The DMZ

Ahh i see now @MarkBuffalo yea that parts fun haha

@MarkBuffalo, cannot second you on that (yet);)

1:11 PM

@silverpenguin let me check...

Benoit Esnard

@Adi: edited

@silverpenguin yes, Saturday night at 18UTC

GOogle "18:00 UTC to local time"

@Adi - thanks. Deleted, and in the redact queue for approval by another mod

AstroDan

lol, I like how this guy gave the same answer as me after saying "One thing the other replies are not including" security.stackexchange.com/a/117829/97432

@Adi yeah, you have to rewrite the packets with the right header to allow it to execute

1:15 PM

@Ohnana hacker

@RoryAlsop Good good

But damn, his PoC is pretty neat

He worked on the encoding quite well

@MarkBuffalo well, it means you have to explicitly disable protection for your machine

@silverpenguin register as "sec.se" or some other team name?

Nice PoC, but accepting base64 like that is moronic

@MarkBuffalo Where's the Base64?

I don't see any Base64

A: Is chrome completely secure against Reflected XSS?

1:19 PM

8

No, because the XSS filter only looks whether it sees XSS code in the input back in the HTML outputted by your server. For example, if Chrome sees your web page is accessed with an URL that contains the following: ?q=<script>alert("XSS!")</script> and if the HTML returned by the server cont...

>

?q=PHNjcmlwdD5hbGVydCgnWFNTIScpPC9zY3JpcHQ+

(PHNjcmlwdD5hbGVydCgnWFNTIScpPC9zY3JpcHQ+ is <script>alert("XSS!")</script> encoded in Base-64), if not filtered, would result in response HTML like this:

If I ever come across that, I will shit a brick

@Mark PoC is in the original question

security.stackexchange.com/questions/117870/…

which is now deleted

I appear to have clicked the wrong one

But I guess you can see it

Yup

> X-XSS-Protection: 0

You mean that?

@MarkBuffalo :|

PoC in the original question

1:21 PM

@MarkBuffalo yep, that's the chrome override

The bit marked as code

Ah, question that I did not read

Mmhm

Huh. That's interesting

It's an interesting question, but worded badly - would have been better without the specific POC

1:24 PM

lol that is funny

@Matthew At least without the screenshot and the name of the domain he's targeting

Or, at least not the full screenshot

Otherwise, it's quite fun question

Especially with the PoC that seems to attach to a subdomain he registered for

@Adi Yeah... As a generic question about Chrome XSS filtering, seems fine!

@MarkBuffalo The interesting part is that it's a domain hosting a fake version of the game's interface

I'm not visiting it for a while.

damn phone. alright, back later

1:27 PM

@RoryAlsop competition for you / your middlest to enter for a cool whisky-barrel skateboard... smokehead.com/competition

hahaha. me dropping that link to plaintext offenders really gets people going.

@RоryMcCune I worry that the competition encourages drinking and skating!

@RоryMcCune very cool - will pass it on!

@Matthew I can drink - she can skate :-)

Too bad the rep cap is reached for today. Now I must manually check the answers fate:)

@RoryAlsop Perfect! Although they should also have made the wheels out of whiskey glasses for extra pizzazz and danger bonus...

M'vy

1:40 PM

Hum password hinter get me from 4 stars to three stars when I add the last character?

Pwn2Own 2016 Day 1 Recap

►

@M'vy those things almost universally suck

Grrr... Why is every browsers a piece of shit -_-

@M'vy Did it make it a word?

Firefox managed to remember how many tabs I had open and even how many of them were pinned. But it totally forgot which url was open in each of them.

So now I have a few hundred open "New Tab"s.

Benoit Esnard

1:43 PM

@CodesInChaos: oh it did it to me too :(

Clicking on one of those tabs sometimes opens the old page

@HamZa interesting, very much goes to show that a well-resourced attacker can be assumed to have a browser-->system exploit up their sleeves...

@RоryMcCune really cool indeed. I need to learn such skillz

@silverpenguin see CTF room

@HamZa yeah I think the barrier to entry is going up when you're seeing the number of vulns they were chaining to get an exploit, it shows that it's trickier to do but obv. still very possible.

true

diagprov

@RоryMcCune that and these days with targets like chrome you need a kernel exploit to sandbox-escape

M'vy

1:57 PM

@Matthew nope

it's a pwgen stuff I think

though not fully random IIRC

I've been wondering, how much/long does it take to become a decent exploiter? I've just started reading a book "hacking : the art of exploitation"

2:08 PM

@CodesInChaos there is a setting in Firefox that utilizes lazy loading by default. It's hidden away. If clicking on those tabs loads the site, try disableing lazy loading:)

@SmokeDispenser I use that feature. But today it simply forgot the tab content entirely.

Though I don't really know if the feature works properly in any case, since firefox takes ages and tons of RAM to start, even with lazy loading enabled.

@CodesInChaos bad luck for you then:/

@CodesInChaos, does it say 'test' while starting up? scnr.

It's just like holding down Ctrl+T for a minute.

I love testing servers on the other side of the world... No, wait. Not love. Really hate. That's the one

2:32 PM

Hmm. Think I might be done posting on secse during the day

And the week...in general

@MarkBuffalo Like, today, or whenever the Sun is up ?

Whenever the sun is up, maybe down... just weekends, maybe.

;/

@MarkBuffalo Isn't that when the hackers are out to play though? "Someone messed with my GTA clan, and I got his IP - can I hack his PS4 and make it an XBox One?"

@HamZa why cant we be like that?

@silverpenguin start reading man :-)

2:34 PM

@Matthew it's a long story. It's not appreciated that I'm answering stuff here

@MarkBuffalo i appreciate your answers

Need to quit chat too, for now.

@silverpenguin management issue

@HamZa man Its going to take decades before i am at their level

Q: Team members spending too much time on Stack Overflow

156

Almost 8 months ago, I encouraged my team members to follow Stack Overflow so that they can read questions, help others, and build their skills. But now this has gotten out of hand. I have a team of 5 developers, and three of them each make at least 150 points on average during business hours. T...

Hahahahahahaha

2:41 PM

@MarkBuffalo @HamZa I dont see why people care.... my boss lets me do what ever the fuck I want. I can come in late and leave early and he just cracks a joke, I take the piss out of him and as long as i do my work BEFORE deadlines he doesnt give a shit

@silverpenguin it depends, really...

@MarkBuffalo that sucks, dude

That linked article is completely irrelevant

@HamZa sometimes my boss asks if im in on what ever day he asks about just because i might decide not to come i xD its good having a lack work place, im more inclinded to work harder

@MarkBuffalo best of luck

2:49 PM

See, that's lunacy - in principle (I've as long as they aren't in breach of law or policy) I don't care where my team are or what they are doing at any moment, as long as they are doing their jobs it's down to them how they want to do it

Over the last 17 years or so I have found that gives best retention, happiest employees and highest output

Studies agree with me

SO someone shouting at you for doing something that is definitely not stopping you delivering your job, and maybe helping you improve your skills etc. Should seriously re-think their role

@RoryAlsop Makes sense to me - I know I did some of my worst work whilst working for a set of control freak managers, and most of my best work when allowed sufficient freedom whilst being allowed to draw on support

Exactly - the manager needs to be able to support as needed, and some individuals want or need more than others, but where your team are delivering, there is no reason to impact that!

Sure - there is a case for trying to make year on year improvements etc, but you do that by slightly increasing the demands, and then seeing how your team cope

(Less relevant in your world, where the changes are down to new technologies/exploits etc., and can be handled well through training etc - so you don't tend to say to pen testers: you need to hack 4 more systems a week this year :-)

Q: Accounts being accessed from X country

Oooh! Question for @kalina to answer! (look at the avatar)

0

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed from India (but got foiled, hooray 2FA). The problem is that I have no idea where the breach is com...

multi-factor incident-response account-security incident-analysis

Lol

@RoryAlsop "Find more issues in the tests you do this year"/"OK"/"Why are these reports full of SSL configuration issues?"/"You wanted more issues..."

3

2:57 PM

Yeah - that's just stupid. Defining KPI's just makes people work to those KPI's

all right

You have to get any KPI's right

off work I go. see you around :)

Hey @RoryAlsop, do you have an actual email address ?

@RoryAlsop Exactly!

2:58 PM

Well at least I can chat on my phone

@RoryAlsop Thanks for the support. Also, being here has helped me find and plug over a dozen holes

@ThomasPornin I'll ping you a quick email (if it's okay to use the one I have visibility of in mod tools)

@RoryAlsop Yes, it's OK (besides, it is not hard to find, I have it as cleartext on my homepage...)

@MarkBuffalo ah, good old "manager up the ass"

@Matthew oh man, when I used to run a test team in a bank we had that all the way. metrics on everything, regardless of whether they were meaningful

@RоryMcCune eww

3:04 PM

:28346071 mark slam your balls on the table and demand some respect :<

@MarkBuffalo e.g. "why have you found less issues this quarter" "well we did a smaller number of larger tests, duh!"

Totally in the most bummed out mood ever today

@RоryMcCune metrics drive bad behaviour, we wanted fewer code review fails... so guess what... :)

@ColinCassidy yeah I laugh so hard when I hear "You can't manage what you can't measure", it's like a huge "I'm a bad manager" flag

simple metrics will always be gamed

Viz the UK bank sector where bonuses were paid for sales, what happened.... ooh lots of mis-selling

or "say what you are going to do in a sprint" and then be measured on what you've done, lead to people saying that they'll complete the thing they did last sprint and work on the next thing for the following sprint

the obvious "bad metric" is the fewer testers we have == fewer bugs

oddly no one seems to want to comment on that one, yet that's the behaviour driven by similar metrics

3:12 PM

@RоryMcCune heh, nope. Just blanket unawareness of what was accomplished

@RoryAlsop it's an oddity in the software business in that if you're not directly contributing then you must be wasting time. When this is clearly wrong. If you hire a lawyer, some of their billable time will be learning and keeping up to date with changes to the law. However to keep up with new technologies, we have do to that in "our own time"...

@ColinCassidy yeah the lack of support in IT for Professional development is kind of weird

Doctors/lawyers/accountants get it taken into account

@ColinCassidy I do it in my spare time anyway

although interestingly the common point of those three is strong bodies like ICAS/the BMA

@MarkBuffalo indeed but should companies be able to rely on that and not train their staff?

"on the job training" is my pet hate. As is "We have a training budget, but we've cancelled the T&L budget"

3:20 PM

@RоryMcCune This leads to fewer it professionals. Whatever a company decides to do is not my business. I am there to complete a job, and will do so.

Things are good here in general

We have a training budget

@RоryMcCune I agree with you, though. It's ridiculous

@MarkBuffalo oh indeed I've always had the same approach which is that I can't depend on anyone else to train me, it's down to me to keep up to date

Yeah

It's depressing sometimes

Only because it's usually done after work, and that's supposed to be me-time

I like learning though

ahh k-pop music videos the closest to NSFW thing i can watch

3:43 PM

Anyone willing to hear the symptoms I'm observing on a system and let me know if it sounds like malware or not? For all intents and purposes it presents as hyper-suspicious, hence my needing extra sounding-boards :/

Any flash drive plugged into this Windows computer is getting its file contents replaced by a link, which runs a rundll32.exe process. This process has a very weird symbols string after it - and I mean really weird. Examining the drive on a Linux machine, there's an empty folder (hidden?) which contains an executable which in turn then has the actual 'disk' contents stored inside a folder inside that

This happens for any disk plugged into the specific computer as well

which further makes me hyper hyper suspicious

sounds like malware to me

anyone know of any malicious threats out there that act like this?

@CodesInChaos that's what it sounds like to me, too

i submitted the suspect Malware to VirusTotal right now as well

to see if they find anything

(thank god for Linux)

@ThomasW. the person who makes a virus for a pure linux system would be hunted down by every nerd on the internet and burned at the stake while be stoned by old dell mice (those fat ones with the old rubber balls)

@silverpenguin Yes, true statement

i'd be at the front of that pack

with all the weapons and wrath

@CodesInChaos what's real interesting is this happens on write-protected drives too, with something trying to write to it when it's write-protected and plugged in

@CodesInChaos suggests active malware?

everyone knows its the unforgivable crime

3:49 PM

"Any flash drive plugged into this Windows computer is getting its file contents replaced by a link": this, alone, qualifies as malware. Wiping out Flash drive contents is not a normal action.

@ThomasPornin that's what I suspected

so I guess I need to talk to the local security team on this

and my managers, 'cause we have write-protected drives we use to restore certain utilities here :/

grabs the sledgehammer from the utility closet in the mean time

Bliss (virus)

Bliss is a computer virus, introduced in 1997, which aims to infect Linux systems. When executed, it attempts to attach itself to Linux executable files, to which regular users do not have access. In the case of the alpha version, this prevents the executables from running, so users notice it immediately. Although it was probably intended to prove that Linux can be infected, it does not propagate very effectively because of the structure of Linux's user privilege system. The Bliss virus never became widespread, and remains chiefly a research curiosity. After the Staog virus it is the second known...

@ThomasPornin we must find him

@silverpenguin and subsequently send him through torturous ordeals, leading to his sacrifice

um, I mean...

:)

@CodesInChaos 100% confirmation of a virus - virustotal.com/en/file/… analysis in progress

this is the .exe i discovered inside the disk

For me the behaviour your described is 10x more convincing that whatever detections "anti-"virus-software might produce.

3:56 PM

@CodesInChaos indeed

I'm 100% certain it's malware though

Does Bliss infect you when you look at it? </reddwarf>

@Matthew hope not

fortunately these symptoms are only observed on a Windows environment

Xander

4:09 PM

On the difference between the DMZ, and crypto.SE's chat room, The Side Channel:

in The Side Channel, yesterday, by e-sushi

@SEJPM But I agree that their chat can’t be compared to ours. Theirs is like a full-fledged rave, while ours feels a bit like checking the refridgerator light every now and then. 8}

heheh

5:09 PM

@RоryMcCune Fantastic, I'm glad you're happy with my suggestions :)

I'm receiving my material/lab access for PWK tomorrow!

Xander

@Simon Fun!

Should be a lot of fun, indeed.

@Simon PWK?

@DavidFreitag Penetration Testing with you know who.

You just wanted me to say it.

5:23 PM

@Simon Oooh nice ( ͡◉ ͜ ʖ ͡◉)

@Simon I genuinely had no idea

So I bought a yoohoo with my lunch

Feb 18 at 0:50, by David Freitag

@Simon PWK?

GOLDFISH

@DavidFreitag TMI

One of those you numpty

Snapple is made by Dr. Pepper?

SNAPPLE MASTER RACE THEN

I haven't had a snapple in a few years

5:25 PM

Me neither.

They have a ton of brands, including 7up.

Dayum.

We don't have those...

We have Yazoo

I yazoo your moms.

When I was in college we had a vending machine that had only snapples in it

It was freaking awesome

Yeah but they're super expensive.

Nope a snapple was $1

5:27 PM

wtf

It was like the size of a small car

You Americanos get everything at a good price.

Yeah I know.

Had like 8098324097 different flavors

@Simon That's because our currency isn't backed by maple syrup

attack-prevention vulnerability

0

Q: Can my car be hacked?

I was reading this article about car hacking and the fact that there are a half million vulnerable cars scared the living daylights out of me! I did some research and many sources claim that car hacking is Nearly Impossible, but if you see that from the other side, the Nearly Impossible is still...

WELCOME TO 2016

@Ohnana That reminds me of the $5 wrench xkcd

5:28 PM

@DavidFreitag pls

Q: VPN - Why is my NAT'ed Laptop being SSH-brute-forced by External IPs when in VPN?

1

I am using a commercial paid licence to a VPN provider, which I use on two boxes, a FreeBSD, and a Linux BackBox. When connected to this proxy, my interface receives a public IP from the VPN provider. My home router has no open ports exposed to the Internet at all (I have tested all 65 thousa...

vpn brute-force

I'm so excited about getting my course material that if as soon as I'd get it my donut would be like "Let's do a threesome with my hot female friend" I'd be like "pls no I have the whole world to penetrate".

@Simon nerd.

NURD MASTER RACE

Only 1h30 of work left even if I have -3 motivation.

aha

5:37 PM

o ffs not the bad looking manatee

@Ohnana someone doesn't understand how VPNs work...

that title tho

@RоryMcCune beat me to posting that answer by a few seconds :p

(was along the same lines as what you wrote)

yay for fast typing :)

it's actually an interesting point, I wonder how many people have VPN accounts but really don't understand how they work

@RоryMcCune Most of them, is my guess

most of the non-corporate world equates "VPN" with "Hey, hide my IP" but don't know the underlying networking that corresponds to them.

5:49 PM

yeah, would make for "interesting" scanning of known VPN provider IP address spaces, to see what people are exposing but shouldn't be..

some shodan/censys searching might work for that.

mhm

The only VPN I bother using is my own - either the one for my apartment or the one for my parents' home, because then I can access all the data I actually need :P

The real reason is because you're a nurd though.

(hiding my IP online is less of a concern, 'cause good firewalls and security setups are better than the average user's setup)

true statement

fiancee calls me a nerd all the time :P

kicks autocorrect

@Simon you do realise that by doing PWK you get forced entry to the nurd club

no-one who does that course/exam is exempt

@Simon Does it make my nurd-state worse that my pfSense firewall at home and the pfSense firewall at my parents network are connected by a point to point vpn tunnel so I can get into the systems I left back at their home? :P

5:52 PM

@RоryMcCune Only when I'll get my OSCP cert this will be true.

@ThomasW. Yeah what a nurd you are, m8.

:P

@Simon pls to complete the course, you're going to have to do nurdy stuff at weekends

pfSense master race, though.

@RоryMcCune You have no proof.

@Simon apart from the fact that there's no way your employer is going to give you time to do it all in work hours...

evening all

5:55 PM

@RoryAlsop watcha'

@RоryMcCune one of the points the IISP is (slowly) working towards...

One of the upsides of a heinous regulatory oversight on me is that I must provide appropriate training for my entire team

:-)

@RoryAlsop well sooner or later there'll be a formal drive for that sort of thing in InfoSec, although given the lack of success of the BCS in that regard, it may be later...

@RоryMcCune Ya but you have no proof that I'll actually be doing it.

However if I do have the cert, it means that either I did the course and learned enough or already knew enough.

Good selling point for me when hiring - "I have to give you this much training each year, in order to help you reach these benchmarks at points x and y"

Now you have no way to tell @@@

5:58 PM

@RоryMcCune was disappointed by BCS going off the boil on that - IISP is pushing hard, and their charter will be directly related

@Simon until you start asking @Adi and @TerryChia questions...

Crap, I was gonna say I'd delete the post but you're a room owner.

@RoryAlsop BTW did you see the new UK gov cyber security thing that got announced today

That's cheating.

Iszi

Urgh. Need to add new phone to the MAC filter on my parents' router. But the filter is full, and we're not ready to pull the old phone out yet. And I know my hardware list is out of date (shame on me) - and I'm really too lazy to bother checking it anyway.

So, gonna probably just nuke a random item and see if anyone screams.