@Polynomial IIRC, backblaze will encrypt your data, but they keep the key. Which sorta defeats the purpose; The people with physical access to the data also have the means of decrypting it... but you who own it do not.

w00t, reverse engineering is fun!

did some trickery with that one to loop through and eval the unpacker using a string replace from eval to return on each iteration, and break out when eval wasn't found at the start of it

if I were writing a shell like this, I'd have some kind of basic encryption in there, with the key passed as a POST parameter. so it'd make it much harder to work out what it does.

and since the POST params don't show in logs, they'd have to catch me in the act

so sneaky polynomial

But I don't really see the advantage over a simple obfuscated eval

stops you from reverse engineering it.

well, hinders you from doing so

@Polynomial how long did it hinder you for?

the stuff they did? a minute or so.

but I'm not talking about that kinda obfuscation. e.g. you could loop through $_POST['k'] with substr and ord, then xor the payload. so unless the owner of the server captures that post param, they can't decrypt the payload.

a little bit like how Stuxnet had an encrypted payload that would only decrypt and run when the C&C server recognised a specific machine profile and sent out the key.

@Polynomial yep - gotcha

and since it's in POST data, it doesn't show in web server logs.

I'm working on some PHP obfuscation CTF challenges for the Sec.SE CTF btw.

@Polynomial Still have not found the time to take a look at those challenges.. :(

Just a general stackexchange question. Do you guys think programmers.SE will be a good site for any questions I have for modelling NoSQL data?

DBA might be a better choice

@Polynomial Ahhh ok. Had not realize there is a SE site for databases.

@TerryChia there's surely a site for everything :-)

@RoryAlsop We need a Rory.SE in that case.

@RoryAlsop when I read "There surely is..." I always imagine it being said by a guy from a 60's movie who then starts singing about whatever came after surely

them musicals

Howdy peeps

@Polynomial Awesome answer bro. security.stackexchange.com/questions/29797/…

heh, cheers

PHP RE is fun :)

@Polynomial yeah well done man, nice analysis skillz

got some PHP reverse engineering challenges coming up too

including a hard one with a really nice packer

@Polynomial I am nowhere near a PHP expert, but don't all these obfuscation layers end up with a eval() call at some point ?

@ThomasPornin sure, but that final eval might be 20 deep

and might require some form of key to decrypt the inner payload

@Polynomial I mean that it suffices to have a modified PHP implementation which logs the parameters to eval() in a temporary file to see what is going on.

unless you need a key.

Ah, if there is a key, it no longer is reverse engineering; it is cryptography.

indeed. though you'll need to reverse engineer the cipher.

For that matter, if you have a key which is not accessible to the attacker, then you could encode the actual code in the key -- PHP would simply be eval(key)

true.

but that's no fun ;)

Preview of the hard PHP challenge for the Sec.SE CTF: pastebin.com/raw.php?i=stNc4cB9

give it a go, and enjoy ;)

I think that's the difference between defeating the attacker, and keeping the attacker entertained.

you might be good at this one actually, @Thomas - it's got some crypto in there

I have a few meetings this morning, I cannot devote much time to it

mmh, gzinflate() starts with gz but it is NOT gzip. I love PHP

s'all good. feel free to take a bash at it whenever, or don't if you're not bothered. either way ^^

@Polynomial is this ok to put on my local apache? it wont break anything if i accidentally call it right?

@lynks nah, nothing dodgy.

i mean rather than firing up a vm

just a few nested evals and some loops

and some gzinflate calls

groovy

@Polynomial Can you trust those words? :P

@TerryChia yes :P though no warranty provided of course! ;)

gzinflate() uses raw Deflate, no header (neither gzip nor zlib). Will have to reclaim my own Deflate implementation.

@ThomasPornin why not just do it within php?

@Polynomial damn you! i ran your code on my production server serving 1345216723 users! I demand compensation!

@TerryChia tough shit! :P

@Polynomial I don't use PHP. I am not savvy of the PHP tools; I use my brain and programming tools I know of

@ThomasPornin fairynuff.

@Polynomial ahh nice obfustication array

this may be useful then: sandbox.onlinephpfunctions.com

online PHP sandbox, will run up to 3 seconds and has sufficient functions enabled to do the job.

it also fits inside the 24 lines without a scrollbar :P

oh, and the key is 18 bytes long. I forgot to mention that, and it's (probably) required knowledge in order to break it.

