The DMZ

Scott Pack

01:18

@AviD You need me?

tylerl

04:04

@Simon as your Donut?

TildalWave

06:12

Münchausen syndrome by proxy

Münchausen syndrome by proxy (MSBP or MBP) is a behaviour pattern in which a caregiver fabricates, exaggerates, or induces health problems in those who are in their care. With deception at its core, this behaviour is an elusive, potentially lethal, and frequently misunderstood form of child abuse or medical neglect that has been difficult to define, detect, and confirm. MSbP has also spawned much heated controversy within the legal and social services communities. In a handful of high-profile cases, mothers who have had multiple children die from sudden infant death syndrome have been declared...

Is there an infosec equiv term for this? Because I've definitely seen such behavior with certain sysadmins

here's one such a case, tho luckily from a rather confused end user

-1

Q: Virus Folder named "Photo"

this is my first time on this web site. I want to ask questions regarding virus that is in my laptop. If its not related to this site, please guide to site where i can get my solution. In my laptop i have virus called "Photo" which is a folder. I tried to delete it come. I formatted my pendrive ...

virus

well, kinda

he's not intentionally making it up

Terry Chia

07:13

@TildalWave "stupid"?

Rоry McCune

07:42

@TerryChia sure there's techniques and indeed it's a lot easier than dynamic, but I'm not sure that there's any free tools that go beyond the grep approach even for static langs...

Terry Chia

09:01

@RоryMcCune Nothing PHP specific but splint from GNU is pretty good for C code.

Rоry McCune

It's actually quite interesting (well I think) how slowly security focused static analysis tools have moved on.. looking at the list checkmarx did checkmarx.com/2014/11/13/…

there's not many new reasonably complete tools in there

if you compare that to innovation in the more "offensive" security tools markets...

Terry Chia

09:24

@RоryMcCune Like you said, static analysis is a difficult problem. :)

Lucas Kauffman

10:20

Any of you scrubs on Untappd btw?

Rоry McCune

@LucasKauffman wouldn't that only be useful to you if they were in Belgium?

Lucas Kauffman

@RоryMcCune not really

I travel

I've had beers with Terry

:o

@RоryMcCune and coffee with you I guess :P

Rоry McCune

@LucasKauffman well ok Belgium or Singapore... BTW what happened to the potential uk trip?

Terry Chia

Oh, @DavidFreitag pinged me about git.

@DavidFreitag Reverting is pretty easy.

Couple of options out there.

If you are using GitHub's PR model, use the revert button on the web interface to revert the entire PR. Easy peasy.

Second option is git revert (git-scm.com/docs/git-revert), which basically adds a new commit that reverts the changes of a previous commit.

Lucas Kauffman

@RоryMcCune quiet on the front

haven't heard anything

Terry Chia

10:32

Third option is git reset --hard, which should only be used if you have not pushed the changes yet.

Rewriting history of a pushed commit is a big nono of course.

Also, this isn't widely known but you can recover from a screwed up git operation with some difficulty, see git-scm.com/docs/git-reflog.

git reflog is approaching black magic territory of course, I have not used it yet.

Stack Exchange

A long, long time (plus 40 years) ago, in a galaxy far, far away (plus a corrective factor involving the Hubble constant) ...

Rоry McCune

@RoryAlsop BTW you attending the SBRC insider threat thing at Gogarburn on the 12th Feb?

Looks like I'm presenting, so lunch might be an idea :)

see it's apples turn for the Google Zero (day) feeling arstechnica.com/security/2015/01/…

Rory Alsop

11:28

@RоryMcCune Yes - lunch catch up would be good!

raz

12:10

You guys work at the same place or something?

Rоry McCune

12:20

@raz we have in the past, these days I'm way out west, but presenting at a conf. next to where t'other Rory works

Ninefingers

@raz @Rory what this means it is acceptable just to ignore the surname and ping @Rory.

