The DMZ - 2020-06-08

« first day (3462 days earlier) ← previous day next day → last day (1435 days later) »

6:55 AM

How do you train ne pentesters besides giving them some boxes?

How do you train new pentesters besides giving them some boxes?

5 hours later…

11:57 AM

@JohnZhau Learning by doing. Once you feel like they have the basics down, let them do a pentest together with a more experienced pentester. This should teach them new tricks, and they get to perform pentests on some real targets

The biggest difference between a "real" pentest and a CtF-box is that a.) the real pentest only has very limited time and b.) you don't know if the real target actually has any vulns.

That means in a CtF, you know roughly where the vuln is and you can spend an obscene amount of time trying to find the exploit. In a real pentest, you have to manage your time. If you only have 5 days, spending 3 days trying to see if you could get a CSRF to work is not viable.

It is the unfortunate reality that we as pentesters are limited in our time. Sometimes, we can only glance at a function for a few minutes before we have to continue to the next one.

12:16 PM

Also, a good skill for a pentester to have is to make a good judgement about how long a pentest for a system will take. You don't want to estimate too low, or you stress yourself and you won't be able to test the whole system as thoroughly as you need to. If you estimate too high, the customer may want to go for a different tester that promises to do the same but faster (and cheaper)

In short, the exact same set of skills needed for any other job. Accurately estimating time is always the hardest skill to learn...

There's a "thing" about that, what's it called again?

...

Ah yes!

Hofstadter's law

Hofstadter's law is a self-referential adage, coined by Douglas Hofstadter in his book Gödel, Escher, Bach: An Eternal Golden Braid (1979) to describe the widely experienced difficulty of accurately estimating the time it will take to complete tasks of substantial complexity: Hofstadter's Law: It always takes longer than you expect, even when you take into account Hofstadter's Law. The law is often cited by programmers in discussions of techniques to improve productivity, such as The Mythical Man-Month or extreme programming. == History == In 1979, Hofstadter introduced the law in connection with...

That needs to be bastardized into a chuck norris saying

"Chuck Norris knows exactly how much time he needs to kill you"

Tasks estimate how much time they need to be performed by Chuck Norris.

Except it's just not a very obvious reference... Someone needs to help me out here...

:) There we go, much better

And yes, you can never really accurately estimate, and new things will pop up all the time. But it's a good skill to know when your estimate is "off". Like, I was asked once about how long it would take to test a "simple" web application, which does some simple things.

On the first day, I saw it only had like 5 functions. Then I gave myself admin rights and...OOF

200 or so functions

I was like "Yeah, no."

Chuck Norris makes the build environment sane.

I'll stop now

:D

:) I've never actually seen a "simple" web application

Chuck Norris knows if the program will stop or not, and makes it stop if it disagrees

12:30 PM

Well, I have seen some. They are designed to really accomplish one task.

No, it's just not quite nice enough... I'm not good at these, lol!

Just say "Chuck Norris knows if a program will halt."

That's good enough

Yeah, I'm trying to hard

For example, I saw a web app once that shows you a list of things, and if you click on one of them, you see details about the thing. And you can search things. That's it

No data is being written at all

Netflix released a "documentary" about Jeffrey Epstein. My wife watched it this weekend. A bit sad that I didn't have the time.

I'm dubious about these netflix documentaries

12:32 PM

Yeah, ever since goop Netflix has lost all reputation

And it makes sense for them to publish every shit. More stuff to watch yo

The stuff people want to see isn't there

Like Shrek 1 or 2

Only Shrek 3

Who the fuck watches Shrek 3?

Shrek one was pretty good. They should have stopped there

Yes, I really enjoyed it. The dialogue is a lot better than it is given credit for.

People just see the "Shrek is gross lol" side, but it actually has quite the character-driven story.

@ConorMancone Chuck Norris's Law: Chuck Norris can always kill you faster than you expect, even when you take into account Chuck Norris's Law

Also I found out that Touhou InfoSec memes are on the rise, which I am very pleased about

@FireQuacker Okay, that one definitely wins

@MechMK1 Touhou?

12:43 PM

@ConorMancone The game with the girls and the bullets

user image

Aka "Beat Touhou on Lunatic and you can walk through the rain without getting wet"

Chuck Norris can beat Touhou with a keyboard that ghosts

@ConorMancone You know all those videos he keeps posting

The ones with the catchy music

(Not to be confused with the other ones with the catchy music which aren't Touhou)

I'm pretty hit-or-miss on videos: I work from a VM and videos tend to lag/crash it, so I only open up videos if I happen to be on my phone when they get posted

境符「ＩｎｐｕｔＯｕｔｐｕｔ」

My memes are so obscure not even I really get them

Chuck Norris understands my memes.

@MechMK1 Man, why are Chuck Norris jokes always so good :)

The worse my memes get, the funnier the joke becomes :D

12:55 PM

@ConorMancone Because they have Chuck Norris

My jokes are never funny so I'm going to totally steal that from you in the future. "Me: [Bad Joke]" -> "crickets..." -> "Me: Chuck Norris gets my jokes"

Just pretend that your jokes are actually suuuuper subtle references to a thing people have never heard about, like Canada or something

I miss forest :/

Me too

And J.J as well.

I thought J.J was still around

1:02 PM

J.J and forest are not the same person

Right. Forest is probably still working on that long-term thing. But I thought J.J was active comparatively recently.

huh

yeah I've seen J.J some time ago

maybe... 6 months?

dunno

No, he was here more recently, like a week or two, but didn't stay for long

And forest was around like a month or so, just to say hi and let us know he's still alive and breathing

ah... so I see now that MechMK is talking, because his icon slided to the right

eerm to the left

what an observant boy I am

I guess that's how J.J came into the conv

@TomK. Okay, Mech said that he missed J.J (J.J showed up a few weeks ago). He also said that Forest was around a month ago or so, said hi and that he's still alive.

1:11 PM

thanks for the effort, but you don't need to do that

Are we really playing the "I'm muting him but I want to know what he said"-game? Jesus...

Not even my parents acted like this during their divorce

So, how about that USBGhost thing?

Totally caught me by surprise

I'm not even sure it counts as a vulnerability if it doesn't have its own website

I love how great you are with changing topics :P

What's that?

but didn't I give my peace about this already?

1:14 PM

Typo on my part

I meant SMBGhost

Them three letter acronyms...

SMBGhost is a wormable SMB 3.0 vulnerability

the other one was usbculprit

Hypothesis: All three-letter acronyms are basically interchangable

Don't want to sound cocky, but zero surprise tbh

Microsoft patched the NSAGhost vulnerability 2 months ago, but of course people may or may not keep up to date with their patches

I honestly wonder why SMB gets so many vulns

1:17 PM

it is just a matter of time until a new wannacry is being released

Is there a workaround for SMBGhost? Like, disabling SMB?

Well hopefully everybody has shut down any external facing SMB (or has patched it) to avoid worms

Which is why I think actually very few private users will be affected

@MechMK1 There was a patch 2 months ago

the vector is more likely going to be wormable through RDP or mail attachment

1:20 PM

Ah, then I probably have it installed

bleepingcomputer.com/news/security/…

Story from when the Windows patch was released: bleepingcomputer.com/news/security/…

Pretty cool vuln though. I'm sure a lot of effort went into that PoC. Perhaps in a few months we'll see something more stable and actually a metasploit module

that's not really a patch though, is it?

it's just a registry entry

Ah yes, now I remember!

I hate these security advisories by msft, they are always so obscure..

1:28 PM

I remember when it came out, and people rushed applying the hotfix. A patch was released soon after

@TomK. I guess Bleeping Computer didn't cover the actual patch. This article does: nakedsecurity.sophos.com/2020/03/16/…

So KB4551762

2:02 PM

hi guys! just moved to another house... all my things scattered around, internet still not connected, using hotspot to work, and kids having classes thru zoom...

it's going to be a messy week

Congratulations on the new house!

@ThoriumBR Nice, congratulations! I hope things are going well for you and your family

it's not mine, it's rented, but is bigger, and there's a spare room to be my office now.

That's so nice. I really enjoy my own apartment, but I am genuinely lacking space for my hobbies there

and I moved from my department to another, so I will be on home-office all time now

2:05 PM

>tfw no dedicated gun room

and a spare room means I can close the door and kids won't throw my notebook from the table anymore... hopefully

@ThoriumBR That's until they learn how to traverse through the vents

2

no gun room? that's really unfortunate... here we have gun streets, gun parking lots, gun highways...

Every place can be a gun place if you bring a gun.

in underdeveloped Brazil, the gun brings you places...

here we have something called "flash hijack:" an armed guy grabs you, puts on the car, gets your card, and drives around the city withdrawing money from ATMs, to bypass withdraw limits

2:11 PM

That sounds quite unpleasant

and there's the fake hijack too... people calls numbers around saying they hijacked your son or daughter, and an actor screams "mommy, please help, they will kill me" and things like that. they demand you to buy gift cards and send them the numbers

the sister of my wife got scammed like this, they said they got her daughter, and when her son tried to call the sister, he had the wrong number of her own sister, and the call never completed...

Wow

I told my mother to every time someone calls her about her son, to ask which one of two wrong names is the son in question. if they choose one of the wrong names, hang up.

That's honestly fucked up

Brazil is not for amateurs... Now there's fake "Home covid testing" on the richer neighborhoods in a van marked with Health Services driving around, people dressed as health workers and stealing everything they can put in the van.

2:21 PM

@ThoriumBR That's smart

@ThoriumBR Yeah, my mom asked the same thing when the home Covid tests started

"But what if people just come up to you in a van, full face mask and everything, and ask to come in to test you. Nobody would be able to identify you. Nobody would bat an eye"

we Brazilians are known by our creativity, but the bad kind of creativity deeply saddens me

@ThoriumBR if I may: why was the number wrong? did he just have the wrong number by chance or was that part of the scam?

One can hope that in the coming decades, Brazil's economy will grow and improve the status quo for everybody. I think a higher standard of living for the poor does well to reduce crime

the amount of email based scams I receive range from obvious scams from barely literate guys, to professional looking ones with official terminology, official links going to real government sites, real data on you...

@TomK. she got a new number and he mistyped it, and they lived together so hey never called each other

2:26 PM

@ThoriumBR Not too surprizing. When you're in a stressful situation, you make lots of "stupid" mistakes

@ThoriumBR ah yeah, I can see that happening

they were like 20 and 22 yo, and not getting that much along, so I am not surprised he had her number wrong for a year and not noticing...

If you don't mind me asking, what does the "lockdown" in Brazil look like? Or did they already lift it? I'm a bit behind. From what I can gather the president of Brazil doesn't sound like he wants this to destroy the economy, although he's getting a lot of flack for it.

Although my own expectation is that an actual country-wide lockdown isn't actually possible in Brazil anyway, so any attempts to do something about this would be largely ineffective anyway...

@ThoriumBR Are you born and raised in Brazil, or move there from elsewhere?

@MechMK1 I don't hope economy will get better. government works only for votes, so long-term planning does not exist. people think on what they will eat tonight, not on what they will eat in a year from now. Education is a joke, as you cannot fail anymore by decree... so if the passing grade is 6, the minimum grade you can get is a 6.

@ThoriumBR How do you think the situation in Brazil can be changed for the better?

2:30 PM

New president maybe?

Though that's probably just a start

I am Brazilian, like my parents and grandparents, but my parents were as honest as they could think was possible, and told us to never ever behave like our people. And I like to read a lot, so on a 4th grade I already read lots of ancient history, the US history, the European history, and our history, and got sad...

how could you not

I am planning to move overseas, but this pandemic threw a wrench on my plans

I hope your plans will still work out long time.

lockdown is city-based. where I live the schools suspended service, churches closed, the commerce stopped for everything but pharmacies, grocery stores, pet shops, and emergency services. now they are reopening because the hospital occupancy is around 35%

@FireQuacker no, we need to get into war against Germany, obviously lose, be occupied, and they rebuild our country like they did twice...

2:34 PM

Another german expansion, hm?

Ah shit, here we go again

@MechMK1 lol!

Grandpa, how did WWIII start?

You see, it all started in this chat room called The DMZ...

seriously, we need a rupture. Brazilian culture does not help long term... kids want to play soccer, not study. elementary schools work only the bare minimum to give you a diploma. kids that study are bullied. people that get more change than it was right and give back the change are ridiculed...

A culture of egoism takes a long time to change

people call the politicians for being corrupt, but they use devices to fool the power meter, fake medic bills to pay less tax, buy a dress, go to a party, and return it the next day...

2:37 PM

Yes, because if I do it, then I'm being smart, not corrupt.

the even get expensive toothpaste, put in the box of the cheaper one, and go home

It reminds me so much of greece, holy shit

a little like Greece, but worse. here even the phone company robs you. I was charged international roaming on a 3g modem that never ever left my home... and took 3 months to be reimbursed

A cultural change takes several generations to complete

I bough a used phone by internet (my primary was stolen), didn't liked it, returned it, and they gave my money back only 17 months later...

and that from a company specialized on selling used phones

2:40 PM

damn, son

Yeah, well, they specialize in selling them, not in refunds. Duh!

@MechMK1 or a catastrophe... like a war.

That too. Though hard to see what the concequences will be

I'm not too well informed about Brazilian history, but I think the last war didn't turn Brazil into a good place for some time

For example, WWII had quite the enormous impact on women, as many women entered the workforce at that time and played a substantial part in the effort to rebuild. As such, the vast majority of them wanted to be considered equal to men for their efforts

2:42 PM

war does not solve anything, but brings to your mind what really matters. look, Brazil have plenty of farm land, lots of rain, we don't have earthquakes, no tornadoes, no volcanoes, no deserts, no freezing winter, no melting summers (they are hot but bearable), one of the largest coast lines, we have everything we needed to be one powerful and prosperous country... but still...

most of the time a lot of people die, a lot of people experience trauma which is rippling through generations, people get maimed and raped.

@TomK. the last war that Brazil really involved itself was against Paraguay 2 centuries ago... fought most by freed slaves, and most of the country don't even realizes we were at war. we sent a couple battalions to first and second world wars, but most of our economy was barely touched by them

It makes me wonder, if you put a civilization with a culture surrounding cooperation and strong work ethic into a country with very lacking natural resources, and a civilization with a culture surrounding egoism to the point of corruption from every side, to a country extremely rich in natural resources.

100 years later, which country would be better off?

100 years? It would take 20...

compare Japan with us! they lack land, food, energy sources, have earthquakes day and night, have integration issues because of the islands...

sorry, I really don't want to lecture you about your country or your culture, but what about the military coup (maybe not a war) which installed the military dictatorship?

2:48 PM

here there were the dam bust from a mining operation that leveled a 600-people village, the government went there to give money to people rebuild, more than 5k showed up saying they lived there.

@ThoriumBR Oh dear, that reminds me of something, but i can't put my finger on what...

government gave money to poor families to buy food, and caught the mayor of a city using the funds to buy things to his pool...

@TomK. for most people, it didn't mattered much. people say that history is written by the winners, but not here. here the history is written by the left. they exaggerate the troubles of the dictatorship, and it was not even close to what we call dictatorship today... some people died, on both sides, but the population didn't even cared.

Just because problems seem overwhelming (like symptomatic corruption) it means that there has to be a war? wtf?

what do you mean by "exaggerating the troubles"?

we as a country don't care much about politics, it's like football fans. if you are a leftie, the righties are allways wrong, and vice versa. the president does not matter much, because the congress is the main money drain, and people don't even remember who did they voted for after a week.

@TomK. no, far from that. I don't want a war in any way, time, place, mode or form... but I don't believe our society will improve by itself, because every generation is worse than the previous.

sure, there has to be a will within a society to change

2:54 PM

@TomK. and I read a study from MIT some time ago that says that history shows that the only thing that can radically change the course of any society is catastrophe.

we don't have any will to change. nobody wants to pay the price to be honest when everyone around isn't. I faithfully pay my taxes and my colleagues make fun of me.

pretty sure there are some other ways as well. the Roman empire changed dramatically over a period of freedom and prosperity..

I tell my kids to tell the truth, to never get home anything that isn't theirs, to help others, and the other parents keep an eye on the toys from the others to steal them

okay.. everything sucks, nothing changes, I'm not in your position, but I think I get an idea of how frustrated you are

but do you think you will be more content when you leave Brazil?

@TomK. some leftist leaders were jailed, some killed, some exiled. some universities lost teachers to jail or exile. but if you take into account that some of those were putting bombs on the house of the governor, or robing banks to finance their operations or hijacking foreign ambassador, I am not surprised...

@TomK. I spent vacations in Toronto. there is a box on the front of the bus were your put $3 for the fare and nobody will look if you really put $3 or not. Here we have a gate with a guy taking your money.

I spent vacations in Berlin. I got a train from Amsterdam, nobody got my train ticket until 6h on the trip... here there's a gate to you show the ticket before you get to the bus depot, and a guy outside of the bus taking the ticket again.

I live in Berlin, and I can tell you, I get checked for tickets regularly

and I as a white person have got off with warnings several times, when not having a ticket, but I have seen a lot of non-white people instantly gotten shouted at when they didn't have a ticket. so the grass isn't always greener on the other side

3:03 PM

It wears me down to live on a society that you have to consider everyone as dishonest trying to rob you, all the time... spending a month in Berlin and another in Toronto, seeing people left their iphones on the table to keep the place, 20 yo girls walking home alone 1am and crossing a park makes me even sad... in other countries there's crime, of course, but you don't have to be on guard every single second.

@ThoriumBR Lefties being extremists again. What a surprize and a totally unforseeable turn of events

sorry, I can't follow. what makes you sad about the iphone or the girls in the park?

@TomK. the girl would never be able to walk alone if she tried this here, and the iphone owner would never ever see his phone again

ah okay

here people take your phone from your pocket in the bus

3:05 PM

yeah, I get that

I always have music playing on my phone in the bus, because if someone takes it, the music stops and I shout

as I said, there are other problems here

Wow again

but I get, that these feel different or "better" in a way

there's the "pyramid of needs", correct? there's the pyramid of troubles too... if you are not minding your survival, you are troubled by comfort, by the music your neighbor is listening to, by the color of the shirt of the president.

3:08 PM

first of all, this pyramid of needs concept is absolutely outdated

you can put your creativity to solve "high level issues"... here we are not fighting for survival all the time, but the personal safety is the issue that takes more "brain cycles" down here...

secondly, surely, the problems in Germany or other industrialized countries are systemic in their own way as well

@TomK. sure, but if you don't have anything to eat, you don't care about your safety when you jump a fence to steal from someone

In what way is the pyramid of needs outdated?

"Maslow's hierarchy of needs is often portrayed in the shape of a pyramid with the largest, most fundamental needs at the bottom and the need for self-actualization and transcendence at the top. In other words, the theory is that individuals' most basic needs must be met before they become motivated to achieve higher level needs.[1][7]

However, it has been pointed out that although the ideas behind the hierarchy are Maslow's the pyramid itself does not exist anywhere in Maslow's original work.[8]"

3:11 PM

I believe there can be better explanations, but that pyramid explains a lot of things

whatever, let's not talk about maslow

I don't see how that outdates the concept. To me, it seems to be quite accurate on a high level for most people

swiss people can get around the plaza and vote on any issue they have, somalians in perpetual hunger can only rent a couple ak's and hijack a vessel, justice be damned

Sure, one can always purposefully violate the ideas set forth there, but any social "law" is merely a description of how the majority of people would react.

If I were in a situation in which I had no way of having food or a home, then societal prestige is the least of my worries

not that's the correct thing in a long shot, but as in Minority Report, when things get hard for any species, survival is the only thing that matters

3:15 PM

the criticism part of the wiki article is okay-ish, but as I said, it's not really used in social sciences anymore

after all, that's just the wikipedia article

anyhow

last question: do you feel any obligation to stay in Brazil?

you know, as "one of the good guys"?

@TomK. not much... I care a lot about my kids, and seeing them incorporating some behaviors from their friends concerns me a lot...

ah yeah, that does sound concerning :(

how old are they?

it's difficult to do the right thing when you are alone, inexperienced, and against the group... I had good friends from good families, bu I cannot count on that for them... they are very young (7, 3 and 1), but the older one already comes home talking about wrong things her friends did and said, and in a way that makes that fell cool...

like finding a nice pen on the room, and waiting to the owner to go home so they can keep the pen...

ah, so she manages to work against the group

I see

we teach her to never get home with stolen things, and she never did, but it's difficult to teach them that all her friends are wrong all the time...

3:20 PM

ok, I gotta get back to work

yeah, that really sounds tough

if you are ever in berlin again, hit me up ;)

bye for now

bye!

6 hours later…

9:22 PM

32

Q: 4 clicks to shut down Ubuntu - can we reduce this?

Ubuntu 20.04 has decided we need 4 clicks to shut down: Click top right of screen arrow-down Expand "power off/logout" panel Click "Power off" Confirm you want to power off by choosing power off vs reboot etc Let's cut out at least 2 clicks here... how? UPDATE: This is a "Lounge PC" - operat...

20.04 shutdown gnome-shell

How often are you shutting down that this is such an issue? — developerbmw yesterday

I really like how Linux distros went from "You can have everything set up how you want it" to "Why would you want to simplify a common task?"

Ubuntu gets less usable with every release

« first day (3462 days earlier) ← previous day next day → last day (1435 days later) »

Transcript for

Jun '208

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile