The DMZ

MickLH

22:00

Warning: Conclusion of humorous experience imminent.

David Freitag

@RоryMcCune Yeah @MickLH I hope you're fire proof

MickLH

I actually feed on fire

Rory Alsop

@RоryMcCune not sure how I first heard of Peaches - she is an ... Odd ... Singer. Probably one of my brothers sent me some stuff. Yeah. I'll blame them

Rоry McCune

@RoryAlsop yeah that was... an unusual track

Rory Alsop

@MickLH I dunno...that's a lot of fire

Rоry McCune

22:03

but now I got peaches in my head, and so I'm on a stranglers tear

@RoryAlsop BTW didn't realise you were in Glasgow town today!

diagprov

@RоryMcCune "that's a lot of fire" :)

Rоry McCune

Stranglers - Golden Brown

►

^ahh golden brown

diagprov

@RоryMcCune I knew the song but not who it was by, now I know :)

Rоry McCune

@diagprov stranglers, great band, have some really good tracks

MickLH

@RoryAlsop Jokes aside, her personality reminds me of all my ex'es, which is a pleasant comfort to me. That's why I joke like that. With that said, the pure irony is that they all lived in different countries and we met on some internet chat not intended for meeting in that context at all. With that said, I don't have any further intentions than having a nice time online.

AviD

22:07

> Simon has been kicked from The DMZ by Rоry McCune and cannot return for 1 minute.

lolol fantastic, what did I miss??

Rоry McCune

@MickLH potentially you have directed that message at the wrong rory :op we have many rories here, he's rory[0]

diagprov

@RоryMcCune I think I might have been forced to listen to most of their stuff while stuck in traffic on a delightful carpark called the M6.

Rory Alsop

@RоryMcCune yarr - over in Waxy's for the IISP meet

Rоry McCune

@AviD more comedy :) @Simon dissed the DMZ, I had to kick him

AviD

oh well of course

whats the point of even having canadians if you cant abuse them every once in a while.

Rоry McCune

22:10

@diagprov ahh you're in the UK, yeah the M6 can be "fun" in the rush hour

Rory Alsop

Stranglers were awesome when we went to see them in Glasgow last year. A less exciting after party than expected, though. One of them ended up talking to Erik's wife about hats...

Rоry McCune

@diagprov I've never seen taxi's take so many rat runs as they do around halifax and leeds

AviD

@RоryMcCune why do they even call it that, noone is going anywhere

Rory Alsop

M8 was a bit crap this afternoon - that average speed camera section sucks

Rоry McCune

@AviD well their in a rush... just not getting far/quickly!

@RoryAlsop road works still going? yeuch

diagprov

22:11

@RоryMcCune I'm actually not anymore, but I've spent enough time on the M5-M6 to be scarred for life :)

The locals like to complain about traffic here. They aint got nothin' on us!

Rоry McCune

@diagprov heh yeah I can understand that!

diagprov

Plus I'm English so I'm allowed to joke about tea and scotland :)

Rоry McCune

@diagprov ah well if you're english it's oblitatory to joke about tea isn't it!

Professor Elemental - I'm British (Dir: Moog Gravett)

►

diagprov

@RоryMcCune Yes and to write strongly worded letters when I am angry. DEAR SIR!

Rоry McCune

^^ that song really should've been "I'm english" given the lyrics

Rory Alsop

22:14

Anyone want to flag, VTC etc:

1

Q: bruteforce computation assignment

Assume you want to brute force a password of length 8, with characters in the range [a-zA-Z0-9]. Estimate the time required to test all passwords if you know the following about your system: SHA1 1 hash | NTLM 500k hashes | MySQL1k hashes 73.97 MH/s | 79.83 MH/s ...

brute-force

Rоry McCune

@diagprov ya know your handle changing is going to confuse me one of these days

AviD

@RоryMcCune oh! totally missed him. Heya @diagprov!

diagprov

@RоryMcCune Fun fact: re-registering with an old openid on SE means you see all notifications on all your old questions, even though they're disassociated :)

David Freitag

Wut

diagprov

I'm walking around with the effects of a 20k rep SO account with 101 rep :)

i.e. all the notifications and none of the power :)

Rоry McCune

22:16

@diagprov interesting, I bet there's some mucking about to be done with assoc/de-assoc of accounts...

@diagprov lolz

David Freitag

So who is this person?

Curiosity is killing me.

Rоry McCune

@DavidFreitag ah young david, to know that you must know of the olden times of Sec.SE

AviD

@DavidFreitag yooouuuu wiiiilll neeevvvaaaah know.

Rоry McCune

when different users roamed these halls and @RoryAlsop was well.... just the same as he is now :op

David Freitag

@RоryMcCune How Olden? I've been around for a few years now

AviD

22:18

@RоryMcCune the daaark times.... before the Empire.

Rоry McCune

@DavidFreitag exactly .. actually you were probably here where @diagprov was here before, you can regard it as a challenge to see if you can work it out :)

Rory Alsop

Ahhh - hello @diagprov. Yes - I did get your email, by the way. I'm just rubbish at remembering to respond

diagprov

Yes. Einstein's law of relativity: Rory Alsop is constant(ly old) in all frames of reference.

Rоry McCune

@AviD hey hey, no spoilers!

diagprov

You have to remember the dark days of flag weight wars

and closing historical questions on SO

David Freitag

22:19

@RоryMcCune Yeah that's probably not likely to happen, I'm even more rubbish at remembering than @RoryAlsop is :b

Simon

o no not him

AviD

@RоryMcCune just dont try counting to ten first.

Simon

not da guy worse than kalinuh da traitor

diagprov

It was a time pre-Simon

Rоry McCune

@Simon pls

AviD

22:20

@diagprov before the dark times

Simon

@AviD YEAH GOOD EDIT OVID

Rory Alsop

Good ninja edit

AviD

sorry, before it was ambiguous

diagprov

Before we had a site design.

Simon

It wasn't ambiguous, it totally meant that pre-Simon was dark.

AviD

22:22

@Simon no, it was referring to the times that @diagprov was talking about before it.

see? convoluted sentence.

Simon

ANOTHER EDIT?

diagprov

Before SO had its own meta

AviD

thats why I had to disambiguate.

@Simon shuddup I'm still fuzzy from my bedtime nap.

Simon

Yup, time to leave.

bye bye

David Freitag

@diagprov WE GET IT YOU'RE A DINOSAUR

AviD

22:26

hehehe thanksalot @kalina, now I'm watching the whole jeggings series. Classic.

diagprov

@RoryAlsop No worries, I still haven't replied to @Avid's :)

I will, I promise :)

Rоry McCune

@AviD you need to go to the Game dev room to give @kalina messages now :op

AviD

@RоryMcCune jeez no man! what you trying to do to me??

Rоry McCune

@AviD don't worry you can leave the room afterwards :op

Also, the "industry's most deployed stateful firewall" apparently has no ASLR or DEP. In 2016.

Tweeted by mdowd on February 10, 2016 at 10:18 PM

David Freitag

@RоryMcCune Waaaaauw

Rоry McCune

22:30

^ Security Vendor != Secure Vendor

David Freitag

@RоryMcCune Yeah well we knew that from the beginning :b

diagprov

@RоryMcCune This being the Cisco thing?

AviD

@RоryMcCune yeah, the security industry suuucks.

David Freitag

I mean, just look at McAfee's track record

Rоry McCune

@DavidFreitag you'd think, but a lot of companies still try to pretend that if they produce security products they have good security....

AviD

22:31

@DavidFreitag McAfee is not a security vendor, they are an AV vendor!

AV is not a security product

Rоry McCune

@diagprov yeah, if that turns out to be wormable, some people are going to have a very bad tomorrow

diagprov

Wasn't there a nice bug in fireeye or something like that a while back where they just ran java classes on their device.

AviD

same with symantec

Gilles

@RоryMcCune is ASLR that useful? It feels like moving the barn door after the horse has bolted

Rоry McCune

@diagprov there's been some fun deserialization stuff

diagprov

22:32

Like, sandboxes are for the weak!

David Freitag

@RоryMcCune The problem is a lack of accountability. Their codebase must be huge an very convoluted by this point, and I'd bet all the issues are present in "legacy" code.

Rоry McCune

@Gilles makes exploitation more tricky from what I've seen... anything to raise the bar a bit

AviD

@Gilles its like blindfolding you and moving the dartboard around the room.

kalina

@RоryMcCune old, I just never stuck around

David Freitag

@AviD True, but aren't firewalls included in most AV softwares nowadays?

kalina

22:32

@RоryMcCune ... :(

Gilles

@RоryMcCune yeah, but exploitation always finds a way, so is it worth it?

kalina

y u so mean?!

AviD

@DavidFreitag not really

kalina

-> games

diagprov

googleprojectzero.blogspot.ch/2015/12/…

Rоry McCune

22:33

@kalina sorry I was just teasing

kalina

@RоryMcCune w/e

Gilles

It makes debugging harder, so you trade harder exploitation for more vulnerabilities. I don't see a clear win there.

AviD

@Gilles makes it harder- and noisier.

kalina

I am going to murder a bear or 10 and get over how you hate me now

Rоry McCune

@Gilles yeah for me security is just a game of whether you can make it harder than that attacker was willing to overcome

David Freitag

22:34

@AviD It makes it harder? Totally worth it.

Rоry McCune

@kalina pls we don't hate you, as I'm sure you're aware

kalina

well obviously

David Freitag

@kalina they're just grumpy because they lost a friend to the game dev people

kalina

do I look like I'm in gamedev?

MickLH

@kalina I can't believe you'd betray me like this

Rоry McCune

22:35

@Gilles if you look at exploitation of modern platforms, overcoming ASLR, DEP, NX etc makes it much more tricky and requires fancy stuff like ROP chaining. Realistically this cuts sets of attackers out of the market

diagprov

@Gilles How does ASLR make debugging harder?

kalina

@MickLH I am sure that in time you shall get over it

David Freitag

@kalina Well just because they think it doesn't make it true

Rоry McCune

@kalina :)

kalina

@MickLH also tell whatever his name is that his game is quite good

MickLH

22:35

Jon is a beast

David Freitag

@diagprov I'd imagine it makes symbols much more difficult to use

Gilles

@diagprov when pointers change from one run to the next, it's harder to debug

kalina

I've been playing it for like the last hour or so

David Freitag

Instead of a fixed symbol map you now need to do dynamic searching

MickLH

@kalina Also, I'll never get over this! mainly because I was joking and so there is no perceived betrayal to overcome

kalina

22:36

@MickLH yeah that's what I thought.

MickLH

@kalina You think you know me so well huh?

kalina

you're more than welcome to idle in here, though

AviD

@DavidFreitag the symbols arent the problem, its the pointers and vtable

David Freitag

@MickLH You do seem like an open book

Gilles

it also makes some bugs less reproducible

kalina

22:37

I'm sure you'll fit into the social hierarchy some place above @Simon

Rоry McCune

ohh and I just realised loads of Cisco admins will be running ASAs without support contracts

no patch for them

well they're stuffed then

David Freitag

@RоryMcCune Haha good times

Gilles

@RоryMcCune can't metasploit do this at the press of a button?

kalina

gosh there is an infosec conversation happening in here

Rоry McCune

@Gilles .. not so far as I'm aware :) it can do a lot but advanced exploitation could be tricky

kalina

22:38

to the tomb raider

Rоry McCune

@kalina what do you expect, you wandered off :op

diagprov

@DavidFreitag Ok so debuggers can trap module loads (blogs.msdn.com/b/rihamselim/archive/2012/03/14/…) and offset from wherever the image is rebased to and work from there. If symbols are relative to the image base (which they should be) you're fine.

kalina

yeah... from my PC...

MickLH

I probably should hang around since I end up doing security for almost all my clients below a certain project size

Simon

o wow look at the traitor pinging me

Rоry McCune

22:39

I actually bought a legit ASA for use and found that as I bought from a standad e-commerce site and not a Cisco re-seller I couldn't get a support contract

David Freitag

@diagprov Yeah but with ASLR there may not be a guarantee that the symbols are relative to the image base.

diagprov

@Gilles only marginally.

Rоry McCune

£500 firewall and it was unsupported instantly

(last time I buy a cisco product)

kalina

@diagprov ...

diagprov

@kalina Sorry meant to reply to Gilles.

Rоry McCune

22:39

@kalina yeah @diagprov is new here, he doesn't really know the ropes yet

Simon

@kalina Stop freaking out, traitor.

kalina

I didn't freak out

Simon

He might be new but he's not Markus new.

Rоry McCune

@Simon pls somon you're sounding a touch jelous there :op

kalina

dotdotdot isn't freaking

Simon

22:40

That's the worst kind of new.

Gilles

@diagprov Depends what you're debugging. I work on an embedded OS, so bad pointers are most of the bugs I use a debugger for. I guess as you move up the stack they become rarer.

David Freitag

@Simon Instead of "Eggs benedict" I'm going to start saying "Eggs Kalina"

kalina

@RоryMcCune somewhat

Simon

@RоryMcCune WOT

kalina

@RоryMcCune I wouldn't dream of scaring away somebody who clearly has an interest in the subject

Rоry McCune

22:40

@Simon just sayin' man, most of us have moved on, you seem a bit stuck on havin' been "betrayed"...

David Freitag

@Gilles Yeah dude ASLR on a microcontroller would make debugging a nightmare

Rоry McCune

@kalina well ya know we've got to be nice to the newbies!

kalina

@diagprov there is absolutely no problem, I was merely startled by the fact I'd turned up the volume to raid tombs and the chat notification was loud

Simon

@RоryMcCune pls, are you a traitor too?!?!?!?

Rоry McCune

@Simon ...no

Simon

22:41

OMG THAT'S WHAT A TRAITOR WOULD SAY

David Freitag

@Simon Out of sheer curiosity, how much coffee have you consumed today?

Rоry McCune

heck the only kind of person who'd accuse me of being a traitor is the kind of person who mysteriously drops off chat unexpectedly :op

TildalWave

Does anyone have a list of more recent games that run on XP? I'm giving away one older box and thought to throw in some better gaming titles.

David Freitag

@TildalWave ..... XP .....?

Simon

@DavidFreitag 1 cup + 1 tea

kalina

22:42

@Simon I'm pretty sure I chatted in gamedev before here

Rоry McCune

@TildalWave have you looked at gog.com

diagprov

@Gilles Ah ok, perhaps. On a desktop environment, even in C, though, it ought to be possible to cope with images being relocated by the OS as needed, on every run if needs be.

Simon

@kalina omg wow :(

TildalWave

@DavidFreitag it's not gonna even be a connected rig

or used for anything that matters

Simon

ok bye

kalina

22:43

@Simon there are several rooms I've been in, just because I mainly chat here...

David Freitag

@TildalWave ...right

kalina

would you be QQ'ing so much if I had gone to the bridge?

TildalWave

and,... I can't be bothered to arse with upgrade

David Freitag

@TildalWave But XP is... SOOOO BAD

kalina

@TildalWave why are you running Windows XP?

David Freitag

22:43

@kalina Laziness, apparently.

kalina

you're not a Windows 10 tinfoil hat type are you?

TildalWave

@kalina I'm not, some old rig does, it works, has relatively good graphics card in it, and I'm giving it away

David Freitag

@TildalWave 8 runs well on older rigs, 10 might also.

8 is terrible, but I'd use it over XP all day every day

TildalWave

look, I'm not spending hours on upgrade... I just wanna load it with a couple of titles

Rоry McCune

@DavidFreitag my missus actually just downgraded her Surface 3 from 10 to 8.1

kalina

22:45

wow XP only has direct x 9

Rоry McCune

@TildalWave gog.com

David Freitag

@TildalWave Well there is a really quick answer, no recent games will run on XP.

Rоry McCune

gog.com/game/dungeon_keeper_2

kalina

Quake 3 will run on it

TildalWave

@RоryMcCune LOL

Rоry McCune

22:46

gog.com/game/heroes_of_might_and_magic_3_complete_edition

David Freitag

@kalina Oooh that's my favorite recent game.

Rоry McCune

gog.com/game/sid_meiers_alpha_centauri

diagprov

Although actually I could excuse no ASLR on a Cisco device, since, presumably they control the entire software stack and consequently can apply best engineering practices to make it a very secure environment.

AviD

@diagprov hahahahaha

Rоry McCune

gog.com/game/planescape_torment

AviD

22:47

damn I forgot how subtly cynical you can be :-)

Rоry McCune

gog.com/game/baldurs_gate_2_complete

gog.com/game/neverwinter_nights_diamond_edition

David Freitag

@RоryMcCune LOL, Baldur's gate.

Rоry McCune

that should be enough games for anyone!

Neverwinter nights, Baldurs gate

heroes of might and magic III

no DRM all run on XP

TildalWave

dude I'm pretty sure it could run things like S.T.A.L.K.E.R., older Bioshocks, Deus Ex,...

David Freitag

I remember when I was in high school Baldur's gate was the shit

Rоry McCune

22:48

all work offline

David Freitag

@TildalWave You might get away with Bioshock 1 and maaaaaybe 2

Rоry McCune

I've played sooo much neverwinter nights

it was great

David Freitag

@RоryMcCune There are soo many games that I haven't played

TildalWave

@DavidFreitag 2 works on XP just fine yup

Rоry McCune

@DavidFreitag more games than time I'm afraid

David Freitag

22:49

I got my first ever computer in 2004

The entire sum of my computer knowledge is the culmination of the past 12 years

Rоry McCune

@DavidFreitag got my first computer in 1981

ZX81

1KB RAM

David Freitag

We built it from parts that were scavenged from a local junk yard. It didn't really play games.

Well unless you count solitaire/minesweeper on Win95 a game

Rоry McCune

@DavidFreitag freecell FTW!

David Freitag

Lol, I didn't even have internet until 2006

Interesting, this year marks my first decade of internet access

Rоry McCune

troyhunt.com/2016/02/… <-- some more details on exactly how horrible vtechs security was

TL;DR very very horrible

and with that I must away... g'night all

David Freitag

22:55

@RоryMcCune wow.

@RоryMcCune \o

diagprov

@AviD I'm being.... ok well yes a bit cynical in this case, but the point stands. You would think if you were in the business of manufacturing firewalls and selling them for money you'd, y'know, have a development process that is hostile to any of these mistakes ever reaching production.

David Freitag

@diagprov The problem is whether or not these "mistakes" are ever found.

AviD

@diagprov I think its a mix of over-pride, NIH, lack of other expertise, and especially the Silver Bullet Effect.

David Freitag

If they aren't doing any kind of security auditing or pen tests, then it's definitely possible that some scary stuff can go unnoticed.

AviD

I.e. if you sell firewalls, you inherently believe that a firewall is The One True Solution to all security woes.

like how certain leading WAFs were trivially exploitable by XSS and SQLi, and their response was: just protect the admin interface with the WAF.

cuz that would never end badly.

diagprov

23:01

@AviD I suspect a healthy mix of "pressure to ship" and other development headaches too.

AviD

@diagprov sure, thats always true - but I meant specifically regarding "security" products.

JukEboX

YOu guys have experience with Security AUdit logs?

AviD

wHat kiND of exPerIenCe?

JukEboX

@AviD

0

Q: EXCESSIVE Amounts Of Security Logs

I am running Server 2008 R2 and in my Security event logs I am getting an OVER abundance of 4656 events for Registry and Object Manipulation. The policy states it should be auditing only the failures on Object Manipulation as well as Registry changes. The logs are not showing an Audit failure. ...

windows-server-2008-r2 event-log

diagprov

@AviD Ah ok.

AviD

23:05

@JukEboX meh, thats OS configuration

@diagprov the silver bullet effect I find to be the most egregious.

David Freitag

@AviD Silver bullet effect?

AviD

8 mins ago, by AviD

I.e. if you sell firewalls, you inherently believe that a firewall is The One True Solution to all security woes.

David Freitag

@AviD Ah right

AviD

8 mins ago, by AviD

like how certain leading WAFs were trivially exploitable by XSS and SQLi, and their response was: just protect the admin interface with the WAF.

David Freitag

Sorry not paying attention :|

AviD

23:06

You're supposed to eat your own dogfood, not drink your own kool-aid!

JukEboX

@AviD which OS Configuration? I have checked all the ones that it could be per a google search

diagprov

@AviD I'd have thought they'd think well the stuff coming in from the WAN interface is not to be trusted and so test for invalid cases...

JukEboX

7 events a second is very ridiculos

AviD

@AviD heh that made me laugh

@JukEboX tell that to @Simon's mom!

boom!

David Freitag

@diagprov Yeah but it's also possible that there are intruders using a LAN port as well, so that's not necessarily enough.

AviD

23:07

@JukEboX it sounds like its NOT auditing just failure.

but he would have to reivew all the SACLs to see where it is enabled

@diagprov not necessarily.

JukEboX

@AviD according to RSOP it is auditing only failure

AviD

though when I was reviewing ISA for security, that type of thing was definitely a focus for me.

JukEboX

I even double checked the policy for registry and object handling

AviD

@JukEboX can you screenshot an example?

of an event entry

diagprov

__attribute__((unshippable)) for stuff that should never make it into production

Tweeted by Catfish_Man on February 10, 2016 at 8:11 PM

If only

David Freitag

23:14

@diagprov I'm dying of curiosity, what was your old username?

diagprov

@DavidFreitag I've had several on SE. I was Ninefingers for the longest. I can't actually remember what else I've used.

David Freitag

@diagprov Ooooh yeah sounds familiar. I don't remember ever talking with that person in chat though.

diagprov

Ahhh, I was also Rhino for a bit.

I had to look that up in chat.

You won't find that user any more, I deleted it for a bit of peace.

Journeyman Geek

Oh. Hi.

David Freitag

@diagprov That seems vaguely familiar as well

Gilles

23:31

@diagprov Oh, is that you? Long time no see! I thought you'd left SE for good

diagprov

@Gilles Yep, they were both me. I dumped my old accounts, they're gone. I answered one Q on crypto (and one I don't remember answering on here, it seems) so I could come back into chat.

Journeyman Geek

Oo

diagprov

I sometimes read the questions, particularly on crypto and math.se, but I can't really summon up the enthusiasm to answer.

(in the cases where I know how)

@JourneymanGeek Hello.

Journeyman Geek

@diagprov I remember ninefingers as a model user :p

Simon

23:47

Doesn't documentation damage me? I spend lots of time improving myself, making mistakes and learning from them: if I just give away everything I know, am I not losing precious professional capital? — Monoandale yesterday

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

diagprov

@Simon Some devs actually think like this. Some devs also deliberately try to block ideas that weren't theirs if they threaten their opinion and if they're a team lead and afraid of their underlings they constantly move the goalposts to undermine their team members, so that nobody looks better than them.

Simon

@diagprov Damn.

Journeyman Geek

@Simon keehauling off a spaceship covered with alien barnacles without a space suit is too good for him.

diagprov

@Simon You can probably replace "devs with "employees" in this, since it's not confined to developers.

Simon

@diagprov The typical employees who will never be fired because they're doing something vital for the company but nobody knows what, yeah I've met some.

Transcript for