The DMZ

Mark Hulkalo

18:02

Just got in trouble for watching a Tech video

:(

Simon

rekt

So, you can't even watch videos on YT on your lunch?

Mark Hulkalo

There's no work right now. So I must stare at the screen intently

I completed my projects too fast I think

And I must also leave this chat for the majority of the day

Austin Hartzheim

@MarkHulkalo This might help with appearances: hackertyper.com

Simon

@MarkHulkalo Surely you could work on something that would be useful internally?

And seriously your manager has nothing for you to do?

pLs

Rоry McCune

@Simon is that a euphamism?

Simon

18:08

ffs you're all mental

Rоry McCune

@Simon you're only just working this out now.... a bit slow really!

Xander

@RоryMcCune I think that's an effect of a steady diet of doughnuts.

Rоry McCune

@Xander true true I could see how that would promote a level of slowness...

Simon

all

Iszi

@RоryMcCune Someone please perma-pin this: This is the DMZ. Everything is a euphemism!

Simon

18:15

pls we don't want to attract poets

Xander

@Simon I'm a poet.

Simon

o no a poet

See what you've done oszi

kalina

@Iszi no

@Iszi do you know who else insisted everybody do what they wanted? Hitler.

Ohnana

hulk's job sounds like a shithole

kalina

@MarkHulkalo hahahaha

aww

Simon

18:20

wadafuk does hulk have to do with any of this ohnuhnuh

kalina

shuttup simun

Simon

pls

kalina

pls

Simon

O

cuz his gravatar is the actor who does hulk

I GET IT

kalina

what a big O you have

Ohnana

18:21

@Simon hulkalo ya dumb shite

Simon

pls I SAID I GOT IT

kalina

pls it's too late to get it

it's too laaaaateeeeeee

Simon

i say it's 2 l8 to apologizeee

Ohnana

the fail cannot be undone

Simon

yyyyeeeeeeaaaaaaahhhhh

sudo tail /var/log/apache2/error.log

sees the error he has been comitting

kalina

18:22

pls sudo rm -rf /

and install windows

Simon

I HAD FORGOTTEN MY SEMICOLON

kalina

well if you concentrated more on your semi-colon rather than your semi-ween it would be less of a problem

Simon

pls it's a fully ween

kalina

pls no

you're such a bad influence on me and this is all your fault

Simon

wat

kalina

18:28

I move for a permanent ban on pls

Simon

You cannot oppress my plses

kalina

did you mean suppress

Simon

Probably.

Wait no.

My plses are a living entity.

kalina

wait yes

Simon

NO

kalina

18:30

no they're not

Simon

I'M A POET

DO NOT TAKE MY PLSES AWAY FROM ME

kalina

please you're still stuck on the choice of paper to use

you will never convince me you're a poet while you're still tweaking a kick drum instead of writing an arrangement

Simon

@kalina But I really like parchment but it's inconvenient

David Freitag

@Simon Ever gotten a paper cut from parchment paper?

Simon

@DavidFreitag n

David Freitag

18:31

Might as well cut your arm off

kalina

might explain the semi-ween

Simon

But I like my arm.

KALINUH I NEED KOMPLETE 10 TO WRITE A FULL ARRANGEMENT

I WANT DA WEST AFRICA VST

kalina

no you don't

Simon

FOR DA CONGA AND BONGO

kalina

that's the most pathetic excuse ever

Simon

18:32

AND DA TAMBOURINE

AND DA SHAKERS

AND DA MARACAS

David Freitag

And the cowbell

Simon

AND MAYBE YES THE COWBELL

kalina

so how do you think people made music BEFORE komplete 10?

David Freitag

There can never be enough cowbell

kalina

that's right, they used samples or made samples

HAVE YOU THOUGHT OF THAT? HUH?

Simon

18:33

@kalina NOOOOOOOOOOOOOOOOOOOOO

kalina

nothing but excuses

Simon

I DON'T WANT TO MAKE TUNED PERC

I'M NOT SUICIDAL

kalina

you're never going to get past the kick drum but you're happy spending thousands of dollars anyway

why not get a maschine while you're at it

solve your drum machine problem

Rоry McCune

@Simon oh pls, oh pls, don't take my pls away. I used to play with them at least ten times a day. Once they were golden, but now they're old and grey, oh pls don't take my precious pls away.

Simon

pls if I were happy to spend monies on software, I'd already have Komplete.

