The DMZ

Sulla

00:00

@TildalWave well alright! thank u sir!

TildalWave

@Sulla question... with "interactive brokers" do you mean the company Interactive Brokers, or in general as in "online discount brokers"?

I'm editing your question slightly... formatting and such, and would like to include a relevant link so that intended meaning is taken care of

Terry Chia

05:18

I'm one year old. :D

AJ Henderson

07:32

@Adnan - any particular reason you responded to that one question about hardware based malware as a comment rather than an answer?

I mean, sure, it's brief, but it answers the question to the point that such things do exist

and are in fact in the wild

Adnan

08:06

@AJHenderson To be honest, I didn't like the question at all. If I were gonna answer, I'd write a 2-3 line Community Wiki answer anyway.

@AJHenderson Also, I VTCed it

Lucas Kauffman

09:03

herro

Adnan

@LucasKauffman Plastava!

Damn it! Apparently it doesn't exist in any language. I'm disappointed, it sounds like it could be a greeting in Hebrew or Polish.

AviD

09:40

@TerryChia and here I was thinking you behave like a three year old.

@Adnan not hebrew, perhaps polish or Russian. I would go with Ukrainian.

@Adnan I am going to start using it, though... ;-)

Adnan

@AviD Yeah, I started using it about 3 days ago. At first, people think that's my name, then I say it's a greeting in my country. They ask me where I'm from, I say I'm from Digrinia. Ah! Then they say "Oh.. Digrinia! Is it the country next to.. ummm.. ummaaah.. France?"

Priceless!

AviD

@Adnan lol

there is a city in israel called "Digania". Would confuse people here.... but, on the other hand, there are people here from so many countries, so it wouldnt be a problem to find a different one...

Adnan

@AviD It gets better. When somebody say they don't know Digrinia, I act surprised as it should be common knowledge. Then I list things famous in my country (Digrinia), we won the world cup in 1964, we make great wine..

AviD

that sounds both obscure and generic just enough to sound plausible.

and, to be fair, there are so many little countries around Europe now, that no one can be expected to know all of them.

Adnan

One time, a girl insisted on Googling it. I convinced her that the reason she can't find it is because she didn't type it in hour alphabet, and her keyboard doesn't support it.

AviD

09:53

just don't demand to have an opinion on your government's foreign policy regarding a country you've never heard of before. That privilege is reserved for the 'merkins.

Adnan

Then she asked me to write her name in our alphabet. I scribbled some shapes and told her that's her name.

@AviD Hmm... I'll keep that in mind next time I meet an American.

AviD

lol. she probably jumped on you for that,

@Adnan you've seen all those clips, right? Some talk show host (e.g. Jay Leno) goes to talk to americans in the street, ask them all these basic questions, and shows how incredibly dumb most of them are...

Adnan

@AviD Well, I'm a gentleman. I don't have wild sex with someone on the first night I meet them and tell.

AviD

heh, your first version was funnier.

like this one: collegehumor.com/video/6891738/…

Adnan

@AviD No, I haven't. But to be honest, it's kind of the point of those things. I'm sure that many many people answer in an informed and smart way.

AviD

09:58

what, you're suggesting that the producers edit the material in a dishonest, slanted way??

but yeah, most people really are incredibly stupid and opinionated, and they dont let one affect the other.

Adnan

@AviD I've read so many LiveLeak comments to know that that is true.

AviD

dammit, I was looking for a good example on youtube, but its just depressing.

".... aaaaand then he voted."

aaahhhh yeeeaaahhhh

just had an A/C unit installed in my office. lowered the potential ambient temperature by at least 15-20C.

NOW I'm ready for the summer!

Terry Chia

10:15

@AviD Wait, so is Benghazi a country, state, person, group of what?

