« first day (1923 days earlier)      last day (3255 days later) » 

13:02
@RоryMcCune right. relevant
is this the chat where I can get my ass flogged... erm, flagged?
@TildalWave sure is
@ThomasPornin the FBI has withdrawn it's case, citing that a "third party" has broken in
You're a third party.
Your a towel
13:07
wtf
@TildalWave definitely
@Ohnana spellcheck pls
ty
yeah you gotta spell correctly so our PHP intelligence automation tool knows where on the list to place you
@JukEboX s/your/you're
:-)
@RoryAlsop lol Morning Rory
13:10
Morning :-)
morning Roro
wait wat? morning? :O
it's 1 pm
No it's not.
it is in UK
Who cares about the UK?
I have had the best morning - coffee with friends, chat with three letter agencies (well, 4 in this case), a free basket of fruit, and the sun is shining...and I got to correct some spelling
13:11
it is early morning you fools
@Simon UK does
EDT BEST TIMEZONE
So it feels like morning, despitee being 10 past 1 in the afternoon
@RoryAlsop GCHQ ?
@RoryAlsop Somehow I read fruit bat.
13:11
god i'm so tired :(
@ThomasPornin yup
MI11?
bah
@Simon a basket of fruit bats... Nice
@RoryAlsop I wouldn't know what to do with them.
beats having a basket of angry bees
13:15
@Simon hey you should go work for GCHQ, did you know their head office is called the doughnut?
@RоryMcCune !!!!!!!
Bat bombs were an experimental World War II weapon developed by the United States. The bomb consisted of a bomb-shaped casing with over a thousand compartments, each containing a hibernating Mexican Free-tailed Bat with a small timed incendiary bomb attached. Dropped from a bomber at dawn, the casings would deploy a parachute in mid-flight and open to release the bats which would then roost in eaves and attics in a 20-40 mile radius. The incendiaries would start fires in inaccessible places in the largely wood and paper construction of the Japanese cities that were the weapon's intended target...
Imagine all these emails that I could send correcting everyone.
just in case we haven't yet mentioned ALL the flaggable words :)
@TildalWave WHY WOULD YOU SHOW ME THIS?
POOR BATS QQ
13:17
"The Doughnut" is the nickname given to the headquarters of the Government Communications Headquarters (GCHQ), a British cryptography and intelligence agency. It is located on a 71-hectare (176-acre) site in Benhall, in the suburbs of Cheltenham, Gloucestershire, in South West England. The Doughnut houses 5,500 employees; GCHQ is the largest single employer in Gloucestershire. Built to modernise and consolidate GCHQ's multiple buildings in Cheltenham, The Doughnut was completed in 2003, and GCHQ moved into the building in 2004. It is the largest building constructed for secret intelligence operations...
@Simon they had their revenge
@Simon sacrafice them to your manatee god...bathe in their blood and ride a uni cycle while playing the banjo e_e
wtf is wrong with all of you wanting to murder bats?
@TildalWave what the actual fuck is this? who thought of -- oh it's a dentist. carry on.
@RоryMcCune That's a cool building.
13:18
@RoryAlsop did they ask you about the DMZ?
@Simon s/murder/sacrafice ... dont call my new religion of me murder I find it offensive....probably
@silverpenguin You don't even know how to spell words in your own language, maybe you should try the simplified form.
@Simon kitty got claws
The complexity of the computer network at GCHQ was responsible for the increase in costs. Issues with the network were found while preparing computers for the "Millennium bug". Simply shutting down each computer individually before restarting them in the Doughnut would have left GCHQ unable to complete key intelligence work for two years
^What the smeg
@silverpenguin :D
@RоryMcCune wat
13:20
@RоryMcCune well....they fucked that up good and proper...
@RоryMcCune oh wow
yeah I struggle to imagine what the network was that would require 2 years to get back up and running after a scheduled shut-down
@RоryMcCune @Simon's mom
@RоryMcCune The problem is probably not powering up, but powering up in a new infrastructure.
It means that they have lots of computers and have absolutely no clue about what their own network configuration is, and they estimate it would take two years to simply establish a map of the whole.
@RоryMcCune alot of windows updates
13:28
oh goody we have a new terrorist attack to freak out about. I've been to brussels airport, too.
@RоryMcCune neural networks that only produce intelligible output at the age of 2 years?
@TildalWave surely the neural network would work fairly straight away and it would be a genetic alogirthm that would possibly take so long ?
@HerringboneCat I didn't know how the attack works when asking the question. I asked it before the blogpost / paper came out.
@Simon cuddle them and feed them sugar water, maybe...
@Simon Well of course they are. When knew that when they decided it would be a good idea to try and tax us without representation.
13:35
@TildalWave yeah I just wonder what would happen if they had had an unexpected outage... it implies that any outage would take 2 years to recover from
which I find amazing, I'm sure they'll have good power systems but there's always a chance of an outage
@Adi have you seen the new info. about the CREST written stuff
@Adi you will soon be able to take the written portion at Pearson centres round the world, so I think you'll be able to do CRT effectively without coming to the UK
@RоryMcCune oh yeah, we forgot to mention EMP bombs in the past couple of hours, thanks! :D
there, now we're on EPA's list too LOL
@RoryAlsop Aw cuties want some cuddles :3
@Xander What a bunch of sneaky little smegs.
13:51
@SmokeDispenser "Too much BDSM"? I miss all the fun stuff!
@Iszi, obviously.
(Seriously, this is threatening to become a meme-level thing. Me missing fun.)
And yeah, too much BDSM. And I'm even into that.
2
@Matthew, Look
@SmokeDispenser Explaining the details of that specific bit of code would be off topic...
@Matthew, I know, that's why I didn't answer it ;)
13:52
@Ohnana My sister and quite a few of my friends live in Brussels.
yet, you should definiatly link to the daily wtf :)
@Arperum :( is everyone okay?
@Iszi didn't you know? They just wait till you go...
@Ohnana As far as I know they are all fine. My sister might not be able to get over here for my birthday this evening though, with all trains and everything being shut down.
@SmokeDispenser i feel like this is my fault lol
13:54
@SmokeDispenser However, providing a massively simplified example means they can go off and infect themselves somewhere else, which is a massive improvement...
@Arperum they have locked down Brussells and closed the borders
@Arperum well, it's good to hear they weren't injured. happy birthday
apparently taxis are running for free
@JukEboX WTF WHY ARE YOU LINKING RUSSIA TODAY!?
13:55
@Ohnana Yea, to some degree, probably not to drive you multiple cities away.
@JukEboX I have heard nothing about a complete closing of the borders.
@SEJPM They have a running live updates and that is the best info I can get from Work atm.
@Ohnana nah. It went over the edge for me with @RoryAlsop and the volts.
@Arperum I have heard reports coming in to work this morning they have closed borders with France
@SmokeDispenser hey hey no ambiguous Rory'ing there, that's that deviant @RoryAlsop you're referring to :op
@RоryMcCune, that's right.
there you go.
13:58
does anyone know if .NET viewstate automatically prevents CSRF?
I hilighted a mod.
@JukEboX I have heard nothing like that. Or noithing extra anyway.
wat
@deed02392 IIRC you need ViewState UserKey set to get that (but it's been a while since I last looked)
@deed02392 only if you use ViewStateUserKey.
13:59
@AviD too slow little tigger :op
otherwise a CSRFer can just drop it.
@RоryMcCune oh snap
@Matthew did you read the tdwtf-articles? I was lmao:)
Look at them little .NET fanatics knowing this.
@SmokeDispenser WOOHOO I'M NOT THE BIGGEST FREAK IN THE DMZ
4
only by seconds, and I wasnt even here
13:59
@SmokeDispenser have you seen the "wat" video
is that evident by the fact viewstate is encrypted?
@Arperum Editted few minutes ago -> rt.com/news/336595-belgium-highest-terror-alert
@AviD you're suggesting that you're not even supposed to be here today?
or should that be sent as a body param
@Ohnana, linking it whereever i can.
13:59
@Ohnana you have called?
@RоryMcCune lol
2
Q: How does ViewState protect against CSRF?

Jarrod EverettAccording to the OWASP CSRF Cheat Sheet viewStateUserKey for ASP.NET ViewState is acceptable to prevent csrf attacks, but I really don't get how. I get that this makes it hard for an attacker to modify the viewstate since they would basically have to know the user's session id, but a form's post ...

@Lighty gtfo little nooblet, you are merely our butt monkey :)
@deed02392 no, it is normally generically encrypted per site. userkey adds in a little something to tie it to per user.
@RоryMcCune dammit man
@Ohnana Is that the kinky name given to me? Butt Monkey?
14:00
@Lighty sure
JSFuck is an esoteric programming language with a very limited set of characters: (,), [, ], +, !. While the name is derived from Brainfuck, the only similarity to Brainfuck is having a very small set of instructions. Very peculiar for an esoteric language, JSFuck is valid JavaScript code, and JSFuck programs can be run in any web browser that interprets JavaScript. The challenge in JSFuck lies in recreating the full set of JavaScript functions using only these six characters, which is made possible by two properties of JavaScript: It is a weakly typed programming language It allows the evaluation...
@JukEboX who is reporting that as closed? As all I cannot find anything at all about it in Flemish media
ok, well they don't appear to be using that. but __EVENTVALIDATION is something long and seeminglyn ecessary (404 if it's not sent)
ah but if that's vlaid site-wide, as long as an attacker has authentication, they can perform CSRF on other users
There is one tweet that reports it closed, and right under it another one that proves it complete bullshit.
14:02
@deed02392 yarr, if it's the same for all users, malicious person just needs one account to attack other users
Terror level 4 does not mean "border is closed"
great, thanks
@deed02392 exactly
i was restricting myself based on unauthenticated CSRF but obviously that's not necessary. i guess it somewhat affects the severity though
@Arperum only going by what I have heard reported. Sorry :(
14:05
@JukEboX I suggest you hold your source to some form of doublecheck, because it seems unreliable.
get fkin rekt jukebox
@Arperum it's the 24 hr rule of disasters, we're not going to get accurate reporting until tomorrow
> Using the same principles as JSF–k, but coupled with JavaScript’s unicode support, they produced this:
@SmokeDispenser why
@Arperum no news source is reliable for anything
14:07
@Ohnana because hard to catch.
@JukEboX Yes, that's why you use multiple ones.
so, I just got spam / phishing emails, pretty stupid and standard. But, they seem to have sent from an actual email account - which seems to be tied to a real Facebook account.
Trolling suggestions?
(assuming it wasnt forged or stolen, which is possible...)
@AviD send the person a nice email telling them that they have malware
Which is most-likely, you mean.
@Arperum they are all equally BS. None have a sense of integrity outside of the money they are paid to report on. Even in situations like this.
14:09
Exactly what ohnuhnuh said you donut.
@AviD Signed?
@Ohnana I dont think so. doesnt look like a zombie account.
@SmokeDispenser no, ofc not
meh, cant be arsed.
why ofc? could at least have DKIM or SPF
@SmokeDispenser ah good point, didnt bother to check.
if it doesn't, probably an address book leak
14:12
though probably valid, since its ostensibly from gmail, so that would be checked
@SmokeDispenser hmm? no, not somebody I know.
@AviD, that's how I checked that last time. I knew the provider used DKIM.
that someone just need to know you;)
@SmokeDispenser no no, not at all - plain ol' spam.
@SmokeDispenser wut? There was nothing weird with my volts - they were zappy, not designed for pleasure!
LET'S WATCH THE FIRST TREMORS
14:14
@SmokeDispenser NOT THAT KIND OF SPAM
@RoryAlsop thats whats weird
@AviD, wat?
@AviD lol
@AviD, my point being: there might be adress book leaks. a lot. and there is the bacon-y truth that everyone is connected over a few edges;)
what does this have anythign to do with addressbooks?
You're an address book leak.
14:17
@AviD, getting legit sender addresses.
pls, not difficult to find my email out in the wild. it's everywhere.
not yours. the sender's.
this is my public address, that I use for posting publicly and such, not my personal one.
@Lighty Is that like what @DavidF sees when you type Cyber Monkey... :-)
@SmokeDispenser okay what?
14:18
@RoryAlsop That one went over my head Im afraid
@Lighty cyberbutt
@AviD you're wondering why the spam comes from a legit address, aren't you? finding those is not hard.
@Lighty @DavidFreitag has an in-browser script that replaces occurrences of the word "Cyber" with the word "Butt"
hmm?
@RоryMcCune, doen't everyone?
14:19
not wondering. I think the spammer USED his own address.
@RоryMcCune butt... why? :')
lets call him a #simonspammer.
@AviD :DDDD
well.
@SmokeDispenser well not on my work machines, given the quantity of security stuff I read, I'd have butts up on my screen all day
2
(and yes... phrasing!)
14:21
@RоryMcCune, yeah, I had the same problem. But everyone once tried it when it was butt hip;)
@RoryAlsop :P
@RoryAlsop I have the same problem. Even more of a pain when your trying to read your more recent security news and the work filter blocks the site due to pre-established key words
Very annoying
@RоryMcCune Butt Defence Operations
4
@Matthew you playing with @DavidFreitag again?
@AviD Would I do that?
14:40
Explained to client that they've not provided any parts of a username/password/pin combo. They say "oh, OK, we can sort that". They provide an alternative login to the same system which only requires username/password.
Huh, what's going on about my butt?
@DavidFreitag We're ensuring it is well defended, along with the rest of your cyberestate
@Matthew Ah yes, can't forget about my buttstate
@Matthew oh lawd
@JukEboX I've found something that might be part of the the reason you found the borders around here were closed. France is said tyo have inclreased border control on the belgian border. But that's France closing a border and not Belgium.
14:43
that moment when the client gives you a finding
@Ohnana lol. "maybe next time you can get some good findings, like me"
Did someone say butts?
@Matthew Sounds like a name for anal condoms
@Ohnana dont they always?
if they dont, you're not doing initial interviews right.
Adi
Adi
@RоryMcCune Are there any other portions than the written exam?
14:55
@SmokeDispenser might be confusing "network" with "internet connection"
I usually know of 80% of the findings in the first meeting. then I just need to find them.
aka, he's in an isolated LAN
@Adi nope s'just written + practical, so from June (when the switch over happens) it'll be CPSA for the written + the practical which can be OSCP
AFAIK anyway
@SmokeDispenser Im reading it as he is trying to remote scan his own network
Adi
Adi
@RоryMcCune Hmm.. without OSCP you'd still have to do it in the UK, right?
Because I don't want to use the OSCP equivalency
14:57
@Adi yeah so for now the practical element of the exams is all UK only (well or Singapore/Australia IIRC)
Adi
Adi
Aye
Thanks
@Adi AFAIK the only difference is that with OSCP you can't do CHECK stuff, but you can't anyway 'cause you're not a UK citizen :)
@RоryMcCune not long untill I start my OSCP trainning .... rocky 80s montage
@RоryMcCune you know you want to train me >_>
jedi mind trick
@Adi even if you decide to do the practical in the UK, at least this should mean that you can take the written whilst at home (I'm assuming there are Pearson centres in Finland...)
@silverpenguin I've not done that one and it's not really the stuff I do day-to-day. You want @Adi or @LucasKauffman for that (or you could be @Simon 's study-buddy)
Adi
Adi
@RоryMcCune Oh, true true. I didn't really no that CHECK TM requires UK citizenship
15:00
@Adi CHECK is a purely UK.Gov thing IIRC and includes UK Security clearance
@RоryMcCune @Adi or @LucasKauffman TRAIN ME I cant study with @Simon he keeps trying to netflix and chill
-4
Q: A service for sharing (partial) passwords with «key holders» for screening purposes: Does this exist?

bjornteDoes a service exist (or if not, where can I find a detailed description of the concept) that facilitates the following?: A customer shares parts of her password with 3rd party «key holders» of her own choosing. These partial passwords can be combined into complete passwords in a strictly cont...

Adi
Adi
@RоryMcCune Yeah. Not for me then
12
A: How are NaN and Infinity of a float or double stored in memory?

Darshan MehtaJava specifies that floating point numbers follow the IEEE 754 standard. This is how it's stored: bit 0 : sign bit bits 1 to 11 : exponent bits 12 to 63 : fraction Now, I have executed below method with different double values: public static void print(double d){ System.out.println(Long...

I mean it's Java, but it's an interesting answer nonetheless.
@Ohnana I answered that, I think.
15:07
@SmokeDispenser it's such a disorganized question
i want to help it, but where do i start
@Ohnana I went for 'bad idea in this case, also: done already', as you can see.
yeah, your answer summed it up
Oh, it has updates.
OP did not get the rhetorical meaning of the questions I posted.
@Ohnana I went for "eh" in the form of many questions
@DavidFreitag There is more to it than 'exactly how the IEEE defined it'?
15:11
@SmokeDispenser Nope, but it's nice to see a visual representation
@DavidFreitag I have been shown that in my first semester at university, I think. Is that not standard curriculum?;)
@SmokeDispenser For me it wasn't
@Ohnana I think the OP has a very optimistic consideration of what people are willing to give their passwords to other people for. Voluntary = no-one. Chocolate = some people. "Microsoft technical support" = some people. Government = no-one.
@Matthew OP edited, answering the questions...
@Matthew it would have to be some damn good chocolate
15:14
@SmokeDispenser Yeah, I saw...
@Matthew, that was my understanding too. And I thought my answer was clear as to 'noone will do that'
@Ohnana Certainly not hershey's
yet: not so much.
@Matthew yea i know what you're referencing :)
so dumb
15:15
> A: It would be to aid law enforcement in a general manner.
That is no reason at all -.-
@Ohnana Sadly, I can't find a 2015 version...
@SmokeDispenser So people who voluntarily give their passwords to law enforcement can voluntarily give up their passwords to someone else instead, which law enforcement can get them from, whilst the criminals don't give theirs to either?
@Matthew that's what I read from it.
@Matthew, can I quote this?
@SmokeDispenser Sure
edited the answer.
Should I be worried that both of the quotes were from me? :-)
15:23
@Matthew :)
@silverpenguin try harder
@Matthew maybe.
@LucasKauffman more pleases?
Clearly, I'm far too cynical
@Matthew, I do not quote easily.
15:27
salut
I think that sums it up nicely.
oh no, she again
@kalina bom dias
salute te, @kalina
@kalina hallo!
@Ohnana guten tag
@SmokeDispenser that's so mean
15:27
@Ohnana jawohl!;)
@Ohnana and the prize for the least imaginative goes to ohnana montana
:( i will just go again
na, @kalina
@silverpenguin pls go give yourself a swirlie
stay. I will go :)
15:28
@Ohnana I feel like you dont love me any more </3
@silverpenguin who said i loved you in the first place
jk, i appreciate everyone here
@Ohnana I would like to watch this. For.. uh... science.
@Ohnana e_e you cut me deep
@kalina, so, stay, I go;)
@DavidFreitag i have watched this for science
2
it was kinda weird
15:30
@Ohnana Someone giving themself a swirlie?
@DavidFreitag no the other person was on the receiving end. idk man, people are weird
@Ohnana ...wut...?
@Ohnana you have been given a swirlie...how do you plan to seek revenge
Revenge is a dish best served lukewarm
@silverpenguin This sounds like DnD type questions... "You've slain the dragon, what now?"
15:32
@silverpenguin no one's done that to me. or else they would be missing multiple limbs
It would take a small group of people to give me a swirlie
Also it would be quite difficult to maneuver all 315lbs of me in a tight space
Mmmm breakfast trail mix
anyone know how long a company in the UK has to provide H&S equipment?
@silverpenguin Until the end of time itself
@silverpenguin I do not even know what H&S is. so... I'm out :)
@DavidFreitag ?? I just need a specific chair for my back and i got the doctors note (finally) over a month ago
and I sitll have heard no news
Adi
Adi
15:36
@SmokeDispenser Health and Sugar?
@Adi safety
Health and Safety
Adi
Adi
Close enough
I was thinking health and sodemy but I knew that couldn't be it
@DavidFreitag It can be when working in I.T...
15:38
@kalina now, did you actually go? what a shame. hope you recover soon from being on the interwebs;)
@silverpenguin, in germany, there's law about it. There should be an equivalent over there?
@SmokeDispenser Yeah I'm also sure there's a law about the minimum amount of sausage that must be consumed by all citizens in Germany too
@MarkBuffalo I bet I know why your doctor called them zcaps, the brand of Azithromycin he used was probably Zithromax
@DavidFreitag actually, no. but that would be imaginable.
@kalina watcha' you've been quiet today :)
My brain finally let me sleep last night
Slept from 9pm to 11am
Damn it feels good to be well-slept
@DavidFreitag hope you weren't expected at work at like 9am then!
15:44
The downside is I haven't eaten since yesterday at 2:30pm
@SmokeDispenser yea im just trying to find the law that gives a time frame .... im truly suffering here.
@RоryMcCune I'm only expected to work 40 hours a week, they only start to get annoyed when I show up at 2pm
@silverpenguin I can help with that
@DavidFreitag well that's something at least :)
@silverpenguin, how about asking for updates and thinking aloud about home office?
@RоryMcCune Yeah it's kinda bad. Some days I show up at 8am, some days it's noon
15:47
@RоryMcCune yeah. She was here and then left again instantly.
@DavidFreitag ???
@SmokeDispenser probably AFK for coffee
@SmokeDispenser I have done every week lol... now im putting my foot down and throwing laws at the HR deparmtent ... never a good move though
0
Q: Where to get a specific malware by its name?

user105127First of all, I have referred almost all the links provided by the following links Finding a specific malware sample for malware analysis purposes http://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze and to several other websites...

@silverpenguin Yeah, sure. I can help. The downside is you won't be able to move anything but your face
But hey, you won't be in pain anymore
15:48
@RоryMcCune, I'm still not sure if I might actually hit her with my "greeting". but then again, it's kali.
@silverpenguin wen't you on the look for a new job anyways?
@SmokeDispenser yea but im not looking to leave unless I get a job in info sec so it might take some time
I really wish uber would stop freaking emailing me about useless crap that they think I do
@DavidFreitag leave me one arm and you got a deal
@silverpenguin, did you check PwC's recruiting?
@silverpenguin I mean I'll give it a go but you never really know when severing spinal chord
15:51
or talk to rory if such a big corp might be a good start?
that seems to be quite a business.
@SmokeDispenser Really? That's been around for quite some time.
Adi
Adi
It's possible through VirusTotal private API virustotal.com/en/documentation/private-api We use it a lot. It's very useful and offers a lot of information besides samples based on names/metadata. — Adi 12 secs ago
@DavidFreitag, I seem to have overlooked it.
Adi
Adi
I love the VirusTotal private API
Give it a name of some malware, get the malware back
@SmokeDispenser Yeah, until someone hacks her database with a $5 wrench
Adi
Adi
15:53
tyvm
@SmokeDispenser 'twas on twatter ages ago
@DavidFreitag, she claims she has no db
@SmokeDispenser imma do this now lol
@SmokeDispenser WHICH RORO?
@SmokeDispenser Hence the $5 wrench...
15:54
DON'T GO FULL ON AMBIGUOUS IN HERE SON
@Simon Does it really matter given the context? They would both know
I know but I felt like typing something in caps.
As if I needed a reason to do it anyway, my bad.
It's ok, we all need to scream from time to time.
@DavidFreitag I think not knowing all generated phrases might be a case of plausible denialability
Sometimes it's standing in the middle of a coffee shop, or in a theater during a movie. (and I don't even drink coffee)
15:56
@Adi malware question for you.. do you know if there are any decent public sources of malware which attempts to avoid forensic tools?
@SmokeDispenser Ok you seem to have misunderstood what I'm euphemising. Nevermind.
@DavidFreitag, Yeah, I got that.
yet, she is not vulnarable to that 'attack'.
(if she keeps no records whatsoever)
@SmokeDispenser Just because her database happens to be on a notebook instead of on a computer does not suddenly make her invulnerable to the $5 wrench vulnerability
4 mins ago, by SmokeDispenser
@DavidFreitag, she claims she has no db
like: no db.
@SmokeDispenser Dude look at the picture in the freaking link
15:58
o lawd dovid is getting mad.jpg
@DavidFreitag, Dude, that's the dictionary the words come from that the dices come up with
Adi
Adi
@RоryMcCune Not public, no.
In SSL/TLS, the client and server are supposed to send each other their notion of the current time (in seconds). Of course, OpenSSL disabled that (in 2013) for dubious reasons.
that is public knowledge, the contents of that pic.
Adi
Adi
@RоryMcCune If you have more information, I can probably hive some recommendation

« first day (1923 days earlier)      last day (3255 days later) »