Myself Peter I am New in England, I want to buy online steroids. But I don’t know where i can buy best online steroids in the England. If you have a much idea so share with me.
@Terry - hahaha. Oh, before I go back through the transcript from last night, how did that conversation go? Did he finally understand what you, @tildal and everyone else were telling him?
@Lucas - congrats, now don't misuse the amazing 10k powers:-P
@TerryChia that looks nice too. I've been using putty for ages, but came across a thread on /r/sysadmin/ with some alternatives last night that have some good added features...
@Sudhi I use fail2ban to rate limit bad behaviour. For example, I filter on excess 404s, urls with .php in them (my webserver doesn't have php), excess failed logins, excess failed logins over ssh and so on.
I used to ban for 3 hours, but I now ban IPs for nearly a month at a time, and I have a ban reporting script which tells me if I've seen an IP before.
Also, I added iptables rules to drop all of China.
fail2ban, that's interesting. This doesn't really look like a skiddie, or maybe. What do you make out of following: /usr/local/apache/logs/access_log.4.gz:133.68.253.242 - - [01/Mar/2013:03:17:01 +0530] "\x80s\x01\x03\x01" 404 -
@Ninefingers please share the -A line for that. I will add it right away
@Sudhi That's one big -A line... your best best is to google for it, and load them in with iptables-restore < file. Do be sure to iptables-save > file first and add these IPs to it with >>.
@Sudhi Basically that's what I googled. It's a bit extreme, but my website is only a personal one and I don't know anyone from china. If you're operating a business, it might not be so sensible.
@Ninefingers yeah, 80 and 443 access only for CloudFlare and our office subnet. Rest just drop
cPanel sucks; i am getting rid of this WHM/cPanel/phpMyAdmin crap over the weekend
@Ladadadada ohh, yeah i think there is some problem with DNS and certificates.
OK. I think the plan is simple. Take backup of the code and database. Match against old version (thank the _git_ ) see if somebody wrote something suspicious. Reformat the server, fresh CentOS 6.x install; update to latest patches; ngnix/apache; FCGI with PHP; MySQL 5.5; fix iptables to listen only to CloudFlare, office; restore website; test; Did I miss anything basic?
@Sudhi I'd throw in there having a look through this guide. It's old, so you might need to adjust some things, and not all things will be possible/relevant, but it is a good starter for really locking down linux: nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf
@Ninefingers thanks! I have ~6 years of linux experience, but it was only in the past couple of years that I have grown to understand the security related issues and their implications on real life businesses
@TerryChia Maybe. Either will do, doesn't really matter. If nothing else it is food for thought, i.e. "ok, this button I have been ignoring for ages, what does it actually do?"
@TerryChia my idea of lock-down is simple. Bind everything to localhost except SSH, HTTP/S; restrict 80,443 to CloudFlare. Change SSH port periodically (say once every quarter) and use SSH tunnels for all your access needs
most of the services like email/IMAP and other stuff should be delegated to others (Google Apps etc.)
@Sudhi That should be fine enough, I agree with all of them except changing the SSH port part. But that's just my personal opinions and shouldn't affect how you do things. :)
@Sudhi If you are the sole administrator of the server it shouldn't be a problem. There was quite an extensive discussion on the topic in this chat room a few days back.
@TerryChia Yep. I moved my port higher. I personally like 22, but the number of scans vs 22 was getting stupid and its just a personal server, so, change it was.
my iptables-foo is not upto the mark, can someone please help me out? Here's my current /etc/sysconfig/iptables : pastebin.com/kThzvXVw , I want to restrict 80,443 to cloudflare's IP range given here: cloudflare.com/ips-v4
@Sudhi depends on your other rules. If you have "drop everything else" at the end of the chain then they'll be dropped because they won't match an accept rule.
@Sudhi You'd need to look that up. It could be related to your hosting provider - my VPS came with a number of entries to allow their monitoring infrastructure to work correctly.
I log into my machine, and that's what stares me in the face?
@Iszi I agree with both of those points. The purpose of the 'We The People' site, however, isn't to institute legislative change. It is to force the administration to publicly acknowledge and comment on the requests.
@Iszi Also remember that while it is the Executive branch that proposes budgets it is up to Congress to actually make them.
My understanding is that it shouldn't be anything since it's sandboxing each process, so it should be limited to a single process that just crashed and was cleaned by its internal memory manager?
@Sudhi That 'strange' '\x80s\x01\x03\x01' request from up is just a Base64 encoded ',Mq|t' request, but I have problems identifying which part is referrer and which one is requested URI (you can change your Apache log formatting to tag these). It looks to me as just another Skype request spilling the beans into Apache log, but it could be anything. There's some results for 'PHPMyAdmin' on Google, but that's bogus and isn't it.
@TildalWave I have loads of those '\x80s', and the IP where it originated is from India. The URL it was trying to access was some content on our website, and just one user had posted 30-40 comments on the content
my first reaction was this is some skiddie trying out stuff, we are CloudFlared so I thought I would disallow direct HTTP to our server and let cloudflare handle the fail2ban'ish stuff
@Sudhi Yes it's on same network and open for ports 80, 25 and 110 so I'm guessing that's your mail server? (if you're on cPanel hoster and you use their mail server)
@Sudhi Coming from India, you'd have a lot of Base64 encoded requests to support extended characters. That's normal, you just need a good log analyzer to read it properly
@Sudhi base64decode.org This one is on-line but that's a lot of manual work to check each line, you really need log analyzer software with Base64 support
@Sudhi That doesn't really matter what language your website is in, mine is also not in any of the languages that really depend on extended characters, yet I get these log results all the time. There's also a lot of IM software that limits incoming traffic to port 80 so it's not stopped by the firewall, and those can make some strange looking requests in your Apache log.
