The DMZ

deed02392

16:00

je suis Charlie!

at least, according to the latest notepad++ version

kalina

no we weren't talking about Charlie

deed02392

oh

Simon

@deed02392 If you're cool, you're Charlie.

deed02392

@Simon, bro, you know me

Simon

aw yeah boi

@kalina This dude won't let me play at a local open deck because he said his crowd don't like distorted kicks.

How sad is that m8?

kalina

16:02

I am not your mate

Simon

pls m8

He wants me to play another style

kalina

we have never reproduced or even practiced. Cease calling me your mate

Simon

like w0t is dat m8

wat

Rоry McCune

4

^@AviD gone bad

kalina

also, I agree, if you have to distort your music to make it sound good, it wasn't good to begin with

AviD

16:03

heh

Simon

@kalina It's only the kick-drum that is distorted you donut.

AviD

@Simon you're a distorted donut.

TildalWave

(I expected you're distorted! to be honest)

Simon

I'm not gonna load up a House track and distort it live you donut.

TildalWave

damn

beaten to it

kalina

16:05

maybe you should just give up your taste in music and just buy 1989.

TildalWave

@kalina that doesn't really rule out all the practicing he's done on his own :)

kalina

@TildalWave his on going, twice a night practice?

Simon

@kalina Hey, I like Hard Trance too.

As far as I know, those kicks aren't dist0rted

d1st0rt3d

TildalWave

@kalina that's the one

@Simon you're distraughted!

David Freitag

@kalina You can buy a year?

AviD

16:09

@DavidFreitag I AM BUYING 2015

kalina

yes

you can buy several years

AviD

2015 - THE YEAR OF AVID

Simon

@AviD Can you make it hot in canaduh?

kalina

no, Canada was designated the cold zone

move somewhere else

TildalWave

@DavidFreitag you can buy the 1990s

1990s (band)

1990s are an indie rock three-piece band from Glasgow, Scotland. == History == They were signed to Rough Trade Record Company (home of many notable acts such as The Strokes and The Long Blondes) when they were spotted at only their sixth gig, (a first for Rough Trade) and have released two albums so far, Cookies and Kicks. Lead singer Jackie (aka John) McKeown and bassist, Jamie McMorrow, were the founding members of Scottish Indie band The Yummy Fur. The line-up over the years that The Yummy Fur existed changed on numerous occasions. At one point, both Franz Ferdinand singer Alex Kapranos and...

Simon

16:11

@kalina Stop attempting to get me to move closer to you.

3

You creep.

Thomas Pornin

@Simon Oh, it won't be free. They'll make an awful lot of money out of it.

AviD

@kalina no dont encourage him! that puts us ALL at risk!

Thomas Pornin

They usually sell something like 50000, and there they will print 3 or 4 millions.

Simon

@ThomasPornin Oh god... It's always about money, isn't it?

David Freitag

@Simon I think you would need America's permission, we don't want a sweaty head if our hat gets too warm.

Thomas Pornin

16:12

3 EUR apiece.

AviD

@ThomasPornin I think that was his point.

Simon

@ThomasPornin Yeah I heard 3M too.

Thomas Pornin

Anyway it was and still is an awful newspaper.

AviD

@ThomasPornin are any not?

Simon

@DavidFreitag pls david

David Freitag

16:13

@Simon I'm not a real American, so I don't count.

Simon

@DavidFreitag Yeah, you're a donut.

TildalWave

@AviD are any printed on a 3-ply soft tissues?

AviD

@TildalWave that would actually be a good idea.

TildalWave

as long as the ink doesn't leak :)

kalina

@Simon erm, I'm not, I'm hoping you move out to hawaii so you're located somewhere that can be nuked from orbit without unacceptable levels of loss of life

It's the only way to be sure

Simon

16:17

Always so rude.

TildalWave

pretty much the last thing you'd want printed all over your ass is yesterday's news LOL

David Freitag

@kalina Why Hawaii, that's a beautiful place.

Simon

@TildalWave Hey, some of us are all about ink.

AviD

@TildalWave possibly tomorrow's news might be worse.

TildalWave

hehe it took me a while to get it but I did :) well done me!

no self high five links? :O

Simon

16:24

@ColinCassidy OI lad, would you like a high koala tea?

TildalWave

FTFY

Simon

I'M GETTING DONUTED AGAIN HELP

2

Colin Cassidy

@Simon I'll pass

AviD

@TildalWave @Simon is busy perusing all those

Rоry McCune

@ColinCassidy watcha' I see eireann has been at it again... ics-cert.us-cert.gov/advisories/ICSA-15-013-04

Colin Cassidy

16:27

@RоryMcCune yeah we've both been digging into industrial switches, all good fun

Rоry McCune

@ColinCassidy hard coded creds FTW

Colin Cassidy

@RоryMcCune something like that yeah :)

Thomas Pornin

@AviD Well, not all newspapers consist solely of marxist propaganda and appeals to eviscerates priests and enterprise owners.

AviD

@ThomasPornin true, not all - but then thats not the only way to make a crappy newspaper.

there are different levels of awful.

David Freitag

@Simon Help! Help! I'm being repressed!

Rоry McCune

16:43

not sure I'm not taking the donut pins too far now...

kalina

pins?

now to invent <some thing> that is as addictive as crack

I need assistance

AviD

sfunny, I have some big lebowski clips going

damn youtube

Rory Alsop

17:09

@Simon so I had a conversation with a French girl today

She says that in the context of Charlie Hebdo and social media

Je suis Charlie means "I follow Charlie"

She and I were both confused

Simon

Suis could be both "follow" and "am".

I'm expecting it to be "am" though.

/cc: @ThomasPornin

TildalWave

@RoryAlsop You were confused with a French girl today?

Rory Alsop

@TildalWave erm.... yes?

@Simon Well the world seems to think it's am.

Simon

@RoryAlsop I'd be surprised if it's not.

Rory Alsop

@Simon apparently in the context of social media it should be "follow"

who knew

Simon

17:14

I think she's insane.

TildalWave

@RoryAlsop ah never mind, I thought it's gonna come out funnier ... damn English non-ambiguity when you need it!

s/with/for

Rory Alsop

@TildalWave lol

I figured you must be aiming at something along those lines

TildalWave

Surely nobody can expect of me to think before I type anymore? :D

Also ... languages. I probably spoke or wrote in at least 4 of them today

erm no 5, also read and listened to some Russian

6 if I count @Simon

Rory Alsop

@TildalWave lol

Simon

#yolo

David Freitag

17:43

Plaintext: We are legion Encrypted: diyfvjrwiiopcvyjkbq British encrypted: Jolly Ho good sir may I interest you in fish and chips and tea

Tweeted by SwiftOnSecurity on January 14, 2015 at 2:25 PM

Simon

lulz

TildalWave

Gotta wonder who this Taylor Swift really is tho

Alter ego of Jack Daniel? :)))

Rory Alsop

@TildalWave it's @kalina :-)

TildalWave

@RoryAlsop OK but then, who really is @kalina?

wow bsidesljubljana.si now I have to go

Rory Alsop

@TildalWave the musical arm of Skynet

TildalWave

17:55

hehehe what was that song again that played everywhere?

Xander

@TildalWave Nice!

David Freitag

@TildalWave Didn't you know? We're all a figment of your imagination.

Simon

Especially me.

4

Q: How to disallow external access to 127.0.0.1?

I use tcp socket on 127.0.0.1:9000 to connect nginx to php5-cgi. However I want make sure that no extrnal request can be made to this IP, so that no attacker can obfuscate IP and bypass nginx to do nasty stuff with php. Now I am wondering whether it is actually possible to do such exploit, and ...

10/10

TildalWave

@Simon Martians ;)

Martian packet

A Martian packet is an IP packet which specifies a source or destination address that is reserved for special-use by Internet Assigned Numbers Authority (IANA). If seen on the public internet, these packets cannot actually originate as claimed, or be delivered. However, certain reserved addresses can be routed using multicast, or on private networks, local links, or loopback interfaces, depending on which special-use range they fall within. Martian packets commonly arise from IP address spoofing in denial-of-service attacks, but can also arise from network equipment malfunction or misconfiguration...

Simon

18:25

Wait for it, wait for it.

YOU'RE A MARTIAN.

Ohnana

"The name is derived from packet from Mars, a place where packets clearly can not originate"

gee TIL

Iszi

18:51

@Ohnana So, I guess Curiosity and the like aren't using TCP/IP?

Simon

@Iszi Any other child disowned you recently?

raz

@Simon :facepalm:

Ohnana

@Iszi whoa

David Freitag

@Iszi Are they?

Ohnana

> To perform uplink communications (to the rover), the DSN’s biggest antennae — 230-feet (70-meter) dishes — are outfitted with transmitters that deliver up to 400 kilowatts of output power. The hacker would also have to replicate the exact same encoding scheme (probably QPSK, the same as satellite TV) and use the same frequency (X band, around 8GHz).

nope!

David Freitag

19:00

@Ohnana You need to throw a space in there.

Ohnana

fscking markdown raaagh

Iszi

@Ohnana That says nothing of internal comms between rover components, or any comm that the rover might have with other Mars-based stations.

Ohnana

@Iszi very true. although the idea of tcp/ip actually originating from mars made me temporarily lose my marbles

i mean, for real. SO COOL

David Freitag

19:16

> Proximity communications are accomplished using special NASA and ESA UHF radios on the orbiters, each optimized for short-delay, short-contact communications passes between orbiter the surface. These radios implement the CCSDS Proximity-1 Space Link Protocol (Prox-1), which is central to the data return strategy of Curiosity. The rover expects to relay over 95% of its telemetry using Prox-1 via the Mars Reconnaissance Orbiter (MRO) or Mars Odyssey.

public.ccsds.org/publications/archive/211x0b1s.pdf

cc:\ @Iszi @Ohnana

That document mentions TCP, but I don't know if it's the TCP I think it is.

Nope.

> TCP: Time Correlation Packet

> The Spacecraft Identifier (SCID) identifies the source or destination of transfer frames
transported in the link connection based upon the Source-or-Destination Identifier.

public.ccsds.org/publications/archive/211x0b5.pdf

Thomas Pornin

19:33

@RoryAlsop That's understandable. The Internet can be confusing at times.

"je suis" can mean either "I am" (from the verb être, i.e. "to be") or "I follow" (from the verb suivre, i.e. "to follow").

Nominally, the current slogan means "I am", not "I follow".

Simon

pls repeat moar of the stuff I just said

you donut

Thomas Pornin

However, people are, as usual, creative, and it is quite possible that some people believe that in some context it means "I follow".

In which case it really begins to mean "I follow" because there is nothing official or administrative in that slogan.

The Académie française did not express any opinion as to the meaning of that three-word sentence.

Simon

They were too busy getting rid of "^" in every single word.

Thomas Pornin

@Simon They are les immortels. They have time. They don't do things hastily.

Simon

I wonder what a typical day is like for those people.

Rory Alsop

19:38

@ThomasPornin which is what I said, but I was forced to defer to a native French speaker :-)

Simon

Well, now you know that she's a native donut.

Thomas Pornin

I saw this morning that some people had planted pencils in the snow banks in front of the French consulate in Québec.

Simon

Did someone tell them that they're gonna need to wait until summer for the farming season?

Xander

@ThomasPornin Like Punji sticks?

I'd say it was a good idea, but landmines really work better.

Thomas Pornin

@Xander In that role the pencils would be rather ineffective, since they were disposed rather inexpertly.

