The DMZ

@Adnan It's been too long, so don't recall exactly, but the last time I tried it, it was around 50 hours. I was writing code the whole time. My primary take away was that even if you can stay away for that long, you can't write good code.

Adnan

@Xander Well, that won't be a problem for me. I can't write good code anyway.

Oh, and you smell bad. At least I do. I stunk like a dead horse after setting at a desk for two days straight.

Thankfully, I was single and working from home at the time, so there was nobody around to care.

Q: DEF CON CTF 2013 qualifiers: 15–17 June

Btw, CTF solutions are up

6

DEF CON CTF 2013 qualifiers will start on Saturday, 15th of June 2013 at 00:00 UTC, and will last 48 hours until Sunday, 17th of June at 00:00 UTC (so midnight to midnight throughout the weekend). Web stuff won’t just be simple baby’s first SQLi this time. It’ll be hard, it’ll be related to r...

@Adnan Y U NO CTF?

Adnan

@ManishEarth A- I suck, B- Absolutely no time. The little free time that I get I use it for food, sleep, and sex.

D3C4FF

6:46 AM

@Adnan Why dont you just penetrate computer systems instead?

Will penetrate for food

@Adnan I can say with authority that I suck more: I still solved 1 challenge on my own and 2 more in collaboration

7:14 AM

@Adnan that's what she wanted to know.

@Adnan you should look into the uberman cycle, or at least some form of polyphasic sleep schedule.

Polyphasic sleep

Polyphasic sleep, a term coined by early 20th-century psychologist J.S. Szymanski, refers to the practice of sleeping multiple times in a 24-hour period—usually more than two, in contrast to biphasic sleep (twice per day) or monophasic sleep (once per day). It does not imply any particular sleep schedule. The circadian rhythm disorder known as irregular sleep-wake syndrome is an example of polyphasic sleep in humans. Polyphasic sleep is common in many animals, and is believed to be the ancestral sleep state. The term polyphasic sleep is also used by an online community that experiments with...

if you have to stay up, at least take 20minute naps every few hours.

and dont try driving...

D3C4FF

@AviD Seconded :)

A: What servers or clients are immune to related-domain cookie attacks? (*.example.com)

7:38 AM

@AviD Spam flagged.

-1

Domain name is something that helps in searching a website. It is a way to reach to website. Domain name is something that helps in making a website popular. Website plays a very important role in business these days. Without website it is impossible to reach out to the world. Website can be sear...

@Xander spam handled.

@AviD Thank you sir. That's what I call speedy service. :-)

@Xander thaaaaat's what she said. Dammit.

@AviD LOL...I suspected that might be on it's way.

@Xander that's what she said!!

7:41 AM

@AviD Fixed it. ;-)

lol, thanks, make me look like an idiot ;-)

I thought we were going to go on like this for a while... I feel like it ended prematurely.

;-)

@AviD Hey, I used the wrong form of "its" in my haste, so I look like just as big an idiot

hahaha

@AviD That's what she said!

All right, there you go. ;-)

8:21 AM

Woop woop wind tunnel time

8:45 AM

what do turtles eat?

been hearing some noises out back.... turns out a turtle come to visit, been scratching at the back door. Now its hiding behind the hose.

real wildlife here, eh...

►

11:54 AM

Possibly afternoon - I've been De-synced ask weekend

Morning all. I'm back!

@RoryAlsop y u no ctf!

Also, welcome back!

@RoryAlsop How many pings did you have? :P

12:13 PM

Hello.

12:48 PM

Many. Many. Many pings.

No ctf because I was watching QotSA, Alice in Chains, Rammstein, UFO, Nekrogoblikon, Turisas, Mastodon, Iron Maiden... and many more

@Poly - you would definitely enjoy Nekrogoblikon!

@RoryAlsop I think about half of it is that jerk @AviD dissing your age.

Morning gents.

Good afternoon Simon

Also, no gals here. Or was that a "gents (m/f)" :-)

@Hennes No girls here except for @Iszi.

I got lazy, I usually type ladies & gents.

12:57 PM

That is just wrong. I realise that we might not get a 50/50 divide, ut with 10 active people there should be a few.

otoh, it might be wise for those to pretend to be guys since the internet has lots of stupid people.

Ladadadada

Are we going to have to send Scott Pack around to test everyone?

I don't know but he's definitely the right person to do it.

@Ladadadada I think we are going to need SE to sponsor the air tickets. Some of us live pretty far apart.

Maybe make a meta.SO question about it?

Blog - Stack Exchange: Supporting Community Conferences

@TerryChia meta.SecSE

Jeff Atwood on August 03, 2011

One fun way to promote your community is to consider what upcoming conferences, seminars, conventions, events, or meetups appeal to your community and represent an opportunity to attract new, high quality users who love this stuff as much as we do!

There are a bunch of ways the community team can support your events; to date we’ve done the following.

One simple method of promoting your community is to have a one-page color flyer available to hand out to interested folks at events. We’ve created a few of these already, both for public sites and for beta sites: …

@ManishEarth That can work.

Do our site moderators agree? @AviD @RoryAlsop @JeffF.

1:08 PM

And poke mods to ping comm team

What conf is this?

8 mins ago, by Ladadadada

Are we going to have to send Scott Pack around to test everyone?

Oh cmon, you thought I was serious?

I didn't know what you folks were talking about :P

I thought it was a conference

oops :P

@ManishEarth Gender Verification Party! Bring your PGP keys!

lol

wotcha @RoryA

you read all those pings already?

@TerryChia hey, 4 years is a big deal! Or something like that...

1:12 PM

@AviD Are you from Tennessee? 'Cause you're the only ten I see.

@Simon ouch.

@AviD I think I'm gonna put together an answer for the meme's question. Any idea when it originated?

@TerryChia what?

@AviD @RoryAlsop's age.

@AviD One day, I will use this pick-up line for real.

1:14 PM

@TerryChia loooooong time ago. isnt there a memeanswer there already?

@AviD Not specifically about the age part.

@AviD Of course it was a long time ago, he's old...

G'day Bruces and Sheilas.

@Bruce!

Morning Americano.

1:18 PM

Shush you! I am not watered down espresso.

@ScottPack You're definitely the right man to check out the gender of SE members.

So's your face?

Q: DEF CON CTF 2013 qualifiers: 15–17 June (ended, including write-ups!)

6

DEF CON CTF 2013 qualifiers will start on Saturday, 15th of June 2013 at 00:00 UTC, and will last 48 hours until Sunday, 17th of June at 00:00 UTC (so midnight to midnight throughout the weekend). Web stuff won’t just be simple baby’s first SQLi this time. It’ll be hard, it’ll be related to r...

discussion ctf

if anyone is interested in write-ups ;)

I'm interested in the RE ones

Already read yours :P

@ScottPack Why do you always have to hurt my feelings?

1:24 PM

@Simon didn't follow, but that's relatively redundant question for @ScottPack :P

There ya go:

0

A: The Memes of IT Security

Meme: @RoryAlsop's age. Originator: @RoryAlsop. He was here before any of us. Cultural Height: 1391 BCE Background: @RoryAlsop is one of the older guys that hangs out in The DMZ. Some of the younger guys started making fun of his age especially when he started reminiscing about the good old d...

@Simon I'm sorry baby. I only hurt you cuz I'm afraid of losing you.

@TerryChia there's quite some memes missing there, wanna add a few? or should we make a new post on memes of DMZ?

@TildalWave Just add them to the question. :P

@ScottPack <3

1:26 PM

I think "Mellon" just about qualifies.

@ScottPack That's so John Lennon-ish of you

@Simon did he... press your buttons? ;-)

2

@TildalWave More Bobby Brown

@TerryChia dammit, half that post was my comments... ;-)

@ScottPack Oh, thought it's the Jealous Guy in you :)

1:27 PM

(most of them stolen from carlin)

@AviD I had to document them somewhere. ;)

@AviD Awwwwww yeaaaaaaah

@TerryChia c'mon I had some good ones for that too

@TildalWave Add them in. ;)

They have been rather good. They got me over to SF for b-sides and RSA in 2011. Not sure whether they'd do that for Scott to gender-check everyone. I think we work more on the Web of Trust idea. I can verify other Rorys, @poly, @avid and a couple of others, @rorym has a couple more. In time I'm sure we can validate the entire community (getting everyone with a Rory number of 4 or less would be cool)

1:30 PM

@TerryChia when I find some LOL

Does the Rory matter when calculating one's Rory number?

@ScottPack The Rory always matters.

Because, frankly, I don't care which Rory buys me a Manhattan.

1:43 PM

@TerryChia added I few I could find, only one of mine tho

I like that tag link... 0 questions tagged older than @RoryAlsop :))

yknow, at some point @RoryAlsop will get fed up with these types of jokes.

And then @RoryAlsop will get out of his rocking chair and chase us with his walking stick.

5

►

Y'all have prolly already seen this, though

@ManishEarth Yup. :)

Heh, I am still doing my baby first steps.
Trying to figure out how cache poisoning works with HTTP splitting.

@scott - you're on.

@avid - nah, by that stage I'll have a servant to do that for me:-)

1:58 PM

@Hennes oh yeah, thats not as simple as most web attacks.

It is the second lesson in webgoat.

I've noticed that the bit that often gets left out, and thus confuses, is that whereas the usual layout is victim -> webserver <- attacker, with HRS you need to remember that there is a proxy in between, and that is where the attack is mounted.

(or rather, between the proxy and the webserver.)

Yeah. I did not figure that out yesterday after midnight.

owasp.org/index.php/Cache_Poisoning

it is a very indirected attack, it does require some abstract level of thinking.

As I understand it (possibly wrong!):
1) Clear the cache in the proxy (pagma: nocache)
2) Request a document using http splitting to insert a last modified in the future
proxy remembers the last modified in the future

then do something with a 304 not changed

2:05 PM

well, yeah kinda, but you skipped over the actual splitting part.

point is, attacker requests page from a.com, splits it so that the bage from b.com is cached on the proxy for a.com. the last-modified is just details.

(URI encoded ofcourse)

Somevalue%0A%0D%0AContent-Length%3A%200%0A%0AHTTP%2F1.1%20200%20OK%0ALast-Modified%3A%20Mon%2C%2027%20Oct%202070%2012%3A00%3A00%20GMT%0AContent-Type%3A%20text%2Fhtml%0AContent-Length%3A%2034%0A%0A%3Chtml%3EPage%20from%20the%20future%3C%2Fhtml%3E

SomevalueBR
Content-Length: 0

HTTP/1.1 200 OK
Last-Modified: Mon, 27 Oct 2070 12:00:00 GMT
Content-Type: text/html
Content-Length: 34

<html>Page from the future</html>

from then on, whenever someone requests a.com, the b.com is fetched from cache.

I am sending this value as a language selection in an unvereified input field:

gorrammit. Does anyone here have experience configuring AD CertServices?

specifially autoenrollment.

Q: is it possible to sniff email content inside network?

0

I am working in a IT company.I am using LAN for all internet activities.I send some email from my personal gmail account .My network administrator sniffed all email i send from LAN and he shows the email to me. I am sure no software installed my system and i used https to send email.How network a...

email sniffer

It has to be a software installed on the system, right?

2:27 PM

@Hennes not sure if that was intended for me, but with cache poisoning I usually wonder the opposite... cache is extremely difficult to invalidate properly, if the requests/responses are structured... I was working on my code (to cache stuff, not to abuse it) probably for half a year on and off, and I'm still not sure it's always safe

I mean sure it's easy to invalidate it safe... you just don't use it much then :)

@Adnan If I had a million dollars, I'd buy your love.

I love your answer.

2:47 PM

@RoryAlsop I missed International Rory Day! I'm so very sorry. :(

2:57 PM

@scott ;-p

I just realized what day today was.

Do @Rory and @Rory share a birthday?

@RoryAlsop You owned Subaru's and never blew-up an engine?

(today?)

wait I prolly can find out myself

Huh, they don't

@ScottPack There's an international Rory day?

3:01 PM

@RoryAlsop happy birthday btw :)

@AntonyVennard Of course. How else can we appropriately extol the virtues of our Scottish Overlords.

5

@AntonyVennard Apparently @RoryAlsop's birthday is International Rory day

@RoryAlsop Damn, happy birthday! You are what, 900 this year?

When 900 years old you are, look as good, you will not (Yoda)

@TerryChia That was last year.

3:03 PM

►

@AntonyVennard Cmon, do you really need to attribute that quote?

Rory Alsop, Scotland, United Kingdom

2k 7 21

astronomy planets rocket sun gravity moon earth

Check his age

@TerryChia Yes. For some people (Rory), Yoda is one of those newfangled ideas us youth have.

@ManishEarth hehe

@AntonyVennard Nah, I think they grew up together.

System doesn't seem fond of him :P

3:07 PM

Never blew up an engine @simon. Clutches, brakes, yes, but the engines are sold up to about 500bhp. They only get flaky above that, or with NOx

And thanks guys- yes, am officially the answer to life the universe and everything! Just for traditions sake I wore the same leather jacket I wore on my 21st birthday, when I went to see Guns n Roses, Soundgarden and Faith No More.

@RoryAlsop I see. Every single STi/WRX here seems to not go past 200k km. I'm still looking to buy a 2.5 RS but I'm not sure if I should get one with ~180k km. I'll definitely get a compression and a leakdown test though.

@Terry - the cheek of you youngsters. Tut

@RoryAlsop You're all hot for Empeg, right?

@RoryAlsop Happy Birthday!

@Polymorphin I'm unaware of any equivalent addon for Google Chrome. Perhaps others know something. — Adnan 24 mins ago

@Adnan - I've been searching for something similar for Chrome just a good week ago - no luck :(

@RoryAlsop hehe good old days eh? Happy birthday!

3:19 PM

Incidentally: blog.feedly.com/2013/06/17/…

@Adnan - If you don't mind, that end of first paragraph is IMO a bit awkwardly written. Most commonly such transparent proxies / routers / whatever would still serve perfectly legitimate pages, just replacing the certificate to make whatever they're intended to do actually doable... but sure, you wouldn't know if it's also replacing something else than just certificates

@simon - where you based? In UK try Litchfield in the Midlands. That's where I got my slightly silly forester sti.

@RoryAlsop Canada :P

@scott - Oh yes. You know it? Best car stereo yet invented.

@RoryAlsop A co-worker wants what amounts to be a Android based stereo/media server for his car. Empeg was the only thing I could really think of that was similar.

3:25 PM

Well, it's a full featured debian, but yeah. Empegbbs.com is the place to go - there is a for sale section on the board

I have the now - one on SSDs, one for my office and one with two half terabyte drives for my main collection

@simon - dunno what the import market is like there:-)

@RoryAlsop I should be able to get a semi-clean one with ~180k km for 4k. But I really hope the motor won't blow up after a few months. I'd love to do some snow lapping this winter.

Yeah. Check the turbo and head gasket for signs of being abused. And look at the service history for clutch replacements, possibly expect two replacements by that age.

@ScottPack Thanks for the heads up.

@RoryAlsop 2.5 RS is N/A so I'm fine. I don't really wanna get a turbo because I bet it's gonna end up costing a lot. Head gasket is definitely their prime weakness. 2 clutch replacements? I didn't know that, thanks.

Certainly up until the 05 or 06 you'd expect a replacement between 75 and 95k. The clutch is really only weak spot.

They got updated a bit more recently

Most of mine have been turbos. It is quite cheap to get 500bhp with a turbo

3:38 PM

I'm aiming for the 04-05 model so I'll definitely need to look into that. I'd rather get a clutch job done than a tranny/engine one though.

Don't you need to forge the engine at like 400?

Oh, brake horsepower, probably even less than 400, no?

only thing worse than when nothing works and you don't have a clue why, is when all of a sudden everything starts to work again but you don't have a clue why.

not worse, better.

@simon, no. The engine block itself needs nothing at that level. To go from 300 to 400 is mostly ECU, inlet and exhaust flow

@AviD I think that depends heavily on what's counting on you getting it working.

@ScottPack yeah, exactly. on the one hand - if it aint broke, dont fix it.

@RoryAlsop Man, 500 bhp on an AWD is serious business.

3:42 PM

on the other hand, since you dont know why it started working right, you dont really know it aint broke, but you dont want to break it again.

@AviD It's a rather unsettling feeling.

@simon - mine still has a small way to go before I hit 500, but I like the fact it is still my daily commute and can take the whole family camping off road:-)

@avid - agreed. Need root cause to be confident it is fixed

@RoryAlsop Gotta love Subaru :)

@RoryAlsop Any maintenance I should do as soon as I get it? So far in my list I have: oil change, spark plugs, fuel filter. Maybe a coolant flush?

4:06 PM

They will be the main engine ones. Would get a good look at brakes and shocks (sti shocks can get a bit worn) and maybe check strut brace points

Ok, thanks.

There's a 02 with 230k kms for sale for 2.9k. It might be suicidal to get one with that many kms though.

Take it for a good hoon anyway. See how solid it feels. I recently sold my old 00 with 180k on it for a few hundred quid. Structurally it was fine, it just needed a couple of grand to replace all the worn bits, so you may find it could be okay. Check everything on it though:-)

4:23 PM

@RoryAlsop Definitely. There's a tuning shop not too far away from where I live that specializes in Subarus. I've been there a few times with a friend of mine who has a tuned 2011 STi and they know their stuff. I'd get it inspected there.

4:41 PM

fucks sake think I bruised a rib

You weren't down the front at Rammstein too were you @Lucas?

@RoryAlsop nope I was at 3500 ft when my canopy decided to decelerate me from 136 mph to 20 in 0.5 of a second :(

(normally this takes up to 5 seconds)

Oooooof

that's what I said

That slows down the opening

How come it went so fast, thought you had that regulator thing

4:56 PM

don't know, maybe I didn't decelerate enough before opening, I've had it once before

that took out my shoulder for 4 weeks

I packed it myself and didn't do it any different than normally

@LucasKauffman Too bad it was the canopy and not the platform.

@ScottPack I love you too.

yesterday, by AviD

Everyone here would do well to remember the 1st rule of StackExchange: BE NICE.

How was that not nice?

And when have I ever been not nice outside of chat?

I CALL SHENANIGANS!

5:12 PM

@ScottPack I have not met you out of chat

We're folks being not nice while I was AFK? Willlook at transcript once back home. Only another hour or so on trains. ..

@RoryAlsop I think @LucasKauffman was whining about my sudden stop comment. I think he's just missed me.

One does not simply miss @ScottPack.

Here you go. Now try again.

memegenerator.net/One-Does-Not-Simply-A

3

5:24 PM

Better

5:40 PM

Lovely:-)

6:09 PM

Woo, my last week of work!

6:20 PM

Yesterday, I received my new credit card because my other one expired. I was so happy when I saw the PayPass icon on it, woohoo! Sigh.

Jeff Ferland

@RoryAlsop You have a 500 bhp car? ^.^

That explains the speeding tickets.

Hey, anybody coming to DEFCON this year?

4

6:57 PM

wow, so this is possibly the worst piece of security I've ever seen. There's a hosting panel application called zamfoo (commercial software) which to upgrade, you go to an unencrypted form on their website, fill in your root credentials for your server and they login and upgrade it! zamfoo.com/updatezamfoo is the form

We do not store any passwords, account or host information and this code set is checked on a daily basis for any potential compromises.

See, it's really secure!

@RoryMcCune Yeah, that's crazy.

yeah that and I saw that page from this thread webhostingtalk.com/showthread.php?t=1275572 where the vendor threatens security researchers who were trying to help him

amazing that people like that can make money off software

@David Heh. I am counting down to an interview and hopefully my first day of work. (well, first in a while, not first ever). Now at T -42h

@RoryMcCune Do you agree with what the OP is doing? (Releasing vulnerabilities to the public)

7:08 PM

@Simon well he seems to be following fairly responsible disclosure procedures (and indeed by the end of the thread hadn't released it from what I read someone else found the vuln.)

ideally I'd say that researchers should never have to release PoC's, vendors should fix things in a reasonable time

unfortunately where vendors choose not do do that experience has shown that PoC's speed things up

@RoryMcCune True. I've only gone through the first 2 pages so far.

so unltimately there's a fine balance which gets called "responsible disclosure"

He probably got scared of the lawsuit.

I've heard that Google have recently moved to a 7 day model for releasing things they find.

@Simon possibly but I doubt it, vulnerability/PoC disclosure is protected as far as I understand it, there's not been a successful prosecution for it that I'm aware of.

otherwise the metasploit guys would be in a lot of trouble :)

@RoryMcCune I see. But to make sure I understood correctly: if an application mentions that you cannot conduct any tests, wouldn't the PoC make it illegal?

7:15 PM

@Simon well it could be a breach of Terms of Use, so they could revoke your license but I doubt it's a criminal offence...

@RoryMcCune Interesting, thanks.

@Hennes nice

i'm only part time, so its just 3 days (15 hours)

I am on sabatical (for 2 years now, I intended 1 year)

But getting a fun new job is hard these days

However I seem to have found two. The T-42h hours in the 3rd interview with one.

The week after I got a second interview as junior security consoltent job

Which is stuff I am not yet good in.

Hence the 3-6 hours / day behind webgoat.

hehe

consultant* =P

@jefff - I don't use it to go very fast unless I am on a track. But it gets to speed very very quickly. It's motorbike quick acceleration. And it isn't 500bhp yet...

7:21 PM

might wanna make sure thats spelled right on your resume @Hennes ;)

@simon BTW from reddit.com/r/netsec/comments/1ggu3p/… apparently the 'exploit' is GET /cgi-bin/zamfoo/blah?date=this_runs_as_root

@RoryMcCune That's it? Oh god...

@Simon sounds like it, if that's true I can see why the researchers were so annoyed at him not fixing it

that's pretty trivial..

I know. I used to call them insultants

But the firm looks nice. Good people working there.

And the job looks interesting.

@RoryMcCune So basically, it's a kind of injection. Wow.

7:24 PM

@rorym - that is spectacular

...ly bad

yeah that vuln and that upgrade manner suprised even me and I thought I'd seen a fair amount of bad security over the years...

I agree that 2 weeks should be plenty of time to fix it.

7:40 PM

The first breach costs you an arm.... Where does this quote come from?

mmm tempted to run a google dork

but that would be illegal :(

googles what a google dork is

Interesting.

@Simon Me.

@ScottPack Oh you.

3

7:46 PM

Haha

I'm watching this documentary about the battle of marjah, 5 year old smoking cigarettes telling american soldiers they are motherfuckers and that he is bad ass and not afraid of the Taliban. This kid should have its own meme

@JeffFerland I'm visiting @Terry then, but I've got two colleagues coming in

I think I'm gonna launch a website to manage Scott Pack's fans. It will be known as the Official Scott Pack Fan Club.

The account ID 1 will be Scott Pack and SQL injection will be possible. Therefore, everyone will be able to know what it feels like to be @ScottPack for a brief moment.