@Polynomial you have a redundant line of code in here..?

@lynks I dunno, maybe?

wait no, fail moment.

Can't wrap my head around modelling data in NoSQL databases... :(

Too used to good old SQL.

@Polynomial 18 makes sense...

@ThomasPornin it wasn't chosen by accident ;)

meeting time... see ya later

.o/~

@Polynomial thats a very camp looking wave

@lynks it works better in system bitmap fonts.

the tilde sits perfectly on the top edge of the slash, so it looks like when people used to wave handkerchiefs off of boats as they left the dock

try it in a command prompt, you'll see what I mean

this font works well for ~~~\o/~~~

i use monaco in my terminals :(

afternoon all. Having an old school time of it today, just found that the app I'm testing has command injection with the amazingly advanced vector of | Dir c:\

@RoryMcCune Windows ewww. :P

well I get the feeling it was designed for Unix and someone's ported it to windows ...

@RoryMcCune hehe

thus the perl CGI's

I swear I thought I'd seen the last of those

I've been CTF'ing it up by releasing a PHP reverse engineering / crypto challenge

so we're both on the oldschool today I guess

cool :)

read up if you wanna take a look at it. or just clicky

that's one I'd need to take away and read up on to do, I don't get to do that much of that type of RE stuff.

although having fun with a Java app and decompiling today, which is a bit away from my usual web apps..

:)

I don't even know what to think.... digitaltrends.com/mobile/…

ooooh, also, my mug arrived today

it's got a QR code on it that links to the wikipedia article for coffee.

also, fun story time.

a friend of mine works at HMV (yes, the one that's closing down or maybe not)

they have a bunch of stuff on offer on display - some iPads, headphones, mobile phones, etc.

a bunch of kids came in and were messing around with it all, and stole a pair of headphones

and the little geniuses took a bunch of photos of them wearing the headphones and messing around in the store... on the display iPad.

so not only do the police have CCTV of them stealing them, they also have nice clear photos of their faces, and fingerprints from the iPad touchscreen.

lol

gotta love bright kids!

and two of them are known to the police already, so they got a nice home visit.

and it was a £120 pair of headphones too, so they're definitely on the hook for a theft charge.

@Polynomial Genius. But do people even buy headphones from HMV? I always wondered about that.

nobody buys anything from HMV. that's why it's going into administration.

heh. I still buy CDs from the HMV in my country regularly.

fuck CDs, lol

CD's.... do you not get Spotify?

Spotify, iTunes, Grooveshark, AllTunes, millionmp3, etc.

or Bandcamp / Soundcloud for independent bands.

Nah, I prefer to buy and rip my own CDs. Collecting albums is kinda my hobby.

my dad was that way for several decades. had over 1000 albums hanging around. eventually ripped them all to WAV and sold most of them off.

digital is the way to go.

only time I buy the CDs is if they're limited edition or signed.

@TerryChia im like that with books

@Polynomial speaking of which, the rootkit book arrived, just gotta find time to work through it

books are different. there's something about reading a real paper book that just exceeds digital print every time.

@lynks cool. it's definitely worth playing around with the sample code too.

I'd say it's worth "acquiring" a VM of Vista to play around with it on, since that's what the book was based on.

@Polynomial sure, i guess i wont get so far with my win7 vm

most of it works for Win7 but there are a few structures that have been tweaked, so copying the definitions verbatim instead of reverse engineering them out of the kernel headers and WinDbg will cause problems.

im pretty addicted to buying books, ordered a book of beksinski prints today, stuff like farm3.static.flickr.com/2161/2129718291_45a9e3e134_o.jpg

@Polynomial I'll do that once online stores start selling music in FLAC more.

@TerryChia tbf I can't tell the difference between 320Kbps AAC and FLAC.

There's a certain level of comfort in knowing that, with the physical CD, I can do whatever I want with it. And if, for whatever reason, if my mp3 collection pops I'll be able to recreate it.

even on my Shure SE310s it's identical to me. and I'm an audiophile.

@ScottPack unless it's a Sony BMG album.

;)

@Polynomial Neither can I, but I prefer my files in a lossless format for archiving purpose.

@Polynomial I don't think I have audio equipment good enough to tell the difference between a 192K mp3 and 320K AAC.

you'd be able to tell with 192 if you listen to any heavy rock or metal.

256 MP3 is good if you configure the encoder properly (most people don't)

I think NIN and MetalTech are the only things I listen to these days that would qualify as heavy rock or metal.

but I avoid MP3 as much as possible unless it's 320Kbps, since it has issues with compressing near-gaussian noise (e.g. symbol crashes) at the same time as wideband riffs (bass + lead guitar)

@ScottPack w00t, MetalTec! :D

I use dbpoweramp for ripping/converting. Works well without needing to tinker with settings.

also, w00t, NIN

EAC was a PITA to get up and running.

@Polynomial I've been a NIN fan since the very late 80s. :)

@ScottPack there's a bit in Hand That Feeds that always compresses badly in MP3 codecs, drives me nuts :P

@ScottPack hipster ;)

also, no Rage Against The Machine on your playlists? they're pretty heavy.

@Polynomial It's sadly true that I do tend to enjoy the older stuff more. The newer albums have been a bit too electronica for my tastes.

yeah, I do agree with that.

@Polynomial Not really, no. I never really got into them.

RatM is my ultimate coding music

"We found your weakness, and it's right outside your door - NOW TESTIFY!"

saw them live at Donnington a while back, they rocked

@Polynomial love RATM - you can see Metaltech's bass influences include those boys

yeah

but also folks like the chili peppers, which probably doesn't count as heavy :-)

I love his guitar, with "ARM THE HOMELESS" written down the fretboard

@RoryAlsop lots of slap-bass though

@Polynomial very nearly wrote Home the Armless down one of mine, some years back :-)

haha

I was feeling clever

for one of the tracks (I forget which) he used a guitar that was made from a replica AK-47

@Polynomial Looks like the harder stuff in my highest rated playlist is Pearl Jam, Nirvana, NIN, Garbage, Bush, Beastie Boys, Albannach/Clann an Drumma, Soundgarden, Smashing Pumpkins.

@ScottPack All of whom are high on my play rankings except Albannach - which means I obviously need to buy some of their stuff :-)

so the lower body of the guitar was made from a gun bipod rest and the AK stock, and the strings ran up the stock and up to the barrel, where they attached onto that little V-shaped bit of metal on the underside of the barrel

was epic

yes - vaguely remember that

@RoryAlsop Not necessarily. So the Clann an Drumma guys got fed up with the old man and decided to fire him. Unfortunately, he owned the name. I don't like their new stuff as much.

@ScottPack most of that is a bit further towards the melodic / prog side than I usually go

@RoryAlsop It feels like to me that the old man was their grounding influence.

Ahh

@Polynomial Yeah. Like I said, "hardest". :) My musical formative years were the mid-90s so that (post-)?alternative and post-punk kind of seeped in.

See, I have a good range like that, but also like folks like Tryptikon, Zao, early Ethereal Scourge etc :-)

I've never heard of those, so clearly you're a hipster.

oh well if we're all confessing our musical tastes.... it's prog rock for me. Long spangely instrumentals I can code to. Or most things instrumental (from classical to just about anything) I find singing distracting.

How about Plastic Noose - nice doomy metal stuff (but I'm in one of their videos)

@ColinCassidy good call - and everyone must like Rush, obviously

@Colin - have you seen Vantage Point yet? Edinburgh based prog rockers

very good old school stuff

@RoryAlsop I have not, but I'm always on the lookout for new things

You probably haven't heard of most of my heaviest stuff... As Blood Runs Black, Parkway Drive, Dimmu Borgir, Chimaira, Winds of Plague, Emmure, Shadows Fall, Ensiferum, Hanzel und Gretyl, Graveworm, Eluveitie, Dry Kill Logic

@AviD, nice strip indeed

Yup -I have Dimmu, Chimaira, Dry Kill Logic , and might have some Ensiferum

To be honest, I like most stuff with a guitar. I am less keen on growly vocals, but sometimes it works for me

With the exception of a month or so where I was using some Bear McCreary as background coding music, and the fact that for a while SNZ was the largest single band in my library, my last.fm profile looks pretty reasonable.

ofc I have a lot of the more mainstream metal stuff too - Rammstein, Slayer, Slipknot, Cradle of Filth, Bullet for my Valentine, Coal Chamber, Deathstars, Dragonforce, Drowning Pool, Disturbed, Five Finger Death Punch, Killswitch Engage, Lamb of God, Machine Head, Machinemade God, Noise Therapy, Papa Roach, Shinedown, Skrape, System of a Down, Turbonegro, Unearth

@RoryAlsop it's gotta be drums for me. Drum heavy vocally quiet music works wonders

@Polynomial Absolutely - and guess what - Rammstein are headlining Download on my birthday this year....so that's where I'm off to

@RoryAlsop lucky. I couldn't afford the tickets + time off.

@ScottPack I always worry that if the kids play some music while Minecrafting, it might skew my last.fm profile - but then I realise that they pretty much like what I like (aside from the odd Justin Bieber or similar...)

@Polynomial That list is so close to what we play in the car most of the time

saw Rammstein at Nottingham Ice Stadium a while back though. and saw them a couple of times at Birmingham NEC too.

@RoryAlsop Heh, yeah. When I swap it over to last 12 months it looks pretty good. I'm the only one that ever scrobbles to my account.

@RoryAlsop nice :D

The kids got really into Dragonforce for a while after SoaD

@Polynomial i was probably at those NEC gigs

SoaD always rock.

@RoryAlsop My biggest annoyance is remembering to actually set up scrobbling whenever I make a change to my system or player.

@ScottPack hahaha -yeas

@Polynomial I have never seen them live, but my kid brother travelled extensively just to watch them in Europe and after watching too many of their videos I have come to the conclusion I must get closer to the flames

yeah SoaD still come around my playlists every once in a while. in addition to Polynomials' list: wintersun, dream theater, fluke, reznor....

@RoryAlsop They're like no other band live. Amazing music mixed with ridiculously insane stage performance and pyrotechnics.

@Polynomial they are my pyro heroes

just to explain how utterly mental their gigs are - we were looking at the stage rigging before one of the gigs and saw loads of weird kids' dolls legs and stuff stuck up inside one of the rigs

during Laichtzeit, they lowered them down, and they were creepy dolls with half their hair cut off and limbs missing

then green lasers fired out of their eyes, as they were dangling from wires

and as if that's not enough, they all EXPLODED at the end of the track.

@Polynomial if that was at the NEC about 2 years ago, I was about 6 rows from the front :P

and that was one track. one of their more tame ones.

@lynks yeah, I was at that one, about the same distance from the front.

first time I saw them was 15.07.2005 at Birmingham.

@Polynomial creeeepy

@lynks I looked up the gig date online ;) I could remember the year but not the date.

@lynks you making it down to BSides London this year?

@Polynomial maybe, i have a lot on over spring; sxsw, prague, changing jobs, moving house. if i do, i'll be sure to let you know so we can organise trains.

@lynks tickets are already gone, unless you got one

@Polynomial nope but a friend is going with a group of people and he says some might drop out.

ah

well you should be able to SE a ticket from the ticket guy/gal, since there are always spares from people who grab tickets and don't turn up

but if you lot are all going down on one train I'll deffo tag along with you lot on travel. journey to London is boring alone.

@Polynomial I'm flying - train takes far too long from here

and the plane is cheaper too!

@RoryAlsop yeah, that's like a 10 hour train run from yours

@Polynomial my friend and his group live in the west, so very much different trains :P

one of the Abertay lads took a coach to 44CON last year

@lynks ah, fair enough

@Polynomial whereas by plane I can leave the house at 6 and be in London City by 9

@Polynomial not fun

took 15 hours on the coach

sending my eldest on a snowboarding trip at the end of the year. In Italy. By coach.

hahahahaahahahaha

left at 5pm and arrived in london at 8am

@Polynomial I wouldn't be any use for anything after that

he slept the whole way lol

@Polynomial I once did Glasgow to Hastings for GenCon by coach, that was a fair way

albeit before the days of Easyjet flights...

three of us were in the same hotel room - was mental, paid £200 for 3 nights and split it down to £70 each. room had 4 beds, full size fridge/freezer, sink, microwave, kettle, walk-in wardrobe, and was ~5 mins walk from 44con

found it as a last minute thing on Expedia. I'm bawss at finding cheap hotels.

immediately got a crate of beers and stuck them in the fridge, of course.

and that MWR Labs afterparty was insane

@Polynomial that's it - just rub it in again!

