The DMZ

kalina

16:00

it just finished downloading

and then I'm going to sample it

Kisunminttu

@kalina Kind of jealous TBH

kalina

and turn it into house music

Kisunminttu

I'm gonna go shopping for things that I can turn into chocolatey goodness.

Or actually I'm going to get some fruit. I'm still getting rid of the mental kilograms I put on after those brownies. Phew.

Terry Chia

5

Rory Alsop

@kalina alternatively it is 100%

Nick

16:25

Time to do a pentest on my own network.. wee xD

Xander

16:43

@TerryChia Are you referring to this?

portcullis-security.com/security-research-and-downloads/…

Terry Chia

@Xander That link has been posted in here twice already. :P

Xander

@TerryChia Ha. Figured, since I haven't been here in a couple of days...But didn't see it in the last screen-worth of messages, and didn't really care to search the whole transcript.

TildalWave

@kalina sorry for taking this long to reply, but I was kinda busy proving you wrong :P

David Freitag

16:59

cc:\ @Adnan @tylerl i think that's everyone...

More parts are on the way.

AJ Henderson

17:18

@DavidFreitag nice. I'm looking forward to my security bit set arriving today

@Kisunminttu <3 Metro 2033

Kisunminttu

@AJHenderson Bought it ages ago, no time to try it out (and I'm scared to play it haha)

AJ Henderson

it is freaking fantastic

one of my favorite games

the sequel is still good, but not as good as the original

I also highly recommend the original FEAR

and Singularity

David Freitag

@AJHenderson Yep it's my first project with 0805 SMD passive components. Luckily i got a 0.015" (0.4mm) diameter solder :]

Kisunminttu

@AJHenderson Nope. Nopenopenopenope. I have it, but I ain't touching it (came with a gamepack)

But Singularity... Hmmmm...

AJ Henderson

@Kisunminttu not a fan of scary games?

Kisunminttu

17:28

@AJHenderson I want to be, but I'm just not cut out for them. I get scared at night if I'm not sleeping next to @Adnan

AJ Henderson

@Kisunminttu yeah, then fear might not be the game for you after all

Singularity is probably ok

it's more sci-fi fantasy interesting situation based than scary

where as the original FEAR is one of the creepiest games I've ever played

Metro is about half way in between

it's got scary moments, but mostly it is the storyline

Kisunminttu

@AJHenderson I am especially sensitive to games and movies that have a supernatural entity in the form of a female, young or old.

AJ Henderson

@Kisunminttu well, FEAR's main scary character is middle aged and only occasionally appears young when she wants to be overly creepy

Kisunminttu

The only form of horror that I can comfortably watch is zombies. I like zombies.

AJ Henderson

and then she's generally walking on the ceiling, and the ceiling is coated and dripping in blood

Kisunminttu

17:31

@AJHenderson Ummmmm...

AJ Henderson

and perhaps either warping or running towards you like a gorilla

oh yes, and if she reaches you, you die instantly

but other than that

Kisunminttu

My favorite survival horror games of all time are Silent Hill games, those have just the right amount of fcked up characters.

AJ Henderson

I couldn't get in to silent hill

or most of the RE games

Kisunminttu

@AJHenderson Yeah I'm going to go with a nope on that one...

AJ Henderson

RE4 was the only one I ever really got in to

Kisunminttu

17:33

@AJHenderson Well, it's easy, it just kind of calls you if you've been a bad boy

AJ Henderson

Half Life is zombies though

zombies and aliens, how can you go wrong

I guess technically they aren't zombies since they are parasites rather than a virus

Kisunminttu

Half Life is good

AJ Henderson

but Half Life wasn't really scary

Kisunminttu

It was a thriller scifi game

Kind of

AJ Henderson

Doom 3 was scary, but it was fairly cheap scary

cause it was just random spawns behind you

and creepy sounds

where as FEAR was genuinely psychologically scary, even when you go back and play it knowing the game

Iszi

18:53

Hey, have any of you guys seen truecrypt.org recently?

As in, today?

Xander

@Iszi ? What's up with that?

Iszi

@Xander You're seeing what I'm seeing, right?

Xander

@Iszi Yep

Iszi

I really don't know what to say about that.

Wow. TrueCrypt's site was excluded from Archive.org?

Xander

@Iszi It looks like Twitter noticed it about 15 minutes ago. Nothing on the Googles yet. I'm going to chalk it up to a defacement until further notice.

Iszi

19:01

@Xander I only saw one tweet about it. It's rather detailed for a defacement.

And I only saw that tweet after searching.

Xander

@Iszi Yeah, I had to search too. I see one before yours, and two since.

AJ Henderson

that's a bit crazy

could still be a defacement, either that or they found some serious, serious vulnerability

but I'd expect more news then

Xander

@Iszi Possibly. Could be copied from somewhere that already had the process documented.

AJ Henderson

so I'm going to go with defacement for now too

my first reaction was that someone was saying it isn't secure because they could deface it though

Iszi

It's not hard to believe though, when you consider that the latest version is two years old.

Oh, interesting. I just noticed that the link at the bottom of their page references "TrueCrypt 7.2" when the latest version (as of earlier this week, at least) is 7.1a.

Anyone wanna try running that download in a sandbox to check it out?

Wonder if anyone's told Matthew Green yet?

Xander

19:18

@Iszi He's been pinged on Twitter, I see.

Iszi

According to Google, it was updated 33 minutes ago. So that would be... 14:40 U.S. Eastern.

@Xander Link?

Xander

Ping @matthew_d_green : know anything about http://truecrypt.org -> http://truecrypt.sourceforge.net and the contents thereof?

Tweeted by cynicalsecurity on May 28, 2014 at 7:14 PM

His reply:

@cynicalsecurity Nope.

Tweeted by matthew_d_green on May 28, 2014 at 7:16 PM in reply to cynicalsecurity

Iszi

@Xander Thanks. I've followed him now, too.

Xander

19:33

@Iszi Since I can't retweet you, I stole your tweet. :-)

Iszi

@Xander That's ok.

Xander

Had to modify it to get it under 140 and still attribute tho.

Twitter has now gone properly bonkers.

@Iszi Ha ha ha...Your advice is popular. Since I re-posted it, it's been re-tweeted by 4 people I've never heard of before.

Iszi

@Xander Cool.

Of course that probably means I'll be getting follow requests from a dozen people I've never heard of before.

Xander

@Iszi :-P Sorry about that.

Iszi

It happens.

Now there's photo results in a Twitter search for "TrueCrypt". Looks like people are screenshotting the site.

Oh, this is a lovely coincidence...

Guys auditing #Truecrypt says "big announcements" are coming " http://bit.ly/1rhtk5k and then TC dev ends http://truecrypt.sourceforge.net #infosec

Tweeted by MisterCh0c on May 28, 2014 at 7:42 PM

This guy had the same thought I did...

@matthew_d_green do you still have contact info for TrueCrypt fellows? Curious for an explanation of the alleged shutdown on their site.

Tweeted by JZdziarski on May 28, 2014 at 7:44 PM

Though Matt has already said he doesn't know anything, he'd be one to know how to find out.

I love this one. Points out the same issue I raised awhile back...

@f3ndot verify sigs from where lol, from the same compromised site?

Tweeted by KevinSMcArthur on May 28, 2014 at 7:24 PM in reply to f3ndot

25

Q: Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS encryption or digital signatures on the website itself. So, if you're downloading a file from w...

Xander

19:52

This made me laugh.

brb, running to Costco to buy enough popcorn for this TrueCrypt news.

Tweeted by bbaskin on May 28, 2014 at 7:49 PM

Iszi

@Xander Heh. I don't think Costco has enough. Anyone know where the nearest Orville Reddenbacher's factory is?

AJ Henderson

@Iszi he said he wanted popcorn

but my first thought was "you need a bigger bag" too

Iszi

Oh, I think this is my favorite.

The only thing worse than TrueCrypt being scuttled would be if Facebook bought them.

Tweeted by JZdziarski on May 28, 2014 at 7:54 PM

3

David Freitag

20:11

@cynicalsecurity So most of the routines got replaced with AbortProcess("INSECURE_APP"); this sounds like a prank to me.

Tweeted by MiodVallat on May 28, 2014 at 8:08 PM in reply to cynicalsecurity

Iszi

TrueCrypt is now trending on Twitter, along with Watch Dogs, and #WearAsManyClothesAsYouCanAtOnceFor1d.

Xander

I sent an email to our contact at Truecrypt. I'm not holding my breath though.

Tweeted by matthew_d_green on May 28, 2014 at 8:15 PM

Andddd....We have a question.

0

Q: Is TrueCrypt not secure now and I should stop using it?

Offical TrueCrypt webpage now states: WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues This page exists only to help migrate existing data encrypted by TrueCrypt. The development of TrueCrypt was ended in 5/2014 after Microsoft terminated suppor...

truecrypt

Iszi

@Xander That didn't take long.

Xander

20:26

@Iszi Sure didn't.

Iszi

21:04

Holy instant up-votes, Batman!

Who did that?

2

A: Is TrueCrypt not secure now and I should stop using it?

At this point, it is still unclear. Speculation runs rampant as to whether it's a defacement or official retirement. That said, it is noteworthy that the latest version of TrueCrypt (before the 7.2 version that's now posted) is over two years old. Also no apparent efforts have been made to suppo...

I'm pretty sure that answer wasn't even posted long enough for anyone to fully read it before it got its first up-vote.

Xander

@Iszi I'm a fast reader. I did read it before up-voting. I wanted to make sure you said something worth voting for. :-P

Iszi

@Xander Aww, thanks.

In news related to #TrueCrypt, @Wikipedia to shut down for errors; recommends using #Microsoft Encarta http://www.idigitaltimes.com/articles/23190/20140527/wikipedia-errors-nine-out-10-entries-medical.htm

Tweeted by SecurityHumor on May 28, 2014 at 9:02 PM

2

I'm debating whether or not that question should be closed. We usually close other speculative news stuff.

Oh, hey. Lifehacker picked up on it.

lifehacker.com/…

And Ars.

arstechnica.com/security/2014/05/…