« first day (1890 days earlier)      last day (3288 days later) » 

10:00
but then what about the android manufacturers, many of them are really stuck for money
they wouldn't abandon a country lightly
so easier to pressure into complying
@RоryMcCune Wouldn't it be easier to just say "everyone with power would ask this"
@Arperum that's the conclusion I'd draw, once it's accepted everyone will want it
Yup.
which is why, to me, the principle is so important
right now Apple can hold the moral high ground and say "we don't even give this to the US gov"
if that goes, they're into fighting it in each country with each agency
and here's some more moral hazard for you , say we have a saudi citizen in the UK, with a phone registered in Germany, which of those three countries can file a demand
all of them, one of them?
@RоryMcCune You forgot to include Sweden. they are the nation that has an interest in the data.
10:04
@Arperum yeah exactly :) soo many countries are possible in any kind of complex case
@RоryMcCune I agree. I was really looking to see if there is a way around it - I mean, in this case it is a single phone being targeted, which is much better than collecting everything (and the dog) just in case. I guess not though, because it will eventually be pushed towards that.
I have a bad feeling it's a losing battle, but at least apple are going down swinging...
@RоryMcCune allegedly
@kalina sure maybe they do work with the NSA in private and maybe they don't, but once it's court order territory, the genie is out of the bottle
it's more than just apple though, isn't microsoft doing the same fight but over data it actually has?
10:07
@kalina yeah they're fighting the US on data held in Ireland
also largely this is all american companies, if this ever actually happened all the fbi would achieve is murdering the entire US technology secter overnight
@RоryMcCune There is another side though, and that's that if a sufficiently powerful market really wants the capability, they'll have it in the end.
if they lose that one and the US compels them to hand it over, european companies using US cloud providers are stuffed
@diagprov possibly, but apple can try and shame them into not doing it, which might work
I mean, our Home Secretary is currently trying to push all kinds of interesting laws through.
it's alright whining "oh we needs your data" but if they do, suddenly it won't be american companies holding the data, it will be their international replacements and then they're back to square one, because they can't play the jurisdiction card to get the data from said international replacement
10:09
@RоryMcCune The citizenship piece there is easy. You obey the law of the country you are physically in.
@kalina One of Microsofts cases is about giving the US access to data they host on European servers for European clients.
@diagprov sure you do, but what do apple do? say I'm in france but with a UK registered phone, why can't the UK gov. go to Vodafone (in the UK) who go to apple (in the UK) to demand access
@CodesInChaos yeah that's the one I mean
@kalina yeah they do run the risk of killing off US cloud suppliers (which ain't necessarily a bad thing from the european points of view)
@RоryMcCune cloud suppliers in microsoft's case, the smartphone industry in apple's case
who would want an american written smartphone OS if apple are forced to backdoor theirs?
10:11
@kalina yeah both sets could be stuffed big style if the cases go against them :)
That battle is about the applicability of US jurisdiction, slightly different from Apple getting forced to push malicious software updates.
@kalina precisely
but then we needen't worry, the new EU/US "privacy shield" legislation will save us!
@CodesInChaos both the same thing from the point of view of Americans overstepping their boundaries without considering the consequences, though
</sarcasm>
argh timing difference broke my closing tag!
I am winner
10:16
@RоryMcCune Is that the one with the space based lasers?
@Matthew yeah it'll totes save us from all the data being transmitted in space and zap any excessive data transfers
@RоryMcCune The question really needs to be the other way around - where did the crime happen? I'm assuming the phone has been surrendered on arrest, rather than the government is randomly pushing out malicious OTA updates. In which case, if you committed a crime in France, with a UK phone, then it would be Apple in France.
Malicious OTA updates, yes, that gets messy!
@RоryMcCune This does raise the question of who has jurisdiction over space based datacenters, launched from international waters?
@Matthew Are you thinking of starting a new private data hosting company? :D
@diagprov to me though that's part of the slippery slope, once the precedent is established for phone's in possession of law enforcement, there's no reason why it shouldn't be OTA updates
law makers would be very unlikely to make that distinction as they don't understand the concepts in question
@Matthew ahh the Elon Musk plan
10:23
We could also base the DC in Antartica ?
I mean why do you think Elon's working on landing rockets on a barge
it's so he can start sea-world in international waters and launch his world-wide-wifi network from there
@M'vy cheap cooling for sure!
@Matthew The Shadow Proclamation.
@RоryMcCune I agree entirely. There's a lot of problems, especially when we start getting away from "proven criminal" to "suspected criminal". If France decide you might be up to no good and schedule an OTA update for you but you go home before it arrives, then, they've scheduled an OTA update for a UK citizen in the UK...