@RoryAlsop hehehe

you'd have loved it. open bar all night, drank all of the hotel's booze, they bought all of the bar's booze from downstairs and we drank all of that, then they bought all of the booze from the cafe/bar across the road, and we drank all of their beer and most of their rum.

then we went to the pub.

ended up wandering round the middle of nowhere in London at 3am looking for pizza.

@Polynomial normal :-)

@Polynomial Fun stuff. On our honeymoon Katie and I wandered around Edinburgh looking for some place to eat at dinner time.

and I carried on drinking once we got back to the hotel, whilst Gordon (the scottish lad) went to sleep. I BEAT A SCOT AT DRINKING! :D

@Polynomial We refused to go into a PizzaHut, and eventually ended up having to settle for an Applebees. That made me sad.

@ScottPack You could've gone to McHamish's Fish & Chip Emporium.

classy place, that.

@Polynomial where is that? I have not experienced it

@RoryAlsop I'm pretty sure it doesn't exist. My dad uses it as a catch-all term for Scottish restaurants.

@Polynomial we like letting folks get a good lead to lull them into a true sense of superiority before we get beaten soundly. This works in Football, Rugby....etc

@ScottPack There is an Applebees in Edinburgh???

@RoryAlsop haha

Have onl;y ever been to one in Cleveland

I met Gordon at DC4420 ages ago, and he was trashed then too.

fell over the sofas in the basement, lost his phone, and heckled speakers a few times.

@RoryAlsop I thought it was. There are 3 or 4 chains that are, as far as I'm concerned, functionally equivalent.

@ScottPack fair enough

though I managed to make a bit of a name for myself at DC4420, which was amusing.

they did this bit where they went round the entire room (of ~60+ people) and got everyone to say their name and what they do

@RoryAlsop Could have been a TGI Fridays

and I said "I'm Polynomial and I break things with hammers."

so I became the hammer guy for the night.

I was wasted by that point anyway, so it was great. Got invited to go do a talk there about breaking things with hammers.

@ScottPack there is definitely one on Castle Street - you can come out the door, look right (and up a bit) and there is the castle :-)

mmmmm, TGIs

@Polynomial superb

their cheesy mash is insanely good.

How much do con tickets cost in the UK?

@TerryChia depends on the con. a lot are free / cheap.

@RoryAlsop Yeah, I just StreetViewed that shit.

@Polynomial I almost went there for lunch today - after crawling out of the gym - but picked up a bacon and pesto bowl instead...

I'd love to go to syscan this year but the ticket cost is waaaaaay too much for me :(

@TerryChia DC4420 and BSides London are both free. Securi-Tay was £10 (might as well be free)

I think 44con was about a hundred quid or so?

Only way i'm going is if i qualify for the finals of their coding competition or as an event helper.

@Polynomial Infosec - free, unless you want the training stuff

NISC - £1600!!!!!

@RoryAlsop Infosec is a trade show more than a con, though.

yeah, I know :-)

Syscan is 1k sgd. Sucks that it is the only technical conference in SG as well.

I still visit it for a half hour or so

after or before B-Sides

@TerryChia Short answer: There is no "typical price" because every single con is different.

just to say hi to some of the folks I know

@TerryChia yikes, that's a lot of money (about 520 GBP)

I'd love someone to do a proper security con somewhere in the midlands.

@Polynomial Indeed. And that is the early bird pricing.

they're always at the extreme ends of the country :P

@Polynomial RoryCOn??

@Polynomial Don't think we have had one back home yet - in sunny Orkney

@ColinCassidy RoryCon would be in Scotland ;)

@Polynomial heh - obviously

aren't most of the major ones in the US really expensive too? Defcon / Blackhat / BSides LV / etc.

Defcon is very cheap

BSides SF was almost free

I remember BlackHat being like over $9000

Blackhat was very expensive (but you got a free Defcon ticket)

I bet BSLV was expensive. But it is Vegas.

I wonder how much Shmoocon is...

hahahaha, shmoocon is insane!

> All tickets were held in 12.24 seconds. The wait list filled up 7.45 after that. So, in other words, we sold out in 19.65 seconds.

@Polynomial wow

@Polynomial nope BSLV was free at least first time around

IIRC all B-Sides are free (but I could be wrong...)

@RoryMcCune that's not bad then. bet it sold out quick though.

