The DMZ

Mark Buffalo

00:00

@Ohnana

I need your EyE

never mind

Ohnana

eh?

Mark Buffalo

Nothing

Ohnana

>.>

Mark Buffalo

0

Q: Is "The New Hacker's Dictionary" a good source for jargon explanation?

I need to clarify some doubts I have about jargons in the Information Security field. I would never go to mainstream media for that, so I'm trying to search for a great source, then I came upon this site The New Hacker's Dictionary, and I've seen some people recommending it. Is it any good? Than...

theory

free vtcs

Ohnana

@RoryAlsop scontent-iad3-1.xx.fbcdn.net/hphotos-xft1/v/t1.0-9/…

Rory Alsop

00:24

Lol

And I craft the stone into an all-powerful MOD-HAMMER!

Ohnana

hee hee

Rory Alsop

01:05

@Ohnana one time, I dropped down 4 or 5 storeys into a pit inside a hollowed out building, turned round and there was a deathclaw right there. Just about ***t myself! Having surround sound and a big subwoofer doesn't help your heart rate :-)

Mark Buffalo

01:19

@RoryAlsop damn

deed02392

01:42

does anyone know where the hell you go to buy supermicro parts?

Mark Buffalo

I read that as supermario pants

that took me a few seconds to get right

David Freitag

@deed02392 Parts? Like what?

deed02392

y'know, motherboards

David Freitag

Neweg has a few

deed02392

and ideally their superdom modules

ah reallyy

I'm in the UK, though

David Freitag

01:50

Superdom sounds like an escort service

Ohnana

@deed02392 overclockers.co.uk ?

deed02392

@Ohnana what's my name

David Freitag

@deed02392 Pineapples?

No.. wait... that's my safety word..

Ohnana

@deed02392 deed02392

learn to read NOOB

deed02392

are you in the UK?

overclockers is taking a very long time to load

Ohnana

01:54

no I am not. I am in america

the SSL connection takes a bit, but that's it

deed02392

it's waiting for amazon cdn

Ohnana

oh. how unfortunate.

deed02392

did you just use sarcasm, on the internet?

Ohnana

no

it's unfortunate that their website is dying

deed02392

i think it was burp

works if i bypass it

Ohnana

01:58

haha! are you testing or just running traffic through it for giggles?

deed02392

i'm actually just reporting now

but i'm on site and this company has this fucked up proxying going on

well it uses a js proxy pac file

burp doesn't support that, so i just picked the ip that most often gets chosen by the js

Bob Ebert

hello

I am looking for a great application/website or a vm to practice pentest

I used mutillidae,dvwa, dvl, metasploitable2

If you have any idea, please let me know =)

Ohnana

@BobEbert owasp.org/index.php/…

Giant list!

deed02392

@BobEbert vulnhub.com has web application based entry points

you can then try to take it further with various windows/linux privilege escalation exercises if that interests you

Mark Buffalo

well I forgot my linux password for this machine

time to format

(this is a rotating machine, so I don't care, kek)

Ohnana

02:10

@MarkBuffalo reboot into rescue mode dude

deed02392

can't you just read it off the postit?

Ohnana

LOL

Mark Buffalo

@Ohnana I rotate the installation every now and then, lol

and I keep choosing a random password that I never remember

lmao @ the postit

Ohnana

@MarkBuffalo fuck up less

deed02392

@MarkBuffalo you should consider an anti-persistent disk image installation

Mark Buffalo

02:13

@deed02392 I... read that wrong

@Ohnana there is no need to not screw up... this is a virtual machine

it matters precisely none

Ohnana

1 min ago, by Ohnana

@MarkBuffalo fuck up less

deed02392

i meant non-persistent

it basically means every time you reboot, all the changes from your session are lost

like if you'd booted from a cd-rom

Mark Buffalo

that doesn't change the fact that I'll forget the randomly-typed password

haha

Bob Ebert

@Ohnana There is indeed a lot of options, but I do not know which one is actually good. Did any of you tried some applications?

Ohnana

@BobEbert LAMPsecurity is good for breakins

Damn vulnerable is good too

deed02392

02:17

@MarkBuffalo well you wouldn't need it to be forgettable

Ohnana

i've done hackthissite so that's neat

deed02392

you are only reinstalling your entire linux installation because you are used to doing that anyway

i'm suggesting you don't need to continuously do that

Mark Buffalo

@deed02392 I am currently sporting a buffer overflow vulnerability out the ASS on this machine

deed02392

if you forget your password next time, you can do the sensible thing of booting into recovery mode

Bob Ebert

Would you recommend hackthissite as well? @Ohnana

deed02392

02:18

@MarkBuffalo what, glibc?

Mark Buffalo

which means, even if I reboot and the state is cleared, as soon as I start back up, I can get autohaxored again

Yes

Ohnana

@BobEbert yeah, it was a while ago. i didn't get very far so hopefully it will be stimulating :)

deed02392

it's not THAT exploitable, and you can easily protect against it

just implement the mitigations

Mark Buffalo

"just implement the mitigations"

deed02392

i'm not even sure completely rebuilding linux right now will patch it depending on your distro

Mark Buffalo

02:19

tell us what these mitigations are ;]

deed02392

ok

Mark Buffalo

it won't patch it, no... but I can't update this

Bob Ebert

thank you!

deed02392

sourceware.org/ml/libc-alpha/2016-02/msg00416.html

Mark Buffalo

- A firewall that drops UDP DNS packets > 512 bytes.

- A local resolver (that drops non-compliant responses).

deed02392

02:19

there you go

Mark Buffalo

etc

deed02392

yes well done

Mark Buffalo

I already read this fyi

deed02392

.. then why did you ask me to tell you what the mitigations are

Mark Buffalo

Maybe it will become clear after a bit

deed02392

02:21

you're an asshole?

Mark Buffalo

Man, this new guy is annoying

deed02392

lolwut

Thomas Pornin

02:37

Now that is good service: my trusty Web+mail server goes down because its Dell IPMI has a tendency to go on strike at times. I open a ticket on the automated system. Where the machine is hosted, it is 03:00 AM. Nevertheless, 11 minutes later, everything is back on line and the support guy wrote a detailed explanation in flawless French.

Simon

@ThomasPornin You're a flawless French.

David Freitag

Fucking dicks

David Freitag

03:07

Woo

Civil chat with the dude who just ganked me and he's buying me another ship

Journeyman Geek

0_0

That sounds oddly euphamistic.

David Freitag

Dude just killed me, then spend 30 million on me

Although I'm pretty sure he's trying to get me to undock to blow me up again

TildalWave

03:37

wait wot?

Mark Buffalo

@DavidFreitag That's awesome, lol

I forgot how to play

logged in, and logged out

David Freitag

Although the ship he bought me is 3 million less than the one I had, its a better ship

Mark Buffalo

let me join you in a sec

David Freitag

Giggity.

oglaf.com/hartsline

NSFW, obs

deed02392

04:09

@ThomasPornin How come the IPMI managed to take the server down?

StackExchange

05:06

Some of you may be thinking, 'But wait, isn't the brightest star in our sky the Sun?' I think that's a great question and you should totally ask it. On the infinite tree of possible conversations spread out before us, I think that's definitely the most promising branch.

David Freitag

06:39

@kalina wut?

@RоryMcCune I've had a LinkedIn for some time now, just finally decided to add all you Sec.SE people

Arperum

08:28

Morning

kalina

08:38

@DavidFreitag that's what t'rory said

also, after spending 90 minutes dealing with netflix support lastnight due to my VPN breaking their entire sign up process and me eventually running out of patience they've given me a free account with 3 months free

in other news I'm already bored so I might just watch house of cards on netflix all day

Barry Carlyon

\o/ NETFLIX AND (OPTIONALLY) CHILL \o/

kalina

too many tiny humans around to chill

it's totally inappropriate to get high in such an environment

Lighty

@kalina But not illegal ;)

kalina

who cares about legality

Arperum

@kalina You've been surrounded by tiny humans the whole week already. What's going on?

kalina

08:53

it was supposed to be chilling out with friends, catching up, generally just having fun

which is exactly what it is

but unfortunately

my perspective of chilling out with friends, catching up, generally just having fun

is different to the same thing from the perspective of a mom of two, a mom of one, and three people with day jobs

Arperum

SO you are stuck with the kids while the dayjob people do their dayjob things?

Matthew

"Hmm, if you have some lockpicks, we can get into the locked room to get a screwdriver to open the locked drawer..."

kalina

no I'm not babysitting

that would be too much like burning down the world

but yes this is basically one of the most awkward things ever

and it seems to get more awkward over time

it's alright at night when everybody is being more normal

Arperum

But people act different when you are stuck with them for some time.

kalina

I'm struggling to not publicly declare all of this nonsense is beneath me, so it must be me that's changing, not them

Arperum

09:06

Probably all of you.

kalina

well yes, time changes everything

Arperum

Yes, And some things you don't expect at all.

M'vy

heya

kalina

salut

M'vy

comment allez-vous ?

Rory Alsop

09:15

morning

kalina

meh

I'm not up or down or happy or sad I'm just meh

I could do with more sleep actually

that would be nice

M'vy

well I took up 1 hour this morning to make up for the 6h I've been on the road yesterday

kalina

also less instant coffee

Rоry McCune

mornin' all

kalina

I forgot about how much this household insisted on drinking crap coffee

Rоry McCune

09:17

and blech to instant coffee

savages!

deed02392

mornin'

Rоry McCune

deeeeeeeeeeeeeeeed how's tricks

Journeyman Geek

@RоryMcCune That is about the only thing worse than adding chickory to coffee.

deed02392

great ta, in hong kong at the mo

Rоry McCune

@deed02392 BTW I was meaning to say to you , you been giving quotes to the Telegraph?

@deed02392 nice!

deed02392

09:18

haha, not directly!!

Rоry McCune

@deed02392 I was reading an article about property IIRC and I thought that name is exactly like deed's

and it's not that common

deed02392

lmao

did you see my face at the bottom

in the paper or online

Rоry McCune

was online, I don't recall seeing the picture, but I was skimming

so may not have got to the bottom of the article.

deed02392

ahh i meant it was on the bottom of the page in the printed version anyway

i was featured a further two times as well, once in the london evening standard and then yesterday in the metro!

Rоry McCune

lolz famous!

deed02392

09:20

haha

Rory Alsop

@deed02392 that's crazy prices - my 5 bedroom house here with a decent sized garden cost less than your flat! Take note @schroeder

deed02392

@RoryAlsop tell me about it

can't wait till the property bubble bursts and I am in debt the rest of my life

Rory Alsop

@deed02392 :-(

deed02392

sad face indeed

kalina

09:40

@deed02392 basically he didn't read the entire thing and thus missed that bit

Rоry McCune

09:53

@kalina phhbt like you and the transcript, @deed02392 said that bit was in the paper version and I read online so it wasn't there to miss

Rоry McCune

10:07

hey @RoryAlsop if you ever decide to join your kids in skateboarding, you should get one of these calebandtaylor.co.uk/store/?category=Skateboards

Rory Alsop

10:23

@RоryMcCune my favourite bit as the site was loading:

> All/ Limited Edition/ Merch/ Skateboards/ Whisky Furniture

kalina

@RоryMcCune pls like I have time to read every little thing

Rory Alsop

@RоryMcCune that is pretty sweet

kalina

if the detail wasn't present when I skimmed then it wasn't worth reading

Rоry McCune

@kalina the irony was that you were commenting on my having skimmed the original article :op

@RoryAlsop he lives down the road from us in the village.

kalina

10:38

@RоryMcCune I'm not immune from being ironic

deed02392

@ThomasPornin there is some seriously tragic irony in the fact an IPMI module can cause such issues

kalina

in fact, along with sarcasm and snarkasm, irony is one of my favorite things

and other asms

deed02392

i bet you like asms

kalina

everybody likes asms

spasms, orgasms and overenthusiasms

2

wow, superorgasms is a real word

I strongly suggest you don't Google it with safesearch off

anybody?

I just <strong'd> the word strongly

sigh

Rory Alsop

@kalina I am off sick today... so safe search is off

kalina

10:44

way to remain sick

I'm sick today

Rory Alsop

@kalina nah - this is definitely one of those children things... Little plague vectors

kalina

of life, children, background noise measured in double digits decibels

Lighty

isn't 10dB already considered as Background noise these days? or is my old Physics teacher just a big derp

Rory Alsop

@Lighty depends where you are

kalina

well tbh, most normally "quiet" environments will be around 30db anyway

Lighty

10:47

I'm pretty sure my old textbook said 10dB -> 20dB is considered quiet noise

kalina

so sue me for exaggerating

like I haven't exaggerated all the time

millions of them

this room is a constant 70db-80db tho

I know because my sound meter for android told me

I would expect up to 10db of incorrectness in such a thing though

it is using a smartphone mic to work afterall

Lighty

Not to be confused anymore, but what exactly are you doing in a room of children again? you work on a daycare or something?

Rory Alsop

@Lighty hahahahahaha

kalina

this is what I do for relaxation

go visit friends and then hate myself for doing it

TildalWave

isn't the strength of background noise relative to strength of the awesomeness through which I can't hear it?

kalina

10:50

get zero relaxation

hang out in a internet chat rooms full of people who don't get me

get zero relaxation

drive to and from airports, getting stuck in traffic

get zero relaxation

airport security

and I'm here until Sunday!

fml

"work at a daycare"

@Lighty that has to be possibly the worst worst case scenario ever in the history of worst case scenarios

Lighty

@kalina It's not an entirely false assumption xd

kalina

I'm sure that sentence means something different from what you were trying to say

Lighty

Quite possibly, not a native English speaker myself

kalina

it feels like I'm at a daycare center at the moment though

I can't even escape by going back to bed

Arperum

@Lighty Have you been reading the transcript or have you actually been living under a rock? Since there is nothing that points in that direction. It was even explained explicitly this morning.

kalina

10:54

and yesterday

and the day before maybe

Lighty

@Arperum It's not a rock, it's a basement, and I don't read /everything/

kalina

well the /everything/ image board is a bit... well, everything

Lighty

the word daycare reminds me of something

this old gem

Rory Alsop

yay for exposing my search terms

dammit wrong tab again

TildalWave

@RoryAlsop yay for explaining what that was

Lighty

10:58

@RoryAlsop Could be worse

Arperum

@RoryAlsop Have fun over there :)

Rory Alsop

@Lighty lol

M'vy

@RoryAlsop at least these should be fine even with safe search off

@kalina hanging out on the internet has never been really relaxing :)

Rory Alsop

SO you know - it looks like I'm just missing Dream Theater, AC/DC, Duran Duran, Smashing Pumpkins, Santana, Journey, Josh Homme, Huey Lewis, Joe Satriani and Dave Gilmour - jeezo

Lighty

I went to Santana not too long ago, here in Amsterdam

kalina

11:02

@M'vy that's not true, I used to enjoy it a lot more

Lighty

Internet > IRL

M'vy

@kalina maybe it's still true where critical mass has not yet been reached

kalina

@Lighty wasn't this image created for when you first started being here?

Lighty

@kalina I plucked the image from a random SE:Meta and added DMZ to append to reality

kalina

oh, we're using colons now for meta

I did not realize

it must be the coffee

I'm going to blame the coffee

this nasty instant coffee is the reason I'm not awake and feel like crap

when I asked if there was any real coffee I got called a snob :(

and then I made a comment about brewing tea using tea bags and how you can taste the paper

evening @TerryChia

Terry Chia

11:16

@kalina Hello.

kalina

@TerryChia Hello.

Terry Chia

@kalina o/

Arperum

@RoryAlsop All I've seen from that list is Dream Theater. I think I fell asleep during that show last summer.

kalina

@TerryChia \o

Rory Alsop

@Arperum lol - think I'm having more luck with bars that play local bands

kalina

11:19

@Arperum you fell asleep during loud distorted guitar strumming?

Rory Alsop

@kalina It's very relaxing if you like metal

Arperum

@kalina Yes.

Rory Alsop

I can easily fall asleep to loud metal

Arperum

I was lying down on a hill while watching, so that will have helped.

kalina

@RoryAlsop oh I'm not doubting it's possible, I've done similar but... dubstep

Rory Alsop

11:21

It puts me in a happy place

@kalina ah - see, I couldn't be at all relaxed with dubstep - it annoys me so intensely. Like elevator muzak

I just end up going "But...why???"

Arperum

agrees with @Rory

Lighty

@kalina beans or gtfo

kalina

I had been awake all weekend though, actually all weekend since instead of just performance > sleep > performance > sleep it was more like pre party > performance > afterparty > watching charity football event > pre party > performance > fall asleep against speaker stack

Rory Alsop

@kalina now that I can sort of understand. But there it isn't the specific music, surely, just a need for sleep

Terry Chia

@kalina How was the Grammy's?

Rory Alsop

11:22

@TerryChia she did well - dissed that Kanye idiot

Terry Chia

@RoryAlsop Ugly dress tho.

Arperum

@TerryChia Kanye?

Rory Alsop

@Arperum lol

kalina

@TerryChia well, 2nd best album award

Rory Alsop

@kalina no - it was definitely the best album award

you weren't 2nd best

kalina

11:24

@TerryChia please you have no style

Lighty

@Arperum the person of loser.com

kalina

@RoryAlsop no I mean it's my second

Rory Alsop

@kalina ( I know... )

TildalWave

bugger, it only snowed for 5 minutes, it all melted by now

kalina

it's done nothing but rain and wind since I arrived in the UK

either it's an omen related to my presence or the UK SUCKSSSSSSSSSSSSSSSSSSSS

Rory Alsop

11:28

@kalina you should come up to Scotland. We have lovely weather here.

CodesInChaos

Needs more fog.

kalina

I'm going with the latter because if there was anything related to my presence it would be epic sunshine so potent that forests start spontaneously combusting

Rory Alsop

All snowy and beautiful outside

TildalWave

not much wind here but I'm really getting tired of rain and clouds, it's been overcast for a week now

a bit of snow would totally change my mood

kalina

the internet says the weather at home is "sunny" but also "9 degrees"

@TildalWave I feel like that sometimes but I resist because it's a slippery slope to start sliding down

Rory Alsop

11:30

@kalina ah hah haaaa

kalina

:-)

TildalWave

@kalina in the voice of Fran from Black Books pretending to be a posh American: Anything, anything but this damn rain

it's not getting better till Friday :(

I'm soooo depressed

kalina

oh right I was going to actually log into netflix and watch house of cards

now I remember

Rory Alsop

@kalina you didn't sign up for Procrastination Stack Exchange, did you?

never got around to it...

TildalWave

lol

Lighty

11:34

Boss asked me to write down why we should persuade our clients to use SSL (https) on their websites, make an overview what SSL certs are for what kind of clients, but mostly, WHY should our clients should do HTTPS, in ethics and security views...

TildalWave

1

A: 75 of my reputation has suddenly disappeared by a user removal, may I ask some details?

I am sorry, no - these sort of details are not provided. Read Why did I just lose some reputation without any explanation in my profile? for a little more information.

Lighty

I already have privacy, security, anonymity, validation that you do make connection to the right server... whats more?

TildalWave

@RoryAlsop But we all know what happened?

Matthew

@Lighty Well, ethically, not buying certificates makes SSL vendors poorer...

Rory Alsop

@TildalWave I can guess which account it was, but that doesn't mean we are in a position to respond to requests like this

kalina

11:36

@RoryAlsop no, I'm already a member except I call it security.SE

@TildalWave I was going to ask this earlier

Lighty

@Matthew ethic is more like "Encrypt the Web" idealism in my eyes

CodesInChaos

@Lighty anonymity?

TildalWave

@kalina never got around to it? :)

Lighty

@CodesInChaos SSL certs/https helps you remain anonymous while being sniffed right? as in, they cant 100% see to where/what part you connect?

TildalWave

@RoryAlsop I know, I asked if that's the information you can't provide that I think it is?

CodesInChaos

11:37

They still see what domains you connect to, but don't directly see your username.

kalina

Don't you think I'm having a hard enough time generating reputation on this website that I don't use and know nothing about the subject matter for without you people removing reputation from me by deleting users?

How selfish of yous.

also: that moment where you're happily typing away while holding a conversation and don't realize your RDP session has disconnected

Matthew

@TildalWave I have no idea what you are talking about, but I'm confused anyway...

TildalWave

@Matthew see, you're assuming that I do know what I'm talking about

Rory Alsop

@TildalWave honestly? I don't know, but I would guess it is

TildalWave

I'm trying now to remember that user name... something B... some w in between

Matthew

11:41

@TildalWave No, I'm sure that I don't know what you think you're talking about. Whether you know what you're talking about it irrelevant really...

TildalWave

now I'm confused

Matthew

@TildalWave Good, that makes two of us

kalina

@TildalWave are you sure?

I would have expected to gain reputation had he been deleted, not lose it

oh, he has indeed been deleted

TildalWave

@kalina not at all, but I got the impression that the member I'm thinking about was highly enthusiastic on the site, so probably also upvoted a lot of stuff

if for nothing else then to get the badgers

kalina

@TildalWave Not I. I was his counter and posted the sensible responses to his hyperbole

TildalWave

11:44

or hats ...

@kalina there are badges and during winter bashes hats for upvoting competitive answers, so maybe it was that

kalina

@TildalWave listen there is no way that he upvoted the posts I lost reputation for

it's not possible

either that or the guy had a major split personality and was actually genuinely trolling us all

TildalWave

I believe you

on both accounts :)

(now signing into my other account to agree with you, hang on... )

kalina

I'm so bad

obviously security.stackexchange.com/users/45139/pleasedeleteme finally got deleted — kalina 2 mins ago

Thomas Pornin

@deed02392 I made a normal reboot (after a libc update) but the machine did not actually reboot. With a flawed IPMI, reboots are converted to shutdown.

kalina

oh no I just spotted a retag post on meta.sec.se

quickly closes tab

Transcript for