The DMZ - 2013-04-15 (page 1 of 2)

« first day (851 days earlier) ← previous day next day → last day (4327 days later) »

AviD

00:17

@D3C4FF hmm. I dont like not understanding everything.

so I'm working on lowering the PLL. I think it might be lowering the temps by a couple of degrees, but its hard to tell what is the effect of the PLL and what is just because of the change in ambient temperature.

not much is consistent, either.

D3C4FF

Whats the PLL set to at the moment @AviD?

AviD

PLL 1.6, vcore 1.2, x44. Temps steady at under 80C at stress.

Like I said, plenty where to push, but I'm trying to understand what each dial does.

so far, not so much.

D3C4FF

00:34

8,000 QUESTIONS IN SEC.SE! :D

AviD

wooot!

D3C4FF

@AviD My understanding of PLL is that it shouldn't have any real impact on temps

AviD

@D3C4FF oh? read on overclockers to lower it as much as stability allows, which should reduce heat.

well, really, any extraneous wattage pumped in adds to heat, so removing it should lower it.

D3C4FF

i've been doing some reading and haven't found anything other than, yeah maybe 2-3 degrees if your lucky.

@AviD That's the logical assumption :P

Also. It sounds like getting a stable OC with a vcore of 1.2v is rather impressive!

Sounds like you got a good chip?

AviD

hmm. okay, so say I lower it to 1.5, or whatever is stable. what else can I do to lower temps?

@D3C4FF yeah? cool!

@D3C4FF or maybe I'm just awesome that way :-)

D3C4FF

00:41

xD

@AviD whats your ambient temperature?

AviD

well, I havent run an overnight burn-in yet.

D3C4FF

Your in israel or something yeah?

AviD

but running torture for an hour or two, gives a good indication.

@D3C4FF Yes. I think now its between high 20's during the day, and low 20's at night.

(indoors, of course).

D3C4FF

Ah okay, so not a crazy climate.

It varies here wildly between 44 deg C during the day (in the shade) and around 0 deg c at night

Which can actually really fuck with your overclocking ability

AviD

@D3C4FF well, it is still spring.

@D3C4FF I'm sure...

but once it gets that hot, I'll be running the AC anyway.

D3C4FF

00:46

You should hook up your CPU to an AC unit directly, put it in a vaccum sealed ice box... and feel the glory that is -70 degrees C of CPU

AviD

lol

seriously, go get the OC proposal going...

D3C4FF

@AviD @TildalWave seems to be having a solid go at it. Maybe we should try what SF suggested? Post to SU and see what kind of responses we get/

AviD

yeah. I'll try to add a few there too, see if you fellows have a go.

2 hours later…

Terry Chia

02:48

@D3C4FF Interesting question about multiple vendors.

I'm not really sure it comes down to security concerns. Rather - price and convenience.

D3C4FF

03:20

@TerryChia Yeah, i'm curious to hear what the general consensus is. There are heaps of other factors but in regards security related concerns i'm interested to see what arguments there are

Once again, it seems to be a really slow day on sec.se

Stack Exchange

04:20

All music is just performances of 4'33" in studios where another band happened to be playing at the time.

Anuj Kaithwas

04:42

YOOOOOOOOO!!!

D3C4FF

05:03

@AnujKaithwas Hello

Anuj Kaithwas

05:23

hello @D3C4FF

D3C4FF

05:48

@AnujKaithwas How are you?

2 hours later…

Rory Alsop

07:57

@nealmcb my game name is doktormayhem. Here we are on very good terms with the smurfs, after every big op there is a meetup in a local pub, and cakes are brought. We also have a training area agreement where nothibg over L2 is to be built in George Square in Glasgow, in order to help the new folks.

We also accompany L1s out for an early foray, weakening portals so they can get the AP for taking them out

And our L8s coordinate the big ops

Getting everyone involved

AviD

08:16

@RoryAlsop that is just so... civilized.

Playing games, having fun, not getting religious fanatic all over someone else for being on the, by definition required, other team, of a game. Shocking.

I guess getting everybody drunk helps with that.

Though I would have expected the Resistance to be the natural enemies of the Scots. And also the Enlightened are natural enemies of the Scots.

Rory Alsop

The resistance are blue (hence smurf) and the scots like the colour blue...

There is the odd cheating type, but they get jumped on from both sides

AviD

which are the good guys?

or is there not enough backstory

Rory Alsop

Obviously it's us, the enlightened. Called frogs or toads by the resistance

The resistance say they are the good guys, protecting the earth

AviD

do people not jump back and forth between teams?

Rory Alsop

The back story is actually pretty well thought out - niantic project.com

There have been a couple who switched, but all amicable - both to fit in with spouses

2 hours later…

Polynomial

09:56

@RoryAlsop What's this game then?

AviD

@Polynomial dunno, something about couple swapping. Must be a Scottish thing.

3

Rory McCune

@Polynomial ingress it's an Android game that ties to real world locations..

Antony Vennard

It's pretty much all @RoryA talks about now.

Rory McCune

@Polynomial ingress.com

AviD

it does look really cool, but I cant imagine investing that much time in it. Then again I'm not a hardcore gamer, so I guess this is closer to that.

Polynomial

10:00

I'll check that out. Looks good.

AviD

Also I find the religiosity of the factions, judging from some of the things @ScottPack and @nealmcb have said, to be quite a bit stupid.

IT'S. A. GAME.

Polynomial

hmm

AviD

@Polynomial Augmented reality is awesome.

Polynomial

anyone got an insta-invite, or will I have to wait?

AviD

Too bad its android only.

Terry Chia

10:01

@AviD This.

Can't play on my iPhone. :(

Antony Vennard

@AviD Augmented reality games always remind me of Total Immersion from Red Dwarf

AviD

I'm sure it would be even more awesome on google Glasses.

Polynomial

@AviD Get with the times! iFail is for kids and hipsters :P

AviD

@Polynomial ahem. I aint no apple fanboi.

Polynomial

@AntonyVennard "Well, sir, this is Better Than Life!"

@AviD kekekeke

AviD

10:02

there are more than 2 mobile platforms... ;-)

Polynomial

OldManBerry?

AviD

guess again :D

Rory McCune

@AviD ooh good point, you know I bet that's where they're going with this...

AviD

its me, @Iszi, and Mrs.@RoryMcCune.

Polynomial

HP WebOS? :P

ohhhh

Windoz Fone

Rory McCune

10:03

now now WP8 is actually quite a good phone platform...

Polynomial

yeah I know, I'm just winding him up ^^

AviD

oh speaking of which, @Iszi and @RoryMcCune - Facebook Home no it's Windows Phone

Polynomial

plus if I actually diss it I know Marion will hit me with a Surface.

AviD

@Polynomial heh, its cool, I'm not a MS fanboi either.

I aint nobody's boyyyy

lol, me too, me too!! Surface sucks!

Polynomial

@AviD Except your mother's, of course.

(subtle yo momma joke is subtle)

AviD

10:04

@Polynomial no, I've disabused her of that notion long ago.

Polynomial

@AviD You abused your mother? Vile!

AviD

she talks to my wife whenever she wants something...

@Polynomial heh, yeah, should have seen that one...

Rory McCune

@Polynomial she might hit you with both of them as she's taken to carrying them both (in case one runs out of charge...)

Polynomial

@RoryMcCune One might argue that therein lies a potential performance issue ;)

AviD

@Polynomial I just happen to like certain MS products, for my specific needs, but not without consideration of the alternatives.

Rory McCune

10:05

@Polynomial well yes

Polynomial

also, wouldn't it be cheaper and lighter to just buy a battery pack? :P

@AviD Sure. I do the same. Running Win7 on this box with BT5 and FreeBSD VMs for when I need that stuff.

Adnan

10:45

This can't be real

Terry Chia

@Adnan :genius:

Rory Alsop

@poly I can send you an invitation if you like

TildalWave

@Adnan made my day :) I see you're putting your new privilege to good use hehe

@Adnan BTW that comment should be flagged for disclosing personal information ;)

Adnan

@TildalWave Already have.

TildalWave

@Adnan added mine too... just in case, the review queue on SO is probably looooooong

Adnan

11:00

@TildalWave To be honest, I don't see them as privileges. I'm not privileged when I offer my help to the community. The community is privileged to have people willing to spend some of their time maintaining the site.

TildalWave

@Adnan oh c'mon say it as it is... you know you want to! :P (hint: should be "The community is privileged to have me here.") :))

what the? when did that minstry of defence get 15 stars? :O when were here 15 people? LOL

Adnan

@TildalWave Well, I wouldn't exactly put that way. We're all privileged to have The Bear to write some neat answers, to have Rory, AviD, and Jeff moderating, to have Terry correct our spelling mistakes, to have Poly with his witty comments. (and all the others). Together, we all make The Community. I refuse to think that offering helping is a privilege, especially in this case since we're all doing it for free.

Terry Chia

@Adnan Why am I the spelling nazi around here. :(

I corrected you once!

Maybe two times. MAX!

Adnan

@TerryChia Twice.

Antony Vennard

@TerryChia That's okay, I'm just an "other". SNIFFLE.

Adnan

11:09

@TerryChia But still, you're our little spelling Nazi.

Terry Chia

@Adnan Ah see, now you hurt @AntonyVennard's feelings. That won't do. Go get your cactus to make it up to him.

Antony Vennard

@TerryChia Actually, now you mention it, my feelings are fine...!

TildalWave

@Adnan word!

Terry Chia

@LucasKauffman @AntonyVennard Any other ctf-ers in here: plaidctf.com

AviD

@Adnan you forgot @ScottPack offering snark.

Adnan

11:11

@TerryChia Well, we don't really see @AntonyVennard that often here.

AviD

and our other moderator

Adnan

@AviD God damn it! Now this is gonna bite me in the ass.

2

Antony Vennard

@TerryChia Ooo.

@Adnan Just threaten them with a cactus.

TildalWave

@TerryChia captured! just open the page in IE :))

Adnan

@TerryChia Fancy countdown.

AviD

11:12

Adnan

@AntonyVennard What cactus? I know no such thing.

Terry Chia

Wanna go for it?

Adnan

@TerryChia Oh please, after you.

Terry Chia

@Adnan The CTF. Not the cactus.

2

TildalWave

ROFL

Antony Vennard

11:14

@TerryChia I think I'm still scared since the last one we did, but yeah, why not.

Terry Chia

@AntonyVennard Heh. This time we need more people.

Antony Vennard

@TerryChia Yes, true. Count me in if we have more than just us!

Terry Chia

@Polynomial, @Gilles, @LucasKauffman.

Maybe @TildalWave and @Adnan will like to join us this time?

TildalWave

@TerryChia Friday evening... hmmm... thinking about it

Why in heaven's name did they put it on Friday? They have no life?

Terry Chia

There are even cash prizes in the (very unlikely) event we win.

Antony Vennard

11:19

@TildalWave Probably because a lot of people who might want to take part work during the week?

TildalWave

@AntonyVennard yup that would be it... didn't realize there's prizes... cool I'll try my best to make time for it

Antony Vennard

@TildalWave Yeah, I'd find it impossible to do one over say Tues-Thurs !

TildalWave

@AntonyVennard OK, who will register? We only need one account per team

Antony Vennard

@TildalWave Not sure and I don't mind - @Terry?

Adnan

@TerryChia Hmm.. looks interesting. How can I find more info about it?

Terry Chia

11:23

@Adnan reg.plaidctf.com

Adnan

@TerryChia I checked it, but no actual info

Terry Chia

Info will probably be released when it starts

chat.stackexchange.com/rooms/info/7384/…

Apply to the room, i'll grant you access.

Oh, I can just grant you without you applying.

Adnan

@TerryChia and how can I do that?

Terry Chia

chat.stackexchange.com/rooms/7384/security-se-ctf-team

You should be able to enter now

TildalWave

11:50

@AviD heh good one... I've also noticed YouTube added tape mode LOL

AviD

12:03

@TerryChia oo, how much cash? if its worth my while, maybe I'll come ensure that we do win.

Terry Chia

12:16

@AviD 1st: 4k, 2nd: 2k, 3rd: 1k.

Polynomial

anyone got an invite code for Ingress?

Terry Chia

I think @RoryAlsop.

Polynomial

@RoryAlsop ooh yes plx :P

Stack Exchange

Stack Exchange Security Blog: About the recent DNS Amplification Attack against Spamhaus: Countermeasures and Mitigation

lucaskauffman on April 15, 2013

A few weeks ago the anti-spam provider Spamhaus was hit by one of the biggest denial of service attacks ever seen, producing over 300 gbit in traffic. The technique used to generate most of the traffic was DNS Amplification, a technique which doesn’t require thousands of infected hosts, but exploits misconfigured DNS servers and a serious design flaw in DNS. We will discuss how this works, what it abuses and how Spamhaus was capable of mitigating the attack.

A short refreshment of the DNS protocol. We have different types of DNS servers, namely: …

AviD

@TerryChia not per person right? and this is US$?

Terry Chia

12:27

@AviD Per team obviously. :P

And yes. USD.

AviD

@TerryChia lessee, simple math. Doing the CTF would take about 10 hours, is that right?

4 person team, means about 100$ an hour.

not too bad, but it is speculative - no guarantee to get any at all.

Thomas Pornin

@D3C4FF ... and I answered 1579 of them.

AviD

Goddamn math.

Terry Chia

@AviD It last for 48 hours. But I don't think anyone is making a living of winning CTFs.

AviD

@ThomasPornin whaaa? over 6000 that you DIDNT?

@TerryChia yeah... If I get paid for it, I dont do it for fun.

Terry Chia

12:31

Meh, it's a learning opportunity for me.

I would take part even if there isn't a prize.

Thomas Pornin

@AviD Well, yeah, I must not spoil them all. Where would be the fun ?

AviD

Hmm, what I said is not always true. I do program for fun, sometimes, and research, etc happens often.

This would especially not be the case if I was a gigolo.

3

Terry Chia

@AviD You mean you aren't one?

Polynomial

lol, more Java fail: reddit.com/r/netsec/comments/1cdrrc/…

42 new vulns, 39 remote exploitable.

AviD

@TerryChia heh. Are you looking for one?

Terry Chia

12:36

@JeffFerland WHEN ARE YOU GONNA BE FIXING THAT SHIT?

AviD

@TerryChia @Jefff I agree.

@jeffferland @TerryChia is right - you need to fix #Java.

(pssst hey @everybody - you should all post @jefff a message about that...! ;-) )

You can't just pray to the computer god! You must also dance with a goat. Bad news--it's a slow dance. And the song that you dance to must be "Muskrat Love." — Nosredna Aug 4 '09 at 0:40

Terry Chia

@AviD s/goat/bear

AviD

@TerryChia that would really be messed up, considering the next comment...

Of course, the worst part is looking the goat in the eyes, knowing that there's an altar and knife in the next room.... — Babu Aug 4 '09 at 2:14

Terry Chia

@AviD It actually fits perfectly. It's the worst part since the bear is gonna sacrifice you on the alter.

AviD

@TerryChia exactly, you dont want to be dancing with the bear if he's going to sacrifice you. It would mess up your two-step.

Adnan

12:44

@Lucas Really, wow. One of the best explanations online. +10!

Adnan

12:57

Speaking of which. Anybody has any idea about why Spamhaus-size DNS Amplification attacks aren't more widely used?

Ladadadada

@Adnan With DNS amplification attacks you get something like a 10x - 30x increase in bandwidth, so a 300Gb/s DDoS using DNS amplification would be at least a 10Gb/s DDoS attack without it.

Polynomial

@Adnan they are, but the source bandwidth is usually low enough not to matter.

Adnan

@Ladadadada Which is easily manageable by the charismatic Anonymous . All they need to do is Tweet some LOIC-like tool and it will be downloaded by the thousands.

Ladadadada

But also DDoS attacks usually only get as large as is needed to knock the service offline. Last year I was knocked offline by 70Mb/s. (But it was the number of packets, not the bandwidth that broke our firewall.)

Polynomial

so the average DDoS might push ~50Mb/s, giving ~1Gb/s after amplification.

Antony Vennard

13:03

@Adnan I wat?

Adnan

@Polynomial Really? 50Mb/s only? I've always thought it would be far more. Good to know

Ladadadada

If we had upgraded our firewall, I have no doubt the attackers had more bandwidth available to them.

Polynomial

@Adnan I'd be tempted to write something like that, just so it gives people the incentive to properly configure their DNS servers.

@Adnan most nodes are going to be home connections that have malware on them. up speeds are usually pretty awful.

Ladadadada

I'd love to see a post on the Google Security blog about what they do to avoid being part of DNS amplification attacks.

Adnan

@Polynomial Jihaaa.. alright alright, the up speed thing skipped me.

@Ladadadada If one client is asking for too much, they ban them for a while. Simple.

Ladadadada

13:06

I guess it's probably not much more than rate-limiting single IP addresses.

Polynomial

even my 100Mbps connection only has ~20Mbps up.

and most people still aren't on more than 20Mbps down.

Adnan

@Polynomial I guess connections here are different. Here it's more common to have those connections that have upload same as download (I don't know the exact term)

Polynomial

@Adnan symmetric.

god damnit Trent Reznor, stop making me depressed at work

Adnan

@Polynomial Yes yes. I don't think I know anyone with asymmetric connection.

Ladadadada

Hmph. I just realised I'm on the slow connection at work. The guys downstairs have a Gb line. I get 40Mb on speedtest.net.

Adnan

13:09

@Ladadadada Oh! The humanity! I'm sorry for you :p

Polynomial

@Adnan in the UK / USA it's pretty common to get very asymmetric connections, such that upload speeds are only just enough to keep up with ACK overheads.

Antony Vennard

@Adnan It's pretty much the norm in the UK (to have asymmetric).

Adnan

@AntonyVennard @Antony As far as you know, how are the prices?

Polynomial

in the UK?

Ladadadada

Australia is having a big argument about whether we go ahead with the national FTTH proposal or switch to a FTTN compromise.

Adnan

13:10

@Polynomial and, Jesus! So depressing.

@Polynomial Yes

Polynomial

I pay £35/mo for 100Mbps.

well, £30 for now. £5/mo reduction for the first 6 months :)

Antony Vennard

@Adnan Depends on who you're with, really. I think £20/month is normal for consumer broadband. It gets more expensive if you go for cable or BT Infinity (which is fibre to the cabinet, and might get you up to 80Mb/s theoretically).

Polynomial

@AntonyVennard I'm on Virgin. Fibre to door.

Antony Vennard

@Polynomial Yeah okay ;)

Polynomial

BT is kinda always going to be a bad choice for cable, since they have to lease the lines from Virgin.

so they'll be more expensive or have worse service. that's the only economy they can manage.

Antony Vennard

13:12

But, @Adnan, cable isn't available everywhere in the UK, so some of us can't actually have cable even if we wanted it, without persuading Virgin to dig up our road.

Polynomial

can get really shitty ADSL for as little as £6/mo, I think... PlusNet maybe?

Antony Vennard

Likewise, FTTC doesn't go everywhere. Depends on if BT have bothered to upgrade the cabinet in your region.

Adnan

@Polynomial In my apartment it comes for free (10Mbps symmetric). For 30€ you can get 50Mb/s symmetric.

Polynomial

nice

places like Norway tend to have really good internet infrastructure

Adnan

@Polynomial Oil!!

:D

Polynomial

13:14

central city areas in Japan also tend to have ridiculously fast speeds. like free gigabit ethernet in hotels.

Rory McCune

@Polynomial BT's FTTC isn't too bad these days and better than Virgins business broadband (which is the only way I know of to get a static IP on virgins network)

planing to look at this openreach.co.uk/orpg/home/products/super-fastfibreaccess/… when it comes out

mmm 330Mbps

Antony Vennard

I can dream...!

Polynomial

@RoryMcCune anyone's business broadband is usually horrible though.

Antony Vennard

@Polynomial What are you trying to say? That business broadband is home broadband, but slower and more expensive? Outrageous!!

Polynomial

:P

Rory McCune

13:20

@Polynomial virgins is particularly nasty. 10MBps is the fastest they'll do (even though their consumer product is 100MBps) and if you want to transfer from business to home you have to buy out your contract even though it's the same co.

Polynomial

I really don't understand these companies offering business leased lines for ridiculous amounts of money, and they only do 8Mbps symmetric or something shit like that.

Rory McCune

@Polynomial Zen FTTC has been quite good. speeds aren't bad and we get a little netblock of 6 addresses to go with it

Polynomial

how do they make any money? surely companies would just say "nope, fuck it, give me the 100Mbps home line"?

Thomas Pornin

@Polynomial What's hard to understand with these offerings ? They totally make sense.

Polynomial

@ThomasPornin how does a full office of people function on such a meager line?

Thomas Pornin

13:21

What's hard to understand is businesses accepting to buy such plans.

Polynomial

precisely.

Antony Vennard

@Polynomial They probably have T&Cs saying you can't do that.

Thomas Pornin

@Polynomial By banning youtube on the firewall, mostly.

Polynomial

@AntonyVennard then they should be pwned by anti-trust lawyers.

Rory McCune

@Polynomial static IP requirement and "Business level" T&C's plus they won't put the consumer grade stuff into an office address :)

Thomas Pornin

13:23

Strangely enough, blocking access to youtube does not seem to decrease work productivity.

3

Polynomial

@RoryMcCune I just don't understand why they only offer such slow connections. Surely their business grade should be the faster stuff?

Rory McCune

@Polynomial ah yeah they do that... and it's much much more expensive :)

Polynomial

yeah, like £800/mo for 40Mbps symmetric

Rory McCune

their website is horrible as well, impossible to find actual figures on speeds on offer

Antony Vennard

But it'll inspire confidence in your customers and... stuff. Hey, read our whitepaper and look at our industry awards we won (for our home broadband service).

Rory McCune

13:24

TBH the FTTC is fine for us 25Mb/s down 3MB/s up does the job for most stuff.

@AntonyVennard oh god the whitepapers, their website is covered in that stuff

Antony Vennard

@RoryMcCune Yep. Cloud integration on demand with big data cyber network threats and your speeds may vary.

lynks

im pretty confused about the advantages of the 'business grade' leases. so you're getting a guaranteed speed? and a static ip? anything else?

for a fraction of the cost you can have fiber to your building : /

I'm still waiting for FTTWC

Antony Vennard

What it comes down to is that some businesses will not spend money on anything that does not involve a lot of money. In fact, they don't do money, they do purchase orders and procurement.

Rory McCune

13:40

@lynks For us static IP is a must as customers need to know the IPs we'll be testing from and they have to be static. What we pay for is waaay cheaper than a dedicated fibre run AFAIK. Even the new FTTP on demand thing that BT are doing is pretty expensive compared to the business broadband style products...

Tinned_Tuna

@Thom

lynks

@RoryMcCune yeah I can understand the need for a static ip, all my experience has been with managed datacenters, so ive never had to worry about connectivity.

AviD

@D3C4FF have at it:

0

Q: How to optimize PLL voltage

I am overclocking my Core i7 (Ivy Bridge 3770K), aiming for a moderate overclock. Currently I have it easily stable at a pleasant 4.4GHZ - BCLK defaulted at 100.00MHz, with the multiplier set to x44. While it is currently stable (tested using Prime95 torture test for a few hours), it does gen...

cooling overclocking voltage undervolting

I'll probably be adding a few more over the next few days...

Tinned_Tuna

derp @ThomasPornin, it seems that (by my calculation) NIST's recommendations are near-perfect :-p

lynks

im sad nobody got my fttwc joke :'(

Rory McCune

13:44

@lynks ahh lucky lucky :op us small business people have some different problems. that said I have seen broadband into datacenters. Usually run by third parties for support purposes..

@lynks I do now I think about it :)

Terry Chia

I have no idea why my answer was accepted over The Bears...

5

Q: Encrypt then checksum or vice versa?

This is probably a naive question, but here goes: What is better for security over TCP/IP? Encrypting the payload and then adding a checksum? Checksuming the payload and then encrypting it? Checksuming the payload and then encrypting it, then checksuming again? Something else entirely? And b...

lynks

@RoryMcCune hey im a small business person :P we just pay people like rackspace, amazon or hetzner to worry about that stuff for us :P

Rory McCune

@lynks ooh can I pick your brains on that then. Any recommendations on where you'd host a dedicated server or VM somewhere that has things like ISO27001/9001 (i.e. things that make auditors happy)?

TildalWave

@lynks you meant TiSP?

Scott Pack

@AviD Strictly speaking, the game is a competition between the two sides, so some amount of trash talk should be expected...

lynks

13:49

@RoryMcCune given that clouds kill kittens, and dedicated servers are due to make a big comeback (any day now) I always point people in the direction of hetzner. but thats pretty much purely down to pricing and reliability.

@TildalWave that is deeply amazing.

AviD

@ScottPack trash talk, sure, but in a friendly manner... dont really need to hate the other side.

Scott Pack

@AviD Only douchebags hate.

Well, douchebags and sysadmins.

2

AviD

@ScottPack Haters gonn' hate.

Rory McCune

@lynks yeah hetzner are mega-cheap, I'll need to check in and see what shiney badges they have :)

AviD

@ScottPack hehe

@ScottPack that sounds extraneous ;-)

Terry Chia

13:52

@ScottPack Why so self-critical?

lynks

@RoryMcCune i was about to check, im not sure they actually have what you are looking for.

Rory McCune

@lynks yeah it's one of those things if we're audited and we host data somewhere you can usually make the auditor go away by intoning the incantation "our hosting company is ISO27001 certified" otherwise you have to do actual work :)

lynks

@RoryMcCune ahh, non-zero work quantities are bad.

TildalWave

@RoryMcCune fyi hetzner are blacklisted on most CBLs that use bad neighborhood policies ;)

Scott Pack

@TerryChia I work in Security, yo.

Rory McCune

14:07

@TildalWave hmm that could be a problem :)

Iszi

14:17

My brain just hurt, reading this post title. Had to share the pain: Ubunto wanting password in dos, when non set

Xander

@Iszi LOL

Antony Vennard

@ThomasP btw, my new smart cards have arrived apparently. Might be able to report something interesting this week. They've taken about 3 weeks to leave france!

Thomas Pornin

@AntonyVennard It takes time to learn how to swim.

Antony Vennard

@ThomasPornin True. I suppose I'm expecting too much, but they could have just booked themselves on a plane, right?

I also find this really interesting, but as a post it makes me feel VERY inadequate!

Terry Chia

0

Q: Strange CGI file

I'm completely new into perl ( CGI and PL ) files, some things i can take a clue, others not. recently i did find a nice one, mostly encrypted, i did try base64 decode without any results, i hope to find some smart people here who can help me out with this file !/usr/bin/perl require './lib.pl...

Holy crap....

TildalWave

14:33

@RoryMcCune I guess it doesn't matter for web servers, but mail might be a problem already... didn't read all your conversation with @lynks, what would you use it for?

Rory McCune

@TildalWave we're thinking about testing from a datacenter location. The idea being that we can SSH/RDP to a dedicated server and then run all the tools from there (thus the requirement for ISO27001) :)

it would be useful 'cause then we could test from anywhere with a static IP and also use things like 3G if we lose connectivity.

lynks

@TildalWave for what its worth, i haven't had any problems sending mail from my hetzner box. not that i send many emails. plus £2/month per gig of ram is such a great deal.

TildalWave

@RoryMcCune hmm no you'd need a clean source for that, might be better finding ISP that would collocate your own server for some reasonable moneys

Rory McCune

@TildalWave yeah that's an option too.. big variances in cost, just investigating at the moment.

TildalWave

@lynks they're cheap yarp... but you can be less lucky with what IP you get to be on

lynks

14:38

@TildalWave yeah, fortunately thats not so much of a huge deal for me, i pretty much only send out account registration emails and password resets.

TildalWave

I checked my filters and there's 30 Hetzner on-line A.G. ranges that auto-committed to bad neighborhood and a few hundred individual IPs... that's on a small scale SaaS type server

Tinned_Tuna

"ex abstracto." I really hope that's real latin :-p

Thomas Pornin

@Tinned_Tuna The usual locution is in abstracto meaning "in an abstract context".

E.g. like "@ScottPack is in abstracto a human being".

lynks

@TildalWave what would be the best way for me to see the filter status of my IP? is there a filter aggregation i can look at somewhere?

Scott Pack

@ThomasPornin You're a bear to deal with sometimes.

TildalWave

14:42

@lynks If you get a bad IP then you might need to wait for CBLs to clear... most common are 60 day blocks, but sometimes you need to send a request on your own

Thomas Pornin

"Ex abstracto" would be translated as "out of the abstract", meaning that the answer cannot be extracted from the purely abstract context it is presented in.

TildalWave

@lynks ipvoid.com for example

lynks

@TildalWave danke

TildalWave

@lynks keine ursache ;)

Tinned_Tuna

so, we have the nirvana album, In Utero, the Pendulum album, In Silico, and now, In Abstracto

I like this :-)

lynks

14:44

@TildalWave woot 0/38 :)

TildalWave

@lynks you can try opening my page (on profile)... I'm running more filters... neglect any funny messages if it's blocked, those are my personal musings and they might be sometimes a bit offensive LOL

IIRC @LucasKauffman hit one of those filters of mine and got a message that was intended for some other individual ... the message really wasn't nice, I kinda blushed when I realized and he asked me what I have against his country LOL

Which I don't... beer and chocolates are mighty nice :)

OK, I studied all previous Forbiddenbits CTFs... mostly just heavy obfuscation and not so much of encryption. Who writes them?

Terry Chia

15:18

@TildalWave That one really kicked our asses.

TildalWave

@TerryChia The red spectrum PHP code injection from a JPeG file? Heh, I bet :)

0

A: Identifying strange Perl CGI script

This script begins by require './lib.pl', which will read and execute the contents of the lib.pl file, from the same directory. Without seeing the contents of this file, your question is (provably) unanswerable. The generic method for reverse engineering is: do things in due order. The script en...

If it would be anyone else that wrote provably in there, I'd have thought it's a typo and should be probably. But it's The Bear's answer, so having any doubt would be utterly misguided :)

Thomas Pornin

Indeed, I really meant provably.

TildalWave

15:35

@ThomasPornin Never had any doubts, just found it amusing that I didn't.. so unlike me :) While we're on the subject of Perl... do you happen to know of any useful decompilers for Perl executables?

Terry Chia

@TildalWave Perl executables? I always thought perl was a scripting language.

TildalWave

0

Q: making perl executables on windows

hi experts, I want to make a executable from simple perl script in dir D:\script.pl (just prints hello world) I want to do this using PAR::pp. I have installed it using cpanm PAR. Could someone show actual steps. As i tried pp -o name.exe D:\script.pl both in cmd prompt and padre, but no success...

perl windows-7 executable

Terry Chia

@TildalWave Ahhh interesting...

TildalWave

OK maybe not the best link LOL

I blame Google!

Terry Chia

I googled: ayaz.wordpress.com/2006/12/17/…

So a perl script compiled into a binary is native code? Or does it still require perl to be installed?

Rory McCune

15:40

@TerryChia from the last time I used that tech (a while back) it compiles the script along with a perl runtime into an exe

so doesn't require a perl install but a small script can be quite big

Terry Chia

@RoryMcCune Ahh interesting..

Rory McCune

@TerryChia is v. handy when you want someone to run a script on a system, but they won't let you install any software on the box

TildalWave

@RoryMcCune yup, and you can specify import libraries, too... single exe, something I learned to love with Delphi too... OK, not for larger projects, but for what usually comes out of Perl, it's useful

Terry Chia

Have I ever mentioned how much I hate writing proposals?

TildalWave

@TerryChia who's the lucky lady? :))

Terry Chia

15:44

@TildalWave Google.

TildalWave

@TerryChia I did. First result was @Adnan's blog :))))

Terry Chia

@TildalWave I don't want no cactus up my ass!

Adnan

@TildalWave Damn! That's a good one.

Rory Alsop

Ooooo - down voting the bear!

-1

A: Does mobile send signals when it's off?

When there's no power in electronic components, they do nothing. However, and that's the tricky point, it is nigh impossible to "switch off" modern mobile phones (and computers, for that matter). The power switch is no longer a real, genuine, true-to-the-core power switch which switches power; it...

Looks like the end times...

lynks

@RoryAlsop im sure this is directly referenced somewhere in 'revelations'

Rory Alsop

15:59

Hahahaha - there will be a gnashing of fangs and a rending with claws!

« first day (851 days earlier) ← previous day next day → last day (4327 days later) »

Transcript for

Apr '1315

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile