The DMZ

Stack Exchange

4:40 AM

Or whatever's handy! I'm pretty much pure alcohol and water, so it doesn't really matter!

M'vy

7:13 AM

hiya

raz

11:10 AM

heya

Rory Alsop

11:42 AM

hoyo

raz

I ain't no ho

Steve DL

it's funny how when some specific people post an answer, I disagree with everything they're saying :/

i'm starting to question myself now.

raz

@SteveDL Example?

Steve DL

0

A: Server for School Coding Assignments

What you need is relatively simple: you need to ensure that your students' unprivileged accounts are well confined. If you don't have a graphical environment involved, your situation is relatively simple. You should start by implementing the following actions: ensure users are created without a...

lack of consideration for the proper tools to do the job, or for the specific context

let's just throw in some pointers to random security stuff to make it "more secure", and that's it.

i mean, Security.SE is a leisure activity, but we should still ensure we give well structured and thought advice when talking to people who know less than us

but im starting to suspect if I've taken a disliking to someone and am just being bitchy

raz

talking about dro1?

or the other one

Steve DL

11:55 AM

@raz the other one

dro1 doesn't even qualify as an answer :p

"tell your sysadmin to ask on Security.SE instead of you because I'm too lazy to type a reply" :-)

raz

@SteveDL Yeah his answer has a couple of good points, but the rest is a little shaky.

Steve DL

i dont wanna comment critics cause i dont want him to think i'm harassing him

raz

I understand what you're saying, he has a history of giving half assed answers.

Steve DL

but i'm quite annoyed with the superficiality of his replies

e.g. you cant chroot a session

unless you wanna patch logind

raz

"While your at it" just annoys me.

"Make the server not publicly accessible on any port > 1024. (run ssh on a high port number to prevent script-kiddie access." And this comment doesn't make a lot of sense.

Steve DL

11:59 AM

no because there's already a uni network set up with identity management and (hopefully) some firewalls

ah well

raz

I mean running sshd on a non-standard port isn't a bad idea, but I don't see how that makes it more secure against student access.

The only two bullet points I like are using ssh keys, and suggesting Git as a possible alternative. But the latter requires that students can code from home, and not on the server.

M'vy

@raz I read an article on "running ssh on non standard port" somewhere

raz

@M'vy Great story, how does it end?

:P

M'vy

Badly

Cause, you can't trust the SSHd

raz

@M'vy But it's SSH, it's secure

Steve DL

12:04 PM

@raz the problem with SSH on a student environment where you have ~200 CS students is many of them will change their computer / break their OS during the course of a year, and they'll need a new key and you'll have to change their authorised_keys for them

M'vy

@raz yeah. I'm pretty confident I can write a ssh mimic :)

Steve DL

the support cost is a bit higher than just passwords (less often "lost" in this specific setup where users will break their systems)

M'vy

and run it on a non-priv port

Steve DL

also consider that there is nothing of value in the system

M'vy

I think there was something like that in the article.

Steve DL

12:04 PM

the worst case is a student finds your password and steals your code, and if you don't run similarity checking algorithms then you're a fool in the first place

M'vy

Probably another thing about tools and monitoring which expect ssh to run on 22

raz

@M'vy Yeah

@SteveDL yeah, this is why Git is the solution. Everyone's repository is private. Everyone checks in their code.

If they can't program in C++ on their own machine then they shouldn't be in the major.

Terry Chia

@raz I'm pretty sure I can't program in C++. :P

M'vy

@TerryChia but you could

if you learn it :P

Terry Chia

@M'vy Probably not. I'll end up writing C and running it through the cpp compiler anyway.

Steve DL

12:10 PM

@raz you'd be surprised

M'vy

@TerryChia Well, if I give you C++ code, you could compile it on your own machine

That's what he says

Terry Chia

@M'vy Go make or go home!

Steve DL

i wouldnt tell stories in a publicly logged channel because I might be violating some uni policies, but I've seen things :p

M'vy

BTW running compilers on server is bad

well unless it's meant to be this I guess... but anyway

Steve DL

can be nice for exams

you give students a time-limited shell

and they have to build some code and upload it

you give them standard desktops so they cant take their internet enabled laptop and cheat

raz

12:12 PM

@SteveDL I wouldn't be, it just frustrates me at the laziness of CS majors

Terry Chia

@SteveDL You know what would be a hell of an exam? Give students a source dump of OpenSSL, rm the Makefile and get the students to compile it. :P

Steve DL

MONSTER :D

Terry Chia

I'll bet at this point even the OpenSSL devs do not know how to do it.

Steve DL

@TerryChia try that with glibc

:-)

Terry Chia

@SteveDL Never actually taken a look at that before. How bad is it?

Steve DL

12:14 PM

They have some really weird checks in configure

and their autotools are a bit unusual

i'm not at ease with it, had to disable some checks to get it to build

weird things about the linker not supporting GNU extensions, even though it should

Terry Chia

@SteveDL Don't think it's worse than Openssl's perl based configure system?

Steve DL

:|

well the difficulty for both programs would probably be to make sure you're setting the right defines for the few bits of code that make use of compiler extensions

raz

12:35 PM

Really not sure how to classify this question

0

Q: Is WPA(2)/AES or some derivative really perfectly secure?

It is said they are uncrackable for now, but my question is how much uncrackable are they? Of course, it requires a situation to answer this, so here comes an assumed situation(the worst possible situation for a wifi/anything in security):- There is a device that is very portable wifi hotspot p...

wifi

Rоry McCune

@raz you ain't no ho, so YoLo?

Arperum

@RоryMcCune My brain refuses to parse that to something understandable.

raz

@RоryMcCune :facepalm:

Rоry McCune

whaat I show up and make an awesome pun, you guys should be happy :op

Arperum

12:51 PM

@RоryMcCune Try making your pun in English next time, and not in whatever weird thing that was.

Rory Alsop

@Arperum it was @Simonish

Rоry McCune

@Arperum phhbt I've being trying to read dutch since I've been here and it ain't that clear!

Rory Alsop

@RоryMcCune have you tried pronouncing any of it?

Arperum

@RоryMcCune I can agree on that.

@RoryAlsop It's hilarious when people try to do that, and horribly fail at it.

Rоry McCune

@RoryAlsop no, I don't think i want to embarrass myself/get beat up by the locals for trying

also their English is mostly flawless so no real need

Rory Alsop

12:58 PM

free spam flags...

-1

A: Is there a trusted independent firewall review company?

Gajshield – A Buggy Firewall, Time & Money Waster. Dear All, I am writing this to you to make you all aware of this useless, buggy and one of the worst firewall “GajShield” that we have purchased and got ripped off, I wish to share my experience to you all to save you being ripped off. BEWARE O...

does that count as spam, dya think

anti-spam?

Arperum

@RoryAlsop Anti-spam spam!

Rory Alsop

Destroyed as spam anyway :-)

Arperum

That logjam question has more than double the upvotes than my previous highest upvoted question network wide. This is just crazy. And it's only a day old...

Rory Alsop

@Arperum it's weird. See security.stackexchange.com/users/485/rory-alsop?tab=questions

my top question has almost 10x as many as my next one

and that was my throwaway question for that year's winterbash

Thomas Pornin

1:16 PM

@RoryAlsop I don't have a top question.

Well, I have a top question on crypto.SE, and it is the site-wide top question.

Rory Alsop

@ThomasPornin sure you do - it's a little one about logjam :-)

hang on - I thought I was replying to arperum

weird

:-)

Thomas Pornin

It's Friday for everybody.

Rory Alsop

@ThomasPornin and an apple question :-)

raz

@RoryAlsop Does that mean he received an apple?

@Arperum Yeah you got it rough here in Infosec

@ThomasPornin I know! And my day is over at 1300. Beer Friday!

Thomas Pornin

@Arperum It's the magic of rep trains. I told you it would not matter if the question was short...

raz

1:27 PM

I've only rep trained twice, but it's pretty fantastic when it happens.

And seriously, we still don't have the new profile.

Rory Alsop

@raz I wonder why ...

I'm not sure I want it - it doesn't work on my system at work

and that will never be fixed, as the build here is unsupported by SE

raz

@RoryAlsop it works fine for me, what are you running?

Rory Alsop

that's my profile on another site

Steve DL

It's a pretty cool question @RoryAlsop!

Rory Alsop

and there is no scrollbar along the bottom

@SteveDL which one? The anonymising one? Well, it is interesting, but it shouldn't be a good fit here really

Steve DL

1:33 PM

yeah

It's clearly unanswerable :D

but the implications of ever needing to properly erase one's online reputation... everything in the way the Internet and online services work goes against making that possible

raz

@RoryAlsop What are you running?

Rory Alsop

some old stuff..

older than the oldest spec SE support

raz

Well that's not really SE's fault now is it. I want the damn profile!

Rory Alsop

@SteveDL you really would need to fully dissociate yourself from your life and behaviour

Steve DL

yup

raz

1:36 PM

@RoryAlsop Live off the grid in the grid

0

A: Is WPA(2)/AES or some derivative really perfectly secure?

Yes you can attack this. But if there're no significant improvements in cryptanalysis (quite unlikely for AES) you'll be dead a long time before the computations finish. Now to decompose your question: Is AES(-128/-256) by itself secure? Yes, the best cryptologists in the world believe that AES...

"you keep using this bold feature, I don't think it means what you think it means."

Also...

1

A: How can someone sniff dial-up connection using phone line?

If its a PSTN line a simple tape recorder attached to the lines could do the trick. For ISDN I suspect you need a DAC but its also ease. as long as you have physical acces to the line. Bottem Line, if you want to protect your physical line use a TLS connection.

"Bottem Line, if you want to protect your physical line use a TLS connection"

Say what now?

Steve DL

I'm apparently notorious for over-bolding but that defeats me, @raz/

raz

@SteveDL haha

Arperum

2:04 PM

@ThomasPornin Indeed.

Rory Alsop

@SteveDL I de-bolded. It was hurting my eyes

Steve DL

oh noes. All the depth, it's gone!

:-)

Iszi

2:20 PM

Ok, I'm feeling stupid.

Why does Firefox say "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys, (null)" is "Broken Encryption"?

Tinned_Tuna

"(null)" ??

what's that all about?

Iszi

Dunno.

It's like a spreadsheet without column headers. Or a line of script without a command reference. No clue what each of the parameters is supposed to be if one of them is blank or doesn't make sense.

This is weird. Ctrl+F5 clears the warning flag for the site, but the encryption mechanism is still the same.

Oh, yep. It's a mixed content warning. Just badly laid out.

It's of the format: Broken Encryption ([Cipher Suite], [Key Size], [Unknown Parameter) [Details of broken bits]

Tinned_Tuna

huh

Iszi

With the details placed underneath the bold parts. Strongly implies it's the crypto suite, key, or whatever that other thingy is, that's broken.

Please tell me I'm not the only one who looks at that and doesn't think "Mixed Content Warning" at first.

Wonder if there's a way I could submit that to Mozilla (though I think every major browser vendor has similar issues) and say "Your SSL error messages are confusing even to experts!"

Tinned_Tuna

2:38 PM

Yea, it looks like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 is the "broken" bit

Iszi

Know what's really stupid? IE doesn't show any errors or warning icons.

The lock is just strangely absent.

Tinned_Tuna

it needs to be something like "insecure connection: {primary reason, easily understandable},\ndetails: {cipher suites, cert details, etc}"

I can't comment on IE

Iszi

I think Chrome gets it "most right".

I wish Chrome had the mouse-over tooltip that Firefox does, but Firefox needs to work on their wording.

Tinned_Tuna

I think changing Chromium's wording would be basically bike shedding at this point.

Iszi

@Tinned_Tuna "Bike shedding"?

Tinned_Tuna

2:42 PM

Oh, it's the term used when everyone wants to leave their mark on a project, so they try to change something. It came from an observation that, when building a bike shed, the most lengthily arguments were over irrelevant things, such as the colour.

Iszi

I wouldn't say it's about leaving a mark for this. It's more of a general UI/UX thing - you're confusing the users over what's wrong, which can lead to incorrect assumptions about the security of a site. And it's also very un-helpful for the technical people who will actually need to work out those issues.

Steve DL

The irony of moderation: our most voted question on XSS is closed! security.stackexchange.com/questions/1368/…

Iszi

I wonder if there's a site, application, or pre-built VM that lets you easily test what browsers do with various SSL/TLS errors or security issues.

Steve DL

Web gurus, any opinions? security.stackexchange.com/questions/89869/…

Actually not my field at all</impostersyndrome>

@Iszi it's very VERY common when speaking about UX/interaction/UI design for engineers and non-designers to sidetrack and discuss unimportant details. Because they've no idea what design practice looks like, they think it's all about opinion. Yes, often the font and colour you use is relevant, but nowhere near as much as the overall interaction.

Tinned_Tuna

3:17 PM

With Chromium, I think the message is perfectly clear. I agree that the Fx on that you showed is very unclear.

*That the message you showed on Fx is very unclear.

Thomas Pornin

@Iszi "Bike shedding" refers to a fictional story that represents how things go in most organizations.

The board of directors meet and agree without discussion to fund a new nuclear reactor or something equally expensive. Then they come to the second item of the agenda, which is the construction of a bike shed in the parking lot. Discussion goes on for two hours and ends in a request for more studies on the bike shed and a committee with regular meetings to discuss the result of these studies.

The moral is that the more insignificant an issue is, the more people feel allowed to have a strong opinion on it.

Really stupid details will keep people occupied for weeks.

While the "big things" go through immediately because nobody feels strong enough to challenge a multi-billion dollars project.

Iszi

3:35 PM

@Tinned_Tuna In Chrome, the message is just fine. But Firefox has a bit of text that appears on mouseover (no click needed) that's supposed to shortly summarize why there's an error icon. Unfortunately, for "mixed content" issues it just says something like "The site does not provide identity information" and you have to dig in to realize it's actually mixed content.

Tinned_Tuna

Yea. I totally agree that Fx's is poor.

raz

4:04 PM

@paj28 It could stop the DLL from doing nefarious things. Sandboxing is always a good layer to have.

Iszi

4:16 PM

@Tinned_Tuna My point was that I'd like to see that tooltip in Chrome too, but with good verbiage.

raz

@SteveDL I think it's fine for it to be closed. Should probably be "Protected" more than "Closed"

Anyone know about telecomms and whether or not they all use different infrastructure's for their networks?

Steve DL

no clue.

Steve DL

4:41 PM

Just reviewed low quality answers. We have a recidivist... :D

raz

recidvist?

oh... yeah we'll get those

Sometimes I wish we could flag users

Woah seriously

@SteveDL Who's a mod, they should really look at this guy's answers

Steve DL

@raz we're still speaking about the same ain't we?

raz

yup

security.stackexchange.com/questions/89708/… For any mod who sees this later. Just check out his answers. All of them are pretty crappy.

Alright, have a good weekend everyone

Steve DL

see you @raz!

schroeder

5:01 PM

not much to do with crappy answers but to downvote

no reason to intervene

@raz votes ARE the flags :)

Steve DL

@raz also security.stackexchange.com/review/low-quality-posts

Good weekend everyone!

schroeder

6:46 PM

0

Q: What makes an Android application vulnerable to XSS?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject a client-side script into a web site that is viewed by other people who become the victims of the...

exploit xss mobile android java

0

Q: What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). How SQL Injection impacts the Android O.S The...

exploit mobile sql-injection android java

1

Q: What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root directory. If the attempt is successful, the hacker can view restricted files or even execute commands on...

exploit mobile android java directory-traversal

no idea how to handle these - I have asked questions in comments

plus cross-posted

Iszi

7:06 PM

Answer to all: "The same thing that makes any other application vulnerable to [X] - trying to take over the world!"

schroeder

7:20 PM

lol

Rory Alsop

7:36 PM

I'm tempted to close them - because as far as I can see, the inclusion of the word Android is pointless...

As @Iszi said

Thomas Pornin

8:18 PM

@RoryAlsop As the Small Bear indicated in his answer, one can find some indirect link between "Android" and "SQL injection" in that Android comes with an SQLite variant, whose API may (or may not) promote the sloppiness in which SQL injections strive.

Though of course the OP is just trying to get a list of bad things to say about Android, probably to piss off another clueless teenager who mocked the iOS allegiance of the OP.

Rory Alsop

8:35 PM

@ThomasPornin - yes, I commented that to him. The other two... Not so much. I have been trying to search for the more general case questions to see if these are dupes, but no joy yet

schroeder

9:03 PM

@RoryAlsop he deleted the question with the comment thread and recreated - 0 change to the question - seems like he wanted to erase the comments

0

Q: What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject a client-side script into a web site that is viewed by other people who become the victims of the...

exploit xss mobile android java

Rory Alsop

Thanks @schroeder

Reverted and left him a comment.

schroeder

10:45 PM

new questions from this guy ....

0

Q: What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to modify firewall settings, post unauthorized data on a forum or conduct fraudulent financial tran...

exploit mobile android java csrf

Xander

@schroeder I'm tempted to vote to close them all as too broad.

schroeder

or duplicates of each other ...

Xander

@schroeder Yup. One way or the other, they're lousy questions.

schroeder

but on their own, they are technically valid ....

poor, but valid

Xander

11:28 PM

Annnnddddd another. And a new name.

0

Q: How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at first. Even though I understand what Memory Corruption is e.g: a programatic situation wherein, ...

exploit mobile android java memory

Lawri van Buël

@raz oops I see now my post is missing an important bit about Why you use TLS...

Transcript for