The DMZ

Mark Buffalo

13:00

@Adi Did not ask, will not ask. Not that kind of person

silverpenguin

@MarkBuffalo I take things very literally :(

Mark Buffalo

I'm being intentionally vague

...oh yeah, sorry. anyway, I'm being intentionally vague.

silverpenguin

ahh i understand now

Adi

@MarkBuffalo What's "that kind of person"?

Shadow Wizard

@Telkitty taking the leap

Adi

13:04

Someone who asks for compensation for fair and responsible disclosure and time spent on improving their security?

Yeah.. greedy bastard!

silverpenguin

im with @Adi I like monies e_e

Mark Buffalo

@Adi The kind of person who would phone a company that you were able to inject minor SQL attacks against, and then ask for money for doing that.

Adi

@silverpenguin It's not about liking money

Mark Buffalo

Yeah, no... not going to do that.

If they offer, sure... I will be happy. I doubt they will, and I'm not going to get caught up in extortion.

Adi

@MarkBuffalo So you "phoned the company". Meaning?

Mark Buffalo

13:06

But mostly, I will just be happy if they fix the bug

Adi

Their support team?

Did they have their CISO number listed?

Mark Buffalo

Meaning, I informed their security team d:

Adi

They have the number of their security department listed?

That's quite interesting

silverpenguin

TIME FOR JAPANESE FOOD BRB

Mark Buffalo

@Adi :)

silverpenguin

13:07

(yes caps was needed)

Mark Buffalo

No need to discuss this further

Adi

NDA? :D

Mark Buffalo

(-:

:-)

silverpenguin

NDA's suck.. :< (from a discussion point of view)

Mark Buffalo

I like NDA's.

silverpenguin

13:08

makes you feel like a secret agent? I just develop so much tech and cant talk about it or its uses:(

Adi

@silverpenguin It's not NDA.

silverpenguin

brb

Mark Buffalo

@silverpenguin No, nothing of the sort. It's interesting what kind of methods people use to attempt to get more information after you've signed an NDA

Usually, I just misdirect, or get them to doubt so they keep on questioning. Adds to my tinfoil kit

@Adi wtf. VTC'd

silverpenguin

Ahh i see now @MarkBuffalo yea that parts fun haha

SmokeDispenser

@MarkBuffalo, cannot second you on that (yet);)

HamZa

13:11

@silverpenguin let me check...

Benoit Esnard

@Adi: edited

HamZa

@silverpenguin yes, Saturday night at 18UTC

GOogle "18:00 UTC to local time"

Rory Alsop

@Adi - thanks. Deleted, and in the redact queue for approval by another mod

AstroDan

lol, I like how this guy gave the same answer as me after saying "One thing the other replies are not including" security.stackexchange.com/a/117829/97432

Ohnana

@Adi yeah, you have to rewrite the packets with the right header to allow it to execute

Mark Buffalo

13:15

@Ohnana hacker

Adi

@RoryAlsop Good good

But damn, his PoC is pretty neat

He worked on the encoding quite well

Ohnana

@MarkBuffalo well, it means you have to explicitly disable protection for your machine

HamZa

@silverpenguin register as "sec.se" or some other team name?

Mark Buffalo

Nice PoC, but accepting base64 like that is moronic

Adi

@MarkBuffalo Where's the Base64?

I don't see any Base64

Mark Buffalo

13:19

8

A: Is chrome completely secure against Reflected XSS?

No, because the XSS filter only looks whether it sees XSS code in the input back in the HTML outputted by your server. For example, if Chrome sees your web page is accessed with an URL that contains the following: ?q=<script>alert("XSS!")</script> and if the HTML returned by the server cont...

>

?q=PHNjcmlwdD5hbGVydCgnWFNTIScpPC9zY3JpcHQ+

(PHNjcmlwdD5hbGVydCgnWFNTIScpPC9zY3JpcHQ+ is <script>alert("XSS!")</script> encoded in Base-64), if not filtered, would result in response HTML like this:

If I ever come across that, I will shit a brick

Adi

@Mark PoC is in the original question

security.stackexchange.com/questions/117870/…

which is now deleted

Mark Buffalo

I appear to have clicked the wrong one

Adi

But I guess you can see it

Mark Buffalo

Yup

> X-XSS-Protection: 0

You mean that?