David Freitag

18:34

@kalina BUUUUUT KNOOOOOOOOOOOOOOOOOOBS...!

Simon

Logic already has a good sampler, I don't need Maschine.

kalina

@Simon yet you want a drum machine

Simon

:DDDDDDD

Rоry McCune

oh and I'll award 100 fake DMZ points if anyone can identify the song that was based on

Simon

I want to tweak a waveform, not tweak a sample.

kalina

18:35

whew

you just said that

and... we're walking

Simon

wat

Ohnana

@RоryMcCune you are my sunshine

Rоry McCune

@Ohnana thank you , but no

David Freitag

Is there 2fa for twatter?

Ohnana

@DavidFreitag yeah, sms

David Freitag

18:38

Ew fuck that

They need to hop on that authenticator game

Ohnana

@RоryMcCune dark they were and golden eyed

@DavidFreitag authenticators make me sad. texting and push notifications are so much nicer

David Freitag

@Ohnana vomits

Rоry McCune

@Ohnana are you still guessing or was that just random?

Ohnana

@RоryMcCune i googled part of your phrase

David Freitag

@Ohnana Giggity.

Rоry McCune

18:43

@Ohnana ahh sometimes google won't get you where you want ...

Simon

Especially if you fill it with pls.

Rоry McCune

especially when it referes to 80's british parody songs

Ohnana

never mind

parody songs are an affront to my humanity

Iszi

@Simon Ew.

Rоry McCune

@Ohnana you're not a fan of Weird al?

and other purveyors of the genre

Xander

18:45

@Ohnana Parody songs are what make life worth living.

Simon

weird al sux irl and in-game

Ohnana

^^

Rоry McCune

@Simon no

Iszi

So, for you guys doing actual penetration testing work... does this sound right?

> Manual testing was required to identify 67 percent of the RVA vulnerability findings (as opposed to off-the-shelf, automated vulnerability scans);

Ohnana

@Iszi yes

Rоry McCune

18:45

@Iszi depends on the vulns found :)

kalina

actual penetration testing

Iszi

From here about U.S. DHS offering free penetration tests, and some info from their FY14 end-of-year report.

Simon

KALINUH FIND ME KOMPLETE 10 PLS

Ohnana

scanner will get you the weird shit it's hard to find by hand

kalina

@Simon er, no?

why don't you find it yourself

Ohnana

18:46

but the bulk of design flaws and broken controls are people powered

Simon

I might just buy the damn West Africa VST.

Rоry McCune

@kalina as opposed to vuln scanning, I know

Simon

ffs

LOOK AT ME BUYING SOFTWARE

LIKE A DAMN DONUTTTTTTTTTTT

kalina

@Simon you don't need it that badly else you'd have already bought it

you're not even buying software

you're buying samples

Simon

=|

kalina

18:47

dirty filthy human

Ohnana

@Simon better than begging an internet stranger for it

Mark Hulkalo

Yeah noooothing. Supposedly Monday the stuff starts though.

Iszi

@Ohnana Strange. I'd expect the reverse to be true. Or is it a bit of both?

kalina

@MarkHulkalo that wasn't the rest of the day, I'm disappointed

Rоry McCune

@Iszi scanner has 50000 checks, you ain't doing that manually

Simon

18:47

@Ohnana no

Mark Hulkalo

I said most. I can hide Jan the bathroom for a few seconds

Ohnana

@Iszi two examples: POODLE and a broken authentication control

Rоry McCune

so it'll find stuff that's not likely you locate

kalina

@MarkHulkalo you're chatting with us on the toilet? ew!

Mark Hulkalo

Hallway

Ohnana

18:48

with POODLE, i can write a tool that goes, "knock knock what ciphers do you have?"

Iszi

@RоryMcCune And yet they're reporting that most of their findings are from manual checks that can't be automated.

Mark Hulkalo

Back to staring at the screen

Rоry McCune

@Iszi so, scanners are bad at some things, that's why I said it depends on the vulns you're talking about

kalina

@Iszi that obviously means somebody checked and fixed the scannable stuff

Ohnana

with broken authentication, a scanner is less helpful because scanners do not think. they can't look at something, get a feel that it's not right, and play with it. fuzzers are a thing, but again, they're dumb

kalina

18:49

I don't understand the problem

Rоry McCune

@Iszi for example scanners suck at business logic flaws in web apps

Thomas Pornin

@Ohnana Why would you need POODLE for that ?

Rоry McCune

@Iszi they also suck at anything requiring multiple steps to find

kalina

oh no the bear arrived, everybody stop acting like they know anything

2

Ohnana

@ThomasPornin talking about vuln scanners. it's easy to scan for poodle and weak ciphers

Simon

18:49

Yeah pls ohnuhnuh, thomas da donut did a talk about SSL knocking

Rоry McCune

@Iszi they also suck at authenticated web app testing on live systems (run a web app scanner on an admin system and be prepared to have it destroy your system)

kalina

we act like we act like we act like we act like we act like we act like we act like we knooooooow

WUBWUUUUUB do do do do

Simon

dodododo WUBWUBWUB

Iszi

@RоryMcCune Yeah, most COTS web app scanners I've seen say "don't try this in prod".

Rоry McCune

@Iszi but say there's a vuln on port 27000/TCP relating to an outdated version of a licensing service that needs a specific packet format to check, then scanners are your man

Thomas Pornin

18:50

@Ohnana Ah ok, simple parsing mistake. I thought you were claiming that you use the POODLE vulnerability to be able to enumerate the cipher suites of a SSL server.

Rоry McCune

@Iszi 'cause someone took the time to code that check up and it's really unlikely the tester knows how to do it by hand

Ohnana

@ThomasPornin now that's what I call hacking

Rоry McCune

@Iszi FWIW for web app. testing , my recommendation is never do it in prod. unless you have to

kalina

zomg I just realized @Ohnana answered one of my questions on Arqade

accepts

Ohnana

@kalina :D

Iszi

18:52

@RоryMcCune Ah, but reliance upon the results comes with the presumption that your test/dev environment was an exact duplicate of prod at the time of the test. How often has that actually happened?

Simon

ohnuhnuh now knows more about video games

Ohnana

seriously that was fucked up

Simon

cuz of his ween

Ohnana

"EXECUTE!" "Oh i understand. i'll make arrangements"

THESE ARE YOUR FRIENDSSSSSSSSSS

Rоry McCune

@Iszi At a web app. level I'd really hope most of the time. If you can't replicate your app. at a functional level in a test environment how are you doing system/UAT/acceptance testing?

kalina

18:53

I'm not that evil

I never tried the murder option

Rоry McCune

@Iszi if you can't do that, what's the DR strategy ?

kalina

well except the start of my fourth playthrough when I skipped the story and grinded a bunch of levels and guns then went and murdered the railroad for fun

Ohnana

@kalina D:

kalina

then again I did mod my laser rifle to set fire to people

Iszi

Oh, you should be able to duplicate the current prod environment on-demand for testing. But I think most people expect the pre-existing test environment to be pretty well deviated due to changes currently in-work. So you'll want a *separate* test instance just for the scan.

<nobodygottime.gif>

Ohnana

18:55

not glory and deacon ;-;

kalina

@Ohnana what? I walked into Diamond City with a fat boy and nuked everybody as well

Rоry McCune

@Iszi that's the best approach for sure, an env that no-one cares if you mess up during the test

Ohnana

@kalina tbh i'm planning on nuking the institute from low earth orbit so killing people with justification makes my job easier

kalina

oh my fourth character decided she doesn't need justification for anything

Ohnana

murder time fun time!

kalina

18:56

and had a simulated nervous breakdown that started upon leaving vault 111

where everybody is the enemy

SCREW YOU GUYS

no longer is it "ooh, trader!" buys things it's "ooh, trader!" murder

Simon

all pls violence is not funny

Iszi

@RоryMcCune What's really amusing is coming across public-facing websites that have strings like "Acunetix" spewed all over them. Gotta wonder then: Skiddie or pentest gone bad?

Ohnana

did you kill cricket and Kleo ? :(

kalina

@Ohnana did you read kleo's terminal?

Ohnana

@kalina no

kalina

18:58

plans on how to murder people in goodneighbor

Ohnana

it's owned isn't it?

kalina

crazy one that is

sure but kleo is downstairs

Iszi

@kalina Oiy! Spoilers!

kalina

oh you want spoilers?

Ohnana

oh fuuuu

Simon

18:59

She's like the ultimate spoilerer.

kalina

shaun is your son and you got frozen in a vault

Ohnana

codsworth is a synth

MIND FUCK

Simon

Don't you know that from the very beginning?

kalina

@Simon yes

Transcript for