The DMZ - 2013-04-21

« first day (857 days earlier) ← previous day next day → last day (4028 days later) »

12:31 AM

@TildalWave "Dirty lightning" is some of the coolest-looking stuff there is.

encrypted.google.com/…

@scotf regardless fuck u

@Iszi saved that as a bookmark - I think I know where my desktop backgrounds will be coming from!

@Iszi Yup they're gorgeous and that's to say a lot coming from a guy lol... wish I had some photo op for these some day... hopefully not the end of days lol

@Iszi although there is the odd one in there that is definitely not lightning!

@RoryAlsop It's the nature of Google. I'd expect Rule 34 shows up in any image search with the word "dirty" in it.

12:35 AM

Flowers peace and boobies!

3

tho I'm not really sure why they'd say it's unclear what makes them possible... with volcanic eruptions I think it's pretty clear, same with earthquake ones IMO :O

@LucasKauffman you're on a star hunt?

2

Lets just saty I've had too much of the local specialty

I'm wearing a Cowboy hat and sitting on a buss

@TildalWave Didn't realize earthquakes made lightning.

*bus

@TildalWave Boobies get stars just as much as stars get stars here, eh?

12:41 AM

@Iszi have been observed before some earthquakes ... particles charge with tectonic shifts and move a lot faster than the quake wave itself... can cause lightning or just what looks like atmospheric flashes (no bolt)

obviously, this is my layman's interpretation ... not sure if there were ever observed spheres/ball lightnings with earthquakes tho, but I think that they were and of course called as UFOs by many... IIRC in Turkey

12:56 AM

@TildalWave sounds legit,

1:20 AM

@LucasKauffman you doing any CTFs?

8 hours later…

8:57 AM

@TildalWave not atm, I still have to finish my SLAE before I start OSCP

1 hour later…

10:13 AM

@TildalWave oo, you should see if you could do QR injections to Google Glass. Now, that would be an interesting exploit.

@RoryAlsop desktop?? Use that as inspiration for Doktor Mayhems next pyroact!

10:30 AM

@AviD You have seen Arc Attack, right? We want to play with them!

@RoryAlsop uhh no, sorry... Googling...

ohh, ahh yeah, seen their vids.

yeah, that is pretty cool.

Reminds me of Merlin's apprentice in that Nicholas Cage movie...

:-) I reckon we'd make sweet music together

heh

@RoryAlsop you know that sounds gaaay, right?

NOT that theres anything wrong with that.

11:08 AM

@RoryAlsop this is funny:

11:56 AM

This is just bizarre: businessweek.com/articles/2013-04-18/…

@TerryChia so's your face/mom.

@AviD You must be so bored because there is no one else in here you can troll.

heh. yeah, doing administrative crapwork. yknow, expense accounting and such.

but yeah, some of that reporting is pretty bizarre. the underlying story too, to be sure, but it's as if whoever wrote that doesnt understand their own words.

DIA != CIA, for one....

user image

HAH! Unlicensed version of sublime text: arstechnica.com/gaming/2013/04/…

12:57 PM

@CodesInChaos So, you sending a counter-notice to StackExchange? Pretty pretty please?

ahhh yeaaah, Dey gone and messed wit teh WRONG site!

My favorite line from the notice so far: "Sid implies that what was perceived from a public demo is CipherCloud's product offering." No shit? Whatever would have led him to that conclusion?

Also, I'm so tired of "patent pending" being thrown around in the world like it carries some sort of magical weight that what you have isn't crap.

4

The right answer would have been for them to clarify details and post an answer. Asshats.

Oooh, they're located in San Jose... :)

@JeffFerland yeah, PR fail. Any way we can spin that in a q?

While we're on the topic of defamatory statements, their lawyer has taken actions that I believe are signs of being a miserable human being. He also sucks at proofreading (FIPS 140-2 becomes FIPS 104-2) and he reference California Civil Code 43 in saying this is defamation. While 43 does say, "every person has, subject to the qualifications and restrictions provided by law, the right of protection... from defamation", it's section 44 that defines defamation.

something like "Can we trust a security company that tries to block any public discussion about its product, like CipherCloud?"

1:12 PM

@JeffFerland Fucking lawyers.

@TerryChia It's a past-time of mine.

@AviD Do it.

@JeffFerland Really? Do you prefer the male lawyers or the female ones?

lol, actually think it might be a dupe.

@TerryChia Female.

@JeffFerland Well, stop wasting time on lawyers and get to fixing Java.

