Anyone doing the Matasano CTF?

I'm really enjoying banging my head against my monitor.

@TerryChia I'm doing it. It's hard, but I'm learning quite a bit.

@KarthikRangarajan What level you at now?

I'm stuck on Cusco.

I'm actually still stuck at 4. I suck at RE and assembly, so even an easy challenge takes a long time.

@KarthikRangarajan Hanoi?

That one is surprisingly easy. Think buffer overflow. ;)

@kalina They keep inventing better fools

@LucasKauffman The NSA doesn't run anything, that takes too much work. They merely make small revisions in certain places.

@ScottPack I thought the worst was when you begin forgetting... err things right?

@AviD Ok, what I meant was that your standard network was trivially breachable by a first year university student with no resources and no training. And now it takes a dropout with a tablet and copy of a linux security distro. Thats a US $50 difference!

So, the guy in charge of my institute's umbrella tech body's site sent an email to the closed google group. Except that he was replying to a private mail in which he had sent the django adminpanel credentials, and forwarding the reply to the group. Anyone who clicks the email context button can see the credentials.

@ManishEarth Heh. Major opsec fail.

So I helpfully changed it and messaged him the new password

because I was pretty sure that others would notice it

Especially those where there is no email context button on their clients

He wasn't angry at me, but the idiot changed it back :o

wut

@ManishEarth Ah well, you did your part! :P

but whyyyyyy

Because people are idiots.

That's like asking why @RoryAlsop is old, why @ScottPack is snarky or why @ThomasPornin deserves our worship.

@StackExchange Reminds me of this...

Also, this..

@StackExchange This resonates a lot with my experiences

:P

@this.josh ahh, okay now I see your point.

Although you're not taking into account the cost of hardware yesteryear. On the other hand, comparing tuition for the 1st year vs. the dropout, that is still a several hundred thousand $ difference...

@LucasKauffman so true though. ITSec seems to me to be very horizontal, and to be good at it you probably need to understand how many things work and know the quirks of all sorts of systems. Unlike learning Javascript, which has a starting point and is focused.

@ManishEarth blame poor opsec. He probably has a whole bunch of mangement systems, scripts, and cron jobs that all have that password hardcoded.

oh, right

didn't think of that

But the django admin password is a web interface thing anyway

I doubt it's scripted

the site is not complex

THAT'S NOT BETTER!

?

@ManishEarth Is the starting point of learning Javascript "Don't learn javascript"? :)

I'm saying that there's little chance of a web interface password to be hardcoded

@TerryChia hey, I like JS!

@TerryChia no, it's "Add moar jquery"

That's for Java

@ManishEarth Don't go to Vegas.

@ManishEarth That's the language that lacks a native numeric sort right? ;)

@ManishEarth In case my previous statement was too subtle, I was implying that you obviously have a poor conception of "little chance".

I shall make a JQuery for Java and everyone will start using Java because of it even though the JQeury will be totally useless (nothing to select) and will essentially be a $ object that does nothing but looks pretty in code

Somewhere, somehow, somebody has already scripted some tool to access the Django admin interface with a hardcoded password.

@AviD You make no sense today

@AviD ah

and I would bet that it is much more common than you'd think.

@ManishEarth Isn't "jQuery for Java" JEE?

Basically, the rule 34 of pogramming?

@TerryChia what? no, nothing like it.

@TerryChia never used it. Also, isn't it J5EEEEE or something?

@ManishEarth or, the rule 34 of poor security practices.

heh

Ah, now the Vegas reference makes sense

see, like I said - too subtle.

heh

@AviD Occasionally useful, comes with a bunch of stuff you most likely never need, both suck.

@ManishEarth or something... i dunno.

see? nothing like it.

jquery does happen to rock, it is just way overused as a silver bullet.

I realized something the other day. It is pretty easy to (for lack of a better word) "hack" accounts on all sorts of systems via MITM or social engineering or application patching. The real reason most folks are safe is that nobody wants to hack into the accounts (unless they can do it in bulk)

@ManishEarth You just realized this? :P

Well, it was in the subconscious, but I became really clear the other day

I'm pretty sure I can get a whole bunch of credentials sitting in a coffee shop or an airport with my Wifi Pineapple for an hour or so.

@TerryChia and that's just MITM

For Facebook the account recovery can be hijacked by preplanning and creating three fake accounts.

@AviD There is charity for some poor universtiy students

@ManishEarth See, but that involves effort.

Whereas sitting in a coffee shop with a laptop and a wifi pineapple involves no effort on my part.

With 20 seconds of access to the user's computer, you can patch FF to log its own passwords (undetectable by virus scans), or note down a session cookie

@TerryChia true

involves money though.

/does not have a pineapple

@ManishEarth There's software for wifi karma attacks.

Everyone's OpSec could be much better

@this.josh Fun story -- I once committed my gmail account's password to a public github repo.

Thank god for 2FA.

@ManishEarth That does not make them safe, such statistically not impacted, but this changes as attacks have larger impacts,

@TerryChia true, ettercap

@this.josh exactly

Hello Target! I'm looking at you.

Most easy attacks are individual, though

@ManishEarth Unfortunatly not true

most

Must publically known easy attacks are agains individuals/underresourced groups

Most attacks are not disclosed.

I plan to hold a session on good 'net security (not from a programmers POV, from a user's POV). I'll know who is coming, and due to me living in the same hostel I can actually prepare beforehand, get a truckload of passwords via various magics, and just whisper their password(s) to each person during the session

rubs palms maniacally

@this.josh that too

@ManishEarth Hah! That would be fun to see actually.

@ManishEarth very nasty, in a cool way :-)

I already did that to a friend, told him two of his passwords. FB password via MITM, old proxy password via ettercap (I remembered it from my scan long ago because the password was longish and memorable -- I deleted those passwords but while testing I had had a glimpse at the contents of the password dump)

but I think you should take it a step further - people dont feel a personal, private connection to their password. Use it, just enough to get a trivial bit of personal information.

The look on his facce was priceless

@AviD Makes me feel evil

manvswebapp.com/…

I don't like using the passwords, except to do trivial, undoable things. Like email a muual friend or changing a profile pic.

Information is not undoable. I can't un-see what I have seen

So ... I try not to gather info.

morning

Hello guys and girls

@HamZa Not nice! Why are you excluding @Simon?

sorry, CTFs is @TerryChia's area.

@HamZa We were all next to useless. :)

Don't worry though, GITS is always challenging.

Mostly about practice really, I'm currently doing this one. matasano.com/matasano-square-microcontroller-ctf

Real good fun and all in the browser too.

@HamZa Might wanna do one of those long running ones instead of the weekend challenges if not enough people are present.

Hello.

I found this question, but I think I'm missing something

@3ventic I can't find a reference in the answers to the lovely mime-type detection IE had (has? Not sure)

It used to try to render the image and then go "AHA! A <script bit! I know what to do with this javascript" And then go and do the javascript

lol

@3ventic noone has ever accused IE of being smart

Aha! Found it: kestas.kuliukas.com/JavaScriptImage

Fixed in IE7

@3ventic also no mention of GIFAR (which is also no longer valid, to the best of my knowledge).

and, if you have control of the link itself, that opens up several other cans of fishbait, including things such as CSRF.

Someone claimed he got some kind of access information by replacing his image with some kind of PHP+JS script

@3ventic probably true, user agent and other random information, just not the JS part (unless the user is using IE6)

I doubt he actually did but I'm still a bit worried

getting IP and user agent stuff is not an issue

Getting cookies is

@3ventic possibly also the IP address, which is not really an attack, but scares clueless newbies nonetheless.

I'll have to see if my IRC logged the discussion..

@AviD I know all the IP addresses, FEAR ME SCRIPT KIDDIES

I could start using a proxy if I was worried about my IP address getting shared

but I don't have a reason to be worried about it.. at the moment anyway

@KevinvanderVelden if you search the site, you'll find someone asked the question, posted it again on MSO as a bug in SE, then fled the internet with his keyboard tucked between his legs.

They have my IP, oh the horror.

@AviD You mean like @kalina? ;)

what

who

when

why

@TerryChia hey! @kalina might be clueless, but she's not a newbie!

how

Spam limited again @kalina?

twice

every two messages

@AviD Well, she did kick up a big fuss when @Adnan posted her IP that one time. ;)

@TerryChia that was mainly because I had assumed my machine had auto reconnected to the vpn I use after I installed Windows 8.1

@AviD Greatest damage Andrew ever caused.

and had then proceeded to tell him that was the case, before he posted my actual IP

I'm actually in chat three times with three different IP addresses atm

I wonder how that would look in logs

I assume all three instances of chat would fetch the image

so you'd get my work IP, my home IP and some IP in holland

... I don't know how, but for some reason I have a wikipedia article open about a device for generating an EMP via explosives =/

@KevinvanderVelden TERRORIST! /cc @NSA

Now that's not that weird, but I don't remember opening that tab

The NSA opened it for you.

@TerryChia Oh noes, the @NSA. Don't forget to ping the @AIVD cause I'm in holland =p

@KevinvanderVelden I'm sure @NSA will inform them.

are you mistyping me? and if so, what do I have to do with it?

@AviD Not mistyping, Algemene Inlichtingen en Veiligheid Dienst, our NSA-ish

@DIVA

(I'm guessing nobody else noticed @AviD is a diva)

@KevinvanderVelden ahhh. That is unpleasantly close to @AviD

@kalina that's right, I dance like a diva, backwards.

@AviD Too close to be a coincidence. Hmmm.....

@AviD I must admit, first few times I saw your name I read it wrong =p

his name is Avi

point at him and laugh

@kalina dammit, grade school all over again

now, if you'll excuse me, I have to get back to taking down this government website. Yawn.

Also, the reason I dont do CTFs....

@AviD I would think the CTFs will be a little more challenging.

meh. Can't be less challenging... but then, it's not the type of challenge I enjoy.

Giving a bull a manual enema during mating season is pretty challenging too, doesn't mean I would do that for fun.

@AviD That's a rather specific example. Sounds like you have prior experience with it?

hahaha, noooo.... but I will leave you with that image in your head.

Actually, there were two specific scenes from different movies that I combined. Want to guess which?

I'm gonn' go give that dang website a full arm enema now.

I'm sure @Scott can appreciate this.

@AviD How does it feel to no longer get easy stars when bashing me?

heh, you're saying that everyone is bored with how easy it is?

Nah, they're just depressed that I'm not around as often these days.

Cross-talk in comments "is da devil!"

Bonjour, folks

@Simon not the case

I mean, hi

@Simon "depressed"

Note how depressed those monks were at 1:10

@lucas you're famous..

<3 PGP

anyone here use WebPG

That would involve me actually sending out emails I care about keeping confidential so no.

@TerryChia you just don't have any cryptofriends

C'mon, let's send each other encrypted pictures of our cats

I don't have a cat.

Crazy cat guy....

:P

aww

I have a proposition, who would be interested in taking a dump of main memory and seeing what we can find out about each others' systems from it?

@deed02392 uuh, what couldn't you find from that?

That sounds like a pretty bad idea from a privacy point of view =p

Well I don't think a document on what you couldn't find would be very interesting

I know, but we could either develop a process of analysing your own dumps or volunteers could set up a dummy machine for fun and share a dump of that

Just trying to suggest something fun we could do to learn a bit more about what an attacker could get from a memory dump

@deed02392 that might be an interesting thing, set up a VM, do something "secret" and then share the memory dump to see if someone can find it

Yeah exactly

capture the flag for memory dumps

Might get us some cool new tools for memory forensics as OSS. I'd be willing to share any python scripts for example that can attempt to cherry-pick certain bits of info

Only problem is, what kind of secret would be hard to find but not impossible

Well if you wanted to make a puzzle out of it you could give no clue as to what someone's trying to find

I've never even looked at a memory dump before, would be interesting to know if you can easily extract things like Chrome remembered passwords

@deed02392 but then how will you know when you find it? =p

you don't necessarily have to, just submit what you found that was interesting

@deed02392 All @Adnan hears is "proposition ... interested in taking a dump ... and seeing what we can find out about each others' "

lol very good @AviD

can always count on you to degrade the conversation

@deed02392 hey, it wasnt me

@RоryMcCune does this mean that from now on I will get sponsored to wear a certain brand of clothing? :O

@LucasKauffman yes, we will all chip in and ensure you keep your shirt on.

@AviD I'll get myself a tiger suit.

FROM YOUR SKIN

what the?

@LucasKauffman lol

encryption OR obfuscation

@CodesInChaos dude, don't you know about the blockstreamcipherhashingalgorithmpawnsauce?

Cracked.com serving malware. Again, apparently. esecurityplanet.com/network-security/…

@LucasKauffman exactly... from now on you have to wear duck branded clothing at all times..

@RоryMcCune excellent

I'm watching doomsday preppers

12 year olds holding AR15

shooting pistols and wearing ghillie suits and learning to kill rabbits with a knife

whatever happened to being a kid and playing with a football or dolls

Oh yay, it's supposed to hover around -20ºC for the next week...

@LucasKauffman For whatever it's worth, when I was 12, I would have preferred the ghillie suits and ARs.

@Xander If you are hardcore training your children to kill tresspassers then something is wrong with you :p

@Simon youtube.com/watch?v=s2-USN476QY

@Xander I'm hoping to shoot some AR15s when going to vegas

@LucasKauffman Yeah, you should! They're a lot of fun.

@LucasKauffman I can't argue with that.

@Xander last time my colleague went to vegas you could get a "package" where they would let you fire different weapons, from handguns to AK47, AR15, SPAS AUTO 12 and even an M249 SAW

think it was like 250 dollars

they were fully auto

and you'd get a box of ammo with every gun

@LucasKauffman Nice!

@Xander I'd really love to do long distance shooting, unfortunately Belgium isn't a gun friendly place :(

which is ironic since we are among the biggest producers <.<

@LucasKauffman I'd bet you can find a long distance range/school in the desert around Vegas for that if you wanted to try it.

@Xander might try that out :D

@LucasKauffman Yup. Tell me about it. The M249 SAW is a Belgian gun, in fact.

It's a re-named FN Minimi.

@Xander exactly, out of all the weapons FN produces we are allowed to have... 3 which are the FN5-7 (9mm mod), the FNS and GP/HP

the rest if all "illegal"

It's even not allowed to hunt with air rifles :(

@LucasKauffman That's rough.

I almost bought an FN P90 a few years ago.

They're nice compact little weapons.

@Xander how much does that cost actually, I've always wanted a real 5-7 and a real P90 using the real 5-7 ammo

@Xander FN was really pissed off that our police purchased Smith&Wesson in favor of FN

@LucasKauffman If I recall correctly, at the time (this was 2008 maybe?) they were around $1,800 US. The 5-7s (I've only seen them in the States in 5.7, never 9mm) are/were around $700-$800 at that time. I haven't been in the market for new guns for the last few years, so I don't know what they are now. I'd expect P90s are insane, as all semi-auto rifles with detachable magazines have become.

@LucasKauffman Ha ha.

I love the M&P. It's a great pistol. My wife's favorite. I have a 9mm in the compact variant.

@Xander nice, I've always dreamt of the 5-7, a Glock and a Walther P99

That's actually a reasonable price

I thought they'd be more expensive

@LucasKauffman Looks like they've gone up. budsgunshop.com/catalog/product_info.php/cPath/36_582/…

(Last prices when it stock was $1,033)

@Xander which is still cheap in my eyes :p

And P90s are cheap though, at under $1,500. budsgunshop.com/catalog/product_info.php/cPath/36_582/…

oh wait that's for the 5-7

Fixed it.

Not in stock, of course, but cheap.

@LucasKauffman Yeah, nice guns. I have a small Walther, the PPS, and a few Glocks.

@Xander If I ever come buy america close to were you live, can you take me shooting :3?

@LucasKauffman Absolutely. :-)

yeeey

how far are you from Vegas?

@LucasKauffman About 2000 miles. :-)

shit

maps.google.com/…

mmmm

that's kind of out of the direction

Just a bit.

Real men dont need guns. They carry enough weapon in their pants.

@AviD I was hoping for fists, but then you surprised me actually as I read along.

@AviD Real men don't tell to others what real men do

@LucasKauffman seriously? That surprised you, in this room?

@AviD Does Krav Maga actually have a special technique in which you turn your circumsized wiener into a deadly weapon?

@TildalWave I'm not telling them, I'm mocking them. Big difference.

@LucasKauffman In the highest level of Krav Maga, you dont use your hands, you just slap the other guy in the face with your oversized wiener.

So, kind of like a Tuesday for @Adnan.

@AviD c'mon calibrate your sarcasm alarm that wasn't even a hard one

@TildalWave hehehe, nicely played.

inorite

so what's been going on here except hacking dairy farms?

@TildalWave Orgies involving voluptious big breasted women only clothed with a TP cable

@TildalWave Virtually nothing.

@TildalWave @LucasKauffman has clearly been somewhere else and gotten confused.

yeah, he doesnt even see the words anymore, he just sees blonde.... redhead.... brunette...

We did have a nice discussion about lovely Belgian firearms, and stupid Belgian firearm laws.

@Xander sounds like he's been over at SF again :)

@TildalWave That's entirely possible.

@AviD All I see is assets, baps, cans, bazongas, knockers, titties, boobs, b00b13s, melons

so maybe close the porn once in a while, and get some real work done.

hey guys can i ask you something about torrent? if it goes too far ill make it a proper question:)

a follow up for the security.stackexchange.com/questions/33983/…

@LucasKauffman ...oookaaaayyyy