The DMZ

2:30 AM

@Anders Yeah it seems like that's a good idea then.

3:14 AM

@JohnDoea On Information Security, there's generally not a lot of questions asking how to configure software. How to disable SSH for example is usually off-topic.

forest

4:30 AM

seclists.org/oss-sec/2018/q4/219

Glad I disabled userfaultfd() as soon as it came out. :D

Luc

9:28 AM

@forest Figured I'd ask more questions here instead of in the comments :). Any idea why md5 was designed with only 128 bits of digest then? The collision thing has been known from the beginning of hash functions as far as I know, and although md5 is from the 90s (96 iirc), it's not unforeseeable that 64 bits become iterable (especially with moore's law in full effect back then)

And md5 is deprecated for its vulnerabilities, not its inherent weakness. I feel like there's something I'm missing about this

forest

9:45 AM

@Luc MD5 was designed in 1992, and was meant to be a drop-in replacement for MD4 and MD2, which were published in 1990 and 1989, respectively. Back then, 2^64 operations just to get a collision was considered next to impossible.

Not to mention, 128 bits is still adequate for certain things (HMAC constructions, preimage resistance, simple data corruption, etc.).

Luc

then why did you say 128 bits is not sufficient to check when checking that two hashes match? If hmac-md5 is fine, and in that one inherently checks 128 bits because that's the whole digest, then checking 128 bits of a sha-256 should also be fine

again, not arguing that you're wrong or whatever, but I feel like there is something I'm not understanding

forest

HMAC is special and doesn't rely as heavily on collision resistance of the hash.

That's why HMAC-MD5 is fine despite MD5's severe collision weaknesses.

128 bits is not sufficient to check that two files match if an adversary is able to create both files (or influence parts of both files), which is a collision. A preimage attack, which is finding input that matches a specific hash that the attacker has no control over, is much harder, so 128 bits is fine for that threat.

Luc

Hmm so something like a certificate fingerprint is not fine if it were a SHA-256 truncated to 128 bits?

forest

Correct.

Luc

the reasoning being that the attacker might have had influence on the cert, since that's why you're checking: if you knew it was the right cert, you wouldn't have to check

forest

9:52 AM

Google performed 2^63.1 SHA-1 operations. 2^64 is only double.

@Luc They could certainly have influence on it. Imagine if they created a certificate for somestupidblog.com, and another colliding cert for google.com. A CA happily signs the former, inadvertently making every browser out there trust the latter.

Luc

it's not the case that to find a collision, one needs (2^64)/2 or 2^63 attempts on average?

@forest I see, that makes a lot of sense

forest

Actually the risk is even bigger. The CA could sign it and instead of just being for Google, it could sign a certificate that has flags set that allow it to be a CA itself.

Luc

sounds like something agencies would be very interested in, back when md5 was allowed in certificates. That wasn't super long ago iirc. Wonder if they could have done this undetected (so long as none of the victims notice the odd CA signature chain and publish it, that probably could have happened)

forest

Most major nation states don't need to. They have their own CAs.

The US government runs the FPKI (Federal PKI), which is in the Microsoft trust store.

Also Flame (the nation state malware) used a chosen-prefix collision for code signing.

Luc

@forest true, every time I see Staat der Nederlanden in the CA list (only a few entries below Portswigger, hence me seeing it when I check that Burp's cert is installed) I feel like my government has a root shell :P

forest

10:04 AM

heh

That's why I don't put much faith in web PKI. :P

Total operations wise, cryptographers often consider anything below 2^80 to be dangerously low. Unfortunately, it's often far easier to just steal a root signing key than it is to perform 2^80 operations.

Anonymous

@Forest, what's with the glasses?

forest

It's the winter bash!

Anonymous

Huh?

Anonymous

What's "winter bash"?

forest

stackoverflow.blog/2018/12/12/winter-bash-2018-2/?cb=1

Tl;dr there are "hats" that you can earn like badges.

You can then superimpose those hats on your profile images.

> This can also be used for benign purposes. See Bitcoin and Tor, where people generate vanity Bitcoin addresses and vanity domain names. These are examples of a partial brute force being used to get fun values.

