The DMZ

M'vy

00:41

+36/-48 I'm climbing a bit. In some kind of way

Probably won't pass the primary though. Unless people were waiting for my comments on meta. But I honestly doubt it.

Scott Pack

01:02

@RoryAlsop Good man!

Terry Chia

03:58

I didn't realize Amazon offers dirt cheap hosting for static sites with their S3 service. I'm probably moving my blog over there after my Linode subscription expires. /cc @AviD

5GB storage space, 20,000 GET request a month for free up to a year. $0.004 per 10,000 additional GET request.

Stack Exchange

05:04

Changing the names would be easier, but if you're not comfortable lying, try only making friends with people named Alice, Bob, Carol, etc.

Anonymous

05:15

lol

Lucas Kauffman

07:13

morning

Rory Alsop

07:43

@Terry - wow. That's tempting.

Terry Chia

@RoryAlsop What? The Amazon price?

Rоry McCune

08:16

interesting vulns to start the morning... securatary.com/Vulnerabilities

Rory Alsop

@Terry yes. I might need to host metaltech.me there once it is updated

Terry Chia

Note that that's only for static sites though, but it's perfect for my blog.

Rory Alsop

Mines pretty static. Even the videos are linked directly to YouTube

Terry Chia

@RoryAlsop Ahh perfect. By my estimates I'll only need to pay for the domain name at my traffic levels. The hosting is nearly free.

AviD

08:42

@StackExchange LOL, an excellent one - I am so trying that out.

@TerryChia wow. Not that I care, but wow.

ah, static sites. Does your blog qualify for that?

Terry Chia

@AviD Yep, it's all HTML/CSS/JS with some images.

Jekyllrb is awesome.

Rоry McCune

@TerryChia did I just hear you call a ruby app awesome :op

AviD

@TerryChia ah. Thought it was wordpress. How do you update?

Terry Chia

@RоryMcCune Heh, I have been talking about Jekyll for a few months now.

@AviD I write markdown on my machine and run jekyll to generate HTML from the markdown. Then I (currently) use a rsync alias to sync with my web server.

AviD

@TerryChia wat.

Rоry McCune

08:46

@TerryChia have you tried the free github hosting for Jekyll sites?

AviD

Sure, that sounds straightforward enough.

Terry Chia

@AviD It is, it is literally write markdown. Run script to push.

@RоryMcCune Looked into it, but didn't use it for anything yet.

AviD

@Iszi thanks

Rory Alsop

Anyone got the usual dupe link for this? I am on phone so can't find it

1

Q: My Home PC was Hacked and Accessed my Bank!!! ADVICE on next steps?

I recently setup a new Win8.1 PC while still working on my main development PC so it did not have all of the security tools that I usually install, e.g. malwarebytes, adaware, etc. Since it takes me a few days to fully setup my machines with coding tools and a myriad of other tools, I made the MI...

CodesInChaos

10:27

Do you want this question, or should we simply close it?

0

Q: RatticDB for passwords is not encrypted. Is this good approach?

I am looking for a password application for storing passwords, and RatticDB have a web interface and SSH access is planned, which are exactly the features I am looking for. However, they write that they don't encrypt the database. When designing RatticDB we made some very specific design deci...

passwords file-encryption database secure-storage

AviD

11:03

@TildalWave I think it's known as "tax advance". At least thats what they call it here.

Stack Exchange

Blog - Stack Exchange: Ola, Mundo: Announcing Stack Overflow in Portuguese.

Jay Hanlon on January 29, 2014

If you can’t read the rest of this post, it’s because I’m not talking to you. Which is a little weird, since I can’t even read this without help from our Brazilian Community Manager, Gabe, who’s been kind enough to help me write this in Portuguese.

Depois de semanas em beta privado, nós temos o prazer de anunciar que hoje vai ao ar o nosso primeiro Stack Overflow internacional. E não se trata de um clone em português do site original, mas sim de uma comunidade completamente nova. Uma comunidade que vai poder decidir como ela quer ser, e como vai poder ajudar os desenvolvedores de língua portuguesa. …

AviD

@AJHenderson haha, funny that you should mention "patent" regarding complicated laws. The US Patent office is one of the most convoluted parts of american legislation.

@StackExchange haha, Chrome translated that whole page for me automatically. So the joke is on you.

> "You must be american."
> "No, I'm not an idiot!"

@LucasKauffman you make me laugh.

Terry Chia

11:53

@AviD Why are you talking to yourself like a crazy person?

AviD

@TerryChia SShhhh. This is a private conversation, d'ya mind?

Lucas Kauffman

@TerryChia it's the age, he's getting senile

Terry Chia

@AviD Go make a private room for yourself if you want privacy!

Lucas Kauffman

12:22

this avid crazy yo

AviD

13:01

yoavido - you only avid once

Terry Chia

@AviD nono-yoavido

AviD

@TerryChia ...nohomo

►

Scott Pack

Gentlemen. @Avid.

AviD

@ScottPack Yococo rococo bono's oboes obozo bonobos.

TildalWave

13:23

Thanks to all here for clicking on that questions I was trolling with yesterday, I think that reptrained it since it was really close on the list of hot questions before! We had a new record breaking number of visits yesterday because of that. Me happy! :))

Lucas Kauffman

where is Jeff anyway?

is he still alive?

has he been assimilated by facebook

AviD

@LucasKauffman didnt he live to start Discourse?

Lucas Kauffman

@AviD that's Jeff Atwood

I meant Jeff ferland

AviD

1 min ago, by Lucas Kauffman

where is Jeff anyway?

you need to be more specific

Terry Chia

@LucasKauffman You need to learn to recognize trolls.

TildalWave

13:28

@LucasKauffman Didn't he mention something about having a new girlfriend? You want videos or what?

Lucas Kauffman

bunch of pervs.

Terry Chia

@LucasKauffman You mean @Adnan?

TildalWave

guilty as charged :)

Lucas Kauffman

more Simon

where is our canadian anyway

he hasn't been in for a while

Terry Chia

@LucasKauffman Probably drinking maple syrup.

You know... it's surprisingly easy to get a package onto PyPi.

AviD

13:37

►

Lucas Kauffman

@TerryChia it is?

what did yo umake?

AviD

it's all in the lips

Terry Chia

@LucasKauffman I put my HOTP/TOTP implementation on there. pypi.python.org/…

Lucas Kauffman

ah nice

@TerryChia are you on twitter?

Terry Chia

Just a couple of lines and distutils did all the work. github.com/Ayrx/py-otp/blob/master/setup.py

@LucasKauffman Yeah, but it's a private account and I prefer not to give it away. :P

Lucas Kauffman

13:41

@TerryChia oooooh

Terry Chia

Am I the only one who thinks this is a really bad idea? github.com/afaqurk/linux-dash

Lucas Kauffman

@TerryChia nope

Terry Chia

Sure, it's a site that takes no inputs... but exec() calls?

Lucas Kauffman

I'm also not sure of the use

there are better tools

and more established ones

Scott Pack

@AviD Why are you talking about bad singes and primates?

AviD

13:45

@ScottPack yolonohomo, yoavido

Lucas Kauffman

gtfobro

chickensoup nom nom nom

AJ Henderson

14:19

@AviD that wasn't a coincidence

AviD

@AJHenderson obviously, but it was probably too subtle for some of our usuals. I was merely pointing it out for their benefit.

It was a well-done non-coincidence.

AJ Henderson

@AviD the American regulars or the British?

AviD

... or canadien....

cmon, when someone is making fun of someone else for being stupid, it is @Simon. It's always @Simon. ;-)

AJ Henderson

@AviD but I'm not making fun of someone else, I'm making fun of myself

Simon

15:03

@AviD uFrench now?

Canadien?!?

Lucas Kauffman

15:31

jeeej simon

Simon

15:53

You should read this if you haven't: medium.com/p/24eb09e026dd

kalina

did not read

Adnan

16:25

@Simon Except that we have no way of knowing if the whole story is even true.

Simon

Yeah sorry, I should have linked something related to video games.

@Adnan Meh, let's just hope that if somebody took the time to write all that it is true.

But you are right.

Adnan

@Simon Add to it that the author's main selling point of his article is the "$50,000" price tag. He seemed to have been more than okay with disclosing a lot of information, except saying who actually offered him that number.

kiBytes

@polynomial Everything great in London, a bit rainy these last days. I went to the Social London Club on monday as well. Very nice people, if you haven't gone to that place, definitely you should (2x1 in cocktails).

@polynomial so, thanks for all the tips =)

Simon

@Adnan Well, it's not the price tag that amazes me, it's the social engineering that has been done.

(if true, like you've stated)

Adnan

@Simon I don't mean to sound like an asshole, but I see nothing impressive there. GoDaddy accepted the last digits from the CC as a verification method, and PayPal gave up that information.

The supposed attacker can't do anything with the account. The account is now "hot". Everybody thinks it's a stolen account. Who's gonna buy it?

Potential buyers of these commodities (short domains, special email addresses, etc.) usually get them for marketing/PR reasons. Who's gonna use a stolen domain to promote their service/product?

I can only think of N

deed02392

16:43

thenextweb.com/socialmedia/2014/01/29/…

Adnan

@deed02392 Et tu?

@deed02392 Read up a few messages

deed02392

I first posted it hours ago

just reopened this tab to see it had failed to send

Adnan

@deed02392 Hmmm.. I've been having this issue with Chat.SE today. Anybody else?

deed02392

was a timeout

Adnan

Then it's probably my proxy

Iszi

16:51

@Adnan Haven't noticed any indicators of a problem, but haven't been paying much attention today either.

So... When a question is a duplicate of a question that was closed for non-duplicate reasons, should we close as duplicate or close for the non-duplicate reasons? I suppose the latter, since the system is no longer allowing the former (at least, for duplicates which do not have an answer).

@LucasKauffman A little heavy on the snark today?

In a domain which contains several websites about asking questions, which about-page is the best to read? I'd like to get some details like the off-topic subjects, on this wesite; a little advice that could be useful. — Lucas Kauffman 23 mins ago

Adnan

@Iszi When I see a dupe closed for another reason, I flag for mod attention and I include the link to the dupe.

So far, it has worked every time.

After all, that's why the mods are here for. When the community moderation and/or the system fails.

Lucas Kauffman

all pentesters read this:

it.toolbox.com/blogs/securitymonkey/…

7

TildalWave

17:11

@LucasKauffman cute

I love this one:

> MySQL configured to allow connections from 127.0.0.1. Recommend configuration change to not allow remote connections.

3

Lucas Kauffman

and schrodingers vulnerability :P

TildalWave

yes, that also but I've seen similar before... sadly

most of it is obviously due to reusing a previous report... just lazy

Adnan

@LucasKauffman Jesus! Best link shared in the DMZ in 2014 so far.

TildalWave

the craziest thing - they got the check for it

Lucas Kauffman

@TildalWave thought they didnt?

TildalWave

17:16

> Nobody wins here - except the tester who collected the check.

Lucas Kauffman

> I called my CISO friend, and after he was done laughing at my astonishment, he told me that he had no intention on paying them a single dollar and was handing the matter over to their legal/contracts area. Phew.

Adnan

Why didn't the dude take the $50k for his Twitter username?!

I've just stalked him online a bit: He's online-poor

Less than 50 Facebook followers. Same for YouTube. Same for Twitter.

TildalWave

@Adnan gotta be careful who you collect $50k from, it might be followed by an unpleasant surprise

Adnan

Well, here's something interesting. His new account, @N_is_stolen, now has nearly 33k followers.

CodesInChaos

It's not a new account. It's the renamed account

Adnan

17:20

@CodesInChaos Great. Now I know how Twitter works

TildalWave

OK but he can't use the @N handle any longer since he gave it up

Adnan

Looks like publishing the story didn't give him much of a push.

My assumptions could be very wrong, then.

CodesInChaos

Asking for the last digits of the CC being sufficient for verification is just plain retarded

deed02392

ripple.com/graph

holy shit

that's cool

CodesInChaos

The last 4 are essentially public knowledge

Adnan

17:27

@CodesInChaos I'd say the same goes for the first few.

CodesInChaos

@Adnan how so? (beyond the basic issue that CC numbers are not that secret in the first place)

Adnan

@CodesInChaos First few (I don't remember exactly, but @RoryM talked about it a while ago) basically tell the issuer (Visa, MasterCard) and the issuing bank.

CodesInChaos

ah right. Forgot about that

Adnan

I remember we concluded that search space for a CC number is about 1M

Oh no no

Much lower

Searcing...

CodesInChaos

Don't domain transfers require a signature on dead trees?

Adnan

17:31

@CodesInChaos Doesn't look like the "attack" involved any domain transfer

CodesInChaos

> Unfortunately, Domain Services will not be able to assist you with your change request as you are not the current registrant of the domain name.

sounds like the domain owner changed

Adnan

@CodesInChaos Oh, sorry. That's what is meant by domain transfer

Oct 10 '13 at 19:06, by Adnan

> @JeffFerland How big was the CC number space? (knowing the issuing issuer and issuing bank)

"Issuing issuer" hehehe

Hehehehehe.. oh! Other name registerers are riding the wave.

How we make sure that you don't lose your $50,000 Twitter username: http://ow.ly/t4yR8 $5.99 domain transfers with code BYEBYEGD

Tweeted by Namecheap on January 29, 2014 at 3:50 PM

Jesus! The discount code is the best

Iszi

@CodesInChaos New domain registrations don't, so why should a transfer?

Looks like we have an early contender for most brilliant dad of the year.

Ok, he wins today. :-) Dad makes alphabet blocks to teach son geek ABCs: http://cnet.co/1gjJPbO http://t.co/wObY8WDM0x /via @bonniegrrl

Tweeted by JeriLRyan on January 29, 2014 at 5:32 PM

CodesInChaos

17:51

@Iszi Registration is a low risk operation, transfer/cancellation extremely high risk

When a friend canceled some .de domains he had to send a signed letter. Not sure if that's registrar or TLD specific.

AJ Henderson

well I guess that answers if you guys noticed the twitter handle hack yet

Iszi

@AJHenderson More like attempted Twitter handle hack, followed by some extortion.

CodesInChaos

"GoDaddy sucks" is a pretty safe conclusion

AJ Henderson

@CodesInChaos and yet "mother's maiden name" is used as a security question

and that's no better

@Iszi a hack can include elements of hacking people

I'd challenge that the extortion is part of the hack

Lucas Kauffman

report draven pls

CodesInChaos

17:57

@AJHenderson security questions should only be used to enable password reset emails, not to authorize password changes by themselves

AJ Henderson

@CodesInChaos true

but that doesn't always make that the case

Rory Alsop

1

Q: Did my computer unlock itself?

I woke up around noon to find my computer unlocked, despite having remembered locking it the previous night and not using it since. I checked the security log, and saw a "logon" event from 11:16 AM. Only thing is, I was asleep then, and noone else with access to my computer knows my password. Jus...

windows-8 security event-log

Iszi

@AJHenderson I'd hardly call extortion "hacking people". Hacking people is the sort of thing he used to get access to the PayPal/GoDaddy info.

AJ Henderson

but yeah, first 4 to 6 numbers of a credit card are specific to card type and issuing bank, last 4 are well known and the rest can be validated by a checksum

now it still gives a goodly number of possibilities for the whole thing, but far fewer than you'd think

that's why CVVs and expiration dates are so important

CodesInChaos

If somebody loses access to their email, send them a damn snailmail

AJ Henderson

18:03

@Iszi because the new registration doesn't have someone currently claiming it

Iszi

@AJHenderson However, based on your statement, the first 4 to 6 numbers can probably be guessed after a certain amount of research on an individual.

AJ Henderson

yes

that's what I'm saying

CC# is not hard to guess

even the whole bloody thing

you've got, best case (for attacker) 5 digits to guess

because you could have as few as 6 unknown, but the checksum removes one of those digits

if memory serves

CodesInChaos

CC numbers are simply unsuitable for online banking. Just send every customer a smartcard+reader and switch to a secure protocol.

AJ Henderson

@CodesInChaos that's how I got my first smart card readre

I actually got an American Express card for the sole reason to get the included smart card reader

Iszi

@CodesInChaos And get online merchants to support them.

AJ Henderson

18:08

I'm actually wondering when someone like Facebook decides to try to make themselves the secure identity provider of the Internet

it would seem to follow as a logical next step to their major SSO initiatives

it's a terrifying idea, even compared to a government based online id, but it wouldn't surprise me at all if they tried something like that

AJ Henderson

18:23

@LucasKauffman it amazes me that some people are able to breath, let alone keep a business afloat even momentarily

Iszi

@AJHenderson Is there a paper somewhere describing the CC Number prediction techniques you mention? I'm curious to test it.

(i.e.: Given the last four of my CC#, plus knowledge of the issuer and card type, would I be able to use the documented methods to match my full CC#?)

Wow... that was a rather ridiculously redundant statement full of redundancy.

Lucas Kauffman

18:55

@Iszi too snarky?

TildalWave

@RoryAlsop stray neutrino flipped the loggedin bit? :D

anyway, probably just some cron job run by the task scheduler

Rory Alsop

@TildalWave yeah, probly - that's why I didn't bother asking it to be migrated here

TildalWave

@RoryAlsop Oh, it's migrated? There's no migration notice on the post, was it duped?

nvm ... I get it

:)

I need a drink

3

Iszi

19:10

So, this just hit me - just now, for some reason...

^ All have the same name.

AJ Henderson

coincidence?

Scott Pack

@Iszi Oh my. Is that a cellphone in his pocket or is he schedule for a very uncomfortable doctor's visit?

AJ Henderson

@Iszi I'm not aware of any papers, just what I learned from the CC# verifier that I had on my TI-89 in high school

it would tell what credit card type it was and if a number you entered matched the checksum

Rory Alsop

@ScottPack yeah...

@AJHenderson not coincidence at all

Iszi

@RoryAlsop That's an awfully ambiguous "yeah...".

AJ Henderson

19:16

did he takes off sunglasses?

Iszi

@AJHenderson No, that thing usually happens when he puts them on.

@TildalWave That was no "stray" neutrino. It was caused by a l33t h4x0r by way of butterfly.

Simon

19:41

-1

A: A "new domain registration" spam?

The QUESTION is if these are people are Domain Brokers who snatch your name for OTHER places you'd like to use for promotion ! The can then, ask for ransom $$ Do any of you see this as a likelihood? These aren't some cheery French girls in a non profit sending out friendly reminders !! In fact...

What the fuck is this retard on about?

Iszi

Dunno. Flagged as VLQ.

Simon

I like his conclusion: "Whores". Well done buddy.

Iszi

Been watching too much Game of Thrones, I guess.

David Freitag

@RoryAlsop Heh, what the heck?

> Impersonation Level: Impersonation

Rory Alsop

19:56

@DavidFreitag exactly - there is some good reading in there :-)

David Freitag

Why would that be in a windows security log...

Rory Alsop

@Iszi and @Simon - thanks for flagging. Modhammered

David Freitag

@RoryAlsop You know what, i bet it was the NSA.

Rory Alsop

@DavidFreitag obviously

:-)

Iszi

So, I'm tweaking one of my old PowerShell scripts and came across this comment. After a moment, I realize what it means but, I kinda just wanna slap my past self for the verbiage.

> # Set $ReportsErrors to prevent script errors when there are no errors counting reports.

AJ Henderson

20:14

wow, ok, just finally got around to looking at todays XKCD

how appropriate

@Iszi that kind of reminds me of that pen testing report a bit

Iszi

@AJHenderson Exactly.

When you know what it's intended to do, it makes sense. (Priming an error counter to zero, to prevent errors with using a potentially non-existent variable when calling that counter later.) Just the way it was worded is wonky.

CodesInChaos

22:11

"Priming" is an unusual choice as well. I'd use "initialize"

Transcript for