The DMZ

AviD

07:34

in case you havent seen this yet....

5

Q: StackExchange OpenID provider should clearly use HTTPS

As discussed in this question on Meta.Security.SE, the SE OpenID provider seems to be using some sort of AJAX call to replace part of the page. The outer page uses plain HTTP, whereas the OpenID part (when the SE provider is chosen) seems to be using HTTPS (only visible if you use Firebug or simi...

what the...?? somebody flagged an answer as a duplicate of a comment. yeah, and...??

Ladadadada

10:22

Yay! I hit 1k rep. Do I get to change my avatar to a bear now?

Ninefingers

@Ladadadada NOT YET! We haven't taught you the secret handshake of the society of the bear! :P

Ladadadada

@Ninefingers That sounds... dangerous.

Ninefingers

@Ladadadada Nah, not at... oh, I see what you did there!

@AviD Decline it with "people should not answer in comments. If they do, it's their fault they get no rep."

I always think comment answers are a way of saying "yeah, I know I should use the answer box, but I might get downvoted!"

Scott Pack

12:05

@Ladadadada It depends on what kind of bear you want to change it to. You must receive Pornin's blessing to be ursine. However, the other kind of bear is totally up for grabs.

Rory Alsop

@ScottPack don't bring out the bear pictures!

Scott Pack

@RoryAlsop I leave that as an exercise to the reader.

Stack Exchange

12:25

Stack Exchange Security Blog: Tor: Exploiting the weakest link

lucaskauffman on April 10, 2012

Since the birth of the internet, there has been censorship. People have always been looking for ways to anonymously access the internet, either by proxy or VPN, however these still (can) log traffic origin and destination.

Since a few years there have been a few projects to anonymize traffic. One of the more famous ones is Tor (The Onion Router).

Tor uses servers and clients. When you request a webpage from your client, Tor will make an encrypted request to a randomly selected relay server called an Onion router. This Onion router knows who you are. Next thing the router does is ask another Onio …

Scott Pack

14:25

Do you guys think a question about creating consumer matching rules for group membership in PGP Universal would be most appropriate here or on SF?

Ninefingers

@ScottPack I suppose it depends. If it's "what buttons do I press..." I imagine it'd be serverfault, but if it's "I'm thinking of implementing X policy, my needs are Y, Does X+Y=hackerproof?" then here?

Iszi

@ScottPack Increased specificity may result in more accurate replies.

Scott Pack

@Ninefingers That's where it gets hard, since it's also a matter of audience. The audience I should be asking is more likely to be here than there.

Ninefingers

@ScottPack Sounds like more of a policy-what-should-I-be-doing than a how do I press buttons type question then, right?

Iszi

@Ninefingers Not necessarily. I could be asking a "how do I press buttons" question about Backtrack 5. The audience I should ask is more likely here, while the audience SE would generally say I need to put it in front of is U&L.

Scott Pack

14:38

I suppose it depends on your definition of "security tools" which is one of the on-topic items.

Ninefingers

It sounds like here, tbh. The worst that can happen is people get all angry and demand you move it to serverfault, which isn't exactly difficult.

Iszi

@Ninefingers Though, it's still harder than it should be.

Yes, I'm gonna keep gnawing that bone until it's fixed.

Ninefingers

@Iszi True.

Scott Pack

14:56

Mmm...marrow

Jeff Ferland

@RoryAlsop ping!

Iszi

A sign you've been playing Portal too much...

You receive an e-mail:

"On be half of [Big-Wig 1] and [Big-Wig 2], you are being invited to attend the [Major Accomplishment] Celebration on [Event Date] at [Event Time] in [Event Location]. Pizza and cake will be served.

Please accept/decline your attendance NLT [RSVP Time] on [RSVP Date] so we can have an accurate headcount.

Thank you!"

Your first thought: The cake is a lie.
Worse: You say it out loud to everyone else in the room.

2

Jeff Ferland

15:12

@Iszi \o/

Scott Pack

Good man.

Iszi

Your second thought: I wish I knew that someone in this room would have gotten that.

Jeff Ferland

@Iszi You work in a sad place :(

Iszi

There's a couple guys who do game, but haven't played it.

Scott Pack

15:34

Lamers

Iain

16:06

G'day anyone got any idea why I keep getting messages about QOTW events here ?

Paŭlo Ebermann

16:21

@Iain Events added by moderators or chat room owners (of a chat room you were in recently) are automatically notified. And these events were created by @ScottPack, who is in fact a room owner.

Iain

16:44

@PaŭloEbermann cheers

Iszi

Wow. Already due for QotW author selection again?

Greg

17:10

If a TOR exit node can see all unencrypted network traffic, can't it identify you as easily as a normal internet connection can?

Paŭlo Ebermann

@Greg The TOR exit node only sees the content of the traffic, not where it came from (or did go to, for downloads).

Greg

@PaŭloEbermann so if I am acting as an exit node, and you make a request through me, it will be impossible for me to identify you (or at least something else like IP address)?

Paŭlo Ebermann

@Greg Yes. You will see where I connect to, and what intermediate node I used to connect to you, but not where I am located (if you can't correlate data from my internet connection or similar).

Of course, if my HTTP headers (assuming I'm using HTTP) are enough to identify my browser's installation, you can see that I'm the same person who accessed another site last week, or similar. If that was a site with plaintext login, you know quite some identifying information.

Iszi

@PaŭloEbermann So (pardoning that I haven't read our blog post yet, nor am I that familiar with TOR) you're saying that one would need data from all the intermediate nodes along the way to ID me?

Paŭlo Ebermann

@Iszi I didn't read it, either :-p

Not necessarily all nodes - if there are few enough users at some time, timing correlation can give an attacker enough to work if it sit sonly between entry node and me, and between exit node and the accessed web site ... being one of these nodes makes this easier, of course.

Iszi

17:27

@PaŭloEbermann But you need MitM between entry and exit, you're saying?

Paŭlo Ebermann

When there is a lot of traffic from many users (and between many TOR nodes), timing attacks are impossible, and the attacker really needs to control the complete path.

Iszi

i.e.:

[User]---[Internet]---[Eve]---[Entry]---[Intermediates]---[Exit]---[Eve]---[Internet]

Greg

hmmm, so as long as your actions are anonymous, there is no identifying factors in your connection over TOR?

Iszi

@Greg I think he's saying that you could correlate the actions to one user, but never actually be sure of who that user is - provided the user does not provide identifying information.

Paŭlo Ebermann

@Greg Yes, as long as at least one of the nodes in your chosen path is honest, there is enough traffic to avoid timing attacks, and you don't put anything into the plain text which makes you identifiable, you stay anonymous.

Greg

17:35

@PaŭloEbermann hmm, I can't really understand what stops an exit node from knowing where there data is going (you)

Iszi

@Greg It's similar to how a network switch doesn't know where the traffic it sends to goes, except for the next hop.

The switch (or, in this case, exit node) doesn't need to know the destination endpoints - just the next waypoint (i.e.: switch, router, or in this case an intermediate node).

Paŭlo Ebermann

@Greg The exit node knows only (in the case of Web browsing) that (1) one end of the connection is the web server, (2) the other end is behind some (known) immediate TOR node, and (3) the content of the connection.

To avoid that the content leaks anything, I would recommend using HTTPS over TOR (i.e. end-to-end encryption), when the web server supports this.

Greg

@Iszi but the next hop is ... you?

Iszi

@Greg That's exactly it - it's not.

There's more than one node between you and the Internet.

Greg

oh... this is the bit I'm missing. Where is the next hop in terms of an exit node?

ahh, ok I think the penny has just dropped.

Paŭlo Ebermann

17:39

@Greg There are normally at least three hops: entry, intermediate, exit.

Iszi

@Greg [User]--->[Internet]--->[Entry Node]--->[Internet]--->[Intermediate Node(s)]--->[Internet]--->[Exit Node]--->[Internet]--->[Destination]

Greg

So if the FBI wanted to track my illegal activities, they would have to already know who I was, what ISP I was using, and when I was going to perform the activities? (By which time, I would already be in prison)

Iszi

@PaŭloEbermann Thanks for the edit. A little forewarning next time would be nice, though.

Paŭlo Ebermann

@Iszi Sorry ... I'm sometimes overusing my moderator capabilities.

Iszi

@PaŭloEbermann No problem.

Paŭlo Ebermann

17:44

@Greg Either this, or doing a general scan of everyone using TOR, or something like this.

Iszi

In other news... Antivirus experts are comparing Flashback to Conficker & ILOVEYOU: securitywatch.pcmag.com/none/…

Urgh. That blog post could use some editing. I should get more involved in that, now that I've got access. Good info, though.

@Greg Have you read the blog post? It has some pretty good coverage of your questions here.

Stack Exchange Security Blog: Tor: Exploiting the weakest link

lucaskauffman on April 10, 2012

Since the birth of the internet, there has been censorship. People have always been looking for ways to anonymously access the internet, either by proxy or VPN, however these still (can) log traffic origin and destination.

Since a few years there have been a few projects to anonymize traffic. One of the more famous ones is Tor (The Onion Router).

Tor uses servers and clients. When you request a webpage from your client, Tor will make an encrypted request to a randomly selected relay server called an Onion router. This Onion router knows who you are. Next thing the router does is ask another Onio …

I really should play with Tor sometime.

The real nasty bit about it all is you have to really trust your entry & exit nodes.

Like, with the same level of trust (or more) that you give to your ISP.

Lucas Kauffman

herro

@ScottPack your question on LDAP what's the difference between the right and left variable in the or clause?

Iszi

18:15

Anyone else getting a 502 error here? technet.microsoft.com/security/bulletin/MS12-020

Lucas Kauffman

@Iszi works

Iszi

@LucasKauffman Works as in, the page loads? Or you're getting the same? I've tried from two different systems, on different ISPs now.

Lucas Kauffman

@Iszi it loads normally

Microsoft Security Bulletin MS12-020 - Critical
Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)
Published: Tuesday, March 13, 2012

Version: 1.0

General Information
Executive Summary
This security update resolves two privately reported vulnerabilities in the Remote Desktop Protocol. The more severe of these vulnerabilities could allow remote code execution if an attacker sends a sequence of specially crafted RDP packets to an affected system. By default, the Remote Desktop Protocol (RDP) is not enabled on any Windows operating system. Systems that do not have …

Iszi

@LucasKauffman What browser?

Lucas Kauffman

chrome

IE6 ._.

Iszi

18:21

@LucasKauffman Really? Wow. I thought my workplace was behind the times.

Lucas Kauffman

no I'm joking

prolly MS their own website wouldn't even work in IE6 anymore

Iszi

Tested in IE9, Firefox 11, and Chrome on one system now. FF11 on another system. Again, systems are on different networks & ISPs. So, I wonder why you can get it and I can't.

Lucas Kauffman

erh

uhoh

Iszi

@LucasKauffman No, I think they're still committed (contractually) to support it until 2014.

Lucas Kauffman

I just notice I'm getting a certificate warning

Iszi

18:23

ruh-roh Raggy

Lucas Kauffman

weirdo shizzle

Iszi

Got a copy off of archive.org. Still don't see the data I'm looking for. Does anyone know if XP SP2 or earlier are affected by MS12-020? Sure, there won't be a patch. But does the vulnerability still exist?

Lucas Kauffman

I'll have a look

Operating System Maximum Security Impact Aggregate Severity Rating Bulletins Replaced by this Update
Windows XP Service Pack 3
(KB2621440) Remote Code Execution Critical KB2570222 in MS11-065 replaced by KB2621440
Windows XP Professional x64 Edition Service Pack 2
(KB2621440)

Iszi

Yeah, I don't see mention of XP versions before SP3 (or, for x64, SP2) at all. So, I think the point is kind of ambiguous. Just renewed my TechNet subscription though, so maybe I can test it myself.

I'll have to learn a bit about the Metasploit module and hope that TechNet still has older versions of XP/2K. Last I checked, they still had DOS and Windows 3.x but for some reason were completely missing the 9x series.

Lucas Kauffman

@Iszi just download it from a torrent site

as long as u have the licenses it doesn't really matter

Iszi

18:33

@LucasKauffman Perhaps. But do you know where those things have been?

Lucas Kauffman

@Iszi I wouldn't trust it for every day usage, but just for testing an exploit in a VM, I don't really mind

Iszi

@LucasKauffman I wouldn't trust it on my computer long enough to burn the disc.

Lucas Kauffman

I wouldn't burn it tho :p

Iszi

@LucasKauffman Of course not. I'd load it into a VM. Still, I maintain my stance.

Lucas Kauffman

you think there is a danger in doing that?

otherwise I can format my home computer :(

Iszi

18:41

@LucasKauffman Perhaps the risk is low, but I don't anticipate it to be none.

Couldn't find Win2K (unless that's what's being called "Windows Advanced Server") but it does appear that they've got XP SP0.

Lucas Kauffman

@Iszi I think you also might be able to find it in the web development part, I think I used that a few months ago to test a website in IE6. There is a special ISO that contains all browsers, I'm not sure which XP version it was though

Iszi

@LucasKauffman MS12-020 is an RDP vulnerability, not browser.

Scott Pack

@LucasKauffman Why, the second one is for a different department. Clearly. Ahem.

Lucas Kauffman

18:56

@Iszi I know I meant the ISO they provide with the different browsers might be an XP SP2

It's just XP with a lot of browsers on it, but it's official from MS

Scott Pack

@Iain Do chat events go out to everyone? I presumed they only notified people actually joined to the room. Those were put in on request, but I'm not entirely sure I like having them if they blast out to everyone on chat.se

Iszi

@ScottPack That would be mildly annoying. Maybe feature-request to modify notification distros?

Iain

@ScottPack not everyone

3 hours ago, by Paŭlo Ebermann

@Iain Events added by moderators or chat room owners (of a chat room you were in recently) are automatically notified. And these events were created by @ScottPack, who is in fact a room owner.

I don't know the definition of recently though

Iszi

@Iain So @PaŭloEbermann is saying that if I were to create an event (didn't know I could), then it would only notify me and anyone else signed up to it?

Scott Pack

@Iain His comment doesn't explain why you would have seen the notification, however.

Iszi

19:02

@ScottPack I think "recently" is somewhere between a few days and a week.

Scott Pack

Or perhaps I'm parsing it incorrectly.

Iszi

Probably whatever threshold is also used to determine whether or not your name can come up in at-mention autocompletion.

Paŭlo Ebermann

@Iszi I'm not sure about people signed up. But it certainly wouldn't that prominently notify people not signed up.

Iain

@ScottPack I do drop in here occasionally asking if you want stuff migrating

Iszi

I don't see anything allowing me to create an event.

Paŭlo Ebermann

19:04

@ScottPack I did see this notification, too ... and I certainly was not subscribed to the event, and I was not in this room for quite some time, I think.

Iain

@Iszi you don't appear to be a room owner

Iszi

@Iain So, since only room owners or moderators can create events, then it stands to reason that all events alert automatically.

Paŭlo Ebermann

@Iszi chat.stackexchange.com/rooms/info/151/the-dmz?tab=schedule

I see the creation form at the bottom, do you, too?

Iszi

@PaŭloEbermann No, but you're a moderator.

Paŭlo Ebermann

Okay, so maybe I misunderstand the "notification" bit.

There was something where events created by moderators were handled specially ... maybe they were also announced on the SE site itself? (But this would be events created by the site's moderator, not any chat moderator, I think.)

Ninefingers

19:12

Did we decide on a QotW blog author by the way?

Greg

@Iszi Yes I read the blog post which is what raised my questions

Iszi

@Ninefingers Officially, I don't think so.

Greg

But you and Paulo have answered them now, thanks.

Iszi

Interesting: Excel will not open two files with the same filename, even if they are in different folders. But if you start a new instance of Excel, the new instance doesn't have trouble opening one other file with the same filename.

Lucas Kauffman

@Greg The guys from Tor also have some very nice vids and presentations on how things work and problems they encounter/overcome. They are pretty good

Greg

19:17

@LucasKauffman I understood that it was secure, but how it physically achieved it was a fluffy subject for me, but I totally missed the point that there are more than one node between you and the Internet and the exit node.

Lucas Kauffman

@Greg ah yes, maybe I didn't put enough emphasis on that in the blogpost :/ sorry

Iszi

@LucasKauffman I thought your "How it Works" section covered it quite nicely.

Lucas Kauffman

ty ^^

Greg

@LucasKauffman I think its a great blog post - just some things take more time to absorb into my brain.

Nothing wrong with your article.

Stack Exchange

20:25

Blog - Stack Exchange: Stack Exchange API V2.0 Contest Winners

Kevin Montrose on April 10, 2012

About six months ago we began work in earnest on the second version of the Stack Exchange API. A few months later, after a short private beta, we opened up a public beta with tantalizing prizes.

Now it’s time to announce the winners.

An Android app by Karan M, supporting all non-meta Stack Exchange sites and a view into your inbox.

Karan will be getting an iPad 2 the new iPad.

This open source app by Greg Hewgill drops your new inbox items into OS X’s menu bar.

Greg will be getting an Acer Aspire One. …

Rory Alsop

22:19

@JeffFerland ping back :-)

Iszi

@RoryAlsop I think he may have been referring to our continued lack of real migration options.

Rory Alsop

ahhh - yep, still don't know whether there will be a due date on these. We brng it up reasonably regularly in the Teachers Lounge, but I'm guessing that until the numbers are higher it is relatively easy to just flag it for a mod and we'll ping it over

Gilles

@RoryAlsop how many do you get?

Until it's several per day, you won't get a migration path

Rory Alsop

@Gilles nah - a handful a week, or month

:-)

we're only small, still

Scott Pack

22:53

Or it seems like our people seem to have a reasonable understanding of what's acceptable

Hendrik Brummermann

23:18

@RoryAlsop, the recent blog post says "Well that’s good for them but they forget that often, if you do not explicitly state https for the facebook login page, your password and username is sent PLAIN TEXT over the internet. "

This is wrong. Even on http://www.facebook.com the form points to https. So unless an attacker manipulates the html-code, the credentials are not sent in plain text.

It is still a bad idea to use the http variant, obviouisly.

Jeff Ferland

23:34

@RoryAlsop Have a related contact I wanted to ask you about... accounting manager at Sonian

Transcript for