The DMZ

Rory Alsop

14:00

time to be industry side, rather than consultancy side - finally

Polynomial

@Tinned_Tuna that's pretty much my position right now, except it's C# and Delphi, and I've got a bit of experience in security in various dev roles. my experience with finding jobs in the security field is that it's a small community and you have to be in the right place at the right time.

Rory Alsop

@Polynomial networking is key

Polynomial

I do plenty. Location is still key.

Tinned_Tuna

How much does 'off the record' experience matter in this field? For example, The project I'm currently working on, I've been going to lengths to upgrade and improve the security of the application and systems -- but it's not in my job description.

Otavio Macedo

So, @Polynomial, in practice, you need to make automatic reviews, right?

Rory Alsop

14:01

@Polynomial that is also key, yes

lynks

im setting up a vulnerable debian vmi for an upcoming lan ctf, i've got; suid root+vulnerable executables, bad passwords, out-of-date daemons, nopasswd sudoers, sqli vulnerable website with root sql user + file access. all tied together by a 'simulated legitimate user' that runs on my laptop, using all the services to make sure they stay up, and logging downtime. any more fun and games i can add?

Rory Alsop

and making sure people know you are looking

Tinned_Tuna

@RoryAlsop Location? i.e. london?

Polynomial

@OtavioMacedo you can't automate them, though. you have to filter down the logs to a set of important ones then review them manually.

I get plenty of offers for interviews, but they're all for companies based >100mi from where I live.

Rory Alsop

@Tinned_Tuna - no, wherever the employer is wanting a new employee - but London has more than elsewhere in the UK, obviously

Tinned_Tuna

14:02

@lynks a known-vulnerable install of wordpress or other CMS is always fun

lynks

@Tinned_Tuna rgr, i shall add it :)

Rory Alsop

worth a try

@Polynomial ask 'em to pay for your travel to interview

Terry Chia

@lynks Patch it all up and sadistically laugh when you see people banging their heads trying to crack the machine.

Polynomial

@RoryAlsop London and a lot of places in Scotland.

Tinned_Tuna

@lynks or something where there's a problem in the framework -- e.g. the JSF version that's vulnerable to padding oracle attacks.

Otavio Macedo

14:02

BRB.

Tinned_Tuna

@lynks do two VMs: one OpenBSD locked down something crazy

Polynomial

@RoryAlsop I'm usually not willing to relocate that far, unless pay is good and/or relocation costs are covered. Which they never are.

Tinned_Tuna

and one Windows :-p

lynks

hehe

Rory Alsop

@Polynomial currently Scotland is hiring in Security - many companies have realised we are a cheap offshoring centre of excellence

Tinned_Tuna

14:03

@RoryAlsop I'm basically always open to relocation, lol

lynks

@Polynomial im hoping to get a job down south soon, so i shall be moving long distance.

Rory Alsop

@Tinned_Tuna where are you now

Tinned_Tuna

@RoryAlsop I'm currently in York.

Polynomial

@RoryAlsop Yep, but I can't move that far. It'd be a case of moving away from all of my family and friends, and the same for my fiancée.

I'd maybe do it if the pay was epic, but it's never enough to cover the distance.

entry level pentester jobs never seem to want to pay more than £24k, even for people with wide ranging dev/sec experience.

Rory Alsop

@Polynomial you said you had spoken with Pen Test Partners, right?

Polynomial

14:06

which would be great if I already lived local. but no chance in hell for getting me to relocate, especially to London.

@RoryAlsop pretty sure I spoke to PTP, yeah.

Rory Alsop

hmmmm - thought they would pay a bit more than that

Polynomial

yeah, I had an interview at PTP

Tinned_Tuna

Given that I'd be taking a pay cut leaving my current job, the last security firm I spoke to said that I'd be a very expensive penn tester -- especially with no formal background in the field.

Rory Alsop

@Tinned_Tuna it gets much more profitable when you manage pen test teams, and there are still niches (I still test legacy kit like mainframes, COBOL applications, wireless networks and weird Unix kit)

I am an expensive tester when I do though :-)

Polynomial

@RoryAlsop they said they couldn't afford to hire me based on the fact that they'd just hired a bunch of people. which was a bit annoying, since I took a day off work and they didn't cover my transport costs.

plus their office really is in the middle of frickin' nowhere.

Rory Alsop

14:10

@Polynomial yeah

Terry Chia

Oh, @RoryAlsop, @Polynomial. Are the securi-tay talks up online yet?

lynks

@Polynomial augment your salary with bug bounties! :P

Polynomial

not yet. tweeted at them yesterday, he's working through the editing as fast as he can, and they'll be up over the next week

it's a shame MWR don't have an office around here. I bet they'd be cool to work for.

