@PatoSáinz Ah, I forgot to give you my input. I really liked the author's perspective but I'm not sure if the fake hype that was built is the only reason why the track is popular. It is a dick move though.

@tylerl @PatoSáinz Perhaps relevant.

Ahhh, Game of Thrones is back!

so, believe it or not, I think I'm settling on KDE

it sucks much less than it did 8 years ago

@tylerl I've been hearing that they'd largely fixed the mess that was KDE4

Morning all

anyone up late compiling OpenSSL?

@TerryChia Well well well, it says "This bug was independently discovered by a team of security engineers (Riku, Antti and Matti)". Those are all Finnish names.

@RоryMcCune Yuuuupp

@RоryMcCune Which version are you installing?

@Adnan Has anyone verified that information?

@Adnan Probably a good call, there's scripts doing the rounds which can dump memory already

@TerryChia Which information?

and I've seen tweets that getting cookies from memory is v.easy

@Adnan That those guys discovered the bug independently.

@Adnan luckily I don't have any production SSL servers :)

Best I can tell the only mention about that was on a site they created.

@TerryChia you could try this

s3.jspenguin.org/ssltest.py

on a server with known vuln version

no idea if it's good/bad/malicious

@RоryMcCune Nonono, I meant if those three guys actually discovered the bug.

@TerryChia ahh

I C

The official OpenSSL report credits a guy from Google.

@TerryChia well then the guy from Google should've got himself a catchy sounding domain name

'cause everyone's calling it heartbleed now

@RоryMcCune Heh, @tylerl says it best.

@TerryChia Also I shouldn't post till I've had coffee :oP

@TerryChia Seems like they are indeed from Google Security

2014 will be known as the year of SSL fails.

@TerryChia heh true, although SSL vulns do have a history of catchy names... BEAST/CRIME etc

I think it's 'cause crypto is inherently very boring :op

@Adnan No, those three guys are from codenomicon.com

@TerryChia They participated at codenomicon.com. The news says that they work for Google's security team.

I don't see how those things are mutually exclusive.

@Adnan Errrr no.

Anything I'm missing?

> This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon and Neel Mehta of Google Security, who first reported it to the OpenSSL team.

That's from the site those guys put up.

@TerryChia Fick!

So only the last dude is from Google Security

@Adnan Yes. You need more coffee me thinks.

@TerryChia I should start drinking coffee

have I heard coffee?

yes please, I'll have a café latte.

and a muffin with chocolate

@TerryChia Found the first dude linkedin.com/pub/antti-karjalainen/24/802/526

Found the second dude linkedin.com/in/rikuhietamaki

aaand found the third one linkedin.com/pub/matti-kamunen/2/417/3a3

@kiBytes hey no chat about chocolate muffins in here, I'm on a diet :op

@RоryMcCune Diets are meant to be broken.

Interesting interesting. They're all 3rd degree connections on LinkedIn

@TerryChia hey young person just you wait till the weight stops dropping off so easily and you'll realise the importance of the odd diet...

@Adnan You find LinkedIn connections interesting. Are you going to quit your developer job and go into HR management?

@TerryChia Hey, man. I'm a great bullshitter. That's quality HR manager material right there.

Well, I've just sent an email to Neel Mehta to see what's going on.

@Terry - that you talking about me again?

@RoryAlsop Oh no, I'm mocking @Adnan this time. I see you are touchy about the subject of HR management... ;)

@TerryChia it's because he feels the draw of his true calling :op

@RоryMcCune HR management is so much sexier than being a rock god.

@TerryChia ... I'd heard about different countries seeing things differently but wow!

@Terry - erm.... nah

RoryM - it isn't my true calling, but before interviewing 90+ candidates last year I did enjoy the people aspects of this job :-)

...actually, I still do - I have hired a good team

@RoryAlsop 90 interviews... I think my intelligence circuits would've melted!

@RoryAlsop you sure you aren't in HR?

First 5 questions I saw when I went to the site were about Heartbleed..