AviD

Benghazi

Benghazi {{#tag:ref| , Libyan Arabic: , ; ; also: Bengasi, Benghasi, Banghāzī,{{cite web|url=http://geographic.org/geographic_names/name.php?uni=-446

cmon son

I say, its fine to not know, not a big deal. But if you don't know, dont insist on having an opinion.

Also, learn how to find out.... ;-)

Terry Chia

@AviD Ahhh... I actually thought they made that up. You know.. since it's collegehumor and all...

AviD

heh, fair point.

Adnan

@TerryChia WHAT?!

@TerryChia WHAAAAT?!

Do you watch/read the news?

Terry Chia

@Adnan When were they last in the news? I have a very short memory for this type of things..

Adnan

10:25

@TerryChia Libyan civil war, the attack on the U.S. consulate. Also, with the recent IRS thing, Benghazi is brought up almost everyday to win points over the left.

AviD

10:35

@Adnan I don't... whats your point?

Adnan

@AviD There is a point to this, so please answer the question. Who's the current president of the United States?

AviD

@Adnan a. I don't care about any part of politics. b. I don't live in the US, so I care even less. c. Hillary Clinton runs everything, so it doesnt matter. d. Barak Hussein Obama is the duly elected president.

so what was your point?

Adnan

@AviD Alright, good. Now, how did you know that information?

AviD

my built-in american cluelessness informed me.

I heard voices in my head.

I binged the crap out of it.

actually I happen to know those...

Adnan

@AviD But how? How did you acquire that piece of information?

Terry Chia

10:44

@Adnan meh, most of them doesn't ring a bell.

@AviD hipster...

AviD

@Adnan general knowledge....

SALUTE!

Adnan

@AviD I'll make it easy for you. You know it because you've watched/read/heard it from a source of information. Be it the TV, your RSS feed, Wikipedia, your friend who watches the news.

So.. you do watch/read the news.

Terry Chia

@AviD Remember the javascript game from Mozilla a while back? Some interesting benchmarks on the performance of asm.js. arstechnica.com/information-technology/2013/05/…

Adnan

@AviD I understand the little hipster in each one of us, the little hipster who makes us say "Oh, I don't care, I don't watch the news". But, in a way, we all watch the news. We all get our information from somewhere. Just because you're not interested in politics (I'm not a big fan either) doesn't mean you "don't watch the news"

Adnan.. out! (fishing)

AviD

@Adnan well... not directly, but I guess I hear it indirectly.

but i definitely dont "watch" news shows.

Except for the Daily Show (Jon Stewart) on rare occasions...

@TerryChia not that I care too much, but those benchmarks seem a bit dodgy.

Terry Chia

10:58

@AviD How so?

AviD

besides the inherent order-of-magnitude difference between javascript and native, I have never seen firfox outperfom IE so badly.

i know, i know... you gonna say I'm a MS fanboi...

but firefox was always heavy in my (and others') anecdotal experience.

there used to be an advantage for FF in streaming media, but that hasnt been the case in a long time.

Terry Chia

@AviD I think they mentioned it in the article.

> Other browsers don't have special asm.js support at all. Google expressed some interest in adding asm.js optimizations to Chrome, but it hasn't done so yet. Worse, our testing showed that the use of asm.js actually hurt performance in non-asm.js browsers.

So basically, it's the lack of support for asm.js that's causing IE to perform badly.

AviD

@TerryChia saw that, but its not really answering the point...

@TerryChia they claimed the differences even without the asm.js.

Terry Chia

@AviD Well, the "regular" js mentioned in the article is also compiled from C/C++ using emscripten. So it might still be an optimization issue.

AviD

@TerryChia cant say I read it that closely.

but sure, I guess that's possible.

Terry Chia

11:11

@AviD hehe. i mostly skimmed it as well. it's just interesting to see how much asm.js can bridge the performance gap between native and web.

Not to mention the fact that it's still in beta so it should probably get better with more optimizations.

AviD

hmm yeah could be interesting.

Fitzroy

11:29

Does anyone here manage a windows domain?

I have a least privilege question...

Terry Chia

@Fitzroy You probably want @AviD or @RoryM for Windows stuff.

Fitzroy

@terry thank you - fingers crossed they make an appearance...

Rory McCune

@TerryChia unfortunately whilst I know a bit of windows stuff, I've not been a domain admin apart from our home domain in the last 15 years :)

Fitzroy

@rory - may i put a question your way?

Terry Chia

@RoryMcCune Pity.. :P

Rory McCune

11:37

@Fitzroy sure

Terry Chia

@Fitzroy Just ask, but you might wanna try the SF chatroom if it's a configuration issue.

Rory McCune

@TerryChia really.. I kinda glad I'm not a windows admin :)

Fitzroy

do you agree that it is best practice for a windows sysadmin to have one account for reading emails, browsing websites, etc - and another for admin type duties?

Terry Chia

@Fitzroy Most definitely yes.

Such a separation is a good idea, no matter the platform.

Rory McCune

@Fitzroy short answer yes. this is a good practice that I've seen used in a number of companies. The idea is a couple of benefits

@Fitzroy 1st it reduces the risks of inadvertant changes to the domain (

Fitzroy

11:40

do you think there's merit in the sysadmin having more than one admin account. My reason for asking this is becuase i feel one account breaks least priviledge..let me explain. If your task is to install a printer on someones pc, then is it right that you use an account that can pretty much destroy your domain?

Rory McCune

@Fitzroy 2nd if an attacker takes out a workstation they're less likely to get a domain token from it.

TildalWave

@TerryChia Congrats... errr..... yearling! :))

Terry Chia

@Fitzroy Can't you use some automated tool ala puppet to push out configuration changes? I do remember windows having something similar.

Rory McCune

@Fitzroy it's a trade-off between usuability and security. For printers I'd say that the account probably needs to be local admin on the box, but not domain admin

Terry Chia

@TildalWave hehe thanks. :) starting to get real lazy to answer questions now that i'm at 10k.

Rory McCune

11:42

@TerryChia devops hipster :op standard tools would be something like MS SCCM (IIRC)

Fitzroy

@rory - in which case you would advocate the use of multiple admin accounts for fulfilling different tasks?

Terry Chia

@RoryMcCune hehe. it's just that the tools for doing so on linux is just so convenient... especially on RHEL systems where you have kickstart as well.

TildalWave

@TerryChia You sound like our football team

Fitzroy

@rory - but i understand what you mean about the conveneice trade-off

@rory - dont go too over the top with loads of separate accounts

Rory McCune

@Fitzroy well up to the point that you start having too many accounts to manage. Most people seem to split standard and admin for a given user unless they have a large number of distinct roles

@TerryChia TBH the windows tools can be really powerful, but these days they're pretty complex

Terry Chia

11:45

I just don't get the Windows privilege model. :P I like the linux one "account" for every single thing type of deal.

Fitzroy

@rory - it personally makes me uncomfortable to use a very powerful admin account to pefform a piddly task like installing a printer or a new browser on someones workstation.

Terry Chia

Just sudo that shit dammit! :P

Fitzroy

@terry - what i am advocating is not 'the windows model'. there is no such thing as the windows model. the model is something you design yourself

Rory McCune

@Fitzroy indeed that's a bad idea. Also to elaborate that means that windows leaves domain tokens on that PC which means that if it gets the wrong kind of malware on it, the attacker can take over your domain.

Fitzroy

@rory - im interested to know more about that. can you elaorate alittle?

Terry Chia

11:46

@Fitzroy Nah, I just mean the way Linux handles it. One account for every daemon that's running. Windows doesn't have something like that.

Fitzroy

@terry - but again thats not the linux model is it? thats just the way you chose to use it?

Rory McCune

@Fitzroy so when a user logs in a token is created. Hacking tools (e.g. metasploit with incognito) can list the tokens of people who are or have recently logged into the box and then use those tokens to attack the domain. so if you use domain admin a lot it increases the risk

Fitzroy

@terry is doesnt have to be tha t way

Rory McCune

@Fitzroy there's a micrsoft paper on reducing the risks of that I'll see if I can see it.

Terry Chia

@Fitzroy No, the model is ingrained into the OS. Every time you install a new daemon, it will create an account for it. All the stuff handled by the daemon is owned by that daemon etc.

Of course you can mess around with it by changing ownership.. but why would you?

But meh, can't say I know much about windows systems administration. my sysadmin education has strictly been linux/unix. :P

Rory McCune

11:50

@TerryChia you can do windows services that way you know

@TerryChia you can either assign an account for it (domain or local) or use the in-built ones

Fitzroy

@terry sorry - when you said 'one account for every daemon thats running' i thought you meant the same account for every daemon. i now see what u mean.

Rory McCune

the inbuilt ones are actually quite good these days in that they have quite limited rights

Terry Chia

@RoryMcCune Ah, really? That's cool. Didn't know that. But that's not the "default" way right?

Or is it the default once you go into all the domain stuff?

My Windows experience is strictly limited to my one machine. :P

Fitzroy

@terry - this is a comon windows misconception. the security is what you make it.

Rory McCune

@TerryChia the default way in windows used to be to use the system account, which was bad. these days you use things like network service or local service which are much more limited

@TerryChia using domain creds is usually a bad idea unless you really lock them down (e.g. block interactive login)

Fitzroy

11:52

"unless you really lock them down (e.g. block interactive login)". Which is what i do

Rory McCune

@Fitzroy couldn't see the MS paper but here's a couple of references on token stealing

computer-forensics.sans.org/blog/2012/03/21/…

pentestmonkey.net/uncategorized/…

Terry Chia

@Fitzroy You can click the little arrow on the right-side of every message to reply to it. Makes it easier to follow the conversation for someone later.

Fitzroy

arrow on the right side?

@rory - thank you

Terry Chia

@Fitzroy Yup, the rightmost of the three icons you see at the side of each message.

Fitzroy

@rory what do you make of Iain Hallam's suggestion here: serverfault.com/questions/224467/…

AviD

12:08

@RoryMcCune same here (though I was never "officially" an admin, I've mucked around with it quite a bit, including building support tools for the domadmin team....)

though I have to say, things have improved a ton in the current versions, since I'd been hands in on them....

@TerryChia well, it could, and often should, but it's not required.

@RoryMcCune ... and often better than creating a new user for each service.

@Fitzroy @RoryMcCune actually in large orgs its usually not even the domain admins that would be e.g. installing printers, it would be some function like HelpDesk.

and those users would belong to a group which has Local Admin privileges on all desktops (or all desktops in a certain region, or department, or whatever), but no special privileges at the domain level.

this would arguably be the best model - compromise between least privilege and usability / ops requirements.

Fitzroy

@avid but what about situations where the number of IT staff is small

AviD

(it's not quite least privilege, since that user still has privilege on all other desktops - but close enough.)

@Fitzroy I would still go with @RoryMcCune's suggestion of automation, ala SCCM...

Fitzroy

does SCCM use a service account or run under the context of the user thats working with it?

AviD

but in the case where you dont have that, sure, it could make sense - though not without operational impact - to seperate between domain admin and desktops admin.

@Fitzroy combination.... mostly both.

Fitzroy

so if i deploy some sfotware to a pc am i doing so using my account or using the service account that runs sccm?

which account does the installation run under on the target pc

AviD

12:19

depends on how you configured it. In principle there is a dedicated system-level account for SCCM deploys.

Fitzroy

i see. makes sense.

AviD

how many pc's are we talking about? how many users, and how many admins / helldesks?

TildalWave

anyone else had problems connecting to SE a few minutes ago, or was it just me?

AviD

('course take into account that I am not a systems guy, I've only looked at these options from an apps PoV. and a certain amount of devops PoV once upon a time....)

so take everything I say with a heaping mound of coarse grained sea salt.

Fitzroy

@AviD - no thank you. i was really just looking for some validation as to whether my idea of having seperate admin accounts makes any sense or not.

@avid i think there seem to be some strong arguments for it.

AviD

12:23

bottom line - yes, it makes sense (in certain situations) - but it is not without a sometimes significant tradeoff.

Fitzroy

agreed - there's a trade-off. I wouldn't intend to take this too far. EG a separate admin account for every pc in the building. and a separate admin account for every server!

nothing insane like that.

i just thinnk there should be some seperation of duties.

although its not 100% abiding by least privilege - its kind of leaning towards it

AviD

right. but its only the difference between lateral privilege, as opposed to vertical privilege.

Fitzroy

can you elaborate?

AviD

this can be very easily done - a single domain group, e.g. "Desktop Admins" or "HelpDesk", pushed out to be a member of every desktop's Local Admins group.

Fitzroy

@avhid that is the exact step that i have very recently done.

TildalWave

12:34

@Poly Don't you think that non-revoked multiple cert usage question is slightly NaRQ?

AviD

@Fitzroy I mean, its' not completely least privilege - but its relatively low-level privilege (relative to the domain), spread across all the desktops. As opposed to high-level privileges on the domain.

TildalWave

@Adnan Morning sunshine!

AviD

@TildalWave leave him alone, he's a high rep user. He gets to do whatever he wants. ;-)

Adnan

@TildalWave Morning!

TildalWave

@AviD hehe yeah right :P

AviD

12:36

and no, personally I think its a solid security question. it's not a how, its a question of risk management.

Adnan

@TildalWave Agreed

TildalWave

@AviD seriously tho, it's a legit question but how are we supposed to provide any meaningful answer to it? It's up to developers, and each and every single one of them, to prevent that

Adnan

Next time anybody asks a question with password, this video should be automatically played.

►

3

AviD

@TildalWave no, this is standard (or at least, de facto) functionality. The SSL spec doesnt say anythign about that, au contraire - and why not?

Fitzroy

@AviD thank you - i take your point about is being low privilege.

AviD

12:39

@Fitzroy "relatively". dont forget, its still pretty powerful...

TildalWave

@AviD sure... but that makes @Poly's question a RFC

Fitzroy

@AviD in the sense that is holds admin permissions over all the workstations - not just the one you are working on?

AviD

@Adnan that's horrible. Showing the password in plaintext??

but yeah, pretty awesome.

TildalWave

@AviD Drop him an answer like that ;)

AviD

@TildalWave I dont think so, on the other side its a "why shouldnt we do this", even at a personal configuration level.

@TildalWave no, thats the question. I dont have an answer, other than: DevOps.

@Fitzroy yes, exactly.

Drivers, ownership, all users' documents.... etc.

Fitzroy

12:43

@avid thank you. i accept that. i mean the account that you use is just one of the layers of security. VLANs and firewall policies between machines will plug other gaps.

AviD

@Fitzroy wweeellll.... Sure. Let's go with that.

Fitzroy

@AviD lol. thanks

@AviD your point about users documents wouldn't apply to me. docs are redirected in my environment. so the ws admin account wouldn't have access to these shares.

AviD

@Fitzroy meh. it helps, but only as a layer of indirection. Don't forget, a local admin owns you.

keylogger anyone? process debugging? token hijacking? Game over.

TildalWave

> Does she remember her password ??

hehe

Fitzroy

@AviD can you propose a stronger model that is still a practical one? i cannot...

its a compromise...

AviD

12:49

@Fitzroy no, I still think this one is a good tradeoff. Just pointing out that this group is still pretty damn privileged...

employee vetting, auditing, monitoring, etc....

@Fitzroy heh, just had an ad show up, for Soluto

> Soluto: IT, Designed For People Soluto for Business makes managing and monitoring multiple PCs easy and stress-free.

sounds like it might be interesting for you....

Fitzroy

i dont like tools that claim to do everything, make you better looking, etc...

i like tools that do specific jobs very well.

AviD

@Fitzroy sure, I'm like that too. But large IT teams, in big corporates, dont want to start managing a whole pile of tools, either.

in some cases, just managing the licensing for a pile of tools is a ridiculous investment of time.

TildalWave

@AviD not if they're government agencies :P there is not such a thing as a ridiculous investment of time

Fitzroy

also, i'm turned off by tools where they've spent way to much time writing a lovely looking front end...

but thats just me.

see you later chaps

TildalWave

@Fitzroy well we all know what makeup and push-up bras are there for... and no, it's not usability :)) j/k

AviD

13:02

@TildalWave right. in that case, they would buy another tool to manage the licensing.

actually, thats not true either - they need the approved, government deal with either CA, IBM, MS, or Oracle.

TildalWave

@AviD you mean hire another tool, right?

AviD

purchasing approval is a bithc.

TildalWave

2

Q: WPA2 audit tool

For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s). I've done some homework: Brute-Force GPU Password Crackers How to setup GPU for Cracking WPA/WPA2? oclHascat? No. But I am still left with some questions on how to proc...

let's reopen this, huh?

AviD

15:10

@TildalWave meh. Still reads strongly as a product recommendation, with some tool opinion thrown in.

I see @Gilles point about it being one part "how to accomplish", but its still 90% about which tool to use.

If I first saw it the way it is now, it would still be borderline closeworthy for me. Definitely an improvement from the original, but still basically a tool recommendation.

TildalWave

@AviD well actually about complete configurations, but I don't see it anymore as a tool recommendation question, the guy is just after suggestions that might help him build his next setup... OK, saying it like so, I see it's still OT LOL... I'd close on one eye tho, I don't see it being damaging to the site

The guy seems so eager to make this question work, maybe some good answers will help it actually be of any use? We've seen those floating around, it would hardly be the first time ;)

AviD

the questions as they read now, are:
1) Is tool X a good tool to use?
2) Besides X, which tool should I use?
3) How should I set up these tools?

TildalWave

Wanna drop him a comment in meta then?

AviD

@TildalWave @RoryAlsop already did, pretty much covered the main points, the q did not (IMDO) change enough.

TildalWave

@AviD D?

AviD

15:16

as I said, its now borderline, and I might not have actually closed it (considering the other factors) - but I'm not convinced enough to actually actionably reopen it.

@TildalWave In My Diamond Opinion ;-)

TildalWave

@AviD hehe ok ok, I'll drop it... can't argue with diamonds... they're harder than my teeth are

AviD

@TildalWave naw, you can always argue with us. You just might not always win.

truth is, it will probably get opened by consensus anyway, no need for diamond. As I said, I probably (personally) won't modclose it as it is now, just not gonna modvote to open it.

TildalWave

@AviD bah, you know I wasn't after winning anything here, just my sense of compassion for the guy that's trying hard

AviD

@TildalWave that's part of the other factors that I would consider in leaving it open...

we really have to work out how to ask around tool requests, though.

definitely agree that just asking for a tool is not a good question, but neither can we just ban any tool request.

TildalWave

@AviD All OK there? You don't seem to be in your best mood :O Red-taped again (it's Sunday, what makes me ask)

AviD

15:21

in general, a good tool question is around things like what to look for in a good tool for X, how to compare between them, how to know if it is a good tool....

@TildalWave heh, naw, I'm great... hey, I'd leave it open, instead of modhammering it as soon as it gets reopened - that's a good mood ;-)

TildalWave

@AviD Yup I know, non-argumentative... define qualitative factors and such... problem is, most people might be having such requirements in their thoughts but fail to describe them... it's this texting culture that's killing use of proper sentences IMNDO

AviD

@TildalWave hehe, "IMNDO" :D

there are actually a few really good examples of those types of questions here, often the OP just doesnt have a complete picture of what is needed.

this is one of my favorites for that:

6

Q: Criteria for Evaluating Static Analysis Tools

As with any tools purchase part of the outcome is in how good the evaluation criteria are, so I'd be interested to hear any criteria people might use when assessing Security static analysis tools. Obviously the weighting on each criterion would be down to the individual companies priorities but ...

appsec tools code-review

Terry Chia

@AviD You know you only say that because yours is the accepted answer!

AviD

and this: (I happened to think of these two because I remember answering them, I'm not repwhoring I promise...)

4

Q: What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log Managment solution? What do you currently, or do you hope to derive from such a system? More inf...

network windows linux logging siem

@TerryChia hehe, see my simultaneous comment...

user2309720

can some one suggest me best room for linux or VM

TildalWave

15:27

@AviD well TL;DR your answer but +1 anyway, if you could think of so many qualitative factors that could be used in the decision making process, you deserve +100 anyway for completeness

AviD

@TerryChia besides, I just think it was well asked, thats the right way to go about a tool question.

Terry Chia

@TildalWave So, you have the case of Long Is Better?

@AviD Don't make excuses you repwhore you!

AviD

@TildalWave haha, dont know if its complete, but yeah I'd been through the process where it's not easy to figure out which product to go with.

TildalWave

@AviD blimey, enough already! I have limits to how many non-ordered lists I can process in a day!!

AviD

@TildalWave haha, semi-ordered lists.

TildalWave

15:29

@AviD even worse, can't employ my garbage collector for the already processed ones

AviD

> Looking over this, I think it's pretty much in the order of preference - starting from basic requirements, to applicability, to quality, to ease of deployment, to efficiency, to nice-to-have...

TildalWave

@AviD I think you need to post in meta how to order these properly

AviD

lol

TildalWave

@TerryChia I do have a case of longer is better, do you? :P

c'mon... I've served it on a silver plate for you

AviD

@TildalWave meh, too obvious. It's like you already said it.

TildalWave

15:34

@AviD with length, redundancy is king!

AviD

@TildalWave so you're saying, you're all about the double penetration?

Terry Chia

15:45

@TildalWave What @AviD said.

Damn, finally finished my implementation of RSA. The maths really gave me a headache...

Plus my code is godawful to look at... really need to go refactor it to something readable...

AviD

15:57

@TerryChia so's your face.

Terry Chia

@AviD Dammit!

TildalWave

@TerryChia Put it on Code Review and have guys there do that for you?

AviD

@TerryChia That's what she said. When she woke up the next morning.

TildalWave

oups, inconvenient butting-in, please continue

Terry Chia

@TildalWave Nah, that's no fun. :P Plus I think they might object to me dumping a few hundred lines of code on them.

@AviD Speaking from experience?

TildalWave

16:01

@TerryChia oh you drop a pastebin bomb on them

AviD

@TildalWave @Adnan maybe that's what a plastava is.

Adnan

17:00

@AviD hehehehe

user2309720

17:29

@RoryAlsop I've just watched your "starting your security career" and it is a so helpful and good guidance thanks a lot dude

AJ Henderson

18:10

@Adnan ah, makes sense

AJ Henderson

18:41

wow, 8 questions in the close queue

well, less now

since a lot of them were 4/5

Lucas Kauffman

19:21

gents

m'lady (if any)

Fitzroy

And lamas?

Adnan

@LucasKauffman Oh! You make me blush!

TildalWave

21:40

@Scott here you go... The Hunting of the Snark - An Agony in Eight Fits by Lewis Carroll (With nine illustrations by Henry Holiday) ;)

Rory Alsop

23:14

@user2309720 Excellent - that's the sort of thing I was hoping for :-)

D3C4FF

@RoryAlsop what's the video user2309720's referencing? :)

Rory Alsop

@D3C4FF The one here:

Stack Exchange Security Blog: Presentations: Starting your security career – where can you go?

roryalsop on March 28, 2013

I gave a talk on career planning in Information Security at Abertay University on the 16th of January 2013.

Securi-Tay is an annual security conference organised by students at Abertay and is a very well organised and run event – could put some professional conferences to shame!

Video of my talk

The talk went down very well, with a lot of discussion spinning off afterwards, and the odd additional visitor to Sec.SE

Most of the video should be straightforward, but a couple of the slides may be hard to read so I have included them here: …

2

D3C4FF

@RoryAlsop Ahh cool :D I'll give it a watch over lunchtime :)

Rory Alsop

@D3C4FF heh - you and your 'many hours' ahead status...I'm about to go to bed :-)

D3C4FF

@RoryAlsop Sigh. I'll be all alone again, in teh DMZ

Rory Alsop

23:22

@D3C4FF awww - @Terry'll be up though, surely

He's over your neck of the woods - ish

D3C4FF

@RoryAlsop @TildalWave as well (cause he's nocturnal/awesome) :P

Rory Alsop

@D3C4FF hahahaha

Fitzroy

Are all security experts called Rory and from Scotland?

2

Rory Alsop

@Fitzroy yes

D3C4FF

@Fitzroy Yes

Fitzroy

23:24

I see.

Rory Alsop

18

Q: The Memes of IT Security

There are memes common to whole Stack Exchange. But after spending some time in The DMZ it becomes evident that IT Security has it's own memes (e.g. rory). I therefore propose that this space be used to document the memes endemic to IT Security's culture. One meme per answer please.

discussion memes

Fitzroy

makes it easier i suppose. you know, for recruiting.

Rory Alsop

Or at conferences - at one we did end up having a 'Rory-track' :-)

D3C4FF

@Fitzroy Instead of writing "Looking to hire a profesional senior security consultant" They say "Looking to hire a @rory"

Doesn't waste as much ink see?

Rory Alsop

And I have worked with Rory M at 3 different organisations...

Fitzroy

23:32

@rory - i have watched your video. I have a slightly on-topic question that kinda relates to social engineering if you're up to it?

Rory Alsop

@Fitzroy erm, okay - as long as you are aware I have had a few gins and am on my way to bed, so if my answers are rambling I apologise

Fitzroy

@rory - ok its a very basic one. If you dont have self service password resets and the help desk are responsible for performing all resets, what's the best method(s) for the help desk to ensure that they are speaking to the legitimate user when perfomring a reset?

Not some imposter...

this is in a windows AD domain environment.

Rory Alsop

@Fitzroy There are a range of effective techniques used. Various companies have a requirement that you are vetted by two colleagues and each of them gets half a password

I quite like that one

Or you have a range of security questions which they can ask you - sometimes less useful, as these questions may not be that difficult (eg mother's maiden name)

Or they could call a specific desk number - so an imposter would have to be sat at your desk or otherwise spoof the number

etc

Fitzroy

@RoryAlsop - you mean call 'from' a specific desk number?

Rory Alsop

@Fitzroy no - have the help desk call you back on a number pre-registered with them

Fitzroy

23:42

@RoryAlsop i see - makes sense. I didnt fully grasp the split password idea.

@RoryAlsop how does giving two different colleagues half the password each work in practice?

@RoryAlsop or is that the gin talking?

Rory Alsop

@Fitzroy They each authenticate themselves to the helpdesk and each gets half a 1 time password. Then they tell you so you can gain access to reset the password - effectively they are acting as trusted/identified individuals validating your identity. It works well

Both corporates I have seen it work in are very slick and quick with it

but now I am going to my bed - early morning tomorrow.

night all

Fitzroy

@RoryAlsop night

and thanks

Transcript for