You can - and should - disagree with his statements, with his answers, with his support of charlatans, but personal attacks are best left to the andrews rooks and other trolls.
@TerryChia that's fair, but remember he was already in a heated argument (on his side) and so didnt really hear the explanations. like when dealing with a teenager, we should have started over, with some patience, or not get into it all.
it turned into a flame match pretty quickly, and most of us were pretty well talking past him.
OK. How about a piece of code that I found in this CometChat plugin we have on our website. I am _grep_ing for all the `eval`s in my code now. I am not sure what the following code is doing: `$x="\x62a\x73\x656\x34\x5fd\x65c\157\144\x65"; eval($x('JHI9ZXhwbG9kZSgnLScsJGxpY2Vuc2VrZXkpOyRwXz0wO2lmKCFlbXB0eSgkclsyXSkpJHBfPWludHZhbChwcmVnX3JlcGxhY2UoIi9bXjAtOV0vIiwnJywkclsyXSkpOw'));`
@Sudhi But that CometChat is the one that would cause a lot of Base64 encoded requests showing up in your logs, most of them should be just chat updates and legit user POSTs. You should always check for URLDecode value of POSTs as well, that 'eval' could be also URLEncoded
getting back to the issue from then, @asadz, Please read the FAQ and the About page. Perhaps also How to Answer. I think it will help you understand a bit better what our site is about, how the community aspects work, and so forth.
and the actual issue - I think most people here agree with your methodology, but as they were trying to say, the question was not at all about that (and hence the downvotes). The question was a very specific, technical, mechanics-of-attacks question.
Check this out (JS URLEncoded) http://jsfiddle.net/jvTFm/ and this: http://security.stackexchange.com/questions/30330/do-javascript-urls-starting-with-allow-xss
This reminds me of that time with the Russian guy on serverfault, @ScottPack do you still remember who that was that went all berserk because someone said ReiserFS was bad
@Avid @Adnan @TerryChia I've been involved in Internet communities since before the web existed, and professional involved in community development and management for 13 years. I have seen time and time again where individuals who are outspoken and enthusiastic and who give wrong answer after wrong answer and basically annoy the community can over time become the bedrock foundation of the community.
They end up being the core members who give the right answers to every question and are the people that n00bs years from now will learn from and respect. It's really as much a part of our role to help develop those users as it is to answer questions. Driving them away doesn't help anybody learn.
@Sudhi You should also ask your provider to complete DNS records. As it stands now there's no reverse DNS pointer records (network name in layman terms) on either of those two IPs which might cause your IPs to be blacklisted faster on some rDNS checking honeypots. No PTR is common though, so none would really depend on it, but might mark IPs as more suspicious if they're self-learning.
@Xander, I totally agree with what you're saying. I genuinely believe in it. The problem isn't the bad/wrong answer. He probably knows more than me, so I can't judge on that. What I do judge, however, is that feeling entitlement, the community or the moderators don't owe anyone an apology or even an explanation. Those might be given if the person chooses do so.
@Xander - Did you manage to look into that PHP session stack? I was having bad dreams because of it LOL. I came to the conclusion it doesn't really change much anything regarding the possibility to exploit it, with an exception that the way he's doing it provides for a convenient way to inspect session data structure without requiring any log-in credentials.
As someone said, most of the guys here are damn smart. Having been used to being the smartest guy in the room most places, I can tell you that I have learned a HUGE amount from these fellows.
@asadz this is true, to some extent, but for the most part it works in a positive manner, keeping people in line and focusing and producing fantastic information.
Here's a tip: Read some of his stuff, critically. Really analyze it. If you dont see the ridiculousness, you need to learn more of the science behind it, then come back and try again.
If you're not convinced, do it recursively - do research on the people who write about him, and about the people Gibson attacks. See which ones are more trustworthy, and which ones don't understand the basic mechanics of a computer.
Or, perhaps he does, and all of this is pure bullshit marketing.
@asadz Here is the list of technical podcasts that I listen to. A couple of them have faded, or died, which is sad but I haven't unsubscribed yet. pastebin.com/D1EEJCbN
It's a mix of vulnerability assessment, forensics, pen testing, and general security.
@TerryChia Well, you can write web apps in assembly, but it is rarely justified. Except maybe when the web server is a very small embedded system (say, a smartcard), and there again Forth would probably be a more efficient way (faster development and possibly more compact code).
@ThomasPornin well, I worked with Intel on some of their firmware (like the vPro). Some pieces need to be managed remotely and they provide an HTTP interface. Still not written in assembly, even considering all the constraints of motherboard firmware.
@asadz I definitely enjoy all the ones on that list but on some of the others the hosts may be too ranty, too vendory, or too agendaey to be a proper favorite.
Because of some of our laws regarding freedom of speech and/or press it's hard to make the jump from spouting off and spouting off negligently/illegally.
@ScottPack I'm no gay and have no homsexual tendencies but if the pic on your profile is really you:) you got to be the smartest / cool looking security guy I ever met
@asadz I'm going to put that on my business card. And yes, that was a heavy crop of a picture that was actually taken of my daughter on a hike. I just happened to be in the background.
> I saw your experience in the field of vulnerability and exploit research and we have a scheme in our company to collaborate with researchers all over the world where we pay them on research done by them. Our interest is exploits which run over Windows 7, Snow Leopard with applications such MS Office, Adobe, Browsers, Media Player , Notepad etc along with native OS exploits as well as iphone, blackberry exploit. These exploits should be unpublished though the vulnerability may be public. We also have requirements to help us do ASLR and DEP bypass for exploits researched by us.
Myself Peter I am New in England, I want to buy online steroids. But I don’t know where i can buy best online steroids in the England. If you have a much idea so share with me.