Terry Chia

Ah cool.

Polynomial

@lynks I don't do browser exploits, which is the only thing that seems to pay out.

Rory Alsop

14:12

@Tinned_Tuna when the videos are up, mine is a fairly high level chat about career planning in security, and how to get into the industry

but it was aimed at graduates mostly

lynks

@Polynomial yeah i came to the same conclusion

Polynomial

found a CSRF in Google Accounts a while back, and some guy beat me to it by about 10 minutes :(

lynks

:(

Terry Chia

@RoryAlsop I'm very interested in that talk in particular actually. Should be really relevant for me. :P

Tinned_Tuna

@RoryAlsop I do hold a degree in CS/Maths ... It's just not a great classification. I was looking at trying to get a Masters in cybersec from the uni of York. But my degree classification didn't go over very well :-/

Polynomial

14:14

was a strange CRSF too. it resulted in a stored URL being dropped into the session, which caused all Google Accounts redirects to go to the URL of your choice, even if the target URL changes, as long as the session stayed alive.

which was interesting.

I demo'd it by setting it to the logout URL for Google Accounts, so it would log you out and you couldn't log back in until you cleared your cookies.

Rory Alsop

@Tinned_Tuna honestly, as an employer, a masters may be interesting but the degree shows you can learn - the rest is all about experience, background, enthusiasm, articulation etc

Polynomial

@RoryAlsop that's why I didn't bother with a masters.

you can write and publish academic papers in your spare time without bothering with a masters

Adnan

Guys, a quick question. I wanna make sure I didn't make a fool of myself.
I was talking to a couple of senior devs who are not exactly security-aware.

One thing I said: "..but SQL injection is the most common attack vector in our projects..

lynks

i might change my name to Seniõr Dev.

2

Adnan

Then one of them smiled at me and said "Okay son, although that's not what attack vector means, but keep going"

Terry Chia

14:17

@lynks heh good one

Polynomial

@Adnan ... no, he's wrong, that's what an attack vector is.

Terry Chia

@Adnan So what does he think an attack vector is?

Polynomial

an attack vector is a way someone might attempt to attack a system.

Adnan

He's like a gazzilon years more experienced that me, so I didn't talk back at him

Rory Alsop

the flaw is the lack of protection, the vector is the thing that you use to attack that flaw

Tinned_Tuna

14:18

My favourite attack vector is the one where you get the guy who knows the passwords and hit him with heavy things until he tells your the passwords.

Polynomial

@Adnan if you were discussing it in Finnish, it may be that something got lost in translation.

Adnan

Nope, English.

But I guess you're write, English isn't anyone's native language in the company

Polynomial

@Tinned_Tuna Rubber Hose Cryptanalysis

Terry Chia

@Tinned_Tuna How can he tell you the passwords if he is passed out on the floor bleeding from the head?

Adnan

@TerryChia please don't go there.

Tinned_Tuna

14:20

@TerryChia depends where you hit them.

@Polynomial I know :-p

Terry Chia

@Adnan Experienced =/= knowledgeable.

Adnan

@TerryChia true that

lynks

**attack vectors:** code injection, social engineering, buffer overflow
**vulnerabilities:** bad input sanitisation, bad staff awareness, bad array bounds checking
**exploits:** sql string delimiter escape, lying, overlong input
**payloads:** evil sql, asking for passwords, shellcode

4

Adnan

@lynks Gold!

lynks

ok so bold doesnt work here, but damned if im going to get rid of them

Terry Chia

14:22

It doesn't?

Tinned_Tuna

Payload: Lying. I like that.

lynks

:'(

Adnan

@lynks Look at the right side..

:D

Polynomial

It does, but markdown freaks out on edits sometimes, especially in multi-line comments.

also...

Vector (malware)

A vector in computing, specifically when talking about malicious code such as viruses or worms, is the method that this code uses to propagate itself or infect the computer. This sense is similar to, and derived from, its meaning in biology. Some common vectors: * buffer overflows — this is how the Blaster worm was able to propagate * HTML email with JavaScript or other scripting enhancements * networking protocol flaws

in short: you = right, he = wrong

and I <3 bacon

Adnan

I never liked bacon

Terry Chia

14:24

@Adnan Blasphemy!

Tinned_Tuna

Wow. This is awkward.

@RoryAlsop send back the 3kg of bacon that we got for @Adnan...

Adnan

Whenever it's cooked the whole apartment smells

Polynomial

@Adnan ... WHAT.

Adnan

and I hate the smokey taste in food

AviD

@Tinned_Tuna @OtavioMacedo notwithstanding the general case that @RoryAlsop was talking about, for smaller merchants (depending on classification) you do NOT need a QSA, you just have to fill out a self-questionairre, after basically implementing everything yourself.

Polynomial

14:25

bacon is like 24958730679305670349023402 times more awesome than anything else ever.

2

Rory Alsop

@Tinned_Tuna hahahahahahahaha - I ain't sending it back. It's.....BREAKFAST!

Polynomial

@Adnan so eat unsmoked bacon!

Adnan

@Polynomial :O

Polynomial

@RoryAlsop standard scottish breakfast.

Adnan

What the hell?! Does that exist!

AviD

14:25

I've worked with some smaller companies to self-comply. @RoryAlsop is probably used to only the fortune 50... ;-)

Rory Alsop

@AviD once again I have gone for the corporate level - wups

Polynomial

@Adnan yes. of course.

Tinned_Tuna

@Adnan yes :-p

AviD

though you still need 3rd party scans.

Adnan

In the store there's one brand, Amerikkalainen Pekoni

AviD

14:26

@RoryAlsop hahah, yup you're the PHB here ;-)

Tinned_Tuna

Depending on how crispy you make it, you can still make your flat smell somewhat smoky. It's delicious

Polynomial

tesco.com/groceries/Product/Details/?id=265115656

Rory Alsop

@AviD yeah, I know

Polynomial

^ evidence.

omynomnomnomnom bacon

Tinned_Tuna

didn't ICO investigate Tescos?

AviD

14:26

@RoryAlsop there really is some interesting differences, when you deal with smaller scale.

not always the most glamorous, but sometimes definitely more interesting.

Polynomial

@Tinned_Tuna Yes. I was one of the major instigators of that, along with Troy Hunt.

Rory Alsop

@Adnan hang on - you're Scandinavian/Denmark is Scandinavian/Danish bacon rocks/surely you must have access to it

Polynomial

though Troy got all of the press. because he has a popular blog :P

Adnan

@RoryAlsop, Scandinavian?! How dare you?!

Rory Alsop

lol

lynks

14:27

@Polynomial unsmoked bacon is not bacon.

Tinned_Tuna

@AviD I'm unlikely to be implementing any PCI stuff, I'd just like to be more generally knowledgeable and able to move into the security field :-p

Polynomial

though it was very fun to come home and have my mum say "Some guy from Tesco has tried to call you 4 times in the last hour. What's going on?"

Tinned_Tuna

@Polynomial wow, that's cool.

Haha, "Some guy from tesco" :-p

Polynomial

they got a password reset sorted after a few days of bitching at them

and stopped sending plaintext passwords out

Adnan

@RoryAlsop Finland isn't in Scandinavia. You'd get into a fight in some places in Finland if you say that

Polynomial

14:29

and the ICO is still investigating. I'd hope they're hashing passwords now.

Adnan

@Polynomial The system I'm auditing does that :D

Tinned_Tuna

YorkCC used to have an XSS back in the day, but I was too lazy and busy to ask them to fix it. They fixed it eventually anyways.

Rory Alsop

@Adnan (I know - was just messing) :-)

Polynomial

@Adnan *vomit*

Rory Alsop

@Adnan - same thing happens here when people get called English

Polynomial

14:30

I've reported about 10 XSS bugs in random sites in the last month

Adnan

@Polynomial They have their own reversible "hashing" algo

Polynomial

including the Daily Star newspaper site

Rory Alsop

@Polynomial do you ever get a thankyou?

Polynomial

(a terrible UK tabloid newspaper)

Adnan

@RoryAlsop yeah, I heard something like that.

Polynomial

14:30

@RoryAlsop fuck no.

@RoryAlsop they didn't even reply for the first 2 weeks, even after 3 emails

eventually I got a reply back saying "We're looking into it, please remember that hacking is illegal."

Adnan

@Polynomial The audacity!

Tinned_Tuna

I found it funny that when a persistent XSS was found in Reddit's comment system, the first thing the guy who discovered it did was make everyone who hovered over a specific link post the comment to the page thousands of times...

and nothing more serious (apparently) came of it.

Polynomial

best two sites I've ever interacted with for security stuff were The Atlantic (magazine site) and T-Shirt Studio (custom T-shirt / mugs / etc. site)

the first one immediately responded to say they were looking into it, gave me a timeline for a fix, got it sorted, then had one of their devs send me an appraisal of how the bug came into existence

second one they didn't really understand the bugs (XSS, CSRF, direct object references, etc) so I explained them all, and showed them examples, and gave them details on how to fix it

lynks

good of them

Tinned_Tuna

@Polynomial that's pretty awesome.