@diagprov yeah it's a complete nightmare jurisdictionally. It's something the Internet has essentially been dodging for a while now and sooner or later I have a feeling reality is going to set iin
@AviD snap!
Adi
Adi
10:27
@RоryM I'm not able to trigger RCE on ASLRed machines
:(
@AviD cause you know, Earth does not have a president
@M'vy neither is there a Galactic President
or Emperor, for that matter
@diagprov I like this idea! Just need some VC funding...
@Adi shame :( you get RCE without ASLR tho? that's still handy for some platforms
Adi
Adi
@RоryMcCune Oh yeah. Working like a charm. Triggering RCE roughly 7 out each 10 runs
10:29
@AviD Yes there is. It's me. Why aren't you obeying my every whim?
@Adi nice! well that's still pretty handy for all those lovely embedded platforms that don't do ASLR
I mean heck IoT == embedded linux mainly these days
@Matthew like Trump?
who the hell do we think we are?
@Adi you should do a blog post with the details, would be interesting :)
@AviD My hair is a lot better than Trump. Also, I take a much more hands off approach
@RоryMcCune and wouldja believe there ARE servers that shut ASLR off?
10:31
@RоryMcCune @Adi I'm intrigued, what are you trying to exploit?
@AviD wouldn't surprise me TBH, I've heard people argue that ASLR/DEP shouldn't be needed as they don't add much and it's "inevitable" that they can be bypassed
@RоryMcCune It's not helped by the fact that, as you say, politicians don't really grasp the concepts they're dealing with.
@diagprov @adi was looking at the glibc DNS resolution bug that surfaced a couple of days back
@RоryMcCune right, exactly like happened with @Adi's exploit right now.
@AviD precisely, it's like for some people defence-in-depth isn't a thing!
Adi
Adi
10:33
@diagprov CVE-2015-7547
@Adi have you tried exploiting with some scenarios like SSH client connecting to dodgy server and the reverse?
I thought that with rDNS if connecting a malicious client to a vuln. SSH server worked, that'd be really nasty
@Adi @RоryMcCune ah yes I patched that one quick quick :)
Sounds like a fun project.
Adi
Adi
@RоryMcCune So far, I can't seem to find insta-excitability vectors
It could be that I'm not thinking hard enough
If a client connects to a rogue SSH server and performs DNS lookups through that server, then you can exploit the client
But I can't seem to be able to get to trigger the other way around (attacker connecting to SSH server)
@Adi hmm is it doing the look-up and then not working, or just not doing the lookup?
IIIRC the default is to do the lookup but that may vary depending on distro
Adi
Adi
@RоryMcCune The server is doing reverse lookup (I can see from the debug messages), but those lookup requests aren't reaching my rogue client
Are they supposed to?
10:46
@Adi ahh have you set up the reverse zone properly?
IIRC it's doing an rDNS lookup so you need a zone file for 1.168.192.in-addr.arpa or similar
Now that's an interesting idea, respond to malicious reverse zones
Adi
Adi
@RоryMcCune I have no clue how that works
Where should I make those setups?
@Adi not in front of my main setup at the moment so references limited but something like this shellhacks.com/en/Setting-Up-Reverse-DNS-PTR-Record looks to explain the kind of config...
that gives you standard reverse DNS lookups then you would need to get it to give a malicious response once it's hitting the server ok
not 100% that this would actually trigger, but if it did it would be a neat hack :)
#bored
amuse me
@RоryMcCune the problem on the internet would be having a client with delegated authority to set pointer records for IP addresses.
I can set reverse dns values in the control panel, but those reverse records aren't supplied by software I control.
10:57
@diagprov well if you've got Internet IPs you own you could host the client Internet facing and then if you can get authority for the domain on a DNS server you control it ... should .. work, but yeah internet control panel style likely wouldn't
for most of my domains I can set the DNS servers to be whatever I want
so I could set it to one of my external facing IPs
@RоryMcCune yep, because you have authority to edit the records delegated to you - you can set the nameserver to whatever you want. I run my own forward dns no problem.
What I'm saying is I cannot edit the dns records for my IP address ranges.
dig +nssearch ccc.bbb.aaa.in-addr.arpa shows you which server is responding to rdns queries for aaa.bbb.ccc.xxx.
Sorry, I'm talking jibberish a little. For each IP I use I can set the PTR record to be some hostname by talking to the datacentre and asking them to do it.
But I don't do it by editing bind / unbound / whatever config, as I do for forward dns on my domains.
11:20
@Matthew - You may not understand how SMBs in Asia have a funky way of operating. So, please leave the moral high ground & help with what's being asked. Please guide on tracing so that we can enforce policies that will prevent in future. Its not about assigning blame, its about preventing repeating similar ACTIVITY/ things in future. Also, to know what faux paus was conducted - it could be someone stupidly installed a browser toolbar/ extension. Why we want this is KEY for us.. If you can help guide us please do let us know. — Alex S 23 mins ago
Sometimes, I don't know why I bother with comments on questions rather than just VTC
> There were some non corrupt zip/ rar files left by Person 2 on the Desktop which we traced to them via looking at created & modified dates.
rahhhhhhhhhhhhhhhh
so bored
@diagprov They also have attempted to clean malware "to the best of our ability". So they've not cleaned it...
12:03
0
Q: How to protect against the new malware Mazar Bot?

GAD3RMazar Bot a new Android malware that spreads via SMS, its capabilities: It can read incoming SMS and send itself, make calls to directory contacts, contaminate Chrome, access to the Network, read the phone status or query the network to know the status and completely erase the contents of storage...

12:20
great. android exploit
@kalina that's usually how life goes
@MarkBuffalo Did you need something or were you just saying hi?
Hey, who's that blue?
hello :)
@TerryChia why did he even do that
is mt19937ar original or something and original php code implemented it incorrectly?
12:32
@deed02392 So PHP's MT rand has been broken for god knows how long; someone notices the mistake and fixes it; guy reverts the fix since it breaks all code that depends on MT rand's output being deterministic.
gotcha
and new PHP frameworks continue to be released
@Matthew ZOMG I JUST POSTED AN ANSWER
wtaf
it's probably wrong
ah those Russians
he installed it all and say I feel fine
@kalina The classic "don't install malware" strategy :)
what, it works for me
oh look, this link is almost definitely malware
I'll click it just to make sure NO YOU WON'T
oh look, a word document from somebody who has never emailed me before
it says I've won $1000
click NO YOU DON'T
12:46
oh the cute little macro!
In that case, is clicking even enough to install the malware? I'd expect android to display a warning screen before installing an apk.
oh a prince from zimbabwe
wants me to move some liquid assets to him to unlock his fortune
@kalina Time to marry him.
all I need to do is give him some personal information
this mazar thing is a joke
after you click the link it tells you you're about to install an application that requires access to ALL THE THINGS
only a truely dim individual would get infected
and they deserve it
I got downvoted
how rude
Adi
Adi
@kalina What's that?
Sounds Iranian
12:51
'S okay - you got an up vote from me
@Adi strange you'd say that, since part of what it does is text an iranian cell number
Adi
Adi
@kalina Well, that's how the name sounded to me
> Law 1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore.
Adi
Adi
But, to be honest, Iranian Russian Chinese.. all pretty much the same poop
Damn!! That proxy is too slow! What did they do at IT...
12:55
@Adi you crazy Finns - all the same... Syrian, Finnish - whatever :-)
@RoryAlsop They run around with knives and stab anyone who touches their drink?
Adi
Adi
@RoryAlsop Yeah, I don't think Syria and Finland have historic cyber warfare cooperation
> They run around with puukot and stab anyone who touches their koskenkorva?
FTFY
@Adi Yea, those are words I don't know :p
@CodesInChaos "but it's my phone, my phone isn't a computer!"
Adi
Adi
@kalina My dad isn't a phone either!
13:00
pls your phone has more computing power than that used by nasa to land on the moon by several orders of magnitude
@CodesInChaos exploits dude. android will block installation by default but maybe people are dumb enough to do it.
@kalina Looks like you've never seen Coming to America.
no
sounds like a stupid american teen movie
You're a stupid american teen movie.
nuh uh you're a stupid american
13:03
@kalina - what happened? You're busy answering questions... Are you just avoiding children? "I'm working here - go away" :-)
Children suck.
I'm not busy answering questions
that's like saying "you look really busy lining up that shot" while I'm spraying bullets from an uzi
I'm somewhat embarrassed by the fact that @Ohnana and @MarkBuffalo have both got way more rep than me in no time at all so for ~3-4 minutes I was motivated to do something about it but then I realized I have more rep than @Simon in less time and he can live with himself so it can't be all that bad
You people have been obsessed with rep in the past few days.
@kalina ಠ_ಠ
@kalina <3
@bluefeet Where is that link to request swag to pass out at events for Secse?
@bluefeet I'd like to attend a security conference, and pass out swag or something. I heard this is a thing, and want to find out how to socialize by bribes
13:10
... Do you even have a ticket for a conference right now?
don't do it, it's a trap
he just wants some swag
with 30 sec.se tshirts he wouldn't need to do laundry for a month
@kalina STOP REVEALING MY PLANS BEFORE THEY LAUNCH
HAHA
13:10
Probably a year since he's a nurd.
@kalina 2 years. ;)
Yeah see, he's even more of a nurd than I thought.
in other news if you send me 12 awesome se tshirts I will do a tshirt only calendar shoot before complaining about the objectification of women
no not really, it would mean new bed clothes
The event is in July, so I want to know where to ask
for when it comes
but it's more likely than @MarkBuffalo going to a conference
13:13
@kalina Somehow I get the feeling you're actually Taylor Swift
oh, I thought that was common knowledge in here
Sometimes it's just the simple answers.
4
A: How to protect against the new malware Mazar Bot?

kalinaThe text message to infect your device with the Mazar bot looks like this: You have received a multimedia message from +[country code] [sender number] Follow the link http: //www.mmsforyou [.] Net / mms.apk to view the message. Don't run the link and you don't get infected. You can also e...

hey look it's me
Common sense really. It's like people don't read the links that they reference.
@RoraΖ So Stagefright?
13:14
@Simon Don't be so self-depreciating.
@MarkBuffalo FRIGHTNIGHT
I got these video texts in China that caused 'someone' (coughRoraZ*cough) to take over my phone remotely and listen in
It was actually quite comical, as I RE'd it and... never mind
@Xander pls I'm almost a teenager.
@MarkBuffalo You realized the video texts were coming from inside the house?
Apple used the term "hackers" and "hacking" in the letter to their customers.
I wanted to punch my own face.
13:23
@Simon yeah we've wanted to punch it for a while now
Another nice and clever thing from kalinuh.
Mark your calendar, lads.
@kalina Much better than my comment to the question!
@Simon like the most adorable playful punch obviously
Anyone have thoughts/answers for this question?
1
Q: How to secure shared user on build server?

aspiringCodeArtisanWe have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and its resources are shared. Each team also manages different environments and this requires ssh con...

it would feel like a bird flapping its wings
13:24
@kalina Or an eagle's talon ripping your face off.
@RoraΖ wut
@Ohnana Did you not understand my statement?
@RoraΖ yes it seems to have many paragraphs
pls fake roro, ohnuhnuh didn't understand the question
i have no ideas
13:26
you must have some ideas
otherwise you'd be like an idea-less mass of flesh
@MarkBuffalo You can use the contact us form. Explain what you need, when you need it by, etc and we'll see if we can do something. I'm not sure if we have any Sec swag in stock though
don't believe her
there's loads of sec.se swag in stock she just wants to keep it for herself
pls kalinuh she's a her.
my bad
@RoraΖ I think it's just a flawed setup. It's like using direct root login - no accountability
13:28
I'm just so used to the sausage party that is the dmz
0
Q: what is the difference between ciphers

MSTCollaboratorwhat is the difference between cipher (i.e. aes128-ctr, aes192-ctr, aes256-ctr, aes256-cbc,aes192-cbc, aes128-cbc,blowfish-cbc,3des-cbc server aes128ctr,aes192-ctr,aes256-ctr) Thanks in advance. MTSC

plz wikipedia me thx
didn't we have this discussion already
plz is so 1990s aol
Just ask him if he has more questions in his homework that he would like to be answered.
@Matthew yeah. I know telling people to nuke from orbit sounds like overkill, but, if you have backups and a disaster recovery plan it shouldn't be too hard
@Matthew It's not uncommon for build environments to do this for production level builds.
13:31
@diagprov You better know when you got infected because your backups could absolutely be infected too.
@RoraΖ Normally with some restrictions on what each system can build though
@Matthew Right, which is why I suggested different build users for each environment.
@Simon Very true.
nuke from orbit isn't just best practice, it's self punishment for being bad enough at computing to get infected
5
@Simon Yes, but that's kind of a different problem. That's "spotting infection when it occurs", and people are terrible at that in my experience (having been dealing with a system that was infected at some point betwen 2011 and 2014, and they spotted last month...)
13:33
@Matthew Yep, hence why I'd suggest a clean install in most cases.
@RoraΖ Yeah, makes sense. Depends why they've built in the way they have - might be to keep the number of accounts on production systems down (seen that before), which seems sensible until you work through all the effects of this
@kalina You most-likely have been infected in the past and don't even know about it.
@Simon Ok but, how do you clean install your company database server with seven years' worth of data on it? You need that data back, as close to now as possible.
@Simon hmmm
@diagprov You better have good analysis tools or a lot of time on your hands.
13:36
@Simon Ditto. Although I've also seen cases where they nuke the known server from orbit, but leave others...
ooh
@Matthew Oh well.
I just crashed the System Settings app in Windows 10
Does that surprise you?
yes, it's the first time I've seen any of those apps crash
13:38
@Simon I mean, credit for trying...
@kalina Really? Do you not change your settings much?
@Matthew well no, what I do is I install a machine, I set it up exactly right and then I don't need to make changes
@Simon You need at least to extract the data from a backup at a time when it was known good. Perhaps not the whole server, maybe for that you have a deployment procedure to install a new one, but rarely can you throw away all your old data.
@diagprov Yes but the challenge is to figure out when they got infected.
@M'vy I recognize that quote.
@kalina I quite regularly have to change network settings and so on, but that's probably atypical and just a side effect of my job
13:42
@ThomasPornin Indeed, not much point restoring a stored xss or some other nasty.
@ThomasPornin Ahhhh! good :)
nope, never have to change settings
maybe adjust output latency, but that has its own window
I was wondering if anyone got the clue :)
@M'vy But he's dead -- and, amazingly, he died in St Petersburg.
I generally find that people got infected before they thought they got infected, and before their oldest viable backup. This isn't helpful...
13:43
@Matthew well those people demonstrate a lack of care
basically, these people are the people who drive around while sitting in the passenger seat
which would be a criminal offence
yes, allowing yourself to be infected by bad software should be punishable
allowing your machine to be used to spread it should be punishable too
punish all the people
@ThomasPornin I don't know very much about the guy himself
@kalina Well, yes... If they didn't show a lack of care, they wouldn't need people to come in and find all the other problems they've not spotted...
you're not allowed to drive without a driving license, maybe you shouldn't be allowed to compute without a computing license
@Matthew Yeah that's a good point. We'll see if we get an update about his "environments".
@kalina Nice dictatorship, do they make it for men?
13:47
@M'vy He was from the Carribean island of Aruba, so technically he was Dutch. The group's producer was German.
@Simon no men would be excluded from being allowed to compute at all
@RoraΖ Also seen similar where the justification was the cost of CI system licences
@kalina "no men" or "no, men"?
omg picking fault with my grammar?!
@Matthew The latter for sure.
@kalina If the legal framework for providing software had been defined along the same lines as the legal obligations when building and selling cars, then there would be a lot fewer bugs in software -- and a lot less software, too.
13:49
@ThomasPornin but considering that a bug in the autodrive system of a car is equally as capable of killing somebody as the driver sitting in the passenger seat not paying attention, maybe they should.
@kalina Only because that little comma reverses the meaning!
and yes, many companies would bankrupt overnight
but, that's their fault for being shit at the end of the day
@kalina Consider the consequences, though. With such a cautious system, there would never have been games.
they've got nobody else to blame, nobody else added those bugs
@ThomasPornin pls doom had no bugs
Did Toyota bankrupt when their mats got stuck on the gas pedal?
@Matthew Didn't think of that one
@ThomasPornin no
Also, that's the perfect situation to say that none of these people would have been killed if they drove a manual transmission.
well people who drive autos deserve to die anyway
casual filth
...
this is why i ride da bus
beep beep c:
13:53
@ThomasPornin that's literally pages of bugs -.-
@Ohnana public transport :(
what a productive use of time, reading about bugs in a game older than me

« first day (1890 days earlier)      last day (3288 days later) »