Adi

@MarkBuffalo :|

PoC in the original question

Ohnana

13:21

@MarkBuffalo yep, that's the chrome override

Adi

The bit marked as code

Mark Buffalo

Ah, question that I did not read

Adi

Mmhm

Mark Buffalo

Huh. That's interesting

Matthew

It's an interesting question, but worded badly - would have been better without the specific POC

Mark Buffalo

13:24

lol that is funny

Adi

@Matthew At least without the screenshot and the name of the domain he's targeting

Or, at least not the full screenshot

Otherwise, it's quite fun question

Mark Buffalo

Especially with the PoC that seems to attach to a subdomain he registered for

Matthew

@Adi Yeah... As a generic question about Chrome XSS filtering, seems fine!

Adi

@MarkBuffalo The interesting part is that it's a domain hosting a fake version of the game's interface

Mark Buffalo

I'm not visiting it for a while.

damn phone. alright, back later

Rоry McCune

13:27

@RoryAlsop competition for you / your middlest to enter for a cool whisky-barrel skateboard... smokehead.com/competition

SmokeDispenser

hahaha. me dropping that link to plaintext offenders really gets people going.

Matthew

@RоryMcCune I worry that the competition encourages drinking and skating!

Rory Alsop

@RоryMcCune very cool - will pass it on!

@Matthew I can drink - she can skate :-)

SmokeDispenser

Too bad the rep cap is reached for today. Now I must manually check the answers fate:)

Matthew

@RoryAlsop Perfect! Although they should also have made the wheels out of whiskey glasses for extra pizzazz and danger bonus...

M'vy

13:40

Hum password hinter get me from 4 stars to three stars when I add the last character?

HamZa

Pwn2Own 2016 Day 1 Recap

►

Rоry McCune

@M'vy those things almost universally suck

CodesInChaos

Grrr... Why is every browsers a piece of shit -_-

Matthew

@M'vy Did it make it a word?

CodesInChaos

Firefox managed to remember how many tabs I had open and even how many of them were pinned. But it totally forgot which url was open in each of them.

So now I have a few hundred open "New Tab"s.

Benoit Esnard

13:43

@CodesInChaos: oh it did it to me too :(

Clicking on one of those tabs sometimes opens the old page

Rоry McCune

@HamZa interesting, very much goes to show that a well-resourced attacker can be assumed to have a browser-->system exploit up their sleeves...

HamZa

@RоryMcCune really cool indeed. I need to learn such skillz

@silverpenguin see CTF room

Rоry McCune

@HamZa yeah I think the barrier to entry is going up when you're seeing the number of vulns they were chaining to get an exploit, it shows that it's trickier to do but obv. still very possible.

HamZa

true

diagprov

@RоryMcCune that and these days with targets like chrome you need a kernel exploit to sandbox-escape

M'vy

13:57

@Matthew nope

it's a pwgen stuff I think

though not fully random IIRC

HamZa

I've been wondering, how much/long does it take to become a decent exploiter? I've just started reading a book "hacking : the art of exploitation"

SmokeDispenser

14:08

@CodesInChaos there is a setting in Firefox that utilizes lazy loading by default. It's hidden away. If clicking on those tabs loads the site, try disableing lazy loading:)

CodesInChaos

@SmokeDispenser I use that feature. But today it simply forgot the tab content entirely.

Though I don't really know if the feature works properly in any case, since firefox takes ages and tons of RAM to start, even with lazy loading enabled.

SmokeDispenser

@CodesInChaos bad luck for you then:/

@CodesInChaos, does it say 'test' while starting up? scnr.

CodesInChaos

It's just like holding down Ctrl+T for a minute.

Matthew

I love testing servers on the other side of the world... No, wait. Not love. Really hate. That's the one

Mark Buffalo

14:32

Hmm. Think I might be done posting on secse during the day

And the week...in general

Thomas Pornin

@MarkBuffalo Like, today, or whenever the Sun is up ?

Mark Buffalo

Whenever the sun is up, maybe down... just weekends, maybe.

;/

Matthew

@MarkBuffalo Isn't that when the hackers are out to play though? "Someone messed with my GTA clan, and I got his IP - can I hack his PS4 and make it an XBox One?"

silverpenguin

@HamZa why cant we be like that?

HamZa

@silverpenguin start reading man :-)

Mark Buffalo

14:34

@Matthew it's a long story. It's not appreciated that I'm answering stuff here

silverpenguin

@MarkBuffalo i appreciate your answers

Mark Buffalo

Need to quit chat too, for now.

@silverpenguin management issue

silverpenguin

@HamZa man Its going to take decades before i am at their level

HamZa

156

Q: Team members spending too much time on Stack Overflow

Almost 8 months ago, I encouraged my team members to follow Stack Overflow so that they can read questions, help others, and build their skills. But now this has gotten out of hand. I have a team of 5 developers, and three of them each make at least 150 points on average during business hours. T...

Rory Alsop

Hahahahahahaha

silverpenguin

14:41

@MarkBuffalo @HamZa I dont see why people care.... my boss lets me do what ever the fuck I want. I can come in late and leave early and he just cracks a joke, I take the piss out of him and as long as i do my work BEFORE deadlines he doesnt give a shit

HamZa

@silverpenguin it depends, really...

Rory Alsop

@MarkBuffalo that sucks, dude

Mark Buffalo

That linked article is completely irrelevant

silverpenguin

@HamZa sometimes my boss asks if im in on what ever day he asks about just because i might decide not to come i xD its good having a lack work place, im more inclinded to work harder

HamZa

@MarkBuffalo best of luck

Rory Alsop

14:49

See, that's lunacy - in principle (I've as long as they aren't in breach of law or policy) I don't care where my team are or what they are doing at any moment, as long as they are doing their jobs it's down to them how they want to do it

Over the last 17 years or so I have found that gives best retention, happiest employees and highest output

Studies agree with me

SO someone shouting at you for doing something that is definitely not stopping you delivering your job, and maybe helping you improve your skills etc. Should seriously re-think their role

Matthew

@RoryAlsop Makes sense to me - I know I did some of my worst work whilst working for a set of control freak managers, and most of my best work when allowed sufficient freedom whilst being allowed to draw on support

Rory Alsop

Exactly - the manager needs to be able to support as needed, and some individuals want or need more than others, but where your team are delivering, there is no reason to impact that!

Sure - there is a case for trying to make year on year improvements etc, but you do that by slightly increasing the demands, and then seeing how your team cope

(Less relevant in your world, where the changes are down to new technologies/exploits etc., and can be handled well through training etc - so you don't tend to say to pen testers: you need to hack 4 more systems a week this year :-)

Matthew

Oooh! Question for @kalina to answer! (look at the avatar)

0

Q: Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed from India (but got foiled, hooray 2FA). The problem is that I have no idea where the breach is com...

multi-factor incident-response account-security incident-analysis

Rory Alsop

Lol

Matthew

@RoryAlsop "Find more issues in the tests you do this year"/"OK"/"Why are these reports full of SSL configuration issues?"/"You wanted more issues..."

3

Rory Alsop

14:57

Yeah - that's just stupid. Defining KPI's just makes people work to those KPI's

SmokeDispenser

all right

Rory Alsop

You have to get any KPI's right

SmokeDispenser

off work I go. see you around :)

Thomas Pornin

Hey @RoryAlsop, do you have an actual email address ?

Matthew

@RoryAlsop Exactly!

Mark Buffalo

14:58

Well at least I can chat on my phone

@RoryAlsop Thanks for the support. Also, being here has helped me find and plug over a dozen holes

Rory Alsop

@ThomasPornin I'll ping you a quick email (if it's okay to use the one I have visibility of in mod tools)

Thomas Pornin

@RoryAlsop Yes, it's OK (besides, it is not hard to find, I have it as cleartext on my homepage...)

Ohnana

@MarkBuffalo ah, good old "manager up the ass"

Rоry McCune

@Matthew oh man, when I used to run a test team in a bank we had that all the way. metrics on everything, regardless of whether they were meaningful

Mark Buffalo

@RоryMcCune eww

silverpenguin

15:04

:28346071 mark slam your balls on the table and demand some respect :<

Rоry McCune

@MarkBuffalo e.g. "why have you found less issues this quarter" "well we did a smaller number of larger tests, duh!"

Mark Buffalo

Totally in the most bummed out mood ever today

Colin Cassidy

@RоryMcCune metrics drive bad behaviour, we wanted fewer code review fails... so guess what... :)

Rоry McCune

@ColinCassidy yeah I laugh so hard when I hear "You can't manage what you can't measure", it's like a huge "I'm a bad manager" flag

simple metrics will always be gamed

Viz the UK bank sector where bonuses were paid for sales, what happened.... ooh lots of mis-selling

Colin Cassidy

or "say what you are going to do in a sprint" and then be measured on what you've done, lead to people saying that they'll complete the thing they did last sprint and work on the next thing for the following sprint

the obvious "bad metric" is the fewer testers we have == fewer bugs

oddly no one seems to want to comment on that one, yet that's the behaviour driven by similar metrics

Mark Buffalo

15:12

@RоryMcCune heh, nope. Just blanket unawareness of what was accomplished

Colin Cassidy

@RoryAlsop it's an oddity in the software business in that if you're not directly contributing then you must be wasting time. When this is clearly wrong. If you hire a lawyer, some of their billable time will be learning and keeping up to date with changes to the law. However to keep up with new technologies, we have do to that in "our own time"...

Rоry McCune

@ColinCassidy yeah the lack of support in IT for Professional development is kind of weird

Doctors/lawyers/accountants get it taken into account

Mark Buffalo

@ColinCassidy I do it in my spare time anyway

Rоry McCune

although interestingly the common point of those three is strong bodies like ICAS/the BMA

@MarkBuffalo indeed but should companies be able to rely on that and not train their staff?

Colin Cassidy

"on the job training" is my pet hate. As is "We have a training budget, but we've cancelled the T&L budget"

Mark Buffalo

15:20

@RоryMcCune This leads to fewer it professionals. Whatever a company decides to do is not my business. I am there to complete a job, and will do so.

Things are good here in general

We have a training budget

@RоryMcCune I agree with you, though. It's ridiculous

Rоry McCune

@MarkBuffalo oh indeed I've always had the same approach which is that I can't depend on anyone else to train me, it's down to me to keep up to date

Mark Buffalo

Yeah

It's depressing sometimes

Only because it's usually done after work, and that's supposed to be me-time

I like learning though

silverpenguin

ahh k-pop music videos the closest to NSFW thing i can watch

Thomas W.

15:43

Anyone willing to hear the symptoms I'm observing on a system and let me know if it sounds like malware or not? For all intents and purposes it presents as hyper-suspicious, hence my needing extra sounding-boards :/

Any flash drive plugged into this Windows computer is getting its file contents replaced by a link, which runs a rundll32.exe process. This process has a very weird symbols string after it - and I mean really weird. Examining the drive on a Linux machine, there's an empty folder (hidden?) which contains an executable which in turn then has the actual 'disk' contents stored inside a folder inside that

This happens for any disk plugged into the specific computer as well

which further makes me hyper hyper suspicious

CodesInChaos

sounds like malware to me

Thomas W.

anyone know of any malicious threats out there that act like this?

@CodesInChaos that's what it sounds like to me, too

i submitted the suspect Malware to VirusTotal right now as well

to see if they find anything

(thank god for Linux)

silverpenguin

@ThomasW. the person who makes a virus for a pure linux system would be hunted down by every nerd on the internet and burned at the stake while be stoned by old dell mice (those fat ones with the old rubber balls)

Thomas W.

@silverpenguin Yes, true statement

i'd be at the front of that pack

with all the weapons and wrath

@CodesInChaos what's real interesting is this happens on write-protected drives too, with something trying to write to it when it's write-protected and plugged in

@CodesInChaos suggests active malware?

silverpenguin

everyone knows its the unforgivable crime

Thomas Pornin

15:49

"Any flash drive plugged into this Windows computer is getting its file contents replaced by a link": this, alone, qualifies as malware. Wiping out Flash drive contents is not a normal action.

Thomas W.

@ThomasPornin that's what I suspected

so I guess I need to talk to the local security team on this

and my managers, 'cause we have write-protected drives we use to restore certain utilities here :/

grabs the sledgehammer from the utility closet in the mean time

Thomas Pornin

Bliss (virus)

Bliss is a computer virus, introduced in 1997, which aims to infect Linux systems. When executed, it attempts to attach itself to Linux executable files, to which regular users do not have access. In the case of the alpha version, this prevents the executables from running, so users notice it immediately. Although it was probably intended to prove that Linux can be infected, it does not propagate very effectively because of the structure of Linux's user privilege system. The Bliss virus never became widespread, and remains chiefly a research curiosity. After the Staog virus it is the second known...

silverpenguin

@ThomasPornin we must find him

Thomas W.

@silverpenguin and subsequently send him through torturous ordeals, leading to his sacrifice

um, I mean...

:)

@CodesInChaos 100% confirmation of a virus - virustotal.com/en/file/… analysis in progress

this is the .exe i discovered inside the disk

CodesInChaos

For me the behaviour your described is 10x more convincing that whatever detections "anti-"virus-software might produce.

Thomas W.

15:56

@CodesInChaos indeed

I'm 100% certain it's malware though

Matthew

Does Bliss infect you when you look at it? </reddwarf>

Thomas W.

@Matthew hope not

fortunately these symptoms are only observed on a Windows environment

Xander

16:09

On the difference between the DMZ, and crypto.SE's chat room, The Side Channel:

in The Side Channel, yesterday, by e-sushi

@SEJPM But I agree that their chat can’t be compared to ours. Theirs is like a full-fledged rave, while ours feels a bit like checking the refridgerator light every now and then. 8}

Thomas W.

heheh

David Freitag

17:09

@RоryMcCune Fantastic, I'm glad you're happy with my suggestions :)

Simon

I'm receiving my material/lab access for PWK tomorrow!

Xander

@Simon Fun!

Simon

Should be a lot of fun, indeed.

David Freitag

@Simon PWK?

Simon

@DavidFreitag Penetration Testing with you know who.

You just wanted me to say it.

David Freitag

17:23

@Simon Oooh nice ( ͡◉ ͜ ʖ ͡◉)

@Simon I genuinely had no idea

So I bought a yoohoo with my lunch

Simon

Feb 18 at 0:50, by David Freitag

@Simon PWK?

GOLDFISH

Matthew

@DavidFreitag TMI

David Freitag

One of those you numpty

Simon

Snapple is made by Dr. Pepper?

SNAPPLE MASTER RACE THEN

David Freitag

I haven't had a snapple in a few years

Simon

17:25

Me neither.

They have a ton of brands, including 7up.

Dayum.

Matthew

We don't have those...

We have Yazoo

Simon

I yazoo your moms.

David Freitag

When I was in college we had a vending machine that had only snapples in it

It was freaking awesome

Simon

Yeah but they're super expensive.

David Freitag

Nope a snapple was $1

Simon

17:27

wtf

David Freitag

It was like the size of a small car

Simon

You Americanos get everything at a good price.

Yeah I know.

David Freitag

Had like 8098324097 different flavors

@Simon That's because our currency isn't backed by maple syrup

Ohnana

0

Q: Can my car be hacked?

I was reading this article about car hacking and the fact that there are a half million vulnerable cars scared the living daylights out of me! I did some research and many sources claim that car hacking is Nearly Impossible, but if you see that from the other side, the Nearly Impossible is still...

attack-prevention vulnerability

WELCOME TO 2016

David Freitag

@Ohnana That reminds me of the $5 wrench xkcd

Simon

17:28

@DavidFreitag pls

Ohnana

1

Q: VPN - Why is my NAT'ed Laptop being SSH-brute-forced by External IPs when in VPN?

I am using a commercial paid licence to a VPN provider, which I use on two boxes, a FreeBSD, and a Linux BackBox. When connected to this proxy, my interface receives a public IP from the VPN provider. My home router has no open ports exposed to the Internet at all (I have tested all 65 thousa...

vpn brute-force

Simon

I'm so excited about getting my course material that if as soon as I'd get it my donut would be like "Let's do a threesome with my hot female friend" I'd be like "pls no I have the whole world to penetrate".

David Freitag

@Simon nerd.

Simon

NURD MASTER RACE

Only 1h30 of work left even if I have -3 motivation.

Ohnana

aha

Simon

17:37

o ffs not the bad looking manatee

Rоry McCune

@Ohnana someone doesn't understand how VPNs work...

Ohnana

that title tho

Thomas W.

@RоryMcCune beat me to posting that answer by a few seconds :p

(was along the same lines as what you wrote)

Rоry McCune

yay for fast typing :)

it's actually an interesting point, I wonder how many people have VPN accounts but really don't understand how they work

Thomas W.

@RоryMcCune Most of them, is my guess

most of the non-corporate world equates "VPN" with "Hey, hide my IP" but don't know the underlying networking that corresponds to them.

Rоry McCune

17:49

yeah, would make for "interesting" scanning of known VPN provider IP address spaces, to see what people are exposing but shouldn't be..

some shodan/censys searching might work for that.

Thomas W.

mhm

The only VPN I bother using is my own - either the one for my apartment or the one for my parents' home, because then I can access all the data I actually need :P

Simon

The real reason is because you're a nurd though.

Thomas W.

(hiding my IP online is less of a concern, 'cause good firewalls and security setups are better than the average user's setup)

true statement

fiancee calls me a nerd all the time :P

kicks autocorrect

Rоry McCune

@Simon you do realise that by doing PWK you get forced entry to the nurd club

no-one who does that course/exam is exempt

Thomas W.

@Simon Does it make my nurd-state worse that my pfSense firewall at home and the pfSense firewall at my parents network are connected by a point to point vpn tunnel so I can get into the systems I left back at their home? :P

Simon

17:52

@RоryMcCune Only when I'll get my OSCP cert this will be true.

@ThomasW. Yeah what a nurd you are, m8.

Thomas W.

:P

Rоry McCune

@Simon pls to complete the course, you're going to have to do nurdy stuff at weekends

Simon

pfSense master race, though.

@RоryMcCune You have no proof.

Rоry McCune

@Simon apart from the fact that there's no way your employer is going to give you time to do it all in work hours...

Rory Alsop

evening all

Rоry McCune

17:55

@RoryAlsop watcha'

Rory Alsop

@RоryMcCune one of the points the IISP is (slowly) working towards...

One of the upsides of a heinous regulatory oversight on me is that I must provide appropriate training for my entire team

:-)

Rоry McCune

@RoryAlsop well sooner or later there'll be a formal drive for that sort of thing in InfoSec, although given the lack of success of the BCS in that regard, it may be later...

Simon

@RоryMcCune Ya but you have no proof that I'll actually be doing it.

However if I do have the cert, it means that either I did the course and learned enough or already knew enough.

Rory Alsop

Good selling point for me when hiring - "I have to give you this much training each year, in order to help you reach these benchmarks at points x and y"

Simon

Now you have no way to tell @@@

Rory Alsop

17:58

@RоryMcCune was disappointed by BCS going off the boil on that - IISP is pushing hard, and their charter will be directly related

Rоry McCune

@Simon until you start asking @Adi and @TerryChia questions...

Simon

Crap, I was gonna say I'd delete the post but you're a room owner.

Rоry McCune

@RoryAlsop BTW did you see the new UK gov cyber security thing that got announced today

Simon

That's cheating.

Iszi

Urgh. Need to add new phone to the MAC filter on my parents' router. But the filter is full, and we're not ready to pull the old phone out yet. And I know my hardware list is out of date (shame on me) - and I'm really too lazy to bother checking it anyway.

So, gonna probably just nuke a random item and see if anyone screams.

Rory Alsop

17:59

@RоryMcCune Actually no - I've been head down in meetings most of the day

@Iszi correct

Transcript for