Polynomial

14:34

didn't hear back from them for a while, and eventually they sent me an email saying they've all been fixed, asked me to test them again (which I did) and thanked me

AviD

@TerryChia he meant college graduates, not middle school ;-)

Polynomial

and a couple days later they sent me a £15 voucher :D

Terry Chia

@Polynomial That's awesome.

@AviD :(

Polynomial

that T-shirt one was funny though. first noticed that you could see other peoples' baskets by changing an ID in the URL

then found out that you could actually empty people's baskets and change quantities via their ajax stuff

and eventually worked out a way to alter people's custom designs in their baskets

Tinned_Tuna

@Polynomial how long've you been at this stuff?

Adnan

14:37

@Polynomial That could've been a very awkward Christmas morning for so many people.

Polynomial

so I made two accounts on two different browsers, and did a demo of changing the text on the second account's custom t-shirt design to say "I dun goofed"

@Tinned_Tuna been coding since I was 6, got into security in my early teens but was mainly a skript kiddie and got into some blackhat circles.

AviD

27

A: What are the career paths in the computer security field?

From my answer on a similar SO question...: As niche as "security" seems, it actually encompasses a few main types of roles, and a couple of areas of coverage. These are actually quite different... Common roles: Enterprise IT security department These guys usually deal mostly with policy enf...

Polynomial

as I learnt more about systems and stopped being a little douchebag I got more into whitehat stuff and security theories

AviD

@Polynomial ".... you forgot your bacon!"

Polynomial

so I guess for the pure whitehat stuff, maybe 9 or 10 years.

Tinned_Tuna

14:40

@Polynomial How old are you now?

Polynomial

for just computer stuff in general, about 18 years or so

@Tinned_Tuna mid 20s.

:P

Tinned_Tuna

@Polynomial lol, I still saw that :-p

Polynomial

indeed. but privacy.

Tinned_Tuna

aye

Polynomial

google indexes this stuff

Tinned_Tuna

14:41

these chat logs live forever

Adnan

I can't believe what's classified as news in this country. yle.fi/uutiset/danske_bank_plans_new_java-free_online_bank/…

"The new service will be launched during the summer and will feature SSL (Secure Socket Layer) and other security solutions, without any Java components."

Polynomial

@Adnan That's more than news. That's a fucking miracle.

Tinned_Tuna

Um

Adnan

PR guy must've been drunk, how can you tell the public that SSL is the new feature in your ONLINE BANKING SYSTEM!

Otavio Macedo

@Polynomial You mean, PCI doesn't allow automated reviews?

Rory Alsop

14:49

@AviD how come I never answered that one....bah! :-)

AviD

@RoryAlsop because my answer was so complete and awesome.

Polynomial

@OtavioMacedo automated reviews aren't reviews, they're filters that give you some important logs.

Rory Alsop

@AviD although we never did find you a good set of OWASP breaker and builder links

Polynomial

@OtavioMacedo you still have to actually investigate the important logs manually.

AviD

@RoryAlsop heh. True. I've looked recently, for something else, and still sucky.

if you find, please feel free to edit it in.

@OtavioMacedo PCI requires some automated reviews.

network scan and web scan is almost defined as automated reviews, and their requirement for code review is also almost exclusive of anything but automated.

oh wait, were you talking about logs? my bad.

Otavio Macedo

14:52

Ok, so it's important to have some kind of tool to narrow down the logs based on the security risk, right?

@AviD Yes :-)

Rory Alsop

aww - had a flag on an answer here - for those who haven't read Tom's answer, enjoy:

101

A: How can PayPal spoof emails so easily to say it comes from someone else?

Here is a dramatization of how the communication goes, when a mail is received anywhere. Context: an e-mail server, alone in a bay, somewhere in Moscow. The server just sits there idly, with an expression of expectancy. Server: Ah, long are the days of my servitude, That shall be spent in eve...

AviD

@RoryAlsop oh wow.

Ol' @Tom there needs to be flagged for his nearest psychiatrist.

And have that answer etched in bronze to hang on the wall.

Polynomial

@RoryAlsop poetic genius! :D

@RoryAlsop a flag?

Terry Chia

@RoryAlsop That has got to be the best answer on Sec.SE.

Polynomial

oh, nm, I see it.

Rory Alsop

14:57

@Polynomial there was a non answer I had to convert to a comment

Polynomial

@RoryAlsop yeah, spotted it

Rory Alsop

but it just reminded me that many of you wouldn't have seen that answer

Polynomial

also, deja vu

Rory Alsop

@AviD that was alternate Bear's best answer ever

Transcript for