@Xander Sticks are ecological.

Xander

19:42

@ThomasPornin This is true.

Lucas Kauffman

20:01

evening

Simon

afternoon

TildalWave

Beignet Llama! Evening!

Rоry McCune

20:31

@LucasKauffman evenin'

David Freitag

Is it odd that the credit limit on my card randomly doubled?

without notice or warning I should say.

Simon

I'm pretty sure this practice would be illegal here.

Rоry McCune

@DavidFreitag used to happen to me in the UK, but when CC companies started catching flack for the practice they stopped it...

one of my cards went from £2000 --> £10000 in about 18 months

well today was a good example of why working in a large testing co' can be a good thing

Faheem Mitha

@DavidFreitag you don't have to put up with that. if you don't want it, tell them to bring it down.

Rоry McCune

had a pretty obscure JRuby/Burp problem and found someone who could fix it \o/

David Freitag

20:45

@FaheemMitha No, I'm excited. It went from $500 to $1000

Faheem Mitha

I think someone did that to me once. Apparently thinking it was some kind of reward. Now, you can go deeper in debt! Screwy consumerist culture.

Ohnana

stupid question, why is doubling someone's credit limit a bad thing?

Faheem Mitha

@DavidFreitag Is that good?

Rоry McCune

@Ohnana it encourages people with poor financial discipline to get more into debt

Ohnana

@RоryMcCune okay, that makes sense

Faheem Mitha

20:46

@Ohnana it means more potential losses in case of fraud. and more short-term debt. suppose you forget to pay it off at the end of the month?

Which, of course, is what they are hoping you will do.

David Freitag

@FaheemMitha I'm not sure, it's my first credit card. Keeping a 10-15% balance on a $500 limit isn't easy. Most of the things I want to buy are more expensive than that.

Ohnana

my credit card is secured with my own capital, so I forget that most credit cards operate on kitten dreams and virgin tears

Simon

@Ohnana What Rory said and IIRC when you ask for a loan, they'll consider the amount of your CC and allow you to get less koinz.

Faheem Mitha

@DavidFreitag Oh, ok.

Lucas Kauffman

@RоryMcCune cool

@RоryMcCune aren't you independant anymore or do you still work as a contractor within their group?

Faheem Mitha

20:47

@Ohnana does that reduce the bad things that can heppen? I forget exactly what secured means.

Ohnana

@FaheemMitha it means if I default, then they close the account, take the money to cover their costs, then call it even

Lucas Kauffman

@Ohnana isn't that called a debit card...?

Simon

^

Ohnana

@LucasKauffman not quite.

Faheem Mitha

@Ohnana sounds like a good deal. that means you can't borrow more than you have, right?

Gilles

20:48

@LucasKauffman not in non-Anglo-Saxon countries

Faheem Mitha

so it operates strictly as a convenience.

David Freitag

@LucasKauffman No, you don't build credit by using a debit card, but you do by using a prepaid credit card.

Ohnana

the money stays in the account as a safety net for both of us. It isn't touched until the account is closed

Simon

@Gilles You're a non-Anglo-Saxon.

Faheem Mitha

Well, as long as they don't charge you for the thing.

Rоry McCune

20:49

@LucasKauffman nah I'm a permie with NCC (idea being that 2 freelancers out in the sticks is a bit vulnerable financially). NCC includes Matasano with many smart ruby people which is awesome

Faheem Mitha

@LucasKauffman No, those are different.

Ohnana

@FaheemMitha the interest is insane and the annual fee is like 30 USD. Although my credit score is obscenely good

Faheem Mitha

What @DavidFreitag said.

Arperum

@DavidFreitag I don't understand the whole principle behind the "building credit" thing.

Simon

lolfee for a credit card.

Lucas Kauffman

20:49

@RоryMcCune cool are they based in scottland or can you just work from home?

Simon

I'll never ever pay any dollar for a credit card.

Faheem Mitha

@Ohnana Huh, that's a bit high for a convenience. But, whatever.

Ohnana

@Arperum "hey money loaners, I'm responsible and pay my bills, don't shove intrest rates up my anus"

David Freitag

@Arperum it is a measurement of how trustworthy you are

Lucas Kauffman

@Ohnana so basically, you give them money, they collect the interest on it and you can use a credit card?

rwollr

20:50

so i'm thinking about, for a research project, setting up an ad hoc web of raspberry pis (possibly arduinos with a wifi shield) and scanning for open wi-fi networks in my city

possibly also integrating something like aircrack and reporting the number of insecure/outdated access points

David Freitag

Basically, "Can i trust you with this shiny new $70,000 car? Am I sure that you will make your payments on time?"

rwollr

how feasible is this

Rоry McCune

@LucasKauffman so ncc have offices all over 3-4 big offices in the UK, Matasano, iSec and Intrepidus in the US some people in australia and Fortconsult in Denmark :) so yeah I work from home for the most part

Faheem Mitha

@LucasKauffman Something like that, I guess. I think I once had one of those long ago. When I came to the US. I couldn't get a regular credit card.

Ohnana

@LucasKauffman it's a 0 interest account. The account is frozen at the amount I put in. It is untouched by anyone. a collateral, if you will

Gilles

20:51

@RoryAlsop Nah, it could mean that, but the probability for a French person to understand it that way out of context would be negligible. Compare the popularity of the plural: we are Charlie, we follow Charlie

Rоry McCune

@LucasKauffman is cool we have like 250+ testers all-in so some v.cool info comes over internal mailing lists

Faheem Mitha

@Ohnana Right, but they can use the money while it is there.

Gilles

@Simon Wow! How did you find me out? YOU HACKED MY COMPUTER DIDN'T YOU?

Lucas Kauffman

@Ohnana See that's where you are wrong, they don't provide YOU with the interest, they leave it to themselves...

Ohnana

@rwollr yo, cool project. Although you could do the same with an android phone. Have it pop up a notification on seeing an open network

Lucas Kauffman

20:52

@RоryMcCune do they have subs in mainland europe?

Arperum

@DavidFreitag Over here if you want a loan you go to a bank, who then checks your finacial status, needing proof of your last six months of paychecks, and a list of all current open loans you have, then they block a certain amount of money you have left over every month for living, and the rest you can use to pay your loan back, and based on this you can get a loan.

rwollr

the idea is to leave like 5-10 just in the city in weatherproof containers and monitor over time how many access points are available

not really like wardriving

Simon

@Gilles Yep, that's what you get for not securing your MAC address, HA!

David Freitag

@Arperum That is credit in a nutshell.

rwollr

having a network of probes that report to a server that collates and displays the data as pretty graphs

Gilles

20:53

@Simon you must have the wrong guy, I don't have a Mac

rwollr

publicly available

Ohnana

@LucasKauffman I highly doubt they'll take their insurance money and loan it out... although I really don't mind them using that account's money, seeing as they've graciously lent me theirs every month

Simon

Yesterday, I saw a highly liked comment on Facebook that said it's easy to hack someone "... through their computer's IP".

I went all bananas.

David Freitag

Accept here the various companies get together and assign a point system. This is your "Credit score" and it's assigned automagically.

rwollr

i'd like to do it with arduinos so i could just leave them out for a long time without having to worry about battery but i dont know if they really have the hardware for it

Arperum

20:53

@DavidFreitag Except that we don't have the ridiculous system of " take loans so you can take a big loan later on"

Rоry McCune

@LucasKauffman well denmark for sure, we also have people who work remotely from various european countries (at least 3 in spain that I know of)

Simon

@Gilles Your name isn't Thomas Pornin?

Ohnana

@rwollr ah, that's tricky. leaving things out in the open begs for them to be stolen

Rоry McCune

@LucasKauffman all in a pretty remote friendly environment

Simon

Odd.

Faheem Mitha

20:53

@Ohnana I don't think it is as direct as they. it probably forms like a big pool or something.

rwollr

well they'd be hidden ideally

it's not hard to hide things in an urban settings

ask geocachers

Lucas Kauffman

@RоryMcCune interesting

Faheem Mitha

pool of money, that is.

David Freitag

@Arperum Yeah it's kinda a vicious circle, you have to get credit but you need credit in order to build credit. It drove me nuts until I got my loan for my car.

Ohnana

@rwollr very true, but all those humans running around, one of them's bound to look at it and go, "that's valuable/dangerous/stupid, let's mess with it"

Rоry McCune

20:54

@LucasKauffman the way it works is that you're nominally "attached" to an office (so mine is manchester) but that's for management/scheduling. then you work remotely or on-site depending

rwollr

only thing i'm really worried about is someone finding a tiny vaguely electronic looking thing and thinking it's a bomb

yeeeeep

Arperum

I hate being in debt to someone or some organisation. I don't want to have to keep loaning for everything, and pay a stupid interest on it if I can pay it normally, just so I can get a big loan for my house eventually.

Simon

Can we change the room's name to "The DMZ - Personal Finance"?

rwollr

so that's why my original idea of dropping/hiding them in buses and trolleys was scrapped fairly quickly

Faheem Mitha

@Arperum I think the idea is that you can be trusted to repay a loan, but seeing as in the secured case, they have your money the whole time, it doesn't really make a lot of sense. but maybe you are supposed to be paying with different money that the stuff they have?

Ohnana

20:55

@rwollr exactly! not trying to crush your dreams, but it's something to consider in the proposal

David Freitag

It doesn't help that all of the money companies in America are sexist. Young men get higher interest rates and way higher insurance rates.

Ohnana

@DavidFreitag insurance rates are high because y'all smoke and drink more because culture and toxic masculinity

rwollr

i think it'd be cool though. ideally i'd have arduinos that can capture handshake packets from wep secured networks and send them back to my desktop to run rainbow tables against

Rоry McCune

@Arperum yeah I hate paying out interest, is just a dead loss. Looking forward to getting rid of my mortgage..

Ohnana

@rwollr and now we've verged into "that's illegal" territory

Gilles

20:56

@Simon not that I know of, so if someone tries to call me by that name, they'd better not be expecting an answer

rwollr

is it?

i wouldn't be using the networks for anything, just recording what percentage are improperly secured

David Freitag

@Ohnana I do? Well I certainly don't remember it....

Arperum

@RоryMcCune exactly, if I had to pay interest when not needed so I could get a loan when I needed it, I'd be pretty pissed. I never loaned anything until I bought my house.

rwollr

maybe just keep track of what kind of security theyre using then..

Ohnana

@DavidFreitag you may not, but insurance companies gamble on your health. you look unattractive because of probability

David Freitag

20:57

Also, "Building Credit" is codeword for "Paying Interest"

Ohnana

@rwollr that's a little better. you can reasonably assume that WEP = bad security because it's awful. period.

Arperum

@DavidFreitag Yup, and that's really bad for the consumers.

David Freitag

@Ohnana I'm not saying I blame them. I wouldn't let some 21 year old guy get in my car.

Lucas Kauffman

@RоryMcCune they pay decent?

rwollr

it would be so undeniably cool though

David Freitag

20:58

But a 10.4% interest rate...

On a $20,000 loan...

Simon

@DavidFreitag WHAT?

David Freitag

@Simon For my car

Simon

You're getting nailed in da donut.

Arperum

@DavidFreitag Yikes. I pay 2.3% interest for my €110k loan.

David Freitag

Yeah tell me about it. My donut is all mangled.

rwollr

20:59

i guess i could just record which type of security and how common the SSID is, and use that to guesstimate how hard it would be to crack each network, then display that on the site

Transcript for