The DMZ

Iszi

02:36

Should we be allowing this question? Seems like it's an active and unauthorized attempt at circumventing an organization's security - not what we're here for.

0

Q: How to listen to all ports (UDP and TCP) or make them all appear open (linux)

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them manually. On my Debian server I would like to listen to all my UDP and TCP ports so I can clearly ...

AviD

08:52

todays morning comic:

Stack Exchange

Scott Pack

13:43

@Iszi I think it's probably ok, just not exactly clear.

At first blush it looks like he's asking for help bypassing the firewall, however he's really just wanting to map out what ports are being blocked at their border firewall.

jwegner

13:55

Hi all - getting some weird traffic reports spitting out of my firewall - I'm wondering if anyone has got a quick idea of what might be going on. One of our users's is using a macbook with a static IP. My firewall is showing hundreds of unhandled (no policy) packets coming from her IP to the gateway. The destination port is 10101, and the source port seems to be trying every possible port (my logs start at 58*** and are now at 61***). Any ideas what's going on?

Seems somewhat like it might be a sort of malware scanning for holes in our gateway/firewall. She's certainly not a techy enough user to be doing a port scan herself, but it's possible that she's got something malicious that she doesn't know about

Iszi

@jwegner Google says it's probably either BrainSpy or Silencer. Good luck.

jwegner

@Iszi, thanks

Iszi

@jwegner Curious though: How'd they end up with a trojan on a macbook? They running Windows in Boot Camp, or a VM, or something?

jwegner

14:11

@Iszi, they've got parallels. Doing a bit more research to confirm that it's not Growl or eZMeeting link, but it's likely an issue in their parallels

Iszi

@jwegner Legitimate software like that shouldn't be doing port scans.

jwegner

@Iszi, I don't mean to make you do my research for me, I just figure you know a bit more, given that you hang out in this chat.... Will a microsoft security essentials install most likely install/remove Brainspy and/or silencer?

Iszi

@jwegner It depends. If the system's been root-kitted, then I wouldn't count on it.

In the rare case that I ever actually catch a virus infection these days, I usually just rebuild.

jwegner

ouch

Iszi

And then make sure antivirus is the first thing you install. (After, perhaps, MS updates.)

jwegner

14:15

Sounds like I might just tell her to get rid of her dang personal laptop... We bought her a 27" iMac that she refuses to migrate to.. This may be a good excuse.

Iszi

@jwegner As good as any, I'd say.

jwegner

Alright, I'm gonna go see if I can get it removed. Thanks for your help.

Jeff Ferland

15:05

@Iszi @jwegner Almost every application uses random source ports to connect to a destination server. DNS queries, your browser, etc will do the same. 10101 indicates "ezmeeting-2" as much as "Brainspy". Go on her machine and use the Sysinternals tools to determine what application is actually using that. It may have been intentional on the user's part.

@jwegner Also, I accept 27" iMacs as payment for advice :)

2

Iszi

@JeffFerland I'd generally agree with this, but will ever application keep trying source ports in order until they find one they can get out with?

Jeff Ferland

@Iszi Source port randomization is relatively new. Historically, source ports for new connections have incremented. A changing destination port is a port scan. A changing source port is just plain common. See en.wikipedia.org/wiki/Ephemeral_port (and no clicking on other links... you know how you get).

"Most implementations may simply increment the last used port number until the ephemeral port range is exhausted."

@jwegner the above is useful for you too

Rory Alsop

15:26

@JeffFerland Tivoli does this, as do various FTP implementations and a host of other 'above board' apps

Scott Pack

@RoryAlsop Well, @JeffF got it spot in when he said, "just plain common."

Until recently one assumed that all normal applications did this.

Rory Alsop

@ScottPack yeah - it has always been a complete PITA

at least proper stateful firewalls can cope

nowadays

Scott Pack

Mebbe

I can into an interesting issue with a Juniper SSG a couple of weeks ago.

It was blocking DNS responses

It was not properly detecting the response as part of a related connection to the request.

Rory Alsop

@ScottPack ahh

Scott Pack

Incidentally, you can not create a firewall rule based on source port using the NSM.

ಠ_ಠ

AviD

16:28

good evening sec.se folks

Thomas Pornin

@AviD Hello

AviD

.... and bears

Scott Pack

Afternoon

AviD

@RoryAlsop you around? something I wanted to discuss with you...

besides how much I hate Fortify.

well, its not so much hate. It's more that I despise Fortify.

Tom Leek

@AviD I'M ESTABLISHED.

AviD

16:34

another bear!

Rory Alsop

@AviD yep - here

@AviD they're taking over the world

Jeff Ferland

@TomLeek @ThomasPornin Same person / puppet, right? That or your writing style is freakishly similar.

Rory Alsop

well, at least Canada, anyway

Jeff Ferland

and if so, why?

Tom Leek

@JeffFerland MY NAME IS LEGION: FOR WE ARE MANY.

Iszi

16:41

This is just... wow.

Just reset my ISC2 password so I can vote for @wimremes , and ISC2 kindly send me my new password in the clear in an e-mail, WTF!

Tweeted by raesene on November 16, 2011 at 4:38 PM

You'd think (ISC)^2 would be more up-to-date than that.

Thomas Pornin

So yes, same person, sockpuppet and all. Keeping writing style aparts is too much work; but bear #2 tends to be less well-mannered.

Ninefingers

@Iszi I always thought that avatar looked suspiciously like Rory.

Iszi

@Ninefingers Different Rory, but they used to work together.

Thomas Pornin

@Ninefingers Y'know, when I first began to roam security.SE, I just blindly assumed that the two Rorys were the same person.

Scott Pack

Team Rory!

Iszi

16:42

Pretty sure the other one used to hang out here too.

Jeff Ferland

I just don't understand why the second account

@Iszi He did

Scott Pack

So he can repcap twice on the same day?

Rory Alsop

@Ninefingers hahahaha - there are a lot of Rorys

Thomas Pornin

@JeffFerland Mostly for fun.

Jeff Ferland

@ThomasPornin It took me a while to keep them separate

Rory Alsop

16:43

@JeffFerland he still does occasionally - but he set up his own consultancy as well, and is doing well, very busy

Tom Leek

@JeffFerland ALSO TO PWN YOU ALL

Rory Alsop

@Iszi Actually used to work together in 4 different companies on different occasions

AviD

the real question is, who would win in a fight: bear vs. lion?

no frikkin lazer beams, and no sleepy lions allowed.

Rory Alsop

@AviD with or without lasers

sorry 'frikken' lazerz!

AviD

hehe

Jeff Ferland

16:49

0

Q: GPU powered Password cracking machine - buy metal or cloud?

As a IS consulting firm, we would like to have our very own password cracking machine. Great. Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU or rainbow tables). And the questions that we found hard to tackle was what is the best choice -...

cloud-computing

That's a math word problem disguised by security words, right?

Iszi

Anyone know any news on this?

11

Q: IT Security SE Logo Wallpaper

Just wanted to post here, to officially request something that was mentioned in chat: An IT Security StackExchange wallpaper. I think the main site's "banner logo" (including: lion, shield, starburst, wings, "Tron lines", banner) would look great against its current backdrop color, as a full-s...

feature-request design

@JeffFerland Something along those lines. I voted as off-topic instead of localized.

@Iszi That feature was requested in June, and the last comment from @Jin was in September... :-(

Rory Alsop

@JeffFerland I reckon so, however I don't think maths.se would thank us for it. Your answer seems spot on.

Jeff Ferland

@RoryAlsop onstartups?

AviD

well, I have to brave the storms to go out for a nighttime meeting.

will be my first time seeing rain this year... :-o

hope I dont melt.

Rory Alsop

@JeffFerland possibly - honestly don't see it as totally on topic anywhere

Iszi

17:02

@RoryAlsop +1

Rory Alsop

@Iszi have had no news on it, but I think it would be good to have it as a marketing tool, given the ubiquity of laptops at conferences etc, having a cool desktop attracts attention

@Iszi @jin guessing you are kept busy with new graduating sites, but what do think in terms of timeline?

Thomas Pornin

@JeffFerland Also, free T-shirt

Rory Alsop

@ThomasPornin hahahaha - you are after 2 free t-shirts :-)

all that work - I knew it had to be for some reason

Iszi

@RoryAlsop Wonder if those will come before or after the wallpapers?

Speaking of... how's our top users pages doing?

Thomas Pornin

Last user on second page has 779 rep.

Iszi

17:08

@ThomasPornin Yeah, it looks like a third of the way down is where we drop below 1k.

Thomas Pornin

It is totally arbitrary on my part, but I like to think that the threshold is when the first two pages are all "established" users (i.e. 1k+)

Rory Alsop

@Iszi I don't know what the criteria are, but mentally I'm thinking first 2 pages over 1k is a good milestone

Iszi

@ThomasPornin I see your puppet is quickly making his way towards page 1, though.

Thomas Pornin

@RoryAlsop I hereby formally deny any allegation about Rory being my sockpuppet, or vice versa.

2

Rory Alsop

@ThomasPornin hahahahaha

one single brain cell

Iszi

17:09

@RoryAlsop Why do I seem to recall mention of the third page being involved in the criteria?

Rory Alsop

@Iszi could be true - I had a look on MSO and there was never anything concrete. SE like to keep thresholds secret so folks can't target them

Iszi

At least page 3 is still all >500.

Rory Alsop

I reckon if Tom Leek gets up to second place we should all change our avatars to bears

Iszi

@RoryAlsop They like to keep a lot of their special sauce recipes secret, it seems.

@RoryAlsop Hey, let's do that!

Like, for a week or so.

@AviD will be easy to pick out though, 'cause he'll surely be using Winnie the Pooh.

Rory Alsop

evening all - need to head home and sleep. Had epic gig supporting KMFDM last night so got home at 3, headed off to work at 7 and am exhausted now :-)

catch you tomorrow

Scott Pack

17:19

@RoryAlsop Glad to hear things went well! Good luck recovering, I hear that starts to get difficult after a certain age. :)

Ninefingers

17:55

This is all your fault, @AviD. All your fault. github.com/ninefingers/pmon. So far, it's just a driver that loads in and loads out without crashing windows - all I've done is set up a simple example and the appropriate key signing stuff to make it work on x64. I need to decide how I'm going to proceed at some point - stage two is just to catch IRJ_* and dump that out to the debug log. Stage 3 is to make it say hi to userland. Actually, I might do that first.

But, I just wanted you to know, I blame you entirely.

Ninefingers

18:10

I think I have some way to go yet, but still.

Right, gotta run anyway.

Scott Pack

So this makes me happy. Check out his shirt

Brendan Long, Colorado

206 7

hash appsec web-application authentication javascript client-side cryptography

Jeff Ferland

18:36

@ScottPack Captain Hammer?

Scott Pack

Yup

Stack Exchange

20:13

Stack Overflow Blog: SE Podcast #27 – Dave Winer

Posted by Alex Miller on November 16th, 2011

Jeff & Joel are joined today by Dave Winer, who’s upset that we don’t have a jingle to start the show! He “invented” (well, pioneered, really) the XML-RPC protocol. Dave tells us the story of how and why the protocol came to be.

Right now, Dave’s working on a “magnificent symphony of software” – it’s the communication system he wants to use. It involves a minimal blogging tool with only RSS output (plus a dongle that will push the RSS to twitter, etc), a “River of News” aggregator, and an overarching tool for creating content that can be picked apart and included on other platforms. …

Iszi

20:49

Ah, this one's great.

in Mos Eisley, Nov 7 at 15:58, by Jeff

This drive-bye posting was brought to you by StackExchange - draining more productive time than TV tropes since 2010

Scott Pack

21:01

Or wikipedia

Iszi

@ScottPack True

this.josh

@Iszi Thats based on the theory that you would otherwise be productive. Not necessarily a good assumption.

Iszi

@thisjosh Depending on the individual, I suppose.

this.josh

@Iszi Yup for moste statements, given enough people, someone will make your statement false. Including this one.

@ThomasPornin Ah thats why I like Bear #2.

@JeffFerland Its an economic question

Scott Pack

21:17

@Iszi When trying to understand how a power works, would asking for an example combat round be reasonable on rpg.se

Iszi

@ScottPack It doesn't seem *un*-reasonable to me.

Scott Pack

That implies that you don't necessarily find it reasonable, either.

Iszi

21:44

@ScottPack Arguably.

Scott Pack

21:59

Well, I realize that the purpose behind asking that question would not be to actually find an answer, but to demonstrate documentation to my DM. The rules are pretty clear, he just doesn't like it :).

However, there actually was a related question, that I'm writing up instead. Something that, I have a feeling on the answer, but I don't actually know.

Holy crap, loads of Pathfinder questions now

Rory Alsop

22:11

evening - I've woken up now

:-)

this.josh

evenin+/-12

studiohack

23:08

hey guys, want this question?

0

Q: Cisco IOS IPSEC Site to Site VPN "send errors"

I have a recently setup (never worked) IPSec VPN between two Cisco IOS routers. The VPN comes up fine, both ISAKMP and IPSEC negotiated without issues - the SAs are sitting there waiting. Traffic is matched to the match-address ACL - no problem. However, all packets that are sent do not make i...

vpn cisco

thinking its more appropos on SF...but giving you guys first pick

this.josh

23:20

I think SF is right.

@Scott What do you think?

All the diamonds are sleeping.

studiohack

@thisjosh that's all right - yous is the 2nd opinion I've got that it's better on SF - migrating there.

thanks for the help - love your site design btw!

this.josh

Thank @Jin he did an awsome job.

studiohack

just complimenting you guys on your site, that's all. :)

cheers!

this.josh

Thanks, cheers!

Iszi

@ScottPack If it's a DnD 4e question, I might be able to assist some. But, I've let my D&DI subscription lapse. So, you'd have to give me rulebook references and/or citations.

@ScottPack Nevermind. I saw your tweet. Dunno Pathfinder.

Transcript for