Rory - my cynicism about what people will put in their CV compared with what they can really do now has no bounds!

I mean, I know the Linux command is safe, I just wasn't sure about the submit box... I guess I coulda just checked the source.. =p

@RoryAlsop Rly, I just can't understand why people do that, they'll get caught at interview!

A guy who just interviewed me said he had that problem with the previous people he interviewed..

like five in a row

readytogo.microsoft.com/en-us/Pages/timeforchange/partneremail/…

1 h 35 mins!

Hahahaha - I like that. The countdown to the end of the world

The Countdown to "Oh crap, shit, dammit, WHY IS EVERYTHING BROKEN HELP US WHYWONTYOUHELPUSNOOOOOOOOOOOOOO!"

hehehehe - or the global corporates approach: and this is a problem, how? They will get upgraded on the next refresh cycle

Heh. Heheheh. Heheheheheheheheh.

it's sad, but true

That reminds me - need to listen to more Metallica this week

Phew, finally converted my resume from .docx to markdown.

Is there not a tool for that?

Plus - who uses docx ? :-)

@RoryAlsop Converted as in rewrote :) I last touched my resume a year ago I think so it needed updating anyway.

Now I can generated shiny HTML and PDF files with make.

@TerryChia Sweet!!

I think I'll do that as well.

y'know, for proper dev houses :-)

@RoryAlsop Why do I need the raw .tex files if I'm using markdown? :P

because .tex

Us neckbeards love latex

It's also up on Github because hipster. :P

lol

obviously I meant LaTex :-)

@RoryAlsop Righhhhhhhhhhhhhhht.

Hmm, pandoc is amazingly flexible. I can apparently generated .tex files from markdown as well.

@RоryMcCune Ruby dev?

@deed02392 yeah I write scripts to automate test stuff, and some little rails apps as well...

Oooh. Have you played with Chef at all?

@deed02392 What's with everybody and Cheff&Puppet these days?

Why a good old .sh script isn't good enough anymore?

I need to make a post on the CMV (Change My Views) subreddit

Imagine trying to manage changes to 10s of machines at a time with .sh scripts

when you could just redefine their roles and have them automatically determine the appropriate delta

@Adnan Puppet (and I think Chef) is declarative rather than imperative. That's the primary difference.

@deed02392 not yet, although definitely on my list of things to look at:)

@RоryMcCune You bought RubyMine?

@TerryChia indeed I did

Nice. :) I have a free license for IntelliJ myself.

if I like something/it's substantially better than the free stuff, I think it's good to buy a license

@TerryChia ah delights of being a student !

@RоryMcCune Nah, students gets discount. I got the license from contributing to FOSS projects. :P

@TerryChia oh. it's cool they do that.

JetBrains is really nice about giving FOSS projects licenses.

I bought Pycharm of em, best IDE ever

@LucasKauffman Ehh, write some code for github.com/pyca/cryptography and I'll give you a license for IntelliJ. :P

@TerryChia ooh interesting

HAH!

OpenSSL opsec #fail

@TerryChia Awww man!

the CVE says up to 64k is leaked, only 16k in that heartbeat response

so what are the variables that define how much is leaked?

@deed02392 I guess it's just that the vulnerability has the potential to leak 64kb. That particular exploit managed to trigger the leakage of 16kb.

@Adnan I see. I guess I want to know how it works technically, is there a geeky write-up?

oh here we go blog.existentialize.com/…

@deed02392 blog.existentialize.com/…

:D

Ninja!

@deed02392 You know what's scary about that bug? You want to read another 64k of memory? Just send another packet!

@TerryChia Is it not likely to be the same 64k each time, though?

@deed02392 @TerryChia I've just tested on one of the company's servers. Two requests, different responses

Christ

I don't know about this. All I see in the responses are stuff that you expect to see in normal HTTPS connection exchange

@deed02392 No(forgive me if I'm wrong), that dtls1_process_heartbeat() function parses a different ssl3_record_st struct each time.

well if you want a list of starter targets

shodanhq.com/search?q=openssl%2F1.0.1

which is another good reason not to leave full headers on :op

@RоryMcCune Hah!

That won't work for distros like RHEL though.

@TerryChia Ah, then yeah it would be a different random 64k of memory each time

They backport security fixes without incrementing the version number.

@TerryChia do they auto-get rid of that info? If so , good stuff

@TerryChia ah true

but today it would work as they don't have a deployed fix

But RHEL's OpenSSL is broken in a whole different way.

@TerryChia @RоryMcCune @deed02392 Any of you guys managed to extract anything that you're not getting in a normal interaction with a browser?

No EC support at all.

@Adnan Ehh, I'm not actually playing with the bug. :P

@Adnan TBH I've not tried directly yet...

I don't have a server I can test on legitimately and I didn't feel like setting one up in a VM.

I've been trying for the last hour. Nothing of value

@Adnan Not tried it myself either, just reading the code atm

However, which I found scary, in one of the responses I received the content of a page behind LDAP authentication

Very highly classified business material

Just there in the response

@Adnan Sure

Yup yup.. I'm starting to get stuff. No keys, though. Dumps of data from password-protected pages.

any 64k near where the SSLv3 struct is in memory

repeat the request until you find something interesting

That blog posts makes sense though, you won't be getting anything from memory allocated before the struct because of the way the stack grows on x86.

Oh yeah, just got a bcrypt hash of one password

Review please?

What the hell?! You can get SQL queries with this?

@TerryChia Although he implies newer malloc implementations won't necessarily work like that

@Gilles Finally, a post that doesn't copy stuff verbatim from other sites. Thank you!

ie memory already allocated might actually exist in space after the struct

@Adnan Anything in memory is fair game.

@deed02392 True.

@Adnan I used what I read of course, but I tried to summarize (from a “typical” Ubuntu user's perspective)

@Adnan Having fun? :P

@Gilles That looks good to me.

@Gilles Yup, and that's what I liked about it. The posts we have on Sec.SE about it are just rep-whoring devoid of any actual contents.

I don't want to be too alarmist (the bug has only been in the wild for a few hours after all), but on the other hand the accepted answer said “upgrade and you're fine”

This bug appears to be the biggest one affecting SSL implementations this year.

@deed02392 Dear Jesus! Lots of stuff.. lots

@TerryChia this year? Got any more serious one from 2013?

Even worse than goto fail and the gnu/tls one.

yeah, dumping memory to any unauthenticated client is a big deal

Any idea what Cloudflare uses?

@Adnan Ehh, three major SSL bugs this year already.

@TerryChia I think this is the biggest one in 2014 and 2013.

has anybody managed to actually learn a private key with that attack?

@deed02392 Cloudflare got prior warning about the bug and pushed a fix before it was officially announced I think.

@Gilles Perhaps your answer should suggest taking servers offline but not shutting them down, so that you can take a process memory dump and use that to identify what could have been leaked

@CodesInChaos Currently, running the exploit in a loop and parsing through the responses. So far, no keys.

@TerryChia Ah, lucky them

@Adnan Biggest one. So far. dundundun.net

However, it's clear that you can get things more important stuff than the keys.

@TerryChia That was humerous

So far, I've got passwords and business code

@deed02392 Is there much point in doing that? A lot of memory might have been recycled since the potential exploitation

I have just retrieved cookies of currently logged in users.

Set the cookie in my browser, I'm now using their session

@Adnan Ugh, preventing that kind of attack is so trivial

what framework are you using?

@deed02392 Framework for what?

whatever covers web authentication

@deed02392 I don't know man, I don't manage that server.

Ah fair enough

Pretty insane vulnerability

@deed02392 ? How can you prevent someone from logging in as you if they managed to grab your session cookies?

@TerryChia Least you can do is pair with the IP

@Adnan Which usually causes more trouble than it's worth. You can't really assume the IP of a user stays fixed.

@Adnan What @CodesInChaos said.

@CodesInChaos Sorry, the least you can do is regenerate the session regularly

Second, is pair with the IP

@CodesInChaos @TerryChia I disagree. Security (all security) is contextual. In the context of our application, it's perfectly fine to pair the session with the IP

Just because in theory something doesn't work in some cases, doesn't mean that you it wouldn't fit other cases.

I wanna see if the cyber security company I want to work for is vulnerable

might impress them into offering me a job?

Yes, I can see some situations where assuming a fixed IP is bad. However, in most cases, assuming a fixed IP for the short life of session is perfectly fine.

> So, hey. I tried to illegally trigger a vulnerability in your systems by using a 0-day exploit. Gimme a job?

@Adnan depends how long the session is and what kind of connectivity the client has (wifi-hopping on mobile?)

@Adnan it's not a 0-day anymore

Damn it @Adnan, I want a cyber security job

Aaaand we have a winner

....-----BEGIN RS

God damn it! The dump ends there! Uggghhh

It might as well be a public key.

Hmm.. but the stuff before it don't seem to be part of an SSL handshake

At least it's only an active attack

The worst issue I can remember is still the Debian disaster.

@CodesInChaos The RNG fail?

yeah

What would be an appropriate 'safer language' if OpenSSL were to be rewritten/

I don't think there is a good choice.

Most safe languages us a GC which rules them out in many situations.

Rust looks really good but I don't think it will be stable enough for another few years at least.

There seems to be some work on using a static analyzer to prove the absence of certain bug classes in polar ssl.

Hmm

@Scott I just found a LinkedIn URL in a Coursera profile for some random dude who answered one of my questions there. I clicked it, and guess what? He's a 3rd level link through that Jesper dude

anyone know anything about working for nccgroup.com/en

@deed02392 No idea, but their website makes me want to work for them.

Sounds good then, they are recruiting and I was asked to send a CV

@deed02392 How did they find you? School?

@Adnan Nah that cyber security challenge event

@deed02392 yeah I've worked with them

worked for them for a year and a bit. Liked it, they were cool

@TerryChia You were at SyScan2014, right? Did you see the MPOS presentation?

@RоryMcCune, what did you think? I'm thinking of applying for them in Leatherhead

@copy I caught about half of it.

@deed02392 you could do a lot worse (IMO) than work for NCC :) I was based out of the manchester office nominally, but usually home based

@RоryMcCune Hmm sounds awesome then

wouldn't mind living near London

my most promising leads on a new job are GCHQ and NCC

@deed02392 Oooooh GCHQ.

@TerryChia Was it interesting? I'll likely write my bachelor thesis about MPOS applications

Go for that, then we can start mocking you.

@TerryChia Haha

@copy I missed the important bits I think (had to go do volunteery stuff).

But it sounded pretty good from the intro.

@deed02392 ooh spook job. Would likely be interesting, but AFAIK they don't pay well, but that said if you get DV clearance via GCHQ work you can do very well in consultancy afterwards :)

I see that the slides from that particular presentation isn't up yet.

@TerryChia Yeah, too bad. I've asked for the slides

I think they got a flappy bird clone running on a MPOS so there's that.

@RоryMcCune Gloucester is quite a cheap place to live too, I'd probably end up just as well off as the job in Leatherhead

@deed02392 AFAIK this is the director at the Leatherhead office twitter.com/iseezeroday

Ooo. Follow request sent

and I think in that office this is resident in the breakout room

well it's either that office or one of the other ones around that way...

@RоryMcCune Are you the dude on the left? :p

@Adnan heh I'm neither of the dudes in that pic, I don't work for NCC :)

nabbed it off twitter

@Adnan That guy is waaaaaay too young. :P

I think they're doing guerrilla hiring by showing pics of cool stuff

@deed02392 Wanting an IntelliJ license are we? ;)

@TerryChia are you offering? It does look good

@deed02392 Heh, I saw your PR on the project. :P

@TerryChia Haha, I didn't even bother mentioning it to you as it was hardly anything substantial

@deed02392 Well, I'm now writing a cover letter for positions in places that aren't Leatherhead.

@RоryMcCune awesome!

@Adnan Are you looking for a job in the UK?

@deed02392 I wouldn't say no to one.

I'm young with very mobile responsibilities, I have no problem to relocate. Any security-related job anywhere in EU is desirable.

I'm starting to see signs of dead ends for me with dev. jobs.

@Adnan I already feel like I'm in one

a dead-end dev job, that is

I'm the youngest in this office by about 20 years too, which doesn't feel great

@deed02392 Hmmm.. may I be frank?

Sure

@deed02392 It's difficult for me to swallow the idea that at 22 you can say you're in a dead end.

Of course, there are red flags that tells you'll be stuck here for a long time. That's true.

However, at 22, you still enjoy lots of flexibility

I'm not that old either, I still have flexibility, but I think you can't really say "I'm in a dead end" until you're beyond 30 and still have all the dead-end signs.

What I meant really was I came here under the pretence this department needs cyber security expertise

@deed02392 Ooooh.. and you're thrown at dev. tasks?

Exactly

Ouch. Sucks.

now I'm here they said well actually we just get contractors in for that, we want you to just be a software engineer

@deed02392 "we want you to just be a software engineer" the hell is that?!

Haha

From what I see, you have a well-defined career path for yourself. The audacity on them to tell you what you should become.

Indeed. Basically programming (C++, C#), networking engineering and hardware integration, whatever they feel like

In all fairness, though, most 20-22 people I met have no idea what they want. At all.

So they assumed you're like that

That's true, but then the point of me joining as an apprentice 3 years ago was that by now I would know

and I did sit and have coffee a few times with the managers here, talking about what I do with that competition and how my hobbies revolve around sysadmin with an interest in secops

@deed02392 You've been there for 3 years?!

@Adnan In fairness, as a mechanical engineer apprentice, but yes

four years in September

@deed02392 Still, approaching your managers multiple times about the topic should at least motivate them to push you in the direction of your interest.

I do have some ongoing support from my development manager, but where I am every day, they have no interest in helping me in that direction since as far as it matters to them it just means they lose a 'software engineer'

@deed02392 Well, they're gonna lose a software engineer aaand a good employee otherwise.

Yeah so hopefully my development manager will come through with something

He's helping me to apply for BAE AI

@deed02392 Which cyber security challenge event was it again?

Cyber Security Challenge Masterclass 2014

BT, GCHQ, Juniper Networks

Well, good luck with your applications. I'm sure you'll find something you'll like.

Yes \o/ it's inevitable

Goddammit the OpenSSL that Fedora ships is really stupid.

@TerryChia Do tell.

@Adnan They silently strip out a few EC curves. A real headache to work with. github.com/pyca/cryptography/issues/900

@manishearth I have an idea for future features of you AnnoTabe extension. How hard is it to add an action to selected text context menu, so you could create a new annotation from the selected text, and then have an icon in the annotation to also find that text in the tab? Say, I have a long PDF open, but I'm only interested in a part of it. I could then close the tab and return where I was reading it. Doable?

I wrote “"Only the server side of SSL/TLS connections is affected”, but that's not true, is it?

security.stackexchange.com/questions/55083/… says that end-users should do nothing. But if an end-user connected to a malicious server, can't memory from the client process have leaked?

@Gilles I doubt that clients have any use for the Heartbeat Extension tools.ietf.org/html/rfc6520, do they?

I honestly cannot see a situation where a client running OpenSSL can be exploited by this.

peer-to-peer clients tho, yes I can see how that could be possible then

@Adnan So where does the putative scenario break down? Alice points her browser to malicious.example.com ; malicious.example.com sends malformed heartbeat requests; malicious.example.com receives snippets from the browser memory

Do you mean that browsers won't respond to heartbeat requests?

@Gilles My semi-educated guess would be no. Before I adopt that answer, I'm digging in tools.ietf.org/html/rfc6520 first

@Adnan I've skimmed through it and it only talks of peers, not server/client