The DMZ - 2015-11-19 (page 1 of 7)

« first day (1799 days earlier) ← previous day next day → last day (3379 days later) »

Mark Hulkalo

03:50

Everyone fled when kalina mentioned NSA

Austin Hartzheim

Be quiet. They are listening.

Mark Hulkalo

:(((((((((((((

Austin Hartzheim

Let's just link to an image from torproject.org. Then everyone not in US, GB, CA, AU, or NZ gets hit by an XKeyScore rule when their browser fetches the image.

Mark Hulkalo

awesome

Austin Hartzheim

04:06

This one seems relatively innocuous: hxxps://www.torproject.org/images/tails_logo.png

Maybe even cute.

Mark Hulkalo

user image

Fixed that for you

I accidentally found out the IP address to xkeyscore

(just kidding, please don't kill me, freaky JSOC)

Austin Hartzheim

If you were outside of a Five Eyes country right now, drones would be in route as we speak.

Mark Hulkalo

Probably

Austin Hartzheim

@MarkHulkalo Have you made any progress on the unicode extension

Mark Hulkalo

I quit

I found something I feel passionate about

working on a video game now

Right now it's just a test, using my own engine... but I know how it's going to work

Making a Fallout Shelter clone. Dunno what to call it

Basically, for the Unicode extension project, you just need to intercept all urls and remove all unicode data that doesn't correspond to ascii. You can also stop it

But it's so horribly documented I don't want to bother

Austin Hartzheim

04:18

Yeah, it's a pretty simple extension. I'll probably throw it together myself sometime in the near future.

Mark Hulkalo

hang on I'll give you the code

pastebin.com/kZFG6gb1

But you will want to change httpChannel.redirectTo() to redirect to something like about:gtfo

Otherwise people could exploit the extension to force you to visit a bad non-unicode site

The code is just for demonstration purposes

Austin Hartzheim

Yeah, that could be useful. I'll have to look into how much of the "Services" stuff is being deprecated in the near future.

Mark Hulkalo

The exploit would work like this: you attempt to visit bankofamerica.com, but it's a fake one.... so it removes the non-ascii vowels: bnkfmrc.com. Someone would just have to register it and set up a drive-by download festival

and you'd end up on the 'replaced' site

again, it's a demonstration. pretty insecure. use at your own risk =D

Austin Hartzheim

Yeah, I see what you mean.

I was probably going to have it warn rather than redirect. A redirect to a warning page is another idea as it would get you off the offending website.

But, if you don't allow JavaScript/plugins by default, it is much more difficult to exploit that.

Mark Hulkalo

Yea

Man I love infosec <3

oh wait. let me fix that code lol

pastebin.com/1PvU5jVy

derped this: return (/[^\x00-\x7F]/g.test(str)) ? true: false;

Austin Hartzheim

04:33

Yeah, that is a bit more explicit.

2 hours later…

David Freitag

06:16

@MarkHulkalo Oooh I wanna help

I don't want to set the world on fire, I just want to start a flame in your heart.

2 hours later…

M'vy

08:12

Morning

AviD

08:28

@LucasKauffman was considering a job offer, wanted to first understand how much of a pay cut it would be...

@RoryAlsop yeah that too. Although EY doesnt really HAVE bad years, and even if they did its not like they wouldnt be able to afford salaries...

AviD

08:39

@DavidFreitag Some men just want to see ~~the world~~ your heart burn.

Journeyman Geek

I know where I can get a bag of dried nagas...

AviD

@JourneymanGeek silly @Geek, those are mythical.

or did you mean these:

The bhut jolokia (Assamese: ভোট-জলকীয়া), also known as bih jolokia, u-morok, ghost pepper, red naga, Naga Jolokia, and ghost chili, is an interspecific hybrid chili pepper cultivated in the Indian states of Arunachal Pradesh, Assam, Nagaland and Manipur. It is an interspecies hybrid of C. chinense and C. frutescens genes. In 2007, Guinness World Records certified that the ghost pepper was the world's hottest chili pepper, 400 times hotter than Tabasco sauce. The ghost chili is rated at more than 1 million Scoville heat units (SHUs). However, the ghost chili was shortly superseded by the Infinity...

Journeyman Geek

The chillies not the snakes

Yup

AviD

but damn, my mouth is tingling just seeing that

jeez

> The ghost chili is rated at more than 1 million Scoville heat units (SHUs).

Journeyman Geek

lol

My nose burned standing in the same aisle as those.

AviD

08:47

okay, this is the way to do it: wearing rubber gloves and a mask, you slice off just a tiny corner. Chop it up, and put it in a big pot, let's say some kind of stew.

Rory Alsop

Mmmmm - have a tiny vial of dried ghost chillies here. Is good to sprinkle on food

AviD

Cook it for a long time and make sure to mix it.

Journeyman Geek

oh this is a quarter kg pack

and I've grown chillies from dried chillies before

AviD

DAMMIT HOW IS THAT BURNING MY MOUTH THEY'RE NOT EVEN REAL

aww now I miss my chili plant

that was fun, picking it straight off the branch on to the cutting board and into the frying pan.

plant died :-(

Journeyman Geek

My dad killed ours ;p

Haven't managed to get a new one up yet

kalina

09:23

morning

Barry Carlyon

10:16

Morning!

Lucas Kauffman

10:30

@Avid if you do decide to sign and its EY tell them I was your referral :p

M'vy

@kalina Salut

Lucas Kauffman

There's a bonus associated

AviD

@LucasKauffman pfft too late for that man

they came to me anyway, so its not so much a referral as a sourcing...

Journeyman Geek

theverge.com/2015/11/19/9759762/twitter-cat-fact-spam-snowden

kalina

@JourneymanGeek awesome

Rоry McCune

10:41

user image

Lucas Kauffman

10:57

@AviD with Thal's team?

AviD

umm... maaaaaayyybe

of course, I cannot comment on possible job offers, which may or may not be pending.

Terry Chia

11:12

@LucasKauffman Wait what?

@AviD the no pants hipster with a Big 4?

2

AviD

@TerryChia inorite?

btw I like that title you gave me.

Terry Chia

@AviD Giving up on the consultant thing?

AviD

meh

though ftr EY is also consultants... even more so than me...

Arperum

@JourneymanGeek This is brilliant.

Terry Chia

11:31

@AviD I'm sure EY needs more HR managers...

AviD

@TerryChia ?

Terry Chia

@AviD You could be following in @RoryAlsop's footsteps.

AviD

ah. unlikely.

Lucas Kauffman

@Avid what position do they offer you?

Terry Chia

@LucasKauffman Kinky.

Lucas Kauffman

11:36

Raur

Brewerkz end of December? @TerryChia cc @JourneymanGeek

Terry Chia

@LucasKauffman Sounds good. @JourneymanGeek doesn't drink though iirc.

Lucas Kauffman

We can also go for sugarcane

Or he can have a soda

@TerryChia what area did you live again?

Journeyman Geek

Yeah I don't

but oh well, gotta get out of the house sometimes. ;p

kalina

not drinking is the best

you get to watch other people destroy themselves

Journeyman Geek

lol

I don't drink due to cultural reasons tho

Terry Chia

11:50

@LucasKauffman Hougang.

AviD

@LucasKauffman I will tell you after I answer them...

kalina

@JourneymanGeek I don't drink due to sensible reasons

and not eating meat for sensible reasons too

AviD

@kalina so why DO you drink? :P

kalina

and no drugs due to sensible reasons

by sensible reasons I mean "because I'm weird, or something"

Journeyman Geek

lol

I'm vegitarian due to religious reasons

though part of that might be pissing off the jains.

(who are actually pretty nice people)

AviD

11:52

@JourneymanGeek I'm not vegetarian because I love animals, I'm vegetarian... because I hate vegetables.

actually no, I'm not vegetarian.

kalina

well you should be

humanity will be a lot better off if we all become vegetarian

Journeyman Geek

lol

Rory Alsop

nearafternoon

Lucas Kauffman

@TerryChia how long does it take you to go from where you live to raffles? I'm checking out different places to get a flat, but it's quite expensive close to there

kalina

@RoryAlsop alreadyafternoon

Rory Alsop

11:57

@kalina \o hey kalina

kalina

o/

Rory Alsop

@AviD - joining big-4 consultancy? Kinda cool

I'm not just HR - it's now mandatory for all staff here to sit a Tax eLearning module on "customer taxation"

Why? I have no idea

kalina

customers are taxing

all that time required to answer them

Terry Chia

@LucasKauffman I want to say under 1.5 hours with public transport.

kalina

I need an automated booking management system integrated with flights and traffic information

Rory Alsop

12:00

like I ever have anything to do with tax. Even my own tax is too complicated - I pay an accountant to do all that

@kalina that sounds like an awesome idea

Lucas Kauffman

@TerryChia damn that's still long

@avid it better be senior manager or director

@RoryAlsop i have to do mandatory anti phishing and social engineering training...

Rory Alsop

@LucasKauffman that's fair enough - you're a security person. But tax? Really?

@LucasKauffman can you offer to teach it?

Lucas Kauffman

@RoryAlsop I'd charge 1 dollar per participant

Doubt it

kalina

you're worth a dollar, I'm in

Rory Alsop

@kalina lol

Lucas Kauffman

12:14

@TerryChia I'm checking bukit panjang now because they have straight busses to raffles using the PIE

kalina

quick, @Lighty is here, everybody be afk

Lighty

@kalina I have no idea how to respond to that

kalina

oh no, you can see me?

Rоry McCune

graphhopper.com/blog/2015/11/18/visiting-every-pub-in-dublin <-- here's something to do if your bored in Dublin. A route to visit all the pubs in dublin in a month

Lighty

Yes I can, I have x-ray goggles

kalina

12:16

you walk around looking at people's bones all day?

Rоry McCune

@AviD if you do it, don't forget the training/Going to AppSecEU budget!

AviD

@RoryAlsop was considerng it, but I dont think Big4 is anything kinda cool... more like the opposite of that ;-)

Rory Alsop

@AviD it depends 100% on what team. Honestly.

Rоry McCune

@AviD you have to excuse the elder rory, his sense of balance is off and it's affecting his judgement on coolness :op

Rory Alsop

I think our team was one of the best ones (although @RоryMcCune may well disagree :-) - but there are teams I would have hated to be a part of

Rоry McCune

12:18

@RoryAlsop yeah it was a very good team, lots of fun had :)

AviD

@RоryMcCune pls, I expect at least one international conference per month.

Rоry McCune

unfortunately I'd say that was in-spite of, rather than because of, the wider corp

Rory Alsop

@RоryMcCune (probably true...)

AviD

@RoryAlsop no no, EY Israel is the bestest team in EY. Even ask @LucasKauffman.

000

@kalina He has the kind of goggles that focuses on weens.

kalina

12:19

oh look, @Simon is talking about weens again

Rоry McCune

@RoryAlsop The key bit (for me) is who the senior management in the team are... good people at the top who are team focused, works well... add the wrong people and... well Blowing and goats springs to mind

kalina

that level of obsession qualifies you as a nerd

@Simon is a ween nerd

AviD

@RоryMcCune so on the one hand, thats a good thing, but on the other hand - why should we have to fight the system? Think how much more awesome that same team could be in a similiarly great corp.

000

I am what I eat.

wat

Rоry McCune

@kalina aka weenie

Journeyman Geek

12:20

there is no simon, only triple naught.

Rоry McCune

@000 T.M.I

kalina

@JourneymanGeek no he changed his name to match the number of people who like him

Rоry McCune

@AviD oh indeed, good corp + good team == loads of fun, but hard to find

000

pls

kalina

he went with three digits because he's optimistic

AviD

12:21

@kalina and one zero wasnt enough to express the nothingness of that?

kalina

inb4

one day he hopes to have 100 or more friends

000

100+ real friends would be a pain to handle.

Lucas Kauffman

@AviD they're good, bestest I don't know :p they're are other larger teams as well like in SG

@AviD how large are they now?

AviD

@LucasKauffman I think around 60?

Lucas Kauffman

Pure pentesters ?

I never worked with them they're in a different region

There are not they are

kalina

12:27

a life of pure pentesting would be fun

000

.

Rоry McCune

@kalina well once you've done stuff from bic to Mont blanc , it can get a bit boring

kalina

@RоryMcCune using a bic wouldn't even touch the sides

000

wat

Rоry McCune

@000 my reaction exactly

kalina

12:29

user image

Rоry McCune

I was making a joke about testing pens (the things you write with)

kalina

so was I

Rоry McCune

@kalina ah well in that case I think you're wrong you can clearly see the pen nib touch the sides there.

000

^

kalina

you're*

AviD

12:37

@LucasKauffman I think mostly pentesters and other types, and about 1/4 other expertises.

@LucasKauffman oh, thought you did... they actually cover EMEA, + some assisting in US etc.

its not a regional office...

RoraΖ

@kalina The pen is blue

Lighty

@RoraΖ The pen is Aqua

Lucas Kauffman

@AviD I know they did some testing in EMEA but it's not a lot to my knowledge, the only time I encountered them here was on a project where they were doing QA

000

That's not even aqua.

Journeyman Geek

Aqua - Barbie Girl

this is aqua

Lucas Kauffman

12:40

EMEA is mostly covered by Spain, Ireland, Poland and Belgium

Journeyman Geek

and I'm sorry ;p

RoraΖ

user image

Colin Cassidy

There, submitted to Securi-tay CFP, fingers crossed

RoraΖ

@JourneymanGeek So much hate

Lucas Kauffman

@AviD but they are more active on the us side I think

000

12:41

@RoraΖ That is the most shady link someone has ever linked to me.

Journeyman Geek

I'm SORRY

AviD

@LucasKauffman ah likely

I was surprised to hear how little they do here in Israel.

@ColinCassidy ooh good luck!

I should think about doing that... do they pay travel for speakers?

RoraΖ

user image

Rоry McCune

@ColinCassidy me too :)

TildalWave

FTFY

000

12:43

@RoraΖ Haha, what movie is this?

Lucas Kauffman

@AviD they're not even on my list for EMEIA for pentest tools and licensing and I take care of that for the whole region, so most likely it's a lot more US.

RoraΖ

@000 :facepalm: Liar Liar

AviD

@000 Liar Liar

000

o

AviD

dammit

Colin Cassidy

12:43

@AviD I have no idea, I'm an hour away by car so it's not an issue for me

RoraΖ

I hate you so much right now

000

I don't think I've seen it but yes, yes lads, I know that I should have seen it.

The time where I anger people the most is when I tell them that I haven't seen a movie.

Lucas Kauffman

@AviD curious tho where they are active then, let me know :)

000

Snobs.

Mark Hulkalo

@DavidFreitag I'll let you know when/what I need :D

000

12:44

OH YOU'VE NEVER HEARD SUBZERO BY BEN KLOCK?

IT IS SUCH A CLASSIC TECHNO TRACK

YOU ARE A BAD PERSON!

AviD

yay I paid my tax bill for the quarter. My goddamn ridiculous tax bill.

Rоry McCune

@AviD I don't think so , but it's a good recruitment opp. for the Big-4 so you may be able to persuade the boss to send you

AviD

@RоryMcCune lol

when is it btw?

ohh I should tell Checkmarx to hook that up ;-)

TildalWave

user image

Rоry McCune

@AviD end of feb 2016

TildalWave

12:45

this is aqua

AviD

They love the conferences track, I think they hit up every single one with more than a dozen people.

Rоry McCune

@AviD securi-tay.co.uk

AviD

cheers

TildalWave

also that pen is cerulean :P

Rоry McCune

@LucasKauffman is EY Israel in EMEA?

AviD

12:46

@RоryMcCune oh man its a weekend? I dont do weekends...

Rоry McCune

@AviD Fri/Sat IIRC

AviD

@RоryMcCune EY Israel is like a globabl center of excellence.

or some kinda more corp-ish name.

Lucas Kauffman

@RоryMcCune Americas

Rоry McCune

@AviD sure I was wondering if it fell under emea as the Security practice director for EMEA is a glaswegian

Lucas Kauffman

@AviD there are several global centres of excellence

Rоry McCune

12:47

@AviD I could've given you some appropriate phrases to use if you spoke to him

AviD

@LucasKauffman yeah, but then its not "regional"

or do I misunderstand the corporate version of "global"

@RоryMcCune pppffft

000

You know what else is not regional but global? My ween.

Rоry McCune

@AviD things "See you jimmy, porsche's are shite, Subaru's are braw, mind"

2

Lucas Kauffman

@AviD it's EY :p there are several ASCs Israel is just one of them

AviD

@RоryMcCune I will try to remember that.

Is that for all glaswegians, or just that one?

000

12:48

@RоryMcCune Hey, those are boxer engines, well done!

Terry Chia

@LucasKauffman Can't help you on rent stuff. :P Can't say I'm familiar with the market.

AviD

@LucasKauffman no, that part I get. I meant the "fell under EMEA"

Rоry McCune

@AviD just that one, he has/had a red porsche and it was slower (in some circumstances) that @RoryAlsop 's subaru

AviD

@RоryMcCune hahaha

Lucas Kauffman

@AviD even if you are a gcoe you are still part of a region

AviD

12:50

see I dont speek corpish

Colin Cassidy

@AviD I can listen to it, but after 10 minutes it gives me a headache ;)

AviD

you should bring your bingo chart

Lucas Kauffman

@AviD I don't really know what they do to be fair so I can't comment and I can be wrong :p

AviD

anyway the bureaucratic hierarchy is not one of the topics I bothered asking about.

If I decide to take it - aaaaand thats a BIG "if" mind you - I will have them put in my contract that I will be ignoring all the internal politics, bureaucracies, and hierarchies.

Corporate shenanigans, if you will.

kalina

yeah that will work

AviD

12:54

Super Troopers (5/5) Movie CLIP - Shenanigans (2001) HD

Lucas Kauffman

@AviD if you are working under a partner it's his job to keep that pressure away, but there will be politics I think

Rоry McCune

@kalina did you forget your <cynicism> tag there?

or is it implied

@LucasKauffman must... resist.... laughing....out....loud....

kalina

sorry for lack of vocal tone

Rоry McCune

@kalina it's these text only mediums

AviD

pls, I'm sure she could have found a cute cat meme, if she cared.

or a minions one.

Rоry McCune

12:58

@AviD more like an MLP one

AviD

that could work too

Rоry McCune

and I ain't talking More London Place (that's a little EY humour for you)

AviD

does MLP even do cynicism?

« first day (1799 days earlier) ← previous day next day → last day (3379 days later) »

Transcript for

Nov '1519

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile