The DMZ

Iszi

03:27

S&M...

0

What are some inspirational videos for the computer security community such as this video L0pth ? I personally find it inspirational, and admire this guys. If anybody feels the same ways and know of more videos that want to share with IT security please let us know.

known-vulnerabilities

Stack Exchange

04:13

I hate when I read something like '... tension among the BASE jumpers nearly led to wingsuit combat ...', and I get excited because 'wingsuit combat' is underlined, only to find that it's just separate links to the 'wingsuit' and 'combat' articles.

Stack Exchange

12:25

Stack Exchange Security Blog: QotW #26: Malicious QR Code and Mitigation

roryalsop on May 04, 2012

This week’s Question of the Week was asked by Purge back in February. His concern has been echoed in various publications – the worry that scanning one of the common QR codes you see in magazine adverts and on billboards could cause something malicious to happen as most QR scanners on smartphones take you straight to the URL encoded in the QR image. This isn’t a malicious QR (unless you count linking to a particular genre of music malicious) but how would you know?

logicalscope pointed out that a QR code was simply an encoding, so anything you could put in a URL could be encoded in a QR code. This could include XSS, SQL Injection or any other URL based attack. …

Iszi

13:02

@StackExchange @RoryAlsop A little shameless self-advertising there, eh?

Rory Alsop

heh -you spotted what I did there, yes :-)

I had that one lying around and thought - it looks malicious but isn't

Perfect for this

:-)

Iszi

Should have thrown in the Sec.SE QR somewhere.

Rory Alsop

@Iszi is that the one you did? What day was that - can edit it in no problem

Iszi

@RoryAlsop I see it on the bottom of the star stack to the right.

Rory Alsop

brilliant - I knew the stars were useful :-)

2

Iszi

13:06

Bah. Just bumped it off my sidebar. Dunno if yours has more.

Rory Alsop

I got it in time

it's those 404 comments that I blame :-)

@StackExchange And of course it's time to start thinking about:

0

Q: Vote for your question of the week #27

For QOTW #27, scheduled for publishing to the Security Stack Exchange Blog on 11 May, please post as Answers, and vote for your favorite question from the whole Security Stackexchange site. Please post any question that you feel is of worth and the reason why as an answer below. Try not to promo...

discussion featured blog qotw

I may not be online at all next week - not sure of connectivity in the highlands, so may not be able to do anything Blog-wise

AviD

13:25

@Iszi @RoryAlsop very nice post. the sec.se qr also highlights the double-indirection problem...

Rory Alsop

@AviD :-)

which would you trust more - the goo.gl shortened one, or the one with a scary mask in the middle

heh

AviD

@RoryAlsop see, my phone has a built in qr reader, that follows your recommendation - it displays the URL, and doesnt take you there until you click it. Of course, the goo.gl blocks that....

Rory Alsop

do you think I should have split that out explicitly? I mentioned that any normal URL attack can work with QR, but didn't mention this one...

@nealmcb - you might be interested in this question:

0

Q: Voting System, is there a hole here?

I had this idea a few years ago and improved it today as I notice a hole or two. I believe I have the system down right but If there was a hole the first time there may be a hole this time. I believe the below will have a voter voting anonymously and impossible to tamper with unless the party han...

encryption authentication

although it does look a bit like a 'check my code' question...

AviD

@RoryAlsop you mean the goo.gl issue? naw, can leave that as an easter egg ;-)

Rory Alsop

lol

AviD

13:31

besides, its off topic of QR, but it does show that its not really all that different...

and seriously, Windows Phone does indeed rock.

the meta.so thread on disclosure is getting even more interesting....

i made the mistake of commenting on meta.so... :-(

@RoryAlsop just a bit?

Rory Alsop

@AviD :-) ... /me scurries off to take a look

Iszi

Pretty cool looking Kickstarter project here. kickstarter.com/projects/1058059772/… Found it via ComputerWorld, which had this suggestion for an application: "One example given is a bicyclist who threads the lights through his jacket: They light up based on hand gestures to indicate turn signals, improving visibility to and communication with motorists."

@AviD @RoryAlsop Where's that disclosure thread again?

Rory Alsop

8

A: How much influence should an external site/entity have over the questions on a Stack Exchange site?

