The DMZ

David Freitag

00:05

I made a huuuuuuuge mess

@silverpenguin They delivered it to the wrong address.

Mark Buffalo

00:39

I'm RE'ing that executable from earlier

David Freitag

@MarkBuffalo Is that a euphemism?

Mark Buffalo

I found the author's email and username/password

lmfao

David Freitag

Which executable?

Mark Buffalo

3

Q: Suspicious .js attachment

I received an email today with the following attachment, and I was hoping to see if anyone could help me understand what it was: //} Expose support vars for convenience support = Sizzle.support = {}; var tDPsXdcAz = ["iK"+"ou"+"D"+("appreciated","projection","layman","pKDO"), "gU"+"As"+("ceremon...

untagged

I RE'd the javascript

now I'm working on the executable for brownie points

kids keep distracting me though

David Freitag

@MarkBuffalo What disassembler are you using?

Mark Buffalo

00:46

IDA Pro

David Freitag

IDA is the shit

@MarkBuffalo you're doing this from a VM... right?

...a linux VM... right?

Mark Buffalo

Why would I need to? :)

<= this is a VM

man. I need another tool

Can't find a purchase page for IDA

David Freitag

@MarkBuffalo I couldn't afford to buy IDA :[

Mark Buffalo

Yeah, it's looking expensive

I don't pirate software

so.... fuck me, right?

@DavidFreitag Does IDA pro "execute" executables when reading them? I don't think so

David Freitag

@MarkBuffalo That's not the issue.

Journeyman Geek

00:55

@MarkBuffalo with a rusty flaming chainsaw.

Mark Buffalo

@DavidFreitag So what is the issue?

Maybe I'm not seeing the same thing you are.

David Freitag

@MarkBuffalo That's like saying "Nah, she'll never get pregnant if I always pull out"

Mark Buffalo

Why would I pull out...?

David Freitag

@MarkBuffalo onlinedisassembler.com/static/home

Mark Buffalo

Yes, I am there

David Freitag

00:57

@MarkBuffalo I can't tell if you're fucking with me or not.

@MarkBuffalo The way I see it is that I use IDA for purely educational purposes. I feel bad about not paying for it but it's just too ridiculously priced.

114

Q: Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive to properly license. Is there any viable alternative, or does IDA hold the monopoly on this marke...

tools ida disassemblers

@MarkBuffalo ^^^

Mark Buffalo

Yeah, and there's OlyDbg which I've used, but it's ass

would cost over $5k for what I need

if I could just try a trial...

David Freitag

Dude just download IDA and deal with it.

The next thing you know you'll be writing your own IDA clone...

Mark Buffalo

can't pirate

:[

David Freitag

You can do it I have faith

Mark Buffalo

I don't want to break teh lawls

David Freitag

01:10

Use a VPN and download it from a reputable site.

The VPN is mainly from keeping your ISP from noticing the traffic and automagically flagging it

Mark Buffalo

EVEN IF I DON'T GET CAUGHT, IT'S STILL BREAKING TEH LAWLS

David Freitag

FINE THEN DISASSEMBLE IT WITH NOTEPAD

Mark Buffalo

-1

Q: How and what is used when information is sent to a hacker's server?

I'm working in some malware research, my main question is how the victim's data is transfered over the internet, protocol and how? Using HTTP or any other way? As fat as I know the data can be sent by a HTTP request for example: hackerserver.com/pageStorer?givemedata={Heregoesvictimdata} Do...

encryption http

@DavidFreitag ...I've actually had to do this a few times

David Freitag

Mark Buffalo

@DavidFreitag LOL

That's a next-level facepalm

...next-next-next level

David Freitag

01:13

@MarkBuffalo Exactly.

Mark Buffalo

@DavidFreitag I'm wondering, do you have a list of memes and stuff on your desktop?

I'm guessing that one is from the "Mark Buffalo" folder :p

David Freitag

@MarkBuffalo Yeah I've got them in a folder called "Google"

Mark Buffalo

Nice

hex-rays.com/products/decompiler

pretty sure I would give round face for this

David Freitag

No, I have a custom search that searches the knowyourmeme site.

Mark Buffalo

time to learn assembly so I can just write this myself

David Freitag

01:16

@MarkBuffalo Fine, I'll let you borrow my legally purchased version.

Mark Buffalo

Chinese hackers break into NY Fed, and steal $100 million from Bangladesh Central Bank

David Freitag

@MarkBuffalo (╯°□°)╯︵ ┻━┻ ︵ ╯(°□° ╯)

Mark Buffalo

02:48

@DavidFreitag So after some digging

It turns out this is crapware. It installs a program that appears legitimate, and fools a lot of people

It basically infects your computer with a bullshit security software suite

David Freitag

FFS GOOGLE YOU FAILED ME

Who the hell uploads a non-animated gif

like srsly

Mark Buffalo

There's even an email address built into it... you can contact support

David Freitag

@MarkBuffalo Yeah I bet this means you accidentally ran it.

GG

Mark Buffalo

They have support forums, etc

Nope

I haven't ran it yet

David Freitag

Or got fed up and YOLO'd it

Mark Buffalo

02:50

yolo hex editor

and trial of ida pro

(but I was actually able to do this in notepad too... sigh)

This shit preys on old people

David Freitag

Mark Buffalo

Anyway, after looking what's going on in IDA pro's assembler output...

It allows complete and total control over your computer. It's a fully-functional RAT-in-a-box

Writes/edits registry, removes legitimate antivirus entries

Sends/receives email

Allows screenshots of your computer screen, etc

David Freitag

@MarkBuffalo RAT?

Mark Buffalo

Remote Administration Tool

trojan

David Freitag

@MarkBuffalo ( ͡◉ ͜ ʖ ͡◉)

Mark Buffalo

02:57

I could do much better with IDA Pro + the awesome plugin

David Freitag

Ok it's 10PM I think it's time do be done with work

Mark Buffalo

uhhhhhhhhhhh

yes

David Freitag

@MarkBuffalo Well in fairness I got here at 11am

David Freitag

03:15

But yeah. Woo 12 hour work day.

Mark Buffalo

do... do you get paid overtime?

David Freitag

@MarkBuffalo Yup time and a half

Mark Buffalo

great. no complaints then

Lighty

08:10

Morning

Arperum

08:27

Morning

Rоry McCune

Morning

Matthew

I hate Outlook

Also, Morning

Any mods around? Question that probably needs shunting to crypto.se:

0

Q: Cube-Root attack - RSA with low exponent

I have this RSA public key -----BEGIN PUBLIC KEY----- MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAx9a8pYAiNaVt9PrwjQ+0 cB6elLiGpcPQxkQckuPToObXVJcg2BSWG1M4XcH70oI3sCipPBDQiy1HvzHIvW96 qAYsbXR5ouEnNNF9hRlV3hE4LPQhN/H8QIOd8lYrepHcO2dR9gYM6zCQg312C3SJ l6Q6AZGaDI8saxv7cmU95wqK4ZfrHGeAp1kUzaz5rKVq81B...

cryptography rsa decryption

M'vy

08:51

hey

@Matthew be grateful you don't have our Lotus Notes

Matthew

@M'vy Would I be able to access my email on my laptop if I had that?

M'vy

@Matthew nothing is certain

@Matthew as a matter of fact we have this only on laptops for IT reasons. But the software is a pile of c... (or badly configure)

Matthew

@M'vy Hmm... Still sounds like an improvement over "try emptying the credential store"

M'vy

search is a mess

GUI is awfull

shortcut are ... weird

and changes with regard to language

very laggy too

Matthew

I'll take laggy over non-existant

Rоry McCune

08:55

it's a shame what notes turned into, it used to be a really good product, for its day

an offline replicated encrypted database tool

that worked back in early 2000's

Matthew

bangs head on desk

Don't! Email! Me! Files! To! Install! When! The! Problem! Is! Email! Not! Working!

Arperum

@Matthew ROFL

hands second desk for more facedesking

Lighty

hands a pillow to scream in

M'vy

Hello?! My internet connection does not work! Ah ok, please download this driver from http://...

Lighty

"Hey! I lost my phone! can you let me know when you find it?" "Sure! texts the phone he found it after a good while"

silverpenguin

09:27

hello i am your technical manatee how can i be of service today

silverpenguin

09:39

@HamZa I see you come to look at my manatee lumps.... why you awake?! isnt it like 3am where you are?

HamZa

@silverpenguin 10:40

@internship :P

silverpenguin

@HamZa 1040? really what country are you in? :O (if you dont mind me asking)

I think i asked before but cnnt remember

HamZa

@silverpenguin netherlands (see profile)

Lighty

oh, another dutchie?

silverpenguin

@HamZa ahh man i went there a month ago

HamZa

09:46

@Lighty sort of

in PHP on Stack Overflow Chat, Jul 29 '13 at 10:51, by HamZa

@Mr.Alien @dragon112 I've got arabic blood, dutch and indonesian. I'm the mixed human being :D

Lighty

Dutchie as in FROM the netherlands, but sounds cool :P

My mate is of mixed blood too, she's half Indonesian and half-dutch, and has almost all Indonesian characteristics in her looks...

HamZa

hehe

Lighty

except her eyes, which are full blue, something that is highly rare for Indonesians I believe

HamZa

@Lighty so how's school life @ ROC?

silverpenguin

school is for noobz

Lighty

09:50

@HamZa far under my level, typical MBO bullshit, like, if you want to give more of a push, theres no use, totally no-one pushing you or giving you an oppertunity to perform

HamZa

@silverpenguin well, kinda required in most cases

Lighty

you know, you sit at school 6 hours a day playing games because thats the only thing to do there

HamZa

@Lighty how long do you have to graduate from there?

Lighty

So glad I'm graduating after this internship, and going to HTS Fontys as Software Engineer

in end June

after my Internship

silverpenguin

I actually miss going to university... T__T all the partying and the not caring .... going to classes for 5 hours a week was nice

HamZa

09:51

Oh nice, I've been @ ROC amsterdam. Trust me, the same story haha

@silverpenguin how young are you if you don't mind?

Lighty

@HamZa ROC's are jsut laughable bogus, anyone doing an education there other than Optics or Administration is an idiot for not learning further after graduationg imho

silverpenguin

@HamZa 24 man im ancient

Lighty

Escpecially here in IT, there is so much more to learn out there than making a website in HTML and throw a CSS file in there

HamZa

@Lighty I'm currently doing HBO @ Hogeschool van Amsterdam. It's better but don't expect too advanced stuff (especially in the first year)

@silverpenguin oh, only a year older than me =)

Lighty

@HamZa I'm not, I know my new teacher already, first year is a refresher of what I found out myself in the past 3

HTML, CSS< Javascript....

then a bit of Python

and after that, PHP, C#, Java, and prolly other languages in C or embedded or such

HamZa

09:55

@Lighty you get that on the MBO? o.O

Lighty

here on MBO, I learned the basics, HTML CSS JS, and PHP and C#

but my teachers are: potatoes, and the education overall sucks

there is zero stimulation to go further, or learn at all, its a shame, because I can't really do alot on my own, I need someone smart to tech me, you see

HamZa

don't worry too much. You might kinda miss those "chilling" days :D

The problem with MBO is that they also kinda need to meet some "expectations". Ie: the number of graduates must not drop too much. So making the program more difficult/intense is not in their interest

Lighty

Indeed, it's almost criminal how easy it is to graduate for "The hardest MBO Course in Limburg"

fuck off mate, a cow could even pass this course -.-

HamZa

mwahahaha

Lighty

and even worse, there are 2 locations

Roermond and Venray

Arperum

10:01

Aren't there more challenging courses available too?

Lighty

and I shit you not, the teachers teach other stuff in another way In Venray as where I go

like

The teachers there are like, 2 chromosones away from a fuckin cow man, going on and yelling "If you know how to build a database, you dont need to learn normalization"

Not joking, more than half the class FAILED their exam, because they build shitty MS-SQL databases

HamZa

@Arperum nope.avi

Lighty

@Arperum thats a good one

silverpenguin

my boss is trying to get me to go install some on some private jets tomorrow but i dont wana go T___T

Rоry McCune

you sometimes wonder whether giving people access to something like code academy or code school would be a better approach...

HamZa

10:04

@RоryMcCune imho, in my previous school. Yes, that would be better

Lighty

@RоryMcCune IKR?! I swear, if the teacher went like "ok, here is this side codecadamy, go complete HTML and CSS, and show me the results of that in 2 weeks!"

or set some standards

Arperum

@HamZa At this point I know enough of the Dutch school system that MBO is not seen as the hardest thing available.

Lighty

MBO 1 through 3 is a joke, and MBO 4 should be more "advanced" then, but still

Graduating people > quality

HamZa

@Arperum I'm currently doing HBO which is IMHO a whole lot better. Ofc there's always some room of improvement. What I did like here is the possibility to follow other courses that aren't in your curriculum.

Lighty

True, there is always room for improvement, but HBO is on a much higher level, meaning that the balance in between a Challenge and getting people to graduate is more realistic

HamZa

10:10

It seems that uni is even harder so it depends on your motivation :-)

Lighty

True, but when you constantly get wrecked by teachers bending the rules, a not-so-quality education, and constantly getting pissed on by others, motivation isnt that high

Henry WH Hack

Greetings and good morning my fellow geeks once again what's is up?

Lighty

although I must say, I got accepted to HTS Fontys Venlo 2 days ago, and I have alot of motivation for that

silverpenguin

@HamZa uni is easy, dont even need to show up to get a high grade

HamZa

@HenryWHHack someone might sue you for using "whatsapp" :-)

Henry WH Hack

10:14

@HamZa what is up not whatsapp!

HamZa

@Lighty ooooh I just realised that HTS Fontys is actually an academic institution and not an IT company :- )

@HenryWHHack fine, just a small cold and a few problems

SEJPM

yay, KeePass 2.32 brought TLS v1.2 and TLS v1.1 support for .NET based connections (i.e. WEBDAV) :)

Lighty

@HamZa Yup, going for an Engineering title and degree :P

silverpenguin

@SEJPM naw this my question boy back up :<

HamZa

seems cool. I've seen their website before.
I was looking for something security related

Lighty

10:20

@HamZa They do have "Ethical Hacking" in Eindhoven I believe

Adi

@HamZa How did the key party go?

HamZa

@Lighty yeah, I've seen it I guess. I was looking for something in Amsterdam. I don't like to travel +1h

@Adi very bad. It was too hard and I was too weak. Need to refine my knowledge/skills. Especially in pwning

Lighty

@HamZa I can imagine, FOntys Venlo is a 15 minute cycle (My speed) or a 25 min cycle (normal speed) away for me

Adi

@HamZa Same here. It was too hard

HamZa

@Lighty My current school is like 10mn. I once aced it in ~6mn :D

silverpenguin

10:23

@Adi we got destroyed in the BKP CTF ... i still walk with a limp

Lighty

@HamZa I once did the distance (about 9-10 km) in 10 minutes by bike

@silverpenguin More vaseline next time

HamZa

We're going to try with https://ctftime.org/event/297
Weighting rate 5. So compared to 60 we might do better :-)

silverpenguin

@Lighty it would be better if I just start my own vaseline company

HamZa

I even read some BKP CTF writeups. I couldn't understand most of them. That's the moment, you know, it's out of your league.

@silverpenguin don't forget the single write up :_)

Adi

@HamZa Oooh.. I should check some of them

HamZa

10:27

@Adi instastar: github.com/ctfs/write-ups-2016

AviD

@silverpenguin I am going to delete your answer to the phone security features question. It is not what was asked, if that is what was asked it would be closed immediately, and your answer will only encourage more of the same. Which is not a good thing...

silverpenguin

@AviD ok if that is what you believe i accept it

AviD

or better yet - can you update your answer to focus on what was asked? i.e "What features should I be looking for?"

silverpenguin

@AviD sure il update it now

AviD

you seem to have the information, but the question was not asking for recommendations

thanks!

@silverpenguin yeah questions asking for product recommendations are explicitly offtopic. This q though was asking more like "how do I choose", not "WHAT to choose". Subtle, but important difference.

silverpenguin

10:30

@AviD yes you are right! I spiraled away from the point, thank you for informing me I obviously only wish to provide good answers

AviD

@silverpenguin thanks!

those questions are always tricky - it is always far too easy to get carried away with our favorites, but ultimately that is less helpful than informing the decision.

you could put your personal recommendations in the comments though!

@silverpenguin dont take it too harsh though, dont want you to think I'm always pushing you down ;-)

silverpenguin

@AviD not at all man, this is constructive

HamZa

@Adi do you have IDA pro?

Adi

@HamZa Nope

HamZa

retdec is kinda really cool and useful unfortunately it doesn't support x64

silverpenguin

10:43

@AviD could you review my new update for me please?

Adi

@silverpenguin You don't need to write "I'm updating my answer"

HamZa

it could be perceived as attention seeker

silverpenguin

@Adi 'T_T yea i was just typing what i was thinking.. @HamZa you talking to me? :<

HamZa

@silverpenguin I'm complementing Adi's message

silverpenguin

@HamZa ahh i was just adding clarity

Adi

10:46

You Talking To Me? - Taxi Driver 1976 in HD

►

M'vy

uhuh. Got my phone back!

silverpenguin

@Adi that but a little less awkward

M'vy

Seems like a factory reset is in order

Adi

@M'vy Or, better, NMD

M'vy

NMD?

Adi

10:49

@M'vy Nuke My Device

It's an app that.. well, it's in the name

M'vy

Power + Down > Recovery > Power + up > Wipe All > Ok

basically NMD I think :)

NMDfO

Adi

@M'vy You're giving your device away or getting a new one?

For the first, NMD is great because it securely wipes that shit

As in overwrite all the data on the SD as well

M'vy

@Adi went for repair

Adi

Oooooh

Okay, yeah. Then overwriting is an overkill

Of course, they might put child porn on your SD, delete it, report you, and now police can recover it

M'vy

Thing booted asking me for 1st install info, but got weird soft wtill on it

Adi

10:52

Can never be too safe

M'vy

No SD

AviD

@silverpenguin oh that looks good!

thanks for updating!

silverpenguin

No prob hopefully thats what he wants, difficult being very generic when speaking though.

HamZa

@silverpenguin side note: I remember there was something like "dual environments" for android where you can separate business/work and personal stuff. AFAIK there's even military grade shizzle out there. You might research/add it too to the answer

silverpenguin

11:09

@HamZa are you talking duel sims? or duel boot as such?

HamZa

@silverpenguin no dual sims, it's something similar than dual boot but more like "profiles" with encryption

silverpenguin

@HamZa Interesting, il relay this in an update to my answer soon

after a bit of research

my back hurts so much! damn being tall

HamZa

define tall

silverpenguin

197cms

HamZa

On the Internet, nobody knows you're a dog

"On the Internet, nobody knows you're a dog" is an adage which began as a cartoon caption by Peter Steiner and published by The New Yorker on July 5, 1993. The cartoon features two dogs: one sitting on a chair in front of a computer, speaking the caption to a second dog sitting on the floor. As of 2011, the panel was the most reproduced cartoon from The New Yorker, and Steiner has earned over US$50,000 from its reprinting. == History == Peter Steiner, a cartoonist and contributor to The New Yorker since 1979, said the cartoon initially did not get a lot of attention, but later took on a life of...

Rоry McCune

11:14

HamZa

hahaha

silverpenguin

11:37

just took some co-codomol... lets get this party started

Colin Cassidy

@RоryMcCune shodan.io/search?query=fridge shodan knows :)

5

silverpenguin

wouldn't it be interesting if you could collaborate answers easier on SE sometimes answers are best merged but only the better one will get full credit ponders life and existence I am a wise and powerful manatee

HamZa

@silverpenguin community wiki

silverpenguin

@HamZa link my flippers are to spread for easy googling

HamZa

11:53

642

Q: What are "Community Wiki" posts?

Some questions and answers are marked Community Wiki and are owned by a Community Wiki user. Why have Community Wiki posts? How do Community Wiki posts work? How does a post become a Community Wiki post? How can the Community Wiki status be removed from a post? Return to FAQ Index

support faq community-wiki posts

silverpenguin

may 1000 manatees bless your bed tonight

HamZa

tldr: you can post an answer as "community wiki". People will be able to help edit it. No one gains any rep from it. Neither do you.

Adi

@ColinCassidy I like!

Transcript for