I'd like to see BSides charge a £10 deposit at least.

well first time no-one had heard of it, I happened to be there 'cause I couldn't afford blackhat

@Polynomial they do keep toying with the idea - to try and stop everyone grabbing a ticket and not turning up

London one always sells out fast and then loads of people didn't turn up.

since then yeah I reckon they all sell out quick..

the no show thing is a big problem with free events...

one of the best things about the £10 deposit as well is that it works as a short-term loan for con organisers, so they can get stuff sorted before the sponsor cheques clear.

that's one of the reasons I always drop my CFP submission in early. organising it ain't easy and having people flood them with submissions at the 9th hour is not fun.

In an ideal world, for a web service (php&mysql in this case), should the production environment (a directory on the company's internet-facing server) be a checkout of the version control repo?

When the developers make changes in the dev environment they test and then commit, then when the changes are agreed upon, the directory on the production is updated.

This doesn't feel right for me, but I don't know why, it's just a gut feeling.

@Adnan how would you handle rolling back? what if you want someones fix, but not someone else?

@Adnan personally I'd have a formal build process, even if that's only taking a copy, and then branch at that point then you can manage emergency patches and continued development much better

@Adnan that's pretty much how we do it. except we have an intermediary/integration repo that has a bunch of unit tests attached to it. we then tag and roll out from there.

@ColinCassidy Indeed. I'm also worried about some people committing for the sake of saving the changes, they might not be breaking commits, but still, they shouldn't go live.

@ColinCassidy all those weird cases can be solved if everyone uses branches heavily - the way git is meant to be used.

Well here's the thing, it's SVN.

0_o

@lynks I like this intermediary step, would solve some of the issues

@Adnan ahh svn, yeah youll have to design some infrastructure

you're lucky to have proper source control at all

we never branch. it's all done in the same branch.

@Polynomial thank you!

at my old job there was no source control at all.

I honestly detest when someone says "Oh! You use SVN! You bunch of backwards old devs"

heh

I like SVN.

we use Vault at the moment.

I'd love to move to SVN. Mercurial is another option. I think git is a bit too *nix-centric for us.

@Adnan nothing wrong with SVN, The last team I was with used it. We started using git recently, so I've had to learn it, and I certainly wont look back to CVCS

@Adnan using SVN was always like '...carefully does it...' with git its more like 'lol branches'

Like Poly said, I'm actually quite pleased we have an outlined development process with version control.

@lynks I love this!

@Polynomial hehe

shiite. 315 messages? I wasnt gone for long.

what is that thing that @Iszi says? y'all need to STFU a bit more...

but but but.. but..

this is a chat room

For serious talk about security

not for idle banter

@CodesInChaos no, the topics are Food, Libations, Rory and Security.

we're libating. or something.

Since I don't know what libating means, I'll assume it's a sexual act until I google it

nope.

@Adnan You're one fick-minded sucker.

"A libation is a ritual pouring of a liquid as an offering to a god or spirit or in memory of those who have died."

but it generally means to drink to memories.

@Polynomial I see no difference

@Polynomial And is often diluted further to just refer to alcoholic beverages in general.

indeed.

etymology, homoeopathy style.

@Iszi thank you. Are you German?

@Adnan Possibly, though it's fairly well thinned out among a mess of other things if so.

@Iszi Genetic homoeopathy!

otherwise known as sex.

@Iszi, then congrats on the well-done usage of fick.

@Adnan he just switched the 'f' and 's' around.

Mein Deutsch ist nicht so gut.

@Adnan Ah, not at all. Happy coincidence, really.

@Polynomial, ist gut enough. Better than mein!

serendipity

@Polynomial Precisely. Just like the expression, "He's a real fart smeller!".

@Adnan I know enough to ask for simple directions and explain pain / injuries, and order stuff in a restaurant.

the important stuff.

@Polynomial oddly that's the level of my german, and I lived there for 7 years

@Polynomial I've always been meaning to ask you, what order are you exactly, and how can we be sure that you're not, in fact, exponential?

@Polynomial, "Wie viel für die Dame?" is also important

so somewhere between "Mein bein ist gebrocken." and "Gehen sie geraderaus, und gehen zu dritte straße rechts." I'm just about capable of making my way around Germany.

@Adnan I've found, in those circumstances, that their English is superb. must be something about the tourist/service industry... ;)

@Adnan how much for that?

@Adnan oh, how much for the woman? haha

@Polynomial, oh please! Show some respect!

"How much for the lady ?"

haha