@Luc Tiny nitpick, but that's a partial preimage, not a partial collision. :P

Anonymous

10:14 AM

Hah, I see.

Anonymous

I'm tired. I went to London with two hours sleep because I was working the night before.

forest

Also interestingly enough, Bitcoin employs partial preimages not just for vanity addresses. The entire core mining algorithm of Bitcoin relies on finding preimages. A winning "block" is one that hashes with a partial preimage with a large number of leading (or was it trailing?) zeros. That's what makes mining computationally intensive.

Anonymous

And then went to London to work, now I'm at work and my eyes are closing..

Anonymous

I just want to sleep :(

forest

@J.J It's a shame sleeping at work is generally looked down upon.

Anonymous

10:15 AM

@forest I know :p

Anonymous

I'm honestly so tired.

Anonymous

Past two days and I've had a total of about 6 hours.

Anonymous

I feel like utter shit.

forest

damn

A couple weeks ago I stayed up for almost 60 straight hours.

It was freaking weird.

Luc

I work 36h and it's often fairly flexible, so while I feel crappy for coming in later unannounced, it is an option for me to go "guys I think it's beneficial for everyone if I just catch a few more hours of sleep". Not exactly sleeping during work time, but pretty neat

Anonymous

10:16 AM

@forest How do you even do that?

Anonymous

60 hours!?

Anonymous

I should've stayed in bed for an extra hour but I didn't know if I was allowed to do that...

Anonymous

But now i'm at my desk struggling to stay awake.

forest

I felt... floaty, almost. In a bad way, not in a high way. And even after my first sleep when I woke up, I was dizzy and everything felt kind of... unreal.

I do not recommend it.

Anonymous

I don't even know how you function like that.

Anonymous

10:18 AM

60 hours awake, I'd be passed out.

forest

It's not something I do regularly. :P

Anonymous

:p

Anonymous

I might leave early today.

Anonymous

THing is, my work get shitty about this kinda' thing.

Anonymous

But honestly, I don't know if I will be able to stay awake till 17:30-18:00.

Anonymous

10:19 AM

Besides, I only got so little sleep because of work

Anonymous

So I think they owe me time.

forest

They'll always try to suck you dry.

Like a lemon, but with less citrus.

Anonymous

Yeah.

Anonymous

Can I not just walk out?

Anonymous

I mean, I got home at 23:30 on Wednesday night.

Anonymous

10:23 AM

And I had to catch a train at 5:00.

Anonymous

By the time I had something to eat, I couldn't sleep anyway, had to be up at 4:00-4:30

Anonymous

I'm actually just venting at this point.

Anonymous

I'm so pissed off.

forest

It's fine to be pissed off.

Most of these companies are evil.

But you have to work. Wage slavery sucks doesn't it.

Anonymous

And the fucker who came with me.

Anonymous

10:24 AM

He is still at home.

Anonymous

He was allowed an extra hour in bed

forest

lol why

Anonymous

But not me.

Anonymous

Because he is new.

forest

ah

Anonymous

10:25 AM

I've already had two Red Bulls this morning.

Anonymous

I'll end up on 6-7 by the end of the day.

Anonymous

10:43 AM

@forest You know all those jobs I applied for?

Anonymous

I only got a response from one of the jobs.

Anonymous

And it was a "no thanks" lmao.

forest

ouch

Are you waiting for a response from any of the others?

Anonymous

Yeah still waiting for a response from the others.

Anonymous

But, I don't think I will get any of them.

Anonymous

10:50 AM

I don't have a degree so.

Anonymous

Pretty much every job I found for a junior SOC role or something along those lines says "degree required"

Anonymous

Wankers.

forest

Well when you get a cert you might have a little more luck.

Anonymous

I have two CCNAs :o

Anonymous

And nearly two years experience working in a NOC. I mean, I know to work in security it's usually a lot.

forest

10:58 AM

Well yeah but that's Cisco.

Anonymous

But I'm applying for a junior position.

Anonymous

And not only that but I have passion.

Anonymous

I will never understand why passion isn't enough.

Anonymous

If I owned a company and someone was as passionate as I believe I am, I'd hire them.

Anonymous

Even if they were borderline useless.

forest

10:58 AM

Because they have to trust you that you are passionate.

If being passionate got you a job, everyone, even the laziest folk, would use it.

Anonymous

I mean, I think my HackTheBox profile should show I'm pretty passionate about pen-testing.

Anonymous

But, you're right. I'm just being entitled right now.

Anonymous

Which is funny, because that's one of the biggest things people complain about when it comes to millennials.

forest

heh

Create a GitHub account. Provide security fixes for a few projects.

Especially good if you do it for popular FOSS projects.

Some low-hanging fruit: Improve the QEMU syscall sandbox.

I submitted some changes on the QEMU mailing list but got irritated by their bureaucratic attitude. The sandbox is crappy so should be easy to improve.

You could also do fuzzing for popular libraries (or the Linux kernel).

Anonymous

Hmm, I guess I should start doing that, yes.

forest

11:05 AM

Get a CVE assigned for something you discover. Put it on your résumé.

Anonymous

But I don't think it will achieve much.

Anonymous

I don't think recruiters look at GitHub.

forest

Oh they definitely do.

Hell they even look at Stack Exchange.

Anonymous

I don't care if anyone disagrees with me, in my experience recruiters are very, very lazy.

Anonymous

I've only met a handful who attempt to do their job properly.

forest

11:06 AM

Only for those who want to get you a crappy job.

If they want to get you a good job, they'll be more careful.

Anonymous

The rest of them have all been lazy fuckers looking for a quick commision.

Anonymous

I get so frustrated by the job market to be honest.

Anonymous

It can be so elitist.

forest

The reason is simple: If the job is good, the company will only want to hire the best. To get that done, they'll only hire recruiters who are actually good at their job.

Anonymous

And just biased.

Anonymous

11:07 AM

So ageist.

Anonymous

Like, what they say - "it's not what you know, it's who you know" has never been truer.

Anonymous

I've never heard such a true phrase.

forest

Well that's true even for good jobs sadly.

Anonymous

Yeah..

Anonymous

Oh well, I'll find something eventually I guess.

forest

11:10 AM

Did NCC Group reply?

Anonymous

I might just have to take another contract here until I find something better.

Anonymous

Not yet, they really want me to pass OSCP before I take a job there.

Anonymous

Or rather, before they interview me.

Anonymous

But, because of the current situation in my life, I've not even started OSCP yet.

forest

What situation is that? Busy with work/wage slavery?

Anonymous

11:11 AM

That and the fact I don't always have access to my PC, yes.

forest

Why don't you have access to it?

Anonymous

Plus sorta' my girlfriend as well.

Anonymous

I'm not blaming her that's my own choice.

Anonymous

But she's also time out of my time is what I mean.

Anonymous

And uh, basically because I'm staying at my fathers but I do not have a room there.

Anonymous

11:12 AM

Because he lives with his girlfriend and her son and my half-sister.

forest

Why do you need a room? Use a laptop on the couch.

Anonymous

Cannot use work laptop for study.

Anonymous

Sorry, I can. But not for VMware or anything.

Anonymous

But I do have my PC.

Anonymous

Sometimes I cannot use it though.

Anonymous

11:14 AM

I'm waiting for my dad to finish his shed so I can put my computer in there.

Anonymous

Then I can use it as much as I want.

Anonymous

But right now it's in the kitchen, hah.

forest

11:24 AM

Can you use your laptop as a thin client for your PC?

Anonymous

Probably not.

Anonymous

Not really allowed to do anything with this laptop really.

forest

Fuck that. Do it anyway.

Not like they'll be able to tell if you use a thin client.

It'd be effectively borrowing the keyboard and monitor from it.

Anonymous

I think I will buy the OSCP material after I meet my girlfriend.

Anonymous

I mean, I can still study towards OSCP of course.

Anonymous

11:28 AM

But the actual material, I think I will wait.

Anonymous

I don't know anymore, I'm bad at decisions :p

forest

I'd do it sooner than later.

Just so it can be out of the way.

Anonymous

Yeah, that's a good point. Problem is, I already feel bad for working so much as it is + the travel. It's not fair really.

forest

You should learn to enjoy infosec. Don't think of learning as work.

I wonder if it'd be useful to memorize a complete cryptosystem...

Memorize some KEM, symmetric cipher, hash, and signature.

So it can be done by hand if necessary one day.

Anonymous

11:49 AM

@forest Funny story.

Anonymous

I might've just landed a job.

Anonymous

lmao.

forest

oh?

Anonymous

Just applied for a role.

Anonymous

30 seconds later they phoned me.

Journeyman Geek

11:49 AM

00

Anonymous

Scheduled a phone interview with the hiring manager for next week.

Journeyman Geek

That can be good or bad

Anonymous

Well, I'm hoping good.

Anonymous

Because the company the job is at is an ISP.

Anonymous

And we're partnered with them.

forest

11:52 AM

Which ISP?

Anonymous

Well, I say ISP it's more like a WAN provider.

Anonymous

Claranet.

forest

Oh gross. I've heard bad things about them.

I can't seem to remember what the bad things were though...

Anonymous

Really? :O

forest

I mean not as a company. For all I know they're wonderful to work for.

Anonymous

11:53 AM

We work with them a lot, they seem quite okay. But, I guess it's different when you're actually there.

forest

Might have been something joepie92 or someone like that told me.

Damn why can't I remember...

Journeyman Geek

Always true

forest

Oh now I remember. Some guy who used to work there.

I mentioned something about them having a good logging policy and he said he used to work there and it's rubbish. Something down those lines.

Anonymous

Oh right.

forest

(But again it might be a great place to work, just recall someone saying that)

Anonymous

11:54 AM

I guess I will find out soon :D

Anonymous

But, at least I might have an option between two companies now.

forest

I'm sure it's in my logs somewhere. Meh

Anonymous

Whereas before then I had only one option.

forest

@J.J Yeah that's good!

Anonymous

(Which was where I'm working now)

Anonymous

11:56 AM

It's cheap to commute to as well.

Anonymous

Well, not "cheap" it's £14 a day

forest

Better than flying to work every day lol

Some people do that.

Anonymous

£560 a month is not terrible, depends how much they offer me, right?

Anonymous

Flying to work everyday!? :o

Anonymous

That's crazy...

forest

11:58 AM

Yep. Not uncommon either. Especially for people with a PPL.

Anonymous

They must have crazy air miles though.

Anonymous

Buy a new bottle of perfume every week with those air miles lol

forest

Well usually they get on puddle hoppers.

Short-distance commuter flights.

Anonymous

That is crazy.

forest

They're nothing like long distance flights. :P

Usually turboprop airplanes, low (relatively speaking) flying.

And they often only hold a dozen people, sometimes less.

forest

12:17 PM

-7

Q: Can I have a pension?

I am getting old and I need money. I bet many people do, but for some reason they prefer not to speak about it. Over 8 years at Stack Overflow I scored 11k rep and some badges. There are not many answers there, as you may see below. It is roughly 64 rep per answer. I like discovering things...

I mean not to laugh at an old guy who's stressed out but...

lmao

Anonymous

:D

Anonymous

Haha.

Tom K.

Is this maybe a hat-gaining question?

hello btw

Anonymous

Afternoon Tom, how are you?

Tom K.

Great actually

Just had a job interview :)

and it went really well

Anonymous

12:31 PM

Nice! :D

Anonymous

I was complaining about not hearing back from any jobs apart from one and the one I heard back from said "no thanks"

Tom K.

sorry to hear that

Anonymous

I applied for one then 30 seconds later had a phone call and next week I have a phone interview.

Anonymous

:D

Tom K.

oh cool

congrats

Anonymous

12:32 PM

Hah, yeah - let's hope I get it.

Anonymous

I've always thought working for an ISP would be cool so we shall see.

Tom K.

by chance I saw some "top10 questions asked at phone interviews" video

maybe that's worth checking out, I've never done that

Anonymous

Yeah I will have to.

Anonymous

Considering I'm terrible at speaking to people already.

Anonymous

This will be interesting.

Anonymous

12:34 PM

I am going to fail so many interviews it's unreal.

Anonymous

But I guess it comes with the territory as we talked about before.

Anonymous

So.

Tom K.

I guess most people will anticipate that IT guys are kind of socially awkward

forest

@TomK. Actually I wouldn't be surprised.

@J.J It's a dream if you like networking.

ISPs are also really, really, really insecure.

Anonymous

Oh I hate networking Forest.

forest

12:37 PM

So it's fun to either improve or exploit that insecurity in such a position.

Anonymous

Why do you think I want a new job so bad?

Anonymous

I hate it.

Anonymous

It doesn't interest me one single bit anymore.

forest

Well I'd think an ISP would involve a lot of networking.

Though certainly not entirely. What position did you apply for?

Anonymous

SOC Analyst.

Anonymous

12:38 PM

There will be some networking, of course.

Anonymous

But not like now, now is literally just mostly networking with some light security stuff here and there.

Anonymous

This is more of an incident response type role for security alerts & incidents from customers and vendors.

forest

Ah

You don't like incident response?

Or do you mean that's what the ClaraNet job is?

Anonymous

That's what the job is :p

Anonymous

But, it says I also get to provide vulnerability feedback to customers.

Anonymous

12:40 PM

Which means I presume I will be able to do some research on these things, pretty deep maybe?

Anonymous

Which is great for me! Because I love reading about vulnerabilities, hah.

Tom K.

hey @HamZa

forest

Curse of knowledge

The curse of knowledge is a cognitive bias that occurs when an individual, communicating with other individuals, unknowingly assumes that the others have the background to understand. For example, in a classroom setting, teachers have difficulty teaching novices because they cannot put themselves in the position of the student. A brilliant professor might no longer remember the difficulties that a young student encounters when learning a new subject. This curse of knowledge also explains the danger behind thinking about student learning based on what appears best to faculty members, as opposed...

Well this explains why everyone in infosec hates how ignorant everyone else is.

Tom K.

regarding SOC analysts: really depends on how they set up their SOC

HamZa

@TomK. heya

Tom K.

12:44 PM

just make sure you don't do 1st level support :<

Anonymous

How bad will that be Tom?

Anonymous

1st line?

Tom K.

just super boring

"hi, I'm calling in because my screen is black. I guess somebody has hacked me"

2

Anonymous

Oh dear...

Tom K.

"did you wiggle your mouse?"

"oh thanks!"

Anonymous

12:45 PM

Hahahah.

Tom K.

but as I said, really depends on how they set up their SOC

Anonymous

Yeah... That is boring.

HamZa

hahaha avoid 1st line at all costs, everyone says this
unless you want a really boring job

Tom K.

some organizations have separate help desks for incident reporting, some have one

Anonymous

Yeah I don't want a boring job.

Tom K.

12:46 PM

so one for incident and one for technical support

Anonymous

This job is boring enough.

HamZa

but then again, i would say get 2nd or even 3rd line, less pressure, harder problems, and sometimes you do have spare times AFAIK

Tom K.

^

Anonymous

Yeah that's the plan, well, we shall see what comes of this one.

HamZa

^ i mean if you ever want to get into "support" but personally i avoid it :P

Tom K.

12:47 PM

that's how a SOC should look, yeah

Anonymous

I don't like support HamZa.

Anonymous

But, I don't think I will get anything else right now.

Anonymous

Being young goes against me, not knowing anyone goes against me, not having a degree goes against me, only having Cisco certs goes against me.

Anonymous

A lot of things are going against me :p

Tom K.

but if the SOC is setup bad, they don't have 3rd level support for instance. so 2nd level does everything from antivirus to company-wide anti spectre controls

you should really practice to re-formulate all of this for your interviews

formulate everything positively

Anonymous

12:48 PM

I don't know how people do that.

Anonymous

I mean, I don't know how people spew corporate/HR bullshit.

Anonymous

I don't get it, it's just bullshit... Literally.

HamZa

the art of bullshitting really
and the more you get yourself into these situations, the better you get at it

Tom K.

"I'm young, I'm flexible therefore I learn quickly. I don't have a degree yet, but IT is unstable - as we all know - and learning comes from doing, and I do a lot, for instance X, Y and Z. And although I'm only 18, I alread have Cert A and B, and am training for Cert C in my free time."

HamZa

and i must say, i was really against this kind of art, but lately, i've seen my colleagues do it during client meetings and i can say, i'm amazed and i'm using these techniques now too

Anonymous

12:50 PM

^^ doesn't sound like anything that would ever come out of my mouth Tom

Tom K.

always say what you do or did and associate it with something that you need for the job

Anonymous

Looks like bullshit, reads like bullshit, smells like bullshit.

forest

@TomK. It must be hard to hold back from trolling them.

Tom K.

@forest I've fortunately never done this in my life, but I heard it's like this from colleagues

the reality is, you can't troll people, because you have a 100.000 tickets open, with more of this BS

HamZa

@J.J no no no, look at it from their side, if you're going to talk badly about yourself/give negative energy, ofc they will get a bad feeling

Tom K.

12:51 PM

exactly ^^

Anonymous

Yeah but it just makes me cringe.

Anonymous

Life would be easier if everyone was just honest.

Tom K.

No, life would be awful :P

Anonymous

Why? :O

forest

Life would be more funny.

HamZa

12:51 PM

there's just one BIG RED FLAG you never should do and that is LIE blatantly about your competences

Anonymous

Oh I wouldn't do that HamZa.

Anonymous

I don't want to be like the guys we have here.

Anonymous

I call them "blaggers"

Tom K.

yeah, overstate, but too much

Anonymous

Because all they do.

Anonymous

12:52 PM

Is bullshit.

Tom K.

damn man, HamZa has all the skills

:>

Anonymous

Like the guy I argued with about crypto.

Anonymous

Pure bullshitter.

Anonymous

Thought he knew everything, and instead of admitting lack of knowledge he just lied instead.

Anonymous

^ too many of them in IT.

HamZa

12:53 PM

@J.J it depends really, sometimes you have some people with the "Dunning-krugger syndrom", sometimes you have people with "imposter syndrom"

some people litterally have no idea about their damn level

Anonymous

To be fair, I don't know about my own level but I don't go around lying.

Anonymous

lmao.

forest

lol I alternate between worrying that I'm trash, and convincing myself I have imposter syndrome and that I'm actually really good. It doesn't help that I try to hang around people who have been doing infosec for far longer than me.

Anonymous

I stick on worrying I'm useless.

Anonymous

99.9% of my waking hours.

Anonymous

12:56 PM

I don't understand how you "sell yourself"

Anonymous

It is so cringe to do it.

Anonymous

It makes me feel like a little wanker.

Anonymous

It's the closest I will feel to a salesman.

Anonymous

lmao.

Anonymous

(I bitch too much I realise, heh)

forest

12:57 PM

It's whoring yourself out. It never feels good.

Anonymous

Yeah it literally is doing exactly that.

Anonymous

I don't like bigging myself up at all.

Anonymous

I'm just me.

HamZa

some people honestly thing they know a lot :P
but hey, pro-tip: watch some videos/articles about interview techniques. One of the best personal investments, small things matters
For example, some people suggest to be able to say like X positive things about yourself, you might get asked such questions, and you will need to be able to answer them
and then the "killer" question is "somethnig negative", and the art here is to be able to state the negative thingy while turning it into somewhatpositive, but don't make it too cliché "im a perfectionist in my job, i will sometimes take more time t…

Anonymous

Nothing is perfect.

Anonymous

12:58 PM

Not even Keira Knightley is perfect.

Anonymous

/shrug

Anonymous

But I will look at some interview technique videos because I will really need them.

Anonymous

lmao.

Forrest

@J.J Then think of it as selling your ability to get things done.

Transcript for