1:16 PM

@TerryChia I'm confused. Isn't Java already thoroughly fucked?

4

Abuse of mod powers. :(

I'll let you know when I start and you can send me requests on what to work on. Given their culture, I might get it.

@TerryChia Help! Help! You're being oppressed! :D

Ping @AviD and @RoryAlsop. All you moderators can suck it!

But seriously, let's keep that private until I finish the process.

@JeffFerland Good luck with it, that should be an awesome place to work.

1:20 PM

Did you know they do your laundry for you?

@JeffFerland that's awesome! and, seeing as you care more than a whit about privacy, probably an uphill battle there too ;-)

@TerryChia whaaaat?? ;-) (@JeffFerland didja see what I did there...? ;-) )

@AviD Turned him into a newt?

heh, abuuuuuuse

@TerryChia Oh, look at that. Abusive comment to moderators. Better kick him.

:((((

@AviD Suck it.

1:25 PM

lol

I really think the CipherCloud lawyer should face sanctions. He's either far beyond comprehending "fair use" in asserting a copyright claim (oh no, they used screenshots of our product to talk about our product), or totally ignorant of the concept. Neither is really excusable for somebody writing DMCA notices.

@JeffFerland Have you seen that Prenda case?

Talk about incompetent lawyers.

@TerryChia Nope, but I'm reading about it now.

@TerryChia Sounds like money-motivated malice so far.

Seriously guys, you have to take an ethics exam just to sit for the bar exam. WTF.

@JeffFerland The thread itself is back, only the images are missing. I'll probably just link to the official documents instead of embedding screenshots. So I don't need to go through that legal bullshit.

I'll also edit my answer to be a bit more comprehensive :)

@CodesInChaos also add in a bit about the apparent snake-oil-ish PR... mention the violation of Kerkchoff's Law.

1:32 PM

@CodesInChaos I don't have standing so I can't do it, nor am I a lawyer (amazingly enough), so I can't do it on your behalf (balls), but I really encourage you to counter-claim, possibly through the EFF, and possibly with the result of punitive damages against the original filer.

... does anybody have a copy of their patent filings?

@AviD I prefer having the facts talk for themselves

@CodesInChaos link please, so we have it here... maybe a mod star on it to keep it handy

12

Q: How is CipherCloud doing homomorphic encryption?

Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet. How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not provide much information about how their system works.

homomorphic-encryption database

@Codes - did you get any explanation note or email

1:57 PM

I first received an email from SE with little information and later received the pdf of the DMCA notice

D.W. posted both of them on meta

@Jeff And I had to take an ethics class for my undergrad. I convinced the class that software/music piracy was ethics neutral.

@ScottPack well considering that in many cases, those that make the bulk of profit, and thus absorb the piracy losses, are not the creators of said product, but those that abuse the actual creators and misdirect the profit into their own pockets - you might have a bit of ground to stand on.

Anybody have a bootlegged Metaltech CD? ;-)

I paid for mine.

I was kidding, you know.

self publishers obviously would negate my above argument.

2:19 PM

Also that, at the time, the Business Software Alliance numbers for global dollar loss from piracy was a tiny tiny percentage of Microsoft's profits.

Granted, they're a huge company with huge profits. Still, it was an interesting data point

I wasn't making the claim that piracy was ethical, just that it wasn't unethical.

@ScottPack So what exactly do you claim it to be?

27 mins ago, by Scott Pack

@Jeff And I had to take an ethics class for my undergrad. I convinced the class that software/music piracy was ethics neutral.

@AviD Ahhhh.

2:52 PM

@AviD - I really meant to take a CD out to Tel Aviv... but I forgot to pack it.

@RoryAlsop thepiratebay.se

;)

3:08 PM

@RoryAlsop make sure you do so next time... :)

ahh... planning the trip south... next week, VACAY BABAY!

srikanth chandrasekaran

3:29 PM

hi . Is this a good SE site to discuss digital forensics?

@srikanthchandrasekaran Hi. Probably the best site to discuss digital forensics :-)

but it kind of depends what you need to know

@TerryChia did you know you cannot access that site in the UK - all ISP's have a mandatory block order on thepiratebay

@AviD definitely

srikanth chandrasekaran

I want to know the best software out there to retrieve data from hard drives after a secure wipe for 1 pass

@RoryAlsop whaaa? really?

@AviD I know - utter lunacy

@srikanthchandrasekaran "the best software to do XXX" is usually not a good fit for SE sites.

3:32 PM

of course you can access it, but only be subverting ISP controls, which means they can get you for breach of TOS

they usually get closed pretty quickly as "Not Constructive".

@srikanthchandrasekaran that is not a digital forensics question

srikanth chandrasekaran

but even in chat?

Well, after a secure wipe, you will not be getting data back

wwe have some questions on that

@srikanthchandrasekaran sure, in chat is fine. @ScottPack would probably be your best bet...

3:33 PM

hang on - will try to find a good link

@RoryAlsop ah yeah, theres that :-)

@RoryAlsop what about a foreign proxy? or TOR?

@AviD yeah -those do work :-)

(apparently)

srikanth chandrasekaran

i do know winhex and x-ways...But there should sure be better ones

@srikanthchandrasekaran Check out security.blogoverflow.com/2012/02/…

after even a single pass of a secure wipe, you will NOT be getting any data back

so we're driving down to Eilat with the kids next week. It's been a few years since I've been, I'll keep an eye out for things to put on your itinerary next time you're here... ;-)

3:35 PM

it is just not possible any more. In the early days of hard disks you could, but now track density is so high there is no way

@RoryAlsop Not so sure about that. The site seems to work fine for me without doing anything special.

@AviD Cool! I have shown Claire the pics and she is really looking forward to going

@Ladadadada The UK ISPs were all told to block it... wonder if they are just bringing it in at different speeds?

@RoryAlsop excellent

I'm with Plusnet. I vaguely remember hearing that it was just the big ISPs that were told.

@Ladadadada hmmmm - you may be right. The articles I'm finding through google do just mention Virgin, BT, Talktalk and a couple of others

3:37 PM

I also vaguely remember hearing that the blocking method was overriding those domains in their DNS resolvers, and since I'm using Google's public DNS, that doesn't affect me.

it's really the best season, its summery, but not yet quite intense heat. We're expecting low-to-mid 20's, so beach weather but not a killer.

@Ladadadada heh

@Ladadadada oh brilliant, that is just so secure.

srikanth chandrasekaran

@RoryAlsop thanks

If we take away their phonebooks - they wont be able to call anybody!

3:39 PM

I suspect that's the only reason the ISPs agreed to it. Blocking it securely is cost prohibitive.

anyway - it is sunny outside. Going to go and join the kids on the trampoline and have a wee beer. Later

@RoryAlsop REALLY?? Quick - take a picture, so there's proof!

@AviD ohhh shiiiite. That's this week. next week its mid-30's C. so, yeah. :S

well, in a couple months, it gonna be 10C hotter than that, down there...

1 hour later…

4:46 PM

Posted an updated version of my CipherCloud analysis

5:22 PM

Is there a name for a substitution cipher where each plaintext unit corresponds to multiple possible ciphertext unit from which the encrypter chooses one?

5:47 PM

@AviD Who's your daddy?

@ScottPack Not sure you'd want to know. He's a scary dude.

@srikanthchandrasekaran So yeah, they hit the highlights. Short answer is: "You won't." Long answer is: "If you possess an electron scanning microscope there is a remote theoretical possibility that you may be able to get some stuff."

@AviD Like, he wears black gloves. a black helmet, a black cape and has some fits of asthma ?

2

@ThomasPornin Batman with pneumonia...?

@ThomasPornin hahahaha

5:50 PM

Like, he grew up one of the last white families in Newark.

If that doesnt mean anything to you, Newark is the place that Harlemites were scared to go to, back in the day.

@RoryAlsop do I not get that reference....?

@AviD I didn't get the reference at all, but it made me laugh

@srikanthchandrasekaran In 2003ish (I think) the US agency responsible for standards, NIST, performed a study where they found that any magnetic media manufactured after about 1998 is data safe after a single pass wipe. It's a combination of storage densities (bytes/square inch) and how the bits are actually encoded into the rust.

@AviD For me, Newark is an airport from which you need to take an outrageously priced bus, or an even more expensive cab, if you want to go anywhere.

@ThomasPornin yeah, there is that, too. Pretty sure cabs from JFK are even more expensive, though.

@AviD The subway goes to JFK. It costs something like 5$ or so (at least that what it did a few years ago).

5:53 PM

@srikanthchandrasekaran Now, if you talk about chip storage, like flash or SSD, then you're dealing with a whole different ball of yarn and lots of data may be recoverable. It would, however, require bypassing the wear leveling (which runs on the drive controller). So I recommend figuring out how to desolder memory chips and reading them directly.

@RoryAlsop He was referring to Darth Vader.

@ScottPack Oh.My.Gosh. I am soooo embareassed.

HOW did I not catch that??

@srikanthchandrasekaran: to add to what @Scott is telling: anyway, it is not a matter of software. From software, once data has been overwritten, it is gone. If there's hope for data recovery, then it necessarily requires some hardware surgery.

@srikanthchandrasekaran This is worth pointing out. :) security.stackexchange.com/tags/destruction/topusers

well, probably because he doesnt actually wear gloves - one hand is a robot hand, the other hand wears a crushgaunt.

also not really fits of asthma, he just breathes via a machine.

and really, no mention of the Force?

still, I am thouroughly ashamed.

I blame Jar Jar Binks.

3

@ThomasPornin But only on flash media. If it's a harddrive don't bother.

5:58 PM

@ScottPack Well, that's a race between increasingly better microscopes, and increasingly denser storage media. What NIST says is that, right now and for the foreseeable future, media density is way ahead.

@ThomasPornin Sure, I'll go with that.

6:13 PM

user image

Reminded me of this guy - Defendor :)

@ScottPack oh doh I didn't get it either hehe

@TildalWave Are you all in coma this Sunday ?

I drank two beers, filled an administrative form, and followed an online course on diversity and equity in employment in Canada, and I still appear to be widely more awake than you guys.

@ThomasPornin Well that seems to be the problem. I, at least, have NOT had the two beers.

@ThomasPornin I am, dunno for others... had a thunderstorm half an hour ago and I nearly fell asleep. Must be the pressure and spring tiredness or something

6:31 PM

user image

@TildalWave Dark Helmet

Spaceballs is a 1987 American science fiction comedy parody film co-written and directed by Mel Brooks and starring Bill Pullman, John Candy, Mel Brooks and Rick Moranis. It also features Daphne Zuniga, Dick Van Patten, and the voice of Joan Rivers. The film was released by Metro-Goldwyn-Mayer on June 24, 1987, and was met with a mixed reception. It later became a cult classic on video and one of Brooks' most popular films. Its plot and characters parody the original Star Wars trilogy, as well as other sci-fi franchises including Star Trek, Alien, and the Planet of the Apes films. Plot P...

@AviD well he wore black gloves, black helmet, black cape and had problems breathing too (among other problems that he had, like teleportation, jamming, combing deserts, and the blow setting LOL) :)

And don't forget his drinking problem.

Drinking hot coffee, of course.

6:49 PM

@AviD and a short Schwartz :)

user image

@TildalWave that really needs to go to sec reactions...

@ThomasPornin I have not yet had two beers either. I will be grilling tonight, but there is no beer in this house. I may have to pour myself a glass of wine. I'll do upscale grilling.

@ScottPack heh, wine and grilling?

unless that wine comes in a box, it would seem to be discongruous.

7:09 PM

Right - beer has now been imbibed. I feel much better equipped to cope with film references, snark and Rule34

@TildalWave @CodesInChaos @RoryAlsop BTW not sure if you saw but ciphercloud are exhibiting at Infosec....

Bacon.

@RoryMcCune Ha! somebody go harass them! Make sure you wear a sec.se tshirt...

@RoryMcCune I plan on popping in to Infosec at some point so could do that with a Sec.SE t-shirt heh heh heh

@RoryAlsop well it does sort out my T-Shirt choice for Tuesday when I'm doing my infosec run :)

@RoryAlsop BTW you mentoring all day on the Wednesday or getting to see some of the talks?

@RoryAlsop leave them one of these:

user image

7:16 PM

@RoryMcCune Excellent. I know I have to be smart for some of Claire's birthday celebrations, but I think it would be funny to take her to Infosec and see if anyone tries to sell her anything

She has a ticket

and knows the PR-speak

@RoryAlsop she should at least try to score some good freebies :)

@RoryMcCune My mentee is first up, so I am pretty free to wander

@RoryAlsop cool. There may be a picture of you in my presentation :)

@RoryMcCune that's what I said - even if she doesn't like t-shirts, I do, and there are always kindles/ipads/stuff

@RoryMcCune ooooo - getting your own back, eh

:-)

@RoryAlsop :) you're in good company next to pictures of kittens and beer :)

7:19 PM

@RoryMcCune are calling @RoryAlsop a drunk or a pussy?