Terry Chia

@Ninefingers Doesn't work anymore sadly. :(

@RоryMcCune spoiled our fun.

Ninefingers

@TerryChia What? How? This is a travesty!

Terry Chia

@Ninefingers Unicode.

Ninefingers

@TerryChia Oh that old chestnut.

Sneaky, sneaky.

raz

12:29

@TerryChia That's lame

I really don't want to be at work today.

Ninefingers

12:40

Wow unicode even appears in SE Urls

Simon

It's Friday, nobody wants to be at work.

Ninefingers

clever

Rоry McCune

@Ninefingers yeah the ambiguous rory'ing was getting painful :)

Ninefingers

@RоryMcCune Yeah I can imagine

Ohnana

13:38

@RоryMcCune why can't they just patch their damn software? if it takes over 3 months for critical vulns to be fixed, maybe they should look at making their process better

Rоry McCune

@Ohnana heh, dunno you'd need to ask apple but in general getting patches working with complex software like an OS can be tricky, I don't know whether 3 months is a realistic timescale or not

Terry Chia

@RоryMcCune Apple has a pretty shitty response to security issues.

IIRC they don't even explicitly mention what security issues gets patched.

Rоry McCune

@TerryChia yeah they do suck at that bit, which is a shame 'cause some of their work on iOS security has been good

Terry Chia

@RоryMcCune Also, I think Apple has been getting away with deferring security patches to major OS updates.

Probably won't work out so well for them with Project Zero's strict 90 days policy.

Rоry McCune

@TerryChia I wonder what project Zero would do if it was an Android bug ;op

Terry Chia

13:53

@RоryMcCune Heh.

To be fair Google does develop patches quickly. It's just that 90% of their ecosystem won't ever see it. ;)

Ohnana

@RоryMcCune probably disclose anyway, since they'd lose all credibility as soon as someone noticed

Rоry McCune

@TerryChia heh

raz

@Ohnana I'm not sure if Google would provide the proof of concept code to exploit it ;)

Ohnana

@raz i don't think they released it for apple either

Simon

@TerryChia When I'm done with this personal django project, can I pay you 10$ CND to pentest it?

I won't go higher than 11$.

Terry Chia

13:58

@Simon Err no. Gimme a git repo link and I'll be happy to take a look though.

raz

@Ohnana No they released proof of concept code for all 3 zero day vulns.

"And since the disclosures contain proof-of-concept exploit code..."

Simon

@TerryChia Sweet, I just gotta avoid procrastination and start working on it seriously.

It'll be a gift exchange website, but I'll keep it as simple as I can.

Which means it won't be that simple.

fml

Ohnana

@raz ah. I see.

Simon

@DavidFreitag Today is a Wasted Penguinz day. Going through Wistfulness.

raz

14:36

@Simon Wasted Penguinz day!?

Simon

aaww yeah boi

Rory Alsop

@Simon what does that even mean

Simon

It means euphoric melodies day.

Ohnana

@RoryAlsop is not hip with the times

Rory Alsop

@Ohnana very much correct :-)

user367890

15:11

Guess who ever coined SHA can rest easy, but the name have bothered me somewhat. Are we going to get RSHAWRMITT? (Really Secure Hash Algorithm We Really Mean It This Time) in the future?

The thought re-surfaced after reading this post: marc.info/?l=php-internals&m=138815272421031&w=2 which also inspired the name.

Ohnana

when we get up to RSHAWRMITT-256 we'll be in deep doodoo

Simon

What about RSHAWRMITT-512?

Ohnana

hmm

Arperum

@Ohnana Nah, The next one can be RSHAWRMITTFR (RSHAWRMITT For Real)

Ohnana

15:26

the new variants of SHA are called SHAKE and that makes me hungry

deed02392

@user367890 I think this too :P

to be fair it's just because they were kind of the first standards, I think

a bit silly they didn't anticipate the name would become less relevant though, pretty sure they knew full well back then that computing power was exponentially increasing with no sign of slowing

Xander

16:04

@Ohnana To be precise, SHAKEs are only some of the sub-components of SHA-3.

Ohnana

@Xander oh, i see. the wikipedia page was unclear

Xander

@deed02392 This is why they increment. SHA-1, SHA-2, SHA-3.

Ohnana

still wanna go to shake shack though lol

deed02392

@Xander but you still end up having a hash algorithm named 'Secure Hash Algorithm', that is no longer secure

Xander

@Ohnana SHA-3 has some standard fixed-length output functions (such as SHA3-256, and SHA3-512) and two functions that allow the output length to be chosen, and it's these two that that are are named SHAKE. (SHAKE128 and SHAKE256, specifically.)

Ohnana

16:08

@deed02392 SHA-0 got nuked within weeks of release, so that problem has already been handwaved away

@Xander what does the KE part stand for then?

raz

Am I the only one that completely disagrees with this answer?

1

A: Is it "cross-platform attack" if first OS is not attacked at all?

The scenario you describe qualifies as a cross-platform attack simply by the fact that one device attacks another. The mobile app containing worms may not harm the mobile device itself, but it is by any other name a malicious, infected device. When plugged into the PC, it launches the attack to ...

Ohnana

@raz everyhting is cross-platform then?

Xander

@deed02392 And such is life. All things shall come to pass. To me, this is better than an alphabet soup of acronyms that don't self-identify their relative age or whether it was ever intended for cryptographic purposes for the sole goal of not containing a word in the title that might be related to security.

raz

@Ohnana That's my logic!

Ohnana

@raz cross-platform would be like a python script. it can nail all operating systems that have python installed

Simon

16:12

@Xander Even your wife shall come to pass?

Ohnana

batch script = one platform

Xander

@Ohnana Keccak. The algorithm that was chosen for SHA-3.

Ohnana

java malware = god help you

Simon

Dayum.

raz

@Ohnana Exactly. Using one platform to inject yourself into a second is not platform independent!

You keep using this word "cross platform"... I don't think it means what you think it means.

Simon

16:17

24

Q: How do you stop Chrome and Opera sorting JSON objects by Index ASC?

I've got a problem. Using ajax I sent a correctly formed JSON object using: $.ajax({ type: "POST", url: SITE_URL+'/data.php', dataType: "json", data: { ajax: 1 }, success: function(data) { ...

jquery json google-chrome opera

Thanks for not minding your business, browsers.

At least you kept my morning busy.

raz

If you're depending on the order of your data to do processing I think you're doing something wrong.

At least as far as JSON objects are concerned.

Simon

If I'm ordering data in a certain way server-side, I'm expecting it to be ordered the same way once it reaches client-side.

But you're right, that might be a bad way to approach the problem.

raz

@Simon Exactly

Probably just a better way to go about doing things.

David Freitag

16:36

@Simon oooh that's exciting. I think I'll join in.

Simon

Cheers.

I typed "MySQL white" instead of "MySQL while".

I think I'm racist.

Rоry McCune

@Simon yeah you should get yourself checked into to a programme for that.. I mean MySQL instead of PostGres, what are you thinking!

Simon

sowie

My django project does use PostgreSQL though!

deed02392

16:57

@Simon did anyone tell you how hot you are

2

Simon

blushes

My donut did.

deed02392

m mmm mmm

David Freitag

18:22

@TildalWave after all of that talk of pens yesterday, I finally found a cool one.

amazon.com/gp/product/B00MA1E864/…

Ohnana

i've never dealt with piston fills before.

2

oh come on that's not even filthy! y'all have low, low standards

Simon

I've been trying to analyze the sentence to find where the filth is for far too long.

I blame @ColinCassidy.

raz

18:49

@Ohnana Your mom has low standards.

Ohnana

@raz your mom jokes don't work on me

TildalWave

erm ^

Simon

You're an erm.

Ohnana

erm?

Simon

Americans don't understand jack shit.

TildalWave

18:56

urbandictionary.com/define.php?term=erm

Ohnana

I know the interjectional form. I'm questioning your interjection

Simon

I interjection your mom.

Ohnana

@Simon have some self respect! damn.

Simon

wat

Rory Alsop

19:09

You're a wat

Simon

dayum son

Rоry McCune

@Simon you're a dayum

Simon

dayum dem Rorys be wild on dis fine Friday aftern00n

Ohnana

still don't know what tildalwave is erming about

Simon

Does it matter?

Rоry McCune

19:16

@Simon waat, it's friday night, and I have holiday in cambodia playing

Simon

watisdat

Rоry McCune

@Simon . . .

Simon

ô_ô

Rоry McCune

you're not aware of the dead kennedys?

Ohnana

holiday in cambodia -- why does that sound like a song about the genocide...

Simon

19:17

'MERICA

Rоry McCune

►

Simon

Did I ever say that I don't care about politics because everyone's corrupted?

o

Xander

@RоryMcCune I haven't listened to the Dead Kennedys since...Well, my Dead Kennedy albums were cassette tapes, if that says anything.

raz

"It's not that I'm lazy, it's that I just don't care"

Simon

I love it how when @RоryMcCune links me music, it's always bad quality 'cause old.

Rоry McCune

19:19

@Xander I have a punk playlist on spotify currently running

Xander

@RоryMcCune Nice!

Rоry McCune

@Xander bit of dead kennedys, some stranglers, the buzzcocks, sex pistols, damned, nice mix

Xander

@RоryMcCune Nice...Throw in a little Black Flag and some Bad Religion, and you'd have the soundtrack of my youth.

Simon

I read that as "mouth".

I was very confused.

Ohnana

@RоryMcCune dinosaur

Simon

19:24

@Ohnana Please, tell us everything about LMFAO.

Ohnana

@Simon REDFOO LETS GET RIDICULOUS WOOOOOOOOOOOO

Simon

wat

Ohnana

for srs though if LMFAO is the hallmark of my generation then I'll be super pissed

Simon

I think they're pretty much dead now. Well at least, I don't hear anything about 'em even though I'm staying away from pop as much as I can.

raz

yasaflajc

Simon

19:26

But sometimes, I get to hear about all dem crazy pop stars.

Rоry McCune

@Ohnana heh I have a ... wide taste in music. Punk is part of it, also like some of most genres

TildalWave

Some of most?

Rоry McCune

@TildalWave yeah some pop, some rock, some punk, some classical, some EDM etc

TildalWave

I rarely get to say what plays around here and when I do it's headphones time :)

Colin Cassidy

@Simon I'd blame me too, though I suspect that's your fault

Rоry McCune

19:30

@Ohnana also if you ignore punk you're missing out :)

Simon

@ColinCassidy Perhaps we can agree that it's donuts' fault.

Rоry McCune

@Simon U..... G.......H

Colin Cassidy

@Simon I wouldn`t be at all surprised if a Rory didn't have a hand in it somehow

Rоry McCune

@ColinCassidy who us ! that's never been known

Simon

Hehehehe.

Colin Cassidy

19:32

@RоryMcCune never been proven perhaps...

Rоry McCune

@ColinCassidy ya know what they say... no evidence, no crime!

Colin Cassidy

unless your name is Sony

TildalWave

@RоryMcCune that explains those Man took three fatal gunshot wounds to the head in an apparent suicide headlines

Simon

pls Colin, be respectful to Sony, I own a PS3.

Rоry McCune

@TildalWave wasn't there another one of those recently where the guy was in the middle of saying bad things about a .gov

TildalWave

19:36

@RоryMcCune Aren't they all the time?

all of a sudden you then see articles of how someone that exhibited nothing but high spirits "apparently" suffered from years long depression and such

Rоry McCune

@TildalWave yeah I just thought I remembered reading about a specific one this week

TildalWave

I did too, I'm just filibustering while trying to remember who it was :)

maybe not exactly this week tho, just recently

Rоry McCune

@TildalWave the one I'm remembering was in Argentina

frontpagemag.com/2015/kenneth-r-timmerman/death-of-a-prosecutor <-- this guy

google search is very handy for filling in the gaps in my memory

2

TildalWave

yup that's the one

Simon

You're the one.

Rory Alsop

19:44

@RоryMcCune They're only little :-)

Ohnana

you're the one that I want! ooh ooh ooh

Rory Alsop

@Xander superb!

Rоry McCune

@Ohnana see that song right there is older than the dead kennedys!

Simon

Everyone's so damn romantic today.

It's not even February yet, calm down young love birds.

Ohnana

@RоryMcCune musicals are exempt from the dinosaur accusation

Rоry McCune

19:45

@Simon yeah, we're like @Simon seeing a frosted doughnut!

Rory Alsop

@TildalWave Here - I have now a wall of Marshalls, so I can play whatever I want really loud

Simon

<3<3<3

Rory Alsop

(when the wife is out)

6

Simon

rip ears

Rory Alsop

Nah - I have full wireless connectivity - turn em up loud and play guitar or something elsewhere

Going to use the wireless stuff in anger for the first time on Valentines day

TildalWave

19:46

@RoryAlsop oh I could play my music real loud too, I just happen to appreciate being alive too much to actually do it :))

Rory Alsop

@TildalWave hence my starred comment above :-)

Simon

I wonder what @Lighty will do for Valentine's day, I suspect something like invite her for dinner at McDonald's.

5

Rory Alsop

Oh - superb - this came up again on my playlist!

►

Once again I go all happy at 4:45 onwards :-)

Simon

Those dudes are so messed up, I like it.

TildalWave

@RoryAlsop Either Zeno's paradox works for you or you move real fast for an octogenarian! :)

Ohnana

19:51

man i never want to be that partner

Rоry McCune

@TildalWave are you calling @RoryAlsop ant octogenarian tortoise?

Simon

#tortoise

TildalWave

@RоryMcCune hey that's a young age for some tortoises

"ant octogenarian tortoise"

Simon

@RoryAlsop Wanna give a try to a Hardstyle/Metal hybrid track?

TildalWave

that'd be quite some species :)

@RoryAlsop 3:14 already works magic on me :)

hey that'd be awesome background music for a trippy pinball fantasies mod with a mushroom table

TildalWave

20:08

> Thank you for reviewing 20 close votes today; come back in 3 hours to continue reviewing.

Can't they send a 6-pack too?

Simon

I'd get to 3k rep ASAP if that would be the case.

TildalWave

Don’t miss tonight’s triple shadow transit on Jupiter! It won’t happen again until 2032. Credit: Steve Marsh http://t.co/pgLteOClYW

Tweeted by skyatnightmag on January 23, 2015 at 7:00 PM

cc @RoryAlsop if you're still up and about at around 4 am this might interest you

's gonna be live here new.livestream.com/GriffithObservatoryTV/…

tho that second simulation video already looks pretty cool imho

Considering it's gonna be late into Friday we could have a competition who sees more shadows. Complete blackouts obviously win :)

David Freitag

20:34

@RoryAlsop YES I love that freaking song.

Thomas Pornin

20:50

I am seeing something weird.

Normally, when a SSL/TLS connection is terminated, whoever is initiating the close should send a close_notify alert.

All the HTTPS servers I contact fail to send such an alert; they just drop the connection.

Has the whole World silently decided to stop conforming to the protocol ?

phwd

Is anyone aware of any books more current than The Mac Hacker's Handbook

Xander

@ThomasPornin Was just reading the other day (in Bulletproof SSL) that many clients and servers do not, in fact send close_notify alerts, hence the change in TLS 1.1 to allow session resumption even when close_notifiy isn't sent, since the practice was/is so widespread. That may be what you're seeing.

Thomas Pornin

@Xander I would have expected OpenSSL (the "s_server" command line tool) to send it, though -- but it does not.

Even when you use the command ("q") to explicitly close the connection, this is done without sending a close_notify.

In older days it did follow the protocol.

Xander

21:05

@ThomasPornin Well that's odd.

Thomas Pornin

Well, I'll add a flag.

Simon

I'm home, bitches! #hoodie #sweatpants #easyaccesstoscratchballs #hashtag

Rory Alsop

21:27

@TildalWave - very cool, but sadly I don't currently have a good enough telescope to resolve that. :-(

@Simon - I'm not sure what that combination means, but sure - I'll listen to anything

Simon

►

You might need to wait a minute for the guitar to kick in.

I don't think this will end up being your favorite song anyway :p

TildalWave

will this one do?

That's why I added a link to an upcoming live stream. I have a telescope with required resolving power but 1) it's overcast 2) it's cold and I'm not gonna freeze for it :)

and 3) I had a few beers so I probably wouldn't assemble the (damn heavy) kit without doing some damage to it

Rory Alsop

:-)

TildalWave

@ThomasPornin Is this exploitable?

Simon

I just did something lulz to one of you, I wonder how fast this will be found.

Rory Alsop

21:38

If it was making me listen to a 'hardstyle' thing, then you managed

SWMBO and I listened to the whole track...

Simon

Win!

Rory Alsop

Not sure I identified anything in a rock genre in there :-)

Simon

There's a metal-like guitar, briefly

^_^

Rory Alsop

Hmmmmm - not convinced. Sounds like a sampled guitar through a synth

Simon

It probably is, hehe.

Xander

21:44

@TildalWave It potentially allows for truncation attacks, since you can't tell if the connection was intentionally terminated by the other party, or by a MitM.

Simon

Sometimes, I see @ScottPack retweeting on Twitter, then nostalgia hits me and I cry.

TildalWave

@Xander ah yes I didn't think of that, cheers!

kalina

22:37

lo

David Freitag

@kalina o/

kalina

22:57

honestly not sure what I hoped to achieve by coming here

David Freitag

@kalina There's always being mean to @Simon in an attempt to make yourself feel better.

kalina

I don't want to be mean to simon

I don't want to be mean to anybody

David Freitag

I'd share some pizza with you, but it might get cold by the time it got to you

kalina

and I very much doubt there's anything on the internet that will make me feel better

meh, I'm not hungry

David Freitag

:[

kalina

23:01

haven't been for the last couple of days

David Freitag

23:11

Jeez $1500 for a plane ticket to Melbourne

lol, $81 to fly to Atlantic City

Simon

23:26

@DavidFreitag QQ

@kalina Just like when I flash people with my D.

David Freitag

►

Simon

@DavidFreitag Now you're gonna have to remind me on Monday.

David Freitag

D:

Simon

Nevermind, I know it.

dat melody

I didn't own it though so I bought it.

David Freitag

I just lost all motivation.

Simon

23:29

Motivation for what?

David Freitag

anything

Simon

ô_ô

Well, do you have anything to do tonight?

David Freitag

Nope, just spin my spaceship, but I'm still at work.

Simon

Ah, ew.

David Freitag

That wasn't a euphemism you donut.

Or are you "ew"ing at the fact that I work until 7?

Simon

23:33

^ that

David Freitag

It's my own fault for waiting to drag my ass out of bed until 11am

I love datasheets translated from mandarin to english.

> Please don't take big load. Otherwise the burned circuit.

Simon

Now that's kind of disgusting.

David Freitag

23:49

@Simon It's talking about drawing lots of current

kalina

@Simon 0/10, didn't even provoke a smirk

David Freitag

@kalina Wait, @Simon's D didn't make someone laugh? Huh, I guess there's a first for everything.

kalina

I don't think I'll be laughing for a while

Transcript for