The DMZ

Rory Alsop

12:02 AM

@ScottPack Somehow that just sounds incredibly smutty :-)

Scott Pack

12:16 AM

I have that gift.

Rory Alsop

12:31 AM

anyway - bedtime. Had to help out a friend sort her laptop, and then do my evening work... catch you tomorrow

Scott Pack

Sweet dreams.

tylerl

3:29 AM

@RoryAlsop YAY.

Stack Exchange

4:28 AM

We can't let this happen again. We need to build a secure TWO-day-before-retirement safe room.

Polynomial

7:38 AM

@RoryAlsop I won? awesome! :D

/me dances

Rory Alsop

8:00 AM

Heh- glees for @Poly

Polynomial

I'm still not entirely sure what I won - did you manage to re-organise the prize tiers?

I'm also rather surprised that I won - I knew I did pretty well on some of the tags, but not that well :o

Lucas Kauffman

Rory u here

Polynomial

he was 7 minutes ago, so probably.

vignesh4303

in Root Access, 10 mins ago, by vignesh4303

in my windows 7 ultimate 64bit system i recently changed the ownership in c drive and i got explorer hanged ,after that my machine got restarted ,after that whenever my system booted after boot screen autochk not found autochk skipped msg gets displayed and restart process continues,i tried to login as safe mode but safe mode doesntget loaded,it stops with tcpip.sys file

@Polynomial mate help me please

Polynomial

@vignesh4303 I don't do tech support.

@LucasKauffman Money, sadly. Just couldn't afford it.

vignesh4303

8:08 AM

@Polynomial ok mate :(

Polynomial

...

Lucas Kauffman

Lol :p I think I saw Rory and his better half but I'm not sure

Polynomial

@LucasKauffman If it helps, she's blonde (I think!) and not much shorter than him.

and he's... well, Rory. Scottish with glasses! :)

Lucas Kauffman

I have an Indian guy sending me email about cen

@rorymcune I'm the guy in the green shirt

Polynomial

8:25 AM

@LucasKauffman That was always fun at cons. "I'm the guy with long hair, wearing all black..."

so basically 80% of the people at the con :P

Lucas Kauffman

Haha :p

Polynomial

it's even more fun when meeting people at gigs

it's like Where's Wally but with hundreds of goths.

Lucas Kauffman

Other Rory is easy he has flashing eyes

Lucas Kauffman

9:12 AM

Found the real Rory

Rory Alsop

9:26 AM

You mean I am a pretend Rory? :(

@poly, we tried to make sure the thresholds were appropriate most weeks. In week four we obviously had @Lucas as clear winner, but for the others there were a handful over the threshold and these went into a pot.

Polynomial

@RoryAlsop Ah, cool. Makes sense.

Rory Alsop

The threshold for top prize was higher, so the pool was smaller,but you were easily in that pool.

My stats meant I was in the pool for level 2 which is why we needed the random choice to come from someone else, not a mod :)

Getting those thresholds right was what took moray discussion time- next time we do one of these I think we have a better idea how it will work

Moray? Blimming phone.

@Lucas, @rorym and @marionm enjoy BruCon. Say hi to Wim, Chris and the usual suspects. <jealous and missing out on cool swag again:(>

Polynomial

@RoryAlsop Yeah, that's the problem with running stuff like this for the first time - it's difficult to gauge interest and participation levels.

Lucas Kauffman

9:48 AM

@rory of course u r real and will do, don't know chris but wim is a colleague

M'vy

11:28 AM

Hi there!

Scott Pack

11:41 AM

@Polynomial I thought she was a soulless Ginger?

Polynomial

@ScottPack What, Rory's missus?

possibly. I only met her once, briefly.

Scott Pack

Can't you check your cache of hair samples?

Polynomial

12:06 PM

Holy frack!

►

Dude's a genius!

Gilles

12:27 PM

1

Q: What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files:- 1. ~/.ssh/authorized_keys:- Holds a list of authorized public keys for servers. When the client connects to a server, the server authenticates the client by checking its signed public key stored w...

on-topic? I've answered practically the same question on U&L

2

Q: I have some questions about ssh key-based authentication.

I read about setting up ssh keys in Linux and have some questions. Correct me if I'm wrong… Let's say host tr-lgto wants to connect to host tr-mdm using ssh. If we want to be sure that it's the real tr-mdm, we generate a pair of keys on tr-mdm and we add the public key to known_hosts on tr-lgto....

linux ssh security

Polynomial

off topic.

Gilles

I guess it's one of these questions that work on both sides. I'll answer here too.

Polynomial

fair enough.

Gilles

well, if you think it's off-topic, I'm ok with closing

but I don't think it is, in fact I think it's fundamentally more sec.SE material, but not so much that I'd consider it off-topic on U&L

why do you think it's off-topic? My view is that it's about who authenticates who, and that's a security question

Polynomial

kinda... it just seems more of a "how do I make SSH work?" question

Gilles

12:36 PM

@Polynomial the U&L one was phrased that way. The Sec.SE is more “explain the protocol”. Upon reflection I think the two questions are exactly where they belong

Polynomial

ok

Lucas Kauffman

12:52 PM

This speaker just passed around his pen drive with files , I don't trust it xd

Rory Alsop

@LucasKauffman hahahahaha

treat it as untrusted - look at it from a vm

Iszi

Okay, I've seen this around the web for awhile but I still don't get the meme. Anyone here that can help me?

Lucas Kauffman

It's an amazed at ignorance/stupidity meme

!!! C

Scott Pack

@Gilles I haven't compared then directly yet but it looks like our answers to that ssh keys question are probably very similar. I was typing out my answer when the kid woke up. By the time I got her dressed and breakfast made I came back to the dreaded New Answer bar.

Iszi

@LucasKauffman I've gotten that much. I'm looking for origins/memetymology. Like, who is that supposed to be, and from what production? Or is it just some random dude someone drew once?

(If that's not a word, I claim coinage now.)

Scott Pack

1:04 PM

@Gilles @Polynomial I think it fits into the overlap phase, which in my thinking means don't bother migrating unless the poster asks or it doesn't get any love.

@Iszi knowyourmeme.com

Iszi

@ScottPack Can't do an image-based search there, can you?

Scott Pack

I know, it's terrible.

knowyourmeme.com/memes/are-you-serious-face-seriously

Iszi

From the KYM front page.

Scott Pack

I shouldn't have shown you that, should I have?

Iszi

Been there before, actually. It's like the TVTropes of Internet Memes.

Scott Pack

1:12 PM

I find it more interesting since TVTropes tends to be so very self-referential.

Iszi

@ScottPack That's what makes TVTropes the ultimate time sink. Once you start down a rabbit hole there, you just can't get out.

Iszi

1:26 PM

Okay, getting away from KYM now before I try to build a "What [X] think I do" image for IT Security that somehow includes Gandalf's "You Shall Not Pass!" scene.

Polynomial

@Iszi Gandalf is the ultimate firewall.

*** ALERT: Detected W32/Balrog. Attack was blocked by Gandalf.

2

Scott Pack

@Polynomial I didn't know that GandolfIDP had signatures for MSSQL.

Iszi

1:47 PM

Speaking of things I should probably never have been shown. From Infosec Reactions, this one is labeled "Remote Code Execution":

Polynomial

rofl

love Infosec Reactions

Rory Alsop

@Polynomial and of course that is the one that gets blocked here!

Lucas Kauffman

Haha @iszi

This OWTF tool looks good for web app assessment

VicKy Amr

2:11 PM

@Iszi wow

Iszi

2:32 PM

Speaking of wow, and a topic discussed yesterday...

►

Bill Nye Gangam Style

Polynomial

2:54 PM

just found the a capella and instrumental versions

time for some remixy fun!

can't believe Gangnam Style has 282 million views

Jonas

3:09 PM

@Polynomial: I've seen it mentioned in mainstream media a few times - that helps a lot. Plus it has become one of the unofficial Starcraft hymns.

Polynomial

@Jonas I play SC2, not really heard it used much.

then again, I don't play much multiplayer these days.

just tend to watch day9 / husky a lot :P

Jonas

@Polynomial: I've seen it played at several recent live events (including Barcrafts)

Polynomial

nice ^_^

anyone netfamous playing there?

Jonas

at live events, you mean?

Polynomial

at the ones you were at

ohhhhh, nm

I misunderstood what you were saying.

Jonas

3:14 PM

The live events I only watched :)

Like Dreamhack, or MLG

Polynomial

yeah, I thought you meant you attended as a spectator

Jonas

Not enough Stockholm where I live :)

Polynomial

I'd love to attend DH / MLG / ESL

it's all in the USA or Korea though :[

just wish IdrA was still good, his games used to be epic

now he just ragequits all the time 'cos his midgame sucks

Jonas

He has been performing a lot better recently

Polynomial

didn't he drop down to Diamond league for a while? :/

I remember someone telling me he dropped out of masters league

Jonas

3:18 PM

But attending a Barcraft is fun as well. You should check whether there's one near where you live before the next big tournament

Really? I guess it's quite possible. He has gone through a bad slump

Polynomial

@Jonas It went downhill since he lost 2/0 to HuK and Destiny consecutively.

really hit his pride, I think

Jonas

Yep, but he has been doing a lot better than HuK since this summer

Polynomial

Hero's still in good form

dr jimbob

Hey @Polynomial - the reason I am arguing over IV being in the first block of a encrypted_message is in response to the insecure authentication routine of solidauth.com (which was the accepted answer to matttt's now-deleted question).

The algorithm there (solidauth.com/auth) was susceptible to timing attacks (non-constant time string comparison) and rather than hashing the password, aes-128-cbc encrypts it using an simple MD5 of the password as an IV. Meaning anyone using the method is very insecure as you can do a timing attack to get the 16 byte IV (which is an MD5 of the password) and then typically easily reverse the MD5 hash.

Polynomial

but you were saying that the IV is the first 16 bytes of the plaintext, which isn't the case.

the IV is a generated value (albeit via MD5) which is still sort-of independant of the key.

dr jimbob

3:25 PM

No; i was saying that the IV is the first 16 bytes of the encrypted_message.

Polynomial

that's still not true.

it cannot possibly, actually.

CBC chains cipher blocks together, which means that the first block requires a non-existent previous block to combine with

since there's no previous block, it uses an IV - that's the entire purpose of the IV in CBC

it initializes the first block

dr jimbob

I agree at that point.

Polynomial

in this case the IV is generated from the MD5 of the password

which isn't ideal, but it's certainly not generated from any ciphertext

dr jimbob

If you have the key (e.g., derivable from a passphrase) and an encrypted message how would you decrypt it.

No. The IV needs to be random.

Polynomial

I know it does. That's why I said it's not ideal.

dr jimbob

3:28 PM

"Randomization is crucial for encryption schemes to achieve semantic security, a property whereby repeated usage of the scheme under the same key does not allow an attacker to infer relationships between segments of the encrypted message."

Polynomial

@drjimbob You can't - you need the password.

iv = md5(pass); key = gen_key(pass); block_0 = aes_cbc(iv, key, message_0);

thus without pass you can't know iv, unless iv is transmitted in the clear (which would be dumb)

dr jimbob

iv = Random(); key = gen_key(pass) ; block_0 = iv ; block_1 = aes_cbc(iv ^ message_0, key)

Polynomial

yes, that's how you should do it.

his method is dumb, and the wrong way to use it

dr jimbob

And that's how implementations of aes-128-cbc does it.

Polynomial

but your description of it was incorrect.

dr jimbob

3:31 PM

in say php

84 $iv = md5($_POST['solidauth_password'], true); // this makes a nice 16bytes string that workd perfectly as IV for the Open SSL function
85 $pass = sha1($_POST['solidauth_password']); // this creates a diffrent hash to be used as key
86 $source = $_POST['solidauth_username']; // since we need something to encode, why not the username
87 $method = 'aes-128-cbc'; //
88 $hash = openssl_encrypt($source, $method, $pass, false, $iv);
89

if($hash != $sqlhash)
95 echo "<div class='solidauthall solidautherr'>username and/or password wrong!</div>";
96
97 // if all checkes out log user in
98 else{
99 echo "<div class='solidauthall solidauthtru'>Welcome!</div>";

Polynomial

yeah, that's not really how AES-CBC is meant to be used O_o

I think we're both saying the same thing in different ways

in proper use of AES-CBC, both parties have a secret key and a public (but authenticated) IV.

the IV must be random per conversation.

dr jimbob

Completely agree.

Polynomial

but he's talking about some sort of dodgy password hashing scheme, from the looks of it

dr jimbob

I'm just saying that in most implementations that I have seen, the IV is concatenated with the encrypted message as zeroth block.

Polynomial

it's not as a block, but rather metadata

or a separate field, rather

it can't really be called a block because it's not part of the ciphertext. the context of the data in transmission is implementation specific.

Scott Pack

3:52 PM

My 3 year old just told me, "Well, it's like this..." >_<

Lucas Kauffman

4:30 PM

There is a guy here that's "building" a website that says royal bank of Scotland

Scott Pack

That sounds pretty skeezy.

Lucas Kauffman

Might be a challenge for the hex factor

dr jimbob

@Polynomial - On further inspection (getting php 5.3.3+ up and running in a VM), it appears I was wrong. I still think the design of solidauth.com is quite weird and insecure (non-constant-time string compare). The output of the php function openssl_encrypt does not include the IV (and if no IV is provided it uses "" as an IV).

Thomas Pornin

5:10 PM

@Polynomial Per message, rather than per conversation -- that's the difference between TLS-1.0 and TLS-1.1, or if you prefer, BEAST and non-BEAST.

Stack Exchange

Blog - Stack Exchange: Apptivate.ms: A Windows 8 App Development Contest

Lauren Gundrum on September 26, 2012

Windows 8 officially launches on October 26th, and it’s already generating quite a few questions on Stack Overflow. So when Microsoft approached us about sponsoring an app development contest, we thought it was a great idea.

Today we’re announcing Apptivate.ms, a Windows 8 App Development Contest sponsored by Microsoft.

The contest has two parts:

A Developer Contest for people interested in writing applications

A Reviewer Contest for people interested in reviewing and voting on apps

You can participate – and win prizes – in both categories, so even if you aren’t interested in developing your own app you can still participate by helping others by reviewing their submissions. …

David

5:28 PM

Good morning, gentlemen!

Scott Pack

Bwah.

Iszi

Meh.

Rory Alsop

I'm still waiting for Gundam Style!

And Afternoon all, bwah and meh

Scott Pack

I had to hear the damn thing 3 times before I realized they were saying something different.

Iszi

@RoryAlsop I fail to believe the Internet has not yet created that thing.

Rory Alsop

5:40 PM

It must have but I have not found it. I did enjoy metal gangnam style

But generally it is annoying the bits off me

Blimming new fangled pop music

Scott Pack

Won't stay off your lawn will it?

Rory Alsop

In my day. ........

Iszi

@RoryAlsop A bit short, but this might quench your crave a bit...

►

Polynomial

6:08 PM

@RoryAlsop Waiting? youtube.com/watch?v=5fD8YVOOyrc

I'm relatively sure the metal version is faked / dubbed.

his hand movements just don't sync up to the track

Thomas Pornin

I have just receive four spams, which claim to give a link to a youtube video for the (in)famous alleged movie "Innocence of Muslims". All four point to the same youtube URL. Is thatt an attempt at youtube-bombing ?

Polynomial

6:23 PM

probably.

or just an attempt at trolling.