@AviD as it happens no. It's part of my Intro where I'm running through some of the ideas I had for following the previous speaker who's known for his good talks. so I have a picture of Rory in full gig get-up with flames coming out of his guitar...

@RoryMcCune ah. so you're saying that @RoryAlsop is a drunk pussy.

Just looking at the Infosec Booth layout here's one I have to go see infosec.co.uk/en/Exhibitors/140883/Moscow-City-Government

Moscow City Government have a larg'ish stand?!?

I'm having trouble translating // Use last nipple of result as index/offset.

Does anyone know what that might mean?

7:34 PM

Well this is funny: securitybookreviews.eu/ciphercloud (check the licence info at the bottom)

Join @CipherCloud's cocktail party at #Infosec Europe, stand P80 on Apr 24th from 4:00-5:30PM. Please come by for a drink and chat!

Tweeted by ciphercloud on April 21, 2013 at 6:31 PM

They better serve Absynth :)

@TildalWave ahh they've lucked out there, that's when my talk is on at B-Sides so there'll be no one there to speak to them ;oP

b'cos that's what their encryption is

@RoryMcCune well you won't run out of jokes then to soften the crowd :)

@TildalWave that's a fair point I may have to have a quick dig.

@TildalWave Which one ? The original one, which is a known neurotoxic, or the blue sugary liquor they serve in Prague and is even better at killing brain cells ?

@ThomasPornin well you end up Absynth-minded with either ;)

7:50 PM

@RoryMcCune eeeexcellent!

@RoryMcCune that one seemed interesting - I was trying to figure out what that department might do.

@RoryAlsop well yeah it seems an odd one will have to wander by, as well as re-stocking my sock collection at the PenTestPartners stand :)

@RoryMcCune lol

@ThomasPornin My absinthe collection may need topping up - only have a few left

@Ladadadada what's the original language it's translated from?

@Ladadadada unless the context makes it interesting, I would put money on the intent being "nibble" (i.e. half a byte).

still, using a nipple as an index could be fun too.

(°)(°) <- use last nipple of result as index/offset

8:10 PM

@AviD I wonder if nipple is big-endian or little-endian?

@TildalWave the would really depend on the person, no?

@AviD you mean the size of one's offset?

hehe

8:34 PM

@avid It is both incongruous and from a box. Yellow Tail shiraz.

9:02 PM

@TildalWave It's one of the mirrors (from google cache) that popped up while the actual thread was down

9:22 PM

user image

Best Have I Got News For You caption competition ever: "mouse celebrates spring by tickling bum with pollen" :))

I was gasping for air laughing... Joe Wilkinson is funny LOL

9:58 PM

@avid change of plans. The wife made me an old fashioned. Downside: Now out of bourbon.

10:09 PM

@ScottPack You have a good wife. If she goes out for more bourbon, she's a great wife.

She's cooking the rest of dinner.

Besides, I don't have a whole lot of faith in her bourbon choices. She likes Makers.

@ScottPack Since she's cooking the rest of the dinner, she gets a pass. I can't criticize her bourbon choices since I'm not much of a bourbon connoisseur myself. I don't have any Maker's though, which apparently is good. :-)

It makes good am alright mixer. The bottle we just emptied is Knob Creek.

My favorite still stands at Blantons.

I did just recently have a local one called Oyo, or similar. Pretty not bad either.

Not worth the price, imho, but quite drinkable.

I think the distillery is still just to small to compete on price.

10:29 PM

@ScottPack Good to know! I've got Knob Creek and Beam Black (which is my current mixer) on hand, but I really haven't tried many bourbons, so I haven't developed a palate for them yet. It

's on the list.

mmmmmmmmmmmm - bourbons

11:08 PM

0

Q: is there any sql injection for this login type?

i am new in stackoverflow and also php :). i wanna have a login form and i get one from web. i want to know is there any sql injection for this code? if there is what is that Entery? this is my form: <form method="post" action=""> <dt class="title"><label for="username">name:</label></dt> <dt><...

some wacky answers there because of the question being so... hmmmm.... basic. I think some moderation is in order

@RoryAlsop Ping! :) ^^

@Xander We don't have a great selection here. It seems like Knob is probably the ideal quality/price.

@Xander Rowan Creek is also really yummy. I have no idea how much it costs, I've only ever had it out of someone else's cabinet.

« first day (857 days earlier) ← previous day next day → last day (4028 days later) »

Transcript for

Apr '1321

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile