« first day (919 days earlier)      last day (3982 days later) » 

12:13 AM
Anyone active? Have a question
 
1:10 AM
@arvid YT has not worked properly for me in 3 to 6 month, even with flash fully up to date
 
1:22 AM
@Phorce Shoot.
@Hennes It's been flaky for me. I don't typically have problems on the site itself, but I see 502s on embedded videos off and on.
 
 
5 hours later…
6:28 AM
@LucasK In case you are interested, I finally solved the login bug in my flask app. Turns out to be a very obscure case of object types...
Took me about an hour stepping through a debugger to figure it out....
 
7:19 AM
@TerryChia the joys :p
 
 
2 hours later…
9:17 AM
@Xander Got an email from someone I think is suspicious which contained an attachment. I'm on a mac, and, instead of downloading the attachment I just pressed "Quick Look" - Is it worth carrying out some visus scanner?
 
 
2 hours later…
10:53 AM
Hellllo everybody!
 
hey :)
 
@RoryMcCune Looks about right! Especially the part about eating the Swedes. if you know what I mean
Damn! SSHing to home which is VPNed to work adds tons of latency
@Manish so what's up?
 
Nothing much
 
Super excited!!! Ensiferum will play tonight! @Poly you jelly? :D
 
10:58 AM
Just shifted from using a 7-year old laptop that's about to die to an 8-year old laptop (XP) that is losing pixels one by one :P
(Only for a week or so, then my new laptop's coming in)
@RoryMcCune That picks up my intranet IP. Geolocation would work better if it picked up my internet IP :P
 
@ManishEarth interesting for me it got my Internet one. still wasn't mega accurate (thought I was in London)
 
I'm on a /8 subnet
10.*.*.*
 
@ManishEarth and it showed that one the page..? RFC 1918 addresses shouldn't leak on the Internet. That said I did see some in a traceroute the other day
what do you get if you visit icanhazip.com ?
 
103.21.127.55
My proxy exposes IPs, I think
lemme check
 
most've those services just check who's connecting at an IP level so will get proxy stuff or your firewall, was just odd that the prism one got your intranet IP (the 10.x.x.x one)
ahh I wonder if that's the x-forwarded-for thing could be I guess.
 
11:06 AM
Yeah, XFF
 
icanhazip wouldn't do that I guess woudln't be too useful as it's meant for letting you know what external IP address you're showing..
 
I'll just check my external headers with a small PHP script
downloads putty
grumbles
 
heh, it'll be that I'd guess tho' couldn't think how else they'd get your internal address without some serious hackery, which would be a bit much for a joke site....
 
Grr php no worky
@RoryMcCune yep, it was an XFF header
@RoryMcCune I think they used the XFF to just add a level of creepyness to those behind a proxy :P
 
 
4 hours later…
2:56 PM
@ManishEarth I was under the impression the guy only wanted a way to modify the URL of the current page, nothing about switching domains.
 
@Adnan just ordered a CP99 from Walther
 
@TerryChia Phishing
That's a pretty rare use case if you're phishing on the same domain
 
@ManishEarth Oh hmm. I get what you are saying now. :)
Yeah, read that trick wrongly.
I need 2 more downvotes on that answer! :P
 
Hey, I'm Google! I'm going to phish....wait for it....Google! Yay! I'm evil!
 
Might as well get the peer pressure badge.
 
2:58 PM
@TerryChia badge whoring?
 
@ManishEarth You know it!
 
WHO WANTS TO DOWNVOTE @TERRY???
:P
 
-1
A: URL & address bar spoofing, only possible on rogue access point

Terry ChiaThis is indeed very possible with most browsers. See this link for a nice explanation on how to pull it off. In general, the only thing that can be trusted in a browser is the padlock indicating that the page is served through SSL. Any other object on the browser can be manipulated some how or o...

Gogogo!
So hmm, assuming that the network connection/DNS you are using is 100% secure, the URL bar can be fully trusted?
 
@TerryChia Well, unless there's some Java magic going on
IIRC Java applets can't do this, but JNLP-launched things can
Also, your own computer must be secure. Obviously :P
 
@ManishEarth JNLP?
@ManishEarth Obviously! heh
 
3:01 PM
(I once modified the hosts file of a friend and left it that way for a week. Not phishing, but I made some annoying changes; like Google-->AskJeeves!. Poor guy :P )
In computing, Java Web Start (also known as JavaWS, javaws or JAWS) is a framework developed by Sun Microsystems (now Oracle) that allows users to start application software for the Java Platform directly from the Internet using a web browser. Some key benefits of this technology include seamless version updating for globally distributed applications and greater control of memory allocation to the Java virtual machine. Functionality Unlike Java applets, Web Start applications do not run inside the browser. However, by default they run in the same sandbox as applets, with several minor e...
Basically, click link on Internet, download file, shiny Java magic happens
 
@ManishEarth What? You don't access Google through http://173.194.38.135?? I thought everyone does that.
 
lol
 
@ManishEarth Ahh.
 
IIRC applets can only make new windows outside the browser content frame, and the windows have headers which can't be removed. Or something like that
 
@ManishEarth Meh it's Java. The less I know about it the saner I will be.
 
3:04 PM
@TerryChia Everyone calls it JAWS, but I came to know of it after downloading a JNLP file so I call it JNLP :P
@TerryChia Ha!
 
@LucasKauffman I'm not afraid. I know a girl from Nebraska.
 
@TerryChia I don't follow
 
@LucasKauffman TBBT
 
3:08 PM
aaah
@TerryChia I hope she didn't touch you in your special place like that
 
@LucasKauffman Come on, downvote me. You will get back your rep when I delete the answer. :P
 
@TerryChia With luck, your downvote-whoring will get me a few upvotes too :P
win-win
This is why we should downvote ALL THE POSTS
 
3:48 PM
My dad bought this apple tv thingie, it's pretty cool and works quite decently
 
nice
 
 
1 hour later…
4:53 PM
Okay guys I need some help. I've just about had it with my brother thinking he knows anything... for example just minutes ago he said "We're probably getting DDoSed. My friend has a 30k bot net and he said he was going to DDos me."
On top of that he kills everyone elses connection due to his malware / spamware ridden computer he insists is perfectly fine. Anyone got any network monitoring tools? I want to prove to him that his computer does suck up all the bandwidth and that he needs to fix it. BTW I restarted the router so we weren't actually getting attacked.
 
... wireshark?
 
@Griffin What @copy said
You can also teach wireshark/ettercap to just drop all his packets rubs palms
 
"The NPF driver isn't running. You may have trouble
capturing or listing interfaces."
 
:(
Sorry
They unplugged the router -.-
I hate stupid people
@ManishEarth And yea that's what I thought
Got it
@ManishEarth Would you mind assisting me in doing this. Haven't used wireshark.
 
5:06 PM
Huh
I dunno really
 
Dunno what?
 
If you install ettercap and run it with the appropriate flags, then Wireshark (run as root) is easily configured to pick up stuff
@Griffin how to help. I have used it only a little
 
@ManishEarth At this point I'm not even sure what to set for interface settings >.<
 
eth0?
First, get linux :P
 
Then I'd have to get out my laptop -.-
And my laptop dislikes linux
But I force it unwillingly upon it.
Actually all it really hates is any form of internet connection
Drivers man drivers.
 
5:11 PM
@Griffin what you do is, you sneak into his room, boot a live of ubuntu and dd the first 40 MB of his drive with random stuff
"Oops your drive must be corrupt"
 
HA!
 
@LucasKauffman See I have done things (less mean than that) before.
So now I am #1 suspect.
My mom blames me when the internet goes out...... during a power outage.
 
hello friends
 
Hello <3
 
how are things going this morning?
 
5:14 PM
Not well
 
@Griffin oh no! who hit you?
 
@Griffin you could set your own router with linux install netop and perform bandwitdh shaping
 
@LucasKauffman Can't again I would if I could.
@GreenFly It's not who hit me it's about who I'm about to hit.
 
@Griffin well you could try to abuse his machine when he's actually using it and destroy it
 
@Griffin boot from a live pen drive. If you do that with Backtrack, everything will come preinstalled
 
5:16 PM
also mind that all of these suggestions aren't really considered "ethical"
 
But wha about Kali
 
@Griffin TomAto tomAHto
 
Exactly the problem Lucas or I would of done a lot more than that.
 
@Griffin kali is the same as BT3 just different organizing
 
@Griffin then things are very well
 
5:17 PM
I thought they moved it off Ubuntu also
And got rid of a bunch of dups
 
@GreenFly loved that story with the magnetic card, why did they target your stash?
 
Wait
I want a story
 
@Griffin read my question and comments security.stackexchange.com/questions/37227/…
 
@GreenFly I want more details, what did the old aquintance want to steal from you?
and where did you know him from?
 
@GreenFly My big question is what are you going to do now? The guy did some pretty clever stuff.
 
5:20 PM
@LucasKauffman long time ago I dated colleague's ex girlfriend. He was very angry with me and it appear he never forgot.
 
@GreenFly So he stole your stuff?
 
@GreenFly so what did he want to steal, I mean cloning an RFID card isn't really considered to be something petty thieves do
 
@GreenFly Or for a hit or miss kinda deal
 
@LucasKauffman btw, barring any rules by the owner of the network, is it legal to spoof within an Intranet not owned by ou?
 
I think that's still undecided.
 
5:22 PM
@ManishEarth depends on the intentions
 
I remember watching something about that.
 
@LucasKauffman Good intentions :)
 
Better question. How likely are you to get caught?
 
@Griffin Don't care.
 
well, just keep in mind, if something bad happens and someone sees it and decides to sue you, will the judge thing you had good intentions too?
 
5:23 PM
I've already done it; my uni has no rules on this and I've submitted a report on it.
 
@LucasKauffman he knew that I had some wwii items that mean a lot to me and then sell them
 
@Griffin depends on the type of spoofing, ARP spoofing can really take down a network if you aren't careful
 
This question was just academic
 
@ManishEarth riiiiight academic ;D
 
I'm pretty sure there are laws against ARPing an internet network
 
5:24 PM
@Griffin I don't think so,he knew exactly what to steal
 
And i'm quite sure it's legal to spoof my own network
 
It's like: "for educational purposes"
@ManishEarth sure if you are the network owner
 
@LucasKauffman I was more think the tech level of the people being spoofed
@GreenFly Sounds like he was hired 'o.o
 
@GreenFly guns?
 
I was just wondering what the law was when you spoof --say-- a university network with no prior permission -- can the government prosecute you?
 
5:25 PM
@Griffin I have all that in the question and the comments
 
@LucasKauffman Well, yeah, I finished my report so I don't have any need for spoofing. ( secretly rubs palms )
 
@LucasKauffman old ones yes,among other items
 
@GreenFly Yea I reread it. So what are you going to do about it?
 
@ManishEarth that will depend on your intentions, just spoofing for spoofing nobody will bother with seuing you, spoofing to steal data, ... different story
 
@LucasKauffman I think the reasons was personal more than the value of the items
 
5:26 PM
@GreenFly a Walther P1? :O
I love that gun
 
@LucasKauffman k, I see :)
So if caught and they decide to prosecute, I'm doomed
 
@LucasKauffman Yet spoofing for spoofing and spoofing for stealing is a line that, depending on your lawyer, doesn't matter.
 
@Griffin it does actually
 
@Griffin LOL
 
Maybe you forgot to take down?
 
5:28 PM
@Griffin because the result of the spoofing is what you will be accounted for
 
Opps
And isn't there a base punishment like with credit card fruad?
 
if it's spoofing because I wanted to try and I took down the network accidently is different from spoofing and hey what's all of these logins on my computer from random users
 
What if they catch you in the act then? Result unknown?
 
@LucasKauffman no,but there was luger p8 in the box
 
@Griffin yea CC fraud will send you to jail for YEARS
 
5:29 PM
@LucasKauffman are you interested in other historical weapons?
 
Yeah I was wondering along the lines of @Griffin's comment -- is there a fixed law+punishment on this
 
@Griffin the police handled the matter and I moved my items to safer place
 
@LucasKauffman But then the punishment also goes ontop depending on how much money is stolen
@GreenFly Do you still have to go to court?
@ManishEarth It's like the pay you get as bar tender. Fixed pay + tips. Except in this case those tips hurt.
 
@Griffin sure, but I mean if you are going to commit CC fraud you aren't just going to get 5 dollars now are you?
 
@LucasKauffman I'm talking about having the #s in possession vs using them. That's how I'd relate it to his spoofing
 
5:32 PM
@Griffin ah yes
 
@Griffin LOL
 
@Griffin for some formalities yes,but the common judge (i'm not sure how is in English) handles the case
 
@Griffin don't forget that they can stack charges
 
@LucasKauffman Gotta love dat jail time.
@GreenFly Are you going to be the better man and ask for minimum punishment?
 
@Griffin you're going to juvi
 
5:33 PM
@LucasKauffman Have 20 life sentences!
 
@Griffin get your lube while you can.
 
@ManishEarth Gotta collect em all
 
lol
 
@ManishEarth the thing is that computer fraud, if you get caught, can have serious consequences, but someone needs to go through the trouble of suing you
 
@LucasKauffman This is one of those times where I'm too disturbed to respond properly.
 
5:34 PM
@LucasKauffman OIC
 
I mean why would you even bother spoofing your university network :p?
"Look at all them facebook accounts"
1337 H@x0rs :p
 
@Griffin yes.I'm not young anymore to go to court every two week for new evidence and hearing and witness etc.
 
@LucasKauffman If they do it seems to be a losing battle now adays. The judges don't know what the terms mean and all the prosecutor has to do is say hacking and the judge will slam that hammer faster than he will your mouth shut.
 
@LucasKauffman Proxy passwords, which are connected to LDAP
 
@LucasKauffman so I take you are not interested in other historical weapons?
 
5:37 PM
Using these, I can wreak havoc with my classmates' acads
And the system is relative grading
 
@GreenFly But you're going to ask for minimum legal punishment on the both of them? It seems like the best case. By showing him that there's no hate between you two it might resolve some of the conflict. Then again if you ask for anything less he could just sit in jail and wait.
 
And if I manage to get a professor's login, I can wreak much, much more havoc
 
@GreenFly I am :p I thought you would share if you wanted too ^^
 
@GreenFly Pics or it didn't happen
 
@ManishEarth why on earth would you want to do that
 
5:39 PM
@LucasKauffman Of course, I'm not going to do that. But I did write paragraph on all the posible ways to abuse ARP spoofing maliciously in the uni in the report
 
@LucasKauffman How to get kicked out in 3 easy steps.
@ManishEarth Make it so oddly placed capital letters spell out his password.
 
@ManishEarth I understand that it's cool, I've been there too, but do realize that this might mean you get expelled from university, after which you get a stigma on your name and certain companies will just throw your resume in a bin the moment it passes
 
@LucasKauffman Huh? I'm not doing it
 
@ManishEarth ah alright ^^
 
I tested a proof of concept once and then destroyed the collected data
 
5:40 PM
Good guy Manish
 
I'm just saying that others can wreak havoc
A lot of havoc
And if done subtly, it may even go unnoticed
 
@GreenFly SHARE!
 
@LucasKauffman I don't think the customs in your country would be happy if they receive a package with guns and grenades
 
@GreenFly lol I would get a police officer on my doorstep the next day :P
 
@LucasKauffman All I did was create a proof-of-concept, research ways to patch this up, think of all the evil things that can be done with the tool, write a report, and hand it over to the HOD of the CS dept, who introduced me to the sysads and asked me to explain the issue.
 
5:43 PM
@GreenFly I meant what else have you got?
 
@LucasKauffman Nahhhh it's the TSA. That's the only shit that's allowed to get through them.
@LucasKauffman Fuck my water bottle. Grenades? No problem.
 
@Griffin I'm not American :p
 
@LucasKauffman You cheating son of a bitch,.
 
@LucasKauffman Nowadays it's the same across the world :S
More or less
 
except for the US and Canada
weapons are super hard to get here, no permit == no weapon
getting a permit is super hard
 
5:45 PM
Canada gives no fucks. They too busy trying to discover locks. That way their emergency maple syrup doesn't get stolen again.
 
@LucasKauffman oh you're from Belgium!what a nice place! I have been there once back in the day in Leper
 
Me too! Been to Brugge and Antwerp and some other places
 
@LucasKauffman a lady took me to her grand mother house. she made the best mosselen friet I ever had
 
@GreenFly hahahaha awesome :D
 
Anyone else hear about the Xbox listening in on you privacy scare?
 
5:47 PM
Sorta
 
Like how self centered are you that you honestly think that NSA / Microsoft honestly cares what you're doing in your living room.
Maybe Microsoft to sell advertising now that I think of it.
 
@Griffin it's datamining, it's not about what the holds, but whatabout it may hold. You just capture shitloads of data and then decide if it's useful or not
 
@LucasKauffman The thing is what could be useful. That's like me capturing the weight of all the shits a 4 year old takes. Yea maybe there will be some new 4 year old toilet paper.
 
@LucasKauffman @Griffin I have two Karabiner43, a few Model 24, one Mauser with original extend stock
 
But why do I need any of that. What would make the profit out weigh the cost?
 
5:49 PM
Won't they need to filter the data somehow? Or do they have enough storage space for all that data?
 
some uniforms and emblems
 
@ManishEarth Considering I'm pretty sure Microsoft is still dumb enough to use their own server software to run their website then the answer is no.
 
@GreenFly nice
 
now I feel that I want a mosselen friet dish very much.too bad we don't have them here
I think I could make one by my own,but I think it will not be the same
 
@GreenFly making it isn't hard
getting the right mussels is
it's just throwing mussels in a pot with some veggies and a bit of white wine
prebaking the french fries, letting them cool down and then baking them again
peferably in already used oil
 
5:59 PM
@LucasKauffman I did not know the part about used oil.now I will tell the wife to keep the oil she use
 
@GreenFly preferably you also use animal derived fat/oil instead of plant oils. You should change it once it's getting too dirty
like when there's burned recidue in it
you should be able to use it at least 5 times
I wouldn't use it more than 10 times
anyway of for beers ^^
 
6:40 PM
I have spent the last half hour reading transcripts from this room and less than 10% was related to security
very impressive
 
That's the usual :P
 
7:32 PM
I dunno, that seems to be an awfully high concentration of security topics.
 
7:50 PM
@ScottPack yeah, I mean security is only the 5th most important topic in here, at best
 
8:09 PM
I would argue 6th since technically counts as two topics.
4
 
@ScottPack very good
 
You know, karma is truly a bitch. I've been getting excited and teasing @Poly about Ensiferum playing tonight, only to find out that they played last night while I was watching Wintersun. Now I'm sitting in the tent with me cock in me hand, masturbating, using my tears as a lubricant. I misread the schedule.
I learned my lesson.
 
8:23 PM
Well then. That's certainly descriptive.
 
8:51 PM
@LucasKauffman Duuude! That's a finnne pistol! So much fun to shoot. How much did you pay for it?
 
9:07 PM
Too many cats here. It's like I got drunk on ambrosia and went to hang out on reddit.
Do NOT tell your password to your cat. Cats are not to be trusted under any circumstances. As innocent as they may appear, they have been known to be malicious. — Evan Teitelman 20 hours ago
 
@AviD Where are you?
 
@Adnan not here, I meant "here" in the DMZ. Reading the transcripts.
 
@AviD I'm so sad right now I can't even look up. Physically or by means of scrolling.
 
@Adnan cuz of ensiferum?
 
@AviD aha :(
 
9:13 PM
okay, listen carefully, this is VERY VERY IMPORTANT....
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
scroll up!
 
@AviD God damn it! I thought there would be something important up there!
 
LOL
 
But thanks, Avi.
 
@Adnan and the cats dont help cheer you up?
 
Actually, last night I've had sex in music fest. for the first time, so that's a reason to be cheered up I guess
 
9:15 PM
I scrolled up and it says up again, god damn it!
 
@AviD I actually spent some time on reddit.com/r/Eyebleach and didn't help that much
 
@Adnan does masturbating with tears as a lubricant, count as sex in a music fest?
 
@AviD That escalated quickly.
 
@AviD It does! The guy who was watching me said so :D
 
@Adnan oh gawd you actually managed to make that even more awful.
@Simon it was in reference to his earlier comment: chat.stackexchange.com/transcript/message/10015485#10015485
 
9:19 PM
@AviD That's what my girlfriend said when she walked on us in the tent
 
lol, you're on a roll. some kind of awful, perverted roll.
 
@AviD Oh phew, little less creepy now.
 
@Simon just barely a little.
 
@Simon I can help resolving that
 
@Adnan I'm fine, thanks anyway.
 
9:26 PM
@Simon Are you sure? I can be reaaaally creepy. Especially when @AviD is around.
 
ewww yukk
 
@Adnan If your goal is to creep @AviD out, I say go ahead!
 
9:40 PM
Yay- making up for all those kitteh's earlier
 
@RoryAlsop Yup, that's my job. Making balance in the world.
 
9:59 PM
I am appalled by the conversation of the last half hour
how has nobody mentioned your mom?
there, now we're owed moar kitenz to tip the balance back
 
speaking of which, @Iszi this was the best use of your mom ever.
yes, I saw that.
 
@AviD hehehehe... "the best use of your mom"
hehehehe
 
@Adnan yes, yes, I said I saw what I wrote.
 
Currently drinking Peroni. It's actually very decent.
Never imagined the Italians would make something drinkable.
Other than wine and olive oil, of course.
Oh shit, and Balsamic viniger.
 
@Adnan you tend to drink a lot of olive oil?
 
10:08 PM
@AviD With almost every meal + 1 shot a week when I open a new bottle.
It's one of my passions.
 
wait, really? you drink it straight?
I mean, I love cooking with it, it goes real nice and salads and stuff, but I wouldnt drink it straight. Again.
 
@AviD Yup, it's actually quit popular amongst olive farmers (got the habit from grandfather)
 
interesting
 
In Greece, Italy, coastal areas of Syria, Lebanon, Jordan, etc.
@AviD Oh yeah, especially with a squeeze of lemon. mmmm.. damn! I have to make some salad tomorrow
Ahhh! Finally home! Now let's see what this Red Wedding episode is all about
 
11:04 PM
@adnan 159 euros with case 12 co2 and 1000 pellets
So that's not too bad is it
 
11:16 PM
@LucasKauffman That's a pretty neat deal. I like that you took 12 canisters and 1000 pellets. With that gun you can make about 82-88 shots per canister, so that was a very close estimation.
@Lucas Don't forget to take photos of the target after shooting a full mag from 15 meters. It'd be nice to see
 
@Adnan defintelely
 
@polynomial I took a more generic view of remote exploit (like remotely breaking in in general) but looking at it again, I think you are right that they meant actual bug exploits
so I deleted my answer
 

« first day (919 days earlier)      last day (3982 days later) »