The DMZ

Mark Buffalo

00:03

@Gilles You're a multi-megabyte kernel.

@RоryMcCune You work for NCR, right?

Gilles

@MarkBuffalo You're Simon. No, you're worse.

Mark Buffalo

@Gilles =(

Simon

00:42

@Gilles fkin rekt

Mark Buffalo

@Simon #rekt #yodo

David Freitag

@Gilles Right now? Nothing. I'm not even entirely sure it will boot

I peeled my burrito like a banana

Also, I got sriracha in my nose

that was an experience

Mark Buffalo

Damn!

I need to start finishing my malware analysis suite

David Freitag

you dork

Mark Buffalo

Needs to be more portable

David Freitag

00:50

dork

able

Mark Buffalo

also, incident response tools

David Freitag

What, a utility that beeps the motherboard beeper in an S.O.S pattern?

Mark Buffalo

no, I have a lot of tools to deobfuscate malware and trace the origin

and the damage it caused

but it's a very manual process... I need to automate it

using like 15 different tools to get the job done is becoming ass

especially when I can put it all into 1-3 different programs

David Freitag

dork

Mark Buffalo

01:40

You're a dork

Mark Buffalo

02:42

kicks back a Sunset Sarsaparilla

Mark Buffalo

02:55

@DavidFreitag

HI

www.jet.com

check this out

Stuff's far cheaper than on Amazon... far, far cheaper. No membership fee, and just all around cleaner

TildalWave

06:17

-2

Q: Getting Feedback from INFOSEC Professionals

I am looking to get feedback from INFOSEC professionals for a Master's Thesis project. The high level subject is on the development of a framework to protect application accounts on servers (as there seems to be no sets of requirements that take modern, distributed computing into account). What...

discussion

I marked this as spam... lots of boloney, new user with no other positive participation, asks where he could post something that is poorly described then goes on to include a link to it anyway, the "research" survey is full of leading just like there is in those of actual service / product providers,...

and the way he describes his thesis makes it entirely unclear why such a survey is even needed (unless of course it's a product that needs to be marketed)

anyway, morning all :)

Rory Alsop

07:18

Moooorning

Arperum

Morning

StackExchange

Rory Alsop

@MarkBuffalo I don't think @Rоry [1] builds ATMs...

@TildalWave I haven't yet removed that post - but have given him an answer to help clarify.

TildalWave

cheers!

Rory Alsop

bit concerned his email address doesn't check out either

TildalWave

07:34

you might wanna mention something about considering becoming an active member here before having such requests for the community, so it doesn't look like "this is the right place" for just anyone butting in and ending up being a legitimate target for second guessing

but yeah, I'll just add a bit of scotch to my coffee and rather see how that goes :)

Journeyman Geek

@TildalWave a active member would know better ;p

and maybe ask on chat

TildalWave

@JourneymanGeek yes, but all he's doing now is making sure he collects only troll data

Journeyman Geek

yup

Rory Alsop

@TildalWave oh - that's a good point. I'll add that in

TildalWave

scotch?

ah LOL

Rory Alsop

07:36

hahahaha

there you go - I'll leave that answer

TildalWave

perfect :)

erm maybe it's because I just brushed my teeth but is glenfiddich really not so good in coffee? As in, possibly too good for that?

it's the green bottle but still

Rory Alsop

Glenfiddich is cheap - it'll be fine :-)

TildalWave

yeah but it's single malt and whisky, I'd usually dope my coffee with some bourbon

haven't any available ATM

Lighty

08:10

Morning

Rоry McCune

mornin' all

@MarkBuffalo incorrect

Lighty

08:26

oh, my question is getting a lot of attention, seems I don't ask shitty questions anymore for some reason

weird

diagprov

@RоryMcCune good morning

Wally

08:37

My ISP is redirecting all the IPs on port 53 (DNS) to a custom localhost DNS IP

Is there a DNS server that provides a different port than 53?

HamZa

@Lighty repfarmer

kalina

09:17

@Wally get a new isp

AviD

@Wally WAT

@kalina this, so much this, this with prejudice.

Also look into your service agreement (or rather, talk to a lawyer), see if you can sue them. That is HIGHLY inappropriate.

@RoryAlsop aww did I miss a whisky discussion? :-(

TildalWave

yeah that might not always be an option if he's accessing from some totalitarian country

@AviD too late, I drank it all :P

AviD

@TildalWave hmm, not sure thats your best choice.

TildalWave

yeah it got better the more I drank it tho :)

AviD

sure, if youre making it Irish, it could work - but depends on coffee, and I dont think glenfiddich is proper sweet enough

@TildalWave hah I'm sure

I would tilt towards rum next time though :P

TildalWave

09:25

the taste was too oaky for coffee to be honest

kalina

oaky coffee

TildalWave

and I don't like oversweetening it

AviD

@TildalWave hmm good point. But even in US there are other options ;-)

TildalWave

LOL

AviD

@TildalWave well, thats how you make it Irish

kalina

09:26

who needs to sweeten coffee

TildalWave

dunno for some reason I like it better with bourbon

and whisky just as it is

kalina

im sweet enough thanks

TildalWave

you weren't in my morning cup tho :P

kalina

consuming more sweetness would make the environment around me sticky

AviD

....

Wally

09:27

I can't change my ISP. All ISPs are probably doing this

TildalWave

bah missed it

was it good?

silverpenguin

@TildalWave I saw it

just in time

AviD

@Wally can I ask what country you're in?

Lighty

@TildalWave "Not Shit" 10/10 -IGN

AviD

pffft

silverpenguin

09:28

o_o manatee always watching

AviD

@TildalWave TWSS

Rоry McCune

:28284259 flirting wth @kalina so early... geez :op

TildalWave

@Wally then you have bigger problems than just reconfiguring the DNS to use a different port (which is possible)

AviD

@RоryMcCune that... thats not .... nevermind.

hahaha A Trump Dodger's Guide to Canada

silverpenguin

@RоryMcCune he is just going through @kalina to get to me... he wants my booty

TildalWave

09:32

@Wally Wanna tell us which country? Most folks here would know what methods they use and suggest what options you have (besides emigrating)

kalina

@Wally no good isp does this

Wally

@TildalWave How do I do it? India.

AviD

@Wally I am very doubtful that all the ISPs do this. This is FAR from standard procedure, and it is so very not acceptable.

kalina

@RоryMcCune I didn't see it and you won't give me room owner so /careface

Wally

If you have gay sex, eat beef, blashphamy you get jail

Gay sex = 10 years in jail

TildalWave

09:33

@Wally depends on your setup, some routers will let you do that but that won't help if you use your ISP's one... in OSes it's usually some system setting, e.g. in Windows you'll have to dig into the registry

AviD

@Wally wut

???

TildalWave

@Wally isn't that like making sure you have more of it? :O

kalina

@Wally find a new country

TildalWave

sorry, couldn't resist... bad joke

Rоry McCune

@kalina the tigger was flirting with you is really all you need to know about it :)

AviD

09:35

@RоryMcCune what I dont even

silverpenguin

@Wally have you considered moving? also is it considered gay if its in a 3 way?

TildalWave

BTW it wasn't that much different even in UK only like 50 years ago

Rоry McCune

@kalina you really want to be a room owner in here though?

kalina

@RоryMcCune I would have still liked to see so I could react appropriately

@RоryMcCune no not really

it would prevent any further instance of the timeout problem I guess

Rоry McCune

@AviD pls I'll go get the deleted message if you keep denying it :op

Wally

09:35

@TildalWave Most laws were copied from the British rules

TildalWave

@Wally yes, I realize that, that's why I mentioned it

AviD

@kalina nah I wasnt flirting really, I was misinterpreting your previous statement in a way that would lead to explicit inappropriateness, as opposed to just implied.

TildalWave

probably one of the more famous cases was the one with Turing

silverpenguin

@AviD and @kalina sitting in a tree fighting each other to the death

kalina

@silverpenguin you're on the wrong side of the line

AviD

09:38

the fact that you think that I am still able to climb a tree with sufficent comfort to engage in any form of hanky panky, is even more flattering than the idea that she would ever agree

@kalina agreed

silverpenguin

all fixed

AviD

@silverpenguin my statement still stands

also.... yeah. you know.

kalina

@AviD really, you think that you being able to climb a tree is more of an achievement than a moment with me?

do you have no legs or something?

AviD

@kalina not a question of achievement, but... yknow, oooold.

little bit decrepit.

Lighty

@kalina A moment with you an achievement?

kalina

09:40

@AviD like chernobyl

@Lighty yes, I would think so, I say no so consistently

AviD

also, did you just refer to a moment with you as an "achievement"?? just another notch in some jerk's belt?

I am shocked.

Rоry McCune

@Lighty well @Simon definitely thought so, that encounter in the club left a mark on him

AviD

@RоryMcCune lol

kalina

@AviD well it is an achievement, you swam through the shark infested waters of my emotional distrust and trauma and we're still both here

AviD

I think I need to be a momentary adult here, and try to change the subject before it gets too explicit...

kalina

09:41

nobody ever makes it

speaking of explicit

AviD

@kalina I am extremely flattered. Thank you.

Lighty

@kalina I'd just offer a drink and maybe some "Dutch Green", and try not to act like a total @Simon, probably gets me far enough

in theory

kalina

@Lighty well that's where you're mistaken, I don't drink and almost certainly definitely have better weed than you do

Lighty

@kalina You forgot I live in the Netherlands ;D

kalina

no I didn't

TildalWave

09:43

@kalina what qualities of weed do you consider "better"?

silverpenguin

@kalina tell me more about your weed e_e

TildalWave

^:O

kalina

@silverpenguin I can't it's classed as an explicit conversation

@TildalWave it entirely depends on the intention

Lighty

@TildalWave Weed isn't the thing you see on the interwebs dear, it doesn't make you stoned 420 n stuff, there are loads of different strains, all with different effects, "loads" n such..

silverpenguin

@kalina why is that? :< that makes no sense... and i have been to the netherlands @TildalWave I had 3 hours to explore... i tried to explore erm... to hard... I was carried to the airport

kalina

09:45

do you want a head high and a creative burst or do you want to sit in the corner dribbling

Lighty

@kalina Or sleep :3

silverpenguin

@kalina dribbling please

kalina

@silverpenguin CBD heavy strains

TildalWave

@Lighty why are you telling me that? :O

Lighty

@TildalWave Oh... just because :3c

kalina

09:47

35 days and several hours until 4:20 on 4/20

silverpenguin

@kalina thc makes me dribble in the corner... :< THC does weird things to autstic people

Lighty

@silverpenguin THC does weird shit to anyone

TildalWave

meh, there's definitely loads of worse shit to take, most of it perfectly legal everywhere

Lighty

@TildalWave Without a doubt

Have fun in your way, but keep it sane and legal plz

kalina

who cares about legal

or sane

TildalWave

09:51

it's legal to use it here, just not to also deal it or grow in large quantities

Lighty

@TildalWave Same here

kalina

this is all because of nylon

Lighty

@kalina Whether or not you're gonna die of it xd

kalina

@Lighty nobody is going to die directly as a result of smoking weed

TildalWave

you might die of old age

:)

kalina

09:52

ask yourself this

Lighty

@kalina Not talking about that, talking about "Recreational Supplements" in general here

kalina

would you rather live 90 years and experience nothing or live 30 years and experience lots of things

congratulations on achieving 90 years of age but still being a virgin who has never left the house

10 out of 10

might as well have culled you at birth, waste of resources

Lighty

@kalina I aint gonna live 90 years in my condition, going for the 30 years and an adrenaline overdose

kalina

which is why I hate heights but have done skydiving twice

(but never again thanks)

TildalWave

@kalina oi there's many people here over 30 that have experienced lots of things

AviD

09:53

@kalina then what are you doing in that tree anyway

Lighty

@TildalWave the second world war doesnt count

kalina

@AviD escaping from you

TildalWave

it's not exactly either or

kalina

@Lighty boom

AviD

@kalina I thought you took me up there with you

kalina

09:54

@AviD yes because I have the physical capacity to drag your lard ass up a tree

TildalWave

you can live to be 90+ and experience more than 3x as much as someone living to 30

AviD

@Lighty that is actually a good joke

@kalina hey now, I said decrepit, I am nothing like fat

not an ounce of fat on me

well, my head probably

kalina

"not an ounce" ?

TildalWave

@Lighty said Hitler?

AviD

@TildalWave GODWINS LAW ACTIVATED

Lighty

09:55

@TildalWave Are you calling me Hitler?

kalina

@Lighty I found find that highly offensive

@AviD really? it's still the AM

TildalWave

@Lighty no, I thought you were quoting someone

kalina

I thought that was a bannable offence if invoked before lunch

AviD

right?

TildalWave

you people do realize this is a lighthearted conversation, right? :P

@Lighty dude now this IS offensive

1st of all I'm not Russian

Lighty

09:58

@TildalWave In my defence, it's more of an internet slang than anything else today

AviD

@Lighty you're an internet slang

but yeah, whoa.

doing you a favor there, the easy way.

Lighty

@AviD Thank you dad <3

AviD

WATCH IT

Lighty

:P

TildalWave

c'mon @AviD it's OK it was just a misunderstanding

AviD

10:01

thats why I didnt kickflag

TildalWave

phew

Lighty

@AviD That's sweet of you :3

AviD

1 min ago, by AviD

WATCH IT

TildalWave

yeah, if you wanna pet talk to @AviD you're gonna have to do it through abuse just like the rest of us!

AviD

@TildalWave exactly

Telkitty

10:04

hello, my dears, how is your year going?

silverpenguin

I have to do work for like 3 minutes and you guys start talking about hitler and sky diving? this conversation just cant keep to topic for very long

TildalWave

Godwin's law

Godwin's law (or Godwin's rule of Nazi analogies) is an Internet adage asserting that "As an online discussion grows longer, the probability of a comparison involving Nazis or Hitler approaches 1"—that is, if an online discussion (regardless of topic or scope) goes on long enough, sooner or later someone will compare someone or something to Hitler or Nazism. Promulgated by American attorney and author Mike Godwin in 1990, Godwin's law originally referred specifically to Usenet newsgroup discussions. It is now applied to any threaded online discussion, such as Internet forums, chat rooms, and...

10 mins ago, by AviD

@TildalWave GODWINS LAW ACTIVATED

Telkitty

has anyone ever seen anything like this:

At Amazon we take your security and privacy very seriously. As part of our routine
monitoring, we discovered a list of email address and password sets posted online.
While the list was not Amazon-related, we know that many customers reuse their
passwords on several websites. We believe your email address and password set was on that list.

Lighty

@TildalWave not pet talking, just complimenting, the tigger should feel fckin honoured ;D

Rоry McCune

@Telkitty yeah facebook have done it in the past. I'd recommend signing up with haveibeenpwned.com

2

that'll tell you if one of your accounts is in a public breach list

AviD

10:07

@TildalWave did you hear that he actually went on record to say that his law does not apply to Trump and his followers, since they are ACTUAL nazis

Telkitty

thank you very much

although strange, the website returned with 'Good news — no pwnage found!'

I am the one whose iphone account has been hacked, then microsoft, paypal & amazon account tempted with

all within the past 6 months

Rоry McCune

@Telkitty yeah it'll say that if it doesn't find your e-mail on any of its lists

Telkitty

any more sites like this where I can search for my email address?

Lighty

@Telkitty 4chan

Telkitty

I tried google, it returned nothing relevant

so in your guys professional opinion, is my email address & a set of not working password somewhere on the internet?

kalina

10:19

@RоryMcCune what about if haveibeenpwned gets pwned

Rоry McCune

@kalina well they're all public data breaches so, I guess someone who is in that line could get them anyway :)

Telkitty

why does amazon reckon that I got pwned but haveibeenpwned.com doesn't

almost every month, I will receive an email or some other kind of message telling me one of my account was compromised or nearly compromised

Rоry McCune

@Telkitty two possibilities, one they have access to a breach that troy doesn't (haveIbeenpwned is a one man show), two that e-mail you got didn't come from amazon but from a scammer (It didn't have a link to click did it?)

Telkitty

no it didn't.

and I checked sender's address, it's legit

[email protected]

reply within 5 mins

  Hello,
We're not able to provide the exact source or website that captured your information.
1. Go to Amazon.com, hover your mouse over the "Your Account" menu and select the
"Sign In" button
2. Click the link that says "Forgot your password?"
3. Follow the instructions to set a new password for your account

automatic reply?

silverpenguin

@Telkitty have you checked the header / source info.... I would change ur password on a seperate device this email seems really odd...

Telkitty

10:34

this is the full header, copied and pasted in the pastebin.com

Reply-To: [email protected]

how could this email be compromised?

diagprov

@Telkitty I would guess that since it contains DKIM signatures, it's probably legit. However, it would be better if those DKIM signatures were actually validated by your provider.

It would help if they also validated SPF.

Otherwise you can check all this stuff manually.

As for forging the email, if there is a mail server willing to transfer anything I can transfer any email I like.

SPF basically designates some servers as valid senders for a given domain, so if mail comes from a different server you can assume it is spam.

DKIM signs the email when being sent by a valid server, giving you added assurance the right server sent the email.

DMARC allows you to read feadback as to what other mail providers are seeing based on delivery from your domain and validate the above two.

Telkitty

the only link the email contains is www.amazon.com

diagprov

@Telkitty well, one thing you can do is (ignoring the email link) go to Amazon.com yourself, directly, by typing it into a browser on a computer you are confident has no malware.

If they have required you reset your password you may find your old password fails.

Victor Lopez

hi there

one question, and this is related to landlines

or more specifically, one thing

Telkitty

@diagprov I don't have an account with amazon with that email address

diagprov

10:47

@Telkitty aaahhhh, now that is worth wondering about.

Telkitty

I know ...

Victor Lopez

don't you even sleep?

like, sleep

diagprov

I would say don't trust the email and definitely do not follow any links from it.

Telkitty

they did invite me to a couple of interviews then decide not to hire me

diagprov

However, with your valid logon details on a safe computer you can check your account.

Telkitty

10:49

so they do have that email address somewhere in their record

Victor Lopez

isn't it like "chaining"?

Telkitty

I am on my macbook

diagprov

@Telkitty yeah but it shouldn't be related to your amazon.com consumer account.

Telkitty

am I not safe?

Victor Lopez

probably in the legal terms we're all "safe"

at some point apples are good

proven that the telecom allows for dtmf interrupts it is probably the best thing to be "safe" to keep some apples or gadgets, even

unless the kind of "safe" means not the gsm/landline, dtmf stuff

diagprov

10:51

@Telkitty I'm caveating heavily because I wouldn't want to say if you are or not in case something happens :)

Telkitty

a lot of hacking/attempted hacking already happened on a few of my accounts

I use different passwords on different sites

Victor Lopez

by the moment the drown thing is active

Telkitty

drown thing?

Victor Lopez

the drown attack

Telkitty

oO

Victor Lopez

10:53

the former thing was the heartbleed bug

TildalWave

@VictorLopez who are you talking to? :O

Victor Lopez

@TildalWave probably not my isp

Telkitty

@TildalWave am I on your ignore? :p

TildalWave

@Telkitty yeah I just realized that, you were hacked weren't you?

is it safe now to unignore?

Telkitty

:(

diagprov

10:56

@Telkitty Do you use a password manager?

Victor Lopez

I'm afraid not. I mean, the best thing can happen is packing your stuff and moving to another set. There is also the phone contact option :)

Telkitty

cached probably

although I changed all my passwords when I was hacked before

BTW the email server (telkitty.com) sits on a shared server

and the admin stole my domain name and put it under his name

diagprov

@Telkitty shared how? VPS?

Telkitty

yeah

Victor Lopez

there is the phone contact option

upon the registrar

Telkitty

10:59

and also I run a app business so my emails are everywhere

Transcript for