The DMZ

nealmcb

03:45

. o O (hope the bed bugs aren't biting :)

packs

12:38

@nealmcb After the papers got over themselves, we found out that it was only a single dorm room, and that it was only a single bedbug. Thanks guys.

Iszi

13:14

Mornin' all.

packs

13:51

@Iszi Morning sunshine

packs

16:53

I know we've been trying to get rid of unnecessary tags, but last night I was thinking about all those questions that come down to hardening various and sundry apps/OSes.

Would anyone be offended if I created a [hardening] tag and added it to all those?

Iszi

17:04

@packs Hmmm... Wonder if we should break that apart?

packs

17:26

@Iszi How do you mean?

Iszi

17:36

@packs [os-hardening] [application-hardening] [website-hardening] etc?

packs

@Iszi See, that's what happens when I have a notion and don't bother to look it up.

I'm wondering if they should be merged

Do we get any benefit from them being split up?

Iszi

@packs You're wondering if they should be merged, and I'm suggesting they be split?

@packs I'm a fan of specificity myself.

packs

@Iszi You would be!

Iszi

@packs What's that supposed to mean?

packs

I'm just being unnecessarily vaguely accusatory.

Iszi

17:40

@packs Heh... Try saying that out loud.

packs

Sounds fine in my voice. I best that sounds fantastic if spoken by one of Alabama or north-east Georgian extraction.

Iszi

@packs Heh... Even a slight Floridian drawl makes it fairly interesting, I think.

packs

Does Florida have it's own accent? Unfortunately, my experience has been primarily with snowbirds and retirees.

nealmcb

@Iszi Offhand I think tags are more useful if they express one thing. folks can search for windows hardening or web-application hardening if they want more specificity

so just "hardening" makes sense

but it doesn't look like any of those are there now

packs

Hey, @RoryAlsop and/or @AviD! Take a look slightly up and tell us what you think of the tag chat.

nealmcb

17:57

Or perhaps just "harden"

on third though, nah - follow Wikipedia with "hardening": en.wikipedia.org/wiki/Hardening_(computing)

Feh - how to keep SE chat from being too clever in ripping off the trailing ")" in that url?

Iszi

@nealmcb I could see it getting annoying if/when people start hitting the 5-tag cap. Though, I rarely have seen that actually happen.

@packs Natives do, a bit. But we're a hard folk to come across these days.

Argh... LMGTFY bait...

0

Q: Malware nomenclature

If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like? If one exists could someone explain it or link to an explaination?

packs

18:18

Well, that's the great thing about standards. You have plenty to choose from.

nealmcb

@Iszi I think these are fine questions, with the goal of having google eventually reference our site for the definitive answer :)

Iszi

18:34

@nealmcb I think they're generally regarded as low quality - pretty sure they're mentioned in the FAQ somewhere.

I'm half-tempted to downvote it myself as a "no effort expended" question.

packs

19:08

Can one downvote themselves? I know one cannot upvote themselves.

Iszi

@packs Never tried it... dare I ask why?

packs

Early on in my use of the site I wondered, so I tried it. They had thought of that situation and addressed it already, so good for them.

Iszi

19:30

@packs You tried downvoting yourself?

packs

Negative, I tried upvoting. But I'll try the other one now

Nope

Iszi

19:44

@RoryAlsop RE: This thread...

2

Q: Virus blocking incoming connections ?

Hello, on my windows 2003 server, all incoming connections are dropped. I can see them getting in using Wireshark, but even a single ping from another computer fails. All locally initiated connection work fine (i'm asking from the server). This server is the DC/DHCP/DNS/File server, so computer c...

windows-server-2003 networking virus

Why wasn't it closed as migrated? It's still its own (albeit dead) question here. Can it either be linked to the SF question, or deleted?

packs

Also, sorry about kicking off that shitstorm/pissing match. Seems like I mis-interpreted that question.

Iszi

@packs Huh?

packs

Well, I flagged the question as a migration candidate. Reading those comments, then the corresponding meta.sf thread, there were definitely some strong feelings about the whole thing :)

Iszi

@packs Oh, I see. Didn't know there was a Meta thread about it. Wow.

packs

19:59

@Iszi Yeah.... Personally, I feel the whole thing was a big overblown, but hey. I'm willing to accept fault for making a bad call.

I got a quorum badge out of it, though.

Rory Alsop

20:13

Evening all

packs

@RoryAlsop Howdo

Rory Alsop

@Iszi Hmmm - clicked on close as migrated so it should have done

oh - I see what you mean

Ah - that's what I did - it has already been migrated, so I didn't want to duplicate

packs

I think he got confused because it is, for all intents and purposes, a migration, but because of the way things happened it displays as a stub.

Iszi

@RoryAlsop Could we get the stub pruned?

Rory Alsop

@Iszi Erm - if you let me know what that means then yes, I'm sure we can :-)

do you mean just remove the entry from here entirely

?

Iszi

20:24

@RoryAlsop Yeah, delete the question.

Locked questions with no answers are of no value to us, IMHO.

Rory Alsop

yup - done - locked questions with no answers and no reason for being here are definitely of no value

packs

One could make that argument about most closed questions. If they were deemed closeworthy, then are they necessarily useful to keep around at all?

Rory Alsop

I think if there are answers which are useful despite the question being crap/offtopic etc then we should just close and keep

packs

@RoryAlsop I would classify those under the set of ALL-MOST :)

Rory Alsop

@packs LOL

Iszi

20:27

And they serve as warnings to others with similar questions.... kinda like pirates hang the corpses of would-be invaders outside their forts or such.

Rory Alsop

@Iszi - now that is an image I like

packs

Also, @RoryAlsop, sorry if that question caused any issues for you. It seemed to have ruffled quite a few feathers.

@RoryAlsop It figures that you would be all into that, imperial bastard!

Rory Alsop

@packs - I don't think it caused me any issues? Must go and check the meta thread to find out

have you got a link to it?

packs

If you don't know, then it didn't. I wasn't sure how much back-channel chatter goes on amongst the mods in the various units.

3

Q: Moving questions

Is there a set of guidelines about where questions get migrated to and when and why? I recently noticed a question that got moved (228792) to a stackexchange site. My thoughts were: Seriously? - we need to move questions about windows firewalls/virus activity to a security stackexchange? wh...

discussion feature-request

Iszi

@packs Although this particular instance may not have been exemplary, shouldn't we want firewall and virus questions here?

packs

20:32

@Iszi I think it depends a lot on the context, but those kinds of things do definitely fall into our (armed?) camp.

To use my work as an example. We (the information security office) does not manage the firewalls, that sits in the networks department. We do, however, have extreme oversight in their design and implementation. Moreover, we have to approve all config changes.

The virus thing works similarly. We have a few incident response procedures (depending on what kind of incident) but the base assumption is that, "All incidents are security incidents until the security office decides that they are not."

Now, granted, 90% of the time that's a 10-30 second decision, but in the event of a suspected virus infection of a core infrastructure system, well, it may be in our court for a few days or a week before it moves on to standard 'Loss of Service Incident'

Rory Alsop

@packs - just had a check on Teachers, and there wasn't much talk about it there either.

packs

@RoryAlsop ?

Rory Alsop

Teachers Lounge - the mod chat room

packs

Oh, that's what that is. I've heard you and Avi mention it before.

Good. I already issued my mea culpa, I just would have felt bad if anything fell on you.

Rory Alsop

Is remarkably similar to here, although last night Avi and I hijacked it for culinary discussion re peacocks and turkeys, and their relative merits

packs

20:38

Nice

Rory Alsop

@packs - no worries. In looking at that SF meta chat, I think some folks were just a bit highly strung

packs

That was my feeling as well.

I've noticed that the Comms Room tends to be more site on-topic than we are here, but that might also be the difference in working environments.

My boss definitely encourages us to take some down time whenever we feel it necessary, so long as we got our work done.

Rory Alsop

I think once numbers increase a bit noise goes down too, as otherwise the chat would fill

packs

The idea being that if we get burned out working had all day, then when the cops walk up with a big case we'll just go nuts.

True as well. There are quite a lot more over there.

Rory Alsop

Yeah - I got dragged into an incident response which led to me and the client doing 90 hour weeks all December, then followup work for the next 9 months

packs

20:40

ugh

Was it at least an interesting case?

Rory Alsop

And that wasn't even arranged as a 'go to court' - it was just firefight/contain and understand

quite interesting yes

atlanta.fbi.gov/dojpressrel/pressrel09/atl111009.htm

packs

I actually prefer those, to be honest. So far, I've only managed to get subpoenaed once, and I was relieved that it settled before my date.

Oo..multi-national operation. Keen.

Rory Alsop

Aye - I ran a team in 18 countries delivering on that one

really good fun

but felt so burned out at the end of it

packs

I bet

No mention of your name in there, though. Too bad.

Because of the scope of my work we tend towards things such as child porn and various forms of fraud. The latter can be interesting, but nothing really grand in scope.

Rory Alsop

LOL - sadly no, I can't even use it as a reference now I've left the organisation :-(

The day I get back from the B-Sides I'm hosting an event that the Lothian and Borders Serious Fraud Squad are talking at - they have some great stories

packs

20:47

Too bad. At least you got the experience.

Well, as interesting a story as auditors usually tell :)

Rory Alsop

hahaha

I spent so long persuading people that working for an audit and accountancy firm didn't have to make you boring

packs

That's true. You are not necessarily boring, but it sure doesn't hurt....

Internal Audit is actually one of our biggest clients. All of them are real nice people, but they're all from an accounting background.

Rory Alsop

well that's where the core of that industry comes from - the Big 4 accountancy firms

packs

No kidding

Rory Alsop

that's about 700,000 people worldwide

packs

20:54

On an unrelated topic, do you have any opinion on the hardening tags we were discussing?

nealmcb

@packs Can you give a reference to the questions and discussions you're referring to?

Rory Alsop

@nealmcb - it was migrated here kind of by mistake. It was sorted at the SF end, so I then closed and deleted the Q here

you may not be able to see it any more (not sure what rep level you might need, or maybe mod privs to see deleted questions)

Right - kids all in bed and asleep. Time for food! (@AviD - not necessarily peacock or wildebeest)

nealmcb

@RoryAlsop well, a reference on SF would be fine...

packs

@nealmcb Here is the meta discussion

3

Q: Moving questions

Is there a set of guidelines about where questions get migrated to and when and why? I recently noticed a question that got moved (228792) to a stackexchange site. My thoughts were: Seriously? - we need to move questions about windows firewalls/virus activity to a security stackexchange? wh...

discussion feature-request

And the question on SF

2

Q: Virus blocking incoming connections?

On my Windows Server 2003 server, all incoming connections are dropped. I can see them getting in using Wireshark, but even a single ping from another computer fails. All locally initiated connection work fine (I'm asking from the server). This server is the DC/DHCP/DNS/File server, so computer ...

windows-server-2003 networking virus

nealmcb

@packs Thanks - I saw that but was confused since there wasn't much discussion on this end. You were referring to the discussion at SF....

packs

20:58

@nealmcb Oh, sorry. There were a fistful of comments on the question on this end, but Rory executed the question.

Rory Alsop

it was a mercy killing

I am going for dinner - really

packs

Wait, you have a 10 year old in bed at 9? Wow. WTG

Rory Alsop

He is the easiest, then my 4 year old and finally the precocious 8 year old

@nealmcb - quick comment summary:

nealmcb

@packs I really like the way we can link one chat line to others that it refers to. Nice dynamic highlighting etc. So I'll link this one to that original one. But I guess I can only link to one message at a time.... So here I'll just refer up a few messages in the history to the messages @packs referenced.....

Rory Alsop

WTF? I can't even tell on SF who moved it or why – Jim B yesterday edit
Yeah - don't see this as likely to be a security issue. Much more likely to be network driver or config issue. Can't imagine a virus/worm wanting to destroy its network connection :-) – Rory Alsop♦ yesterday edit
@jim At SF it says it was moved by serverfault.com/users/45/splattne Who can move it back, and what is the protocol for doing so? – nealmcb 23 hours ago edit
Can i get my question back to serverfault please ? – Benoît 3 hours ago edit

nealmcb

21:03

@RoryAlsop Thanks for the "for the record"..... Anyone know how/whether chat is archived or searchable?

packs

At least some of that information is in the info page

chat.stackexchange.com/rooms/info/151/it-security

Rory Alsop

@nealmcb - yes, it is archived and searchable - don't know about the hows and wherefore's. I have often gone back to much older chats referenced by mentions of @roryalsop so the archive definitely exists

packs

You guys want this over here?

0

Q: grsecurity effieffectiveness test with latest proftpd remote exploit

hi. i just tested grsecurity. i installed debian and a vulnerable version of proftpd. i launched an exploit. worked. patched the latest kernel with grsec. and now the exploit doesnt work anymore. BUT . wouldnt just a the new kernel alone cause the exploit to fail? the exploit was only for debian ...

proftpd exploit grsec

Rory Alsop

@packs - I dunno. Can we get spelling fixed on the way :-)

packs

No kidding

Rory Alsop

21:13

I think it is appropriate here - definite yes

packs

I'm feeling a bit trigger shy now :)

Rory Alsop

Hahaha - I'll add a comment there to think about sending it over (I don't have enough rep there)

packs

security.se is not one of the migration paths offered for the vote-to-close crowd

Only a mod can migrate it here

Rory Alsop

yeah

packs

I flagged is as such

Rory Alsop

21:16

I couldn't figure out how to flag it so just commented on it

packs

21:43

@RoryAlsop The trick is to click on the link that says 'flag' and type something :)

Gorramit! Who in their right mind decided that calling me at 4:30 was a good idea?

Rory Alsop

21:57

@packs Is this you stuck there for a while then?

packs

@RoryAlsop It just means I'm working harder during my last half hour than I prefer.

Due to traffic, if I don't leave by 5:10 then I won't get to the school in time to pick up the little one.

Granted, one of her teachers will stick around until I get there, but after a few times they start adding charges to the bill.

Rory Alsop

@packs Aye - prioritisation! That is one of the best things about my new job - I am now involved in teh school run, dinner time and I even got to see the kids nativity plays this year

my first ever

packs

Moreover, I know how much I want to be home after work, so I don't want to keep them if I don't have to.

Rory Alsop

!

yeah - good call

packs

Funk that. Work is work, being a good child is better. They already get more than their 40 hours, so if I leave something unfinished on an afternoon, I'm not too worried.

Rory Alsop

22:01

@packs - well, go - be off with you. School run! Catch you later!

:-)

packs

Yeah, I can't wait until she's older and can walk home, that will be another 4-5 years at least :(

ta

Transcript for