Each scroll is a full-screen update.

Iszi

@ThomasPornin Why does nobody use terms like Mm?

Thomas Pornin

@Iszi Because they sound dirty.

Scott Pack

@ThomasPornin And by "dirty" you mean "fantastic", right?

Iszi

Holy crap. They're really getting serious about traffic enforcement around here. (Or, at least, they want you to think they are.) I've been getting two e-mails a day, plus an item in the daily newsletter e-mail, from security about new speeding policies for the past week.

Thomas Pornin

By Jove ! The Rules Have Changed !

To get your 2% epicness, you just need to reach the rep cap, instead of exceeding it ! (I.e. 20 upvotes are sufficient, whereas 21 were needed beforehand)

Gilles

17:26

@ThomasPornin I'm pretty sure that's always been the case

Iszi

@ThomasPornin Do what, now? I'm not sure I follow. However, according to @Gilles, I think it is now up to you to put this into the changelog.

Thomas Pornin

@Gilles I had noticed the contrary, some months ago. You had to be deprived of at least one point by the cap in order to get your brownie point.

Gilles

@ThomasPornin I'm sure that this is not the case: I got the Legendary badge on U&L, and the cap only deprived me of votes on at most 128 days according to my reputation history

What matters for Epic/Legendary is reaching 200 points, including accepts and so on

Iszi

@ThomasPornin Wait... how'd you get my question vote count before getting to the bit where I called it out?

Gilles

e.g. 20 upvotes in a day counts. 20 upvotes and 1 downvote, not. 18 upvotes and 2 accepts, counts (because you're getting 230 points, even though 2 more upvotes would give you 20 more rep for that day)

30 upvotes and giving a 50-point bounty doesn't count, because your daily total is only 150

Thomas Pornin

17:31

@Iszi I am a l33t HaX0r. Also, it is written in your profile.

2

@Gilles What, the accepts count ? I might be more epic that I believed, then.

Scott Pack

Accepts don't count towards rep capping, but they would count towards 200 rep. That does make sense.

Iszi

@ThomasPornin Thought you couldn't see other peoples' voting stats/history? (At least, that's what @Gilles told me.)

Scott Pack

I'm with @Thomas on this, though I have no data to back it up. I thought those badges used to say "rep capped".

Gilles

@ThomasPornin RTFFAQ: meta.stackoverflow.com/questions/67397/… It's correct AFAIK

there's even a link to the actual query

Scott Pack

@Iszi Look familiar?

Gilles

17:34

HAVING SUM(targetrepchange) >= 200

@Iszi you can see their voting total, not voting details

Iszi

@Gilles Right, but when I asked about querying for those numbers, you said they were private.

Gilles

the only thing you can know is the total number of votes on questions, the total number of votes on answers, the total number of upvotes, the total number of downvotes, and some limited information about the number of votes in some time periods

@Iszi the data isn't on SEDE, but some aggregate stats are visible in your profile

Thomas Pornin

@Gilles We shall soon see. I am at "earned at least 200 reputation on 46 days".

Gilles

@ThomasPornin Soon, indeed. Maybe not in exactly 4 200-point days, because I think your history lies a bit

If you earned, say, 200 points in a day, but 10 of these were from a user that was later deleted, then this day now shows as 190 in your history, but still counts for Epic/Legendary. I think.

I checked my rep history when I got the badge, and it lacked a few days of “reached 200 rep”

I think subsequent deletions explain the difference

Iszi

►

Jeff Ferland

17:50

@Iszi "Your order sir... assuming you have some."

Iszi

@JeffFerland Yes. The whole video is just total awesome. Gotta find a way to do that sometime.

Scott Pack

sir?

Iszi

"Somebody hail DS1 for a firmware upgrade for our f***ing starship!"

Scott Pack

Looks like the FAFSA game.

Iszi

@ScottPack Free Application for Federal Student Aid is a game?

Scott Pack

17:57

Woops, FASA.

Gilles

18:12

Iszi

@Gilles Why does that comic have a Furry?

Gilles

@Iszi why not?

this is a story that's been going on for more than a decade

I recommend starting here

It's not a really furry, it's an artificial intelligence that happens to be a genetically engineered wolf

Today's comic is relevant to security too:

She's an engineer, and discovering that she can violate her safeguards against harming her creators makes her very uneasy

Iszi

"His CPU doesn't pick up on all clock cycles, does it?"

Gilles

Oh, and this from a few days ago is about social engineering:

adric

@Gilles Ha, yes. I had to do that to my (home) ESX last night. Easy enough once I embraced the need.

Rory Alsop

18:30

@ThomasPornin 'snot gonna help me - I'm still not as epic as a bear

David

3

A: How to manage admin rights for helpdesk staff?

Mitigation 1: Use two-factor authentication, for logging into admin accounts. Mitigation 2: Give helpdesk staff a tablet or netbook that they can carry with them. Instead of typing their password into the user's machine, they could log into their tablet/netbook and use the internal remote admin...

on that, what kind of two-factor auth is good/popular for AD/Windows?

I can't comment yet

Rory Alsop

@David depends on environment - RSA is popular in corporates

@Iszi that is brilliant

David

18:46

@RoryAlsop what about for a small non-profit

Rory Alsop

@David not sure actually - I tend to deal mostly with global corporates

David

@RoryAlsop what ever happened with the RSA in the news thing, where something was hacked at places like Lockheed or sometihng like that?

Iszi

@David Smart cards are another popular option.

RSA is primarily for remote 2FA. Smart cards are really good for local.

Rory Alsop

@David RSA had seed values compromised, which appears to have been done deliberately to gain access to lockheed martin. The fix for orgs that use RSA was simply to replace tokens

David

@Iszi 2FA?

oh nvm lol

Rory Alsop

18:53

@Iszi agreed - a lot of my public sector clients use them for logon+physical access

David

I wish my company was cool enough to have some form of two-factor auth

We could probably be destroyed by a malicious attack

Scott Pack

Ok, I just updated the blog post to try and fix the problems we noticed earlier.

For as long as 2FA has been around, the market seems awfully immature.

RSA is a reasonably good system with gobs of application. It is also exceptionally ugly to run, and somewhat expensive.

PhoneFactor is a not bad solution that has, probably, good enough application support and integrates pretty well with AD has a backend authentication. It doesn't have any kind of integration with the Windows GINA, which means you can 2-factor TS logins but not console.

I'm fair positive there's a question or two from the early days that were just asking for lists of 2fa solutions

Transcript for