As a security professional with over 16 years in the field, and in my role as Chairman of the Scottish branch of the Institute of Information Security Professionals and the President of ISACA Scotland, as well as being one of the moderators over on our very own Security Stack Exchange, I thought ...

well, that's my answer :-)

scroll up a bit for the interesting stuff

AviD

@Iszi all the fighting is going on at casper's post.

Rory Alsop

I like Fabian's point - it's up to the Drupal SE. And over there it looks like they have taken the decision to delay posting the question (or temporarily deleting it) until the drupal team have a chance to respond

Scott Pack

13:40

@RoryAlsop Same here. We've got an siem engineer on site most of next week.

Rory Alsop

@AviD - did you see the original post on drupal se:

4

Q: better tools for dealing with questions that disclose security issues

The Drupal project encourages security researchers to follow responsible disclosure and this usually works. Sometimes, though, people will post a security issue to the support forum or the public issue queue or whatever. Now that Drupal.SE exists people post questions or vulnerabilities here, som...

feature-request

I may have caused trouble

AviD

@RoryAlsop nice.

i was considering registering on drupal just to upvote your comments, but I couldnt be bothered.

Rory Alsop

heh

AviD

@RoryAlsop i like how you got casper to be very clear about his position: I dont give a damn about ethics.

then again, he didnt seem shy about that.

made the mistake of adding another comment - but I just had to call him out on that.

Rory Alsop

@AviD - I couldn't think of an answer, but you may have played with different tools:

3

Q: Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however it only does black box scanning for IIS and fails to detect SQL injections in certain scenarios. ...

asp.net sql sql-server security sql-injection

@AviD and he's come back atcha

AviD

13:55

@RoryAlsop and back.

seriously, I have to learn my lesson and just shaddap.

Rory Alsop

LOL - but there's someone wrong on the internet!!

Scott Pack

So, am I being a little short here, or is that guy a qock?

Rory Alsop

:-)

we just got this one over from UX stack exchange - I think the q needs work, but the core of it is probably on topic:

1

Q: Why does Paypal send TWO verification payments not just ONE?

The process would be easier if there was only one payment, but there must be some security or financial reason for Paypal to send you two random payments

financial

Scott Pack

Although, I suppose I shouldn't be so closed minded. Both are entirely possible.

Iszi

@RoryAlsop Do we have a thread on responsible disclosure already? I thought we did. Does it cover the security tradeoff - the possibility that not disclosing to the public will mean only black hats who have independently discovered the vulnerability will have knowledge of it, and white hats will not have awareness necessary to build defenses.

@RoryAlsop I think you meant to do...

What do you want me to do? LEAVE? Then they'll keep being wrong!

AviD

14:02

@RoryAlsop exactly.

Rory Alsop

@Iszi ah yes, one-box wins over copy of image

AviD

@RoryAlsop I actually do, but I flagged it to come here first.

theres a new batch of "hybrid testing" tools, though I cant vouch for their quality.

IBM is talking about "glass box" testing a lot, in that space - but apparently its vapor ware for them.

@Iszi rory linked to one of them in his answer.

Iszi

@RoryAlsop You seen Casper's response to you over on Meta.Drupal.SE? He does have something of a point there, with regards to 10k users. Drupal Answers doesn't have many, but the trilogy sites (of which, Stack Overflow is probably most likely to have similar issues) have quite a bunch.

AviD

okay, I'm tired of this. anyone else want to step in?

@AviD As a moderator on a Stack Exchange site, other site's security and vulnerability is not my concern (as a moderator, not as a person, that view is irrelevant). My concern about quality information and censorship of content on Stack Exchange overrides my concern for third-party software/sites issues. Again, as a moderator. — casperOne 3 mins ago

@Iszi hmm, his last comment there is actually a good point.

regarding the 10k, I dont buy that, because I think these should be special-case available for moderators only.

Iszi

@AviD Aren't all deleted posts available to 10k users, unless SEI does their own nuke from orbit?

Rory Alsop

14:15

@Iszi I think that is right

Iszi

By the way, I just counted... Stack Overflow has more than 2300 10k+ users!

AviD

@Iszi I believe so, but I was talking about a special case for irresponsible disclosure...

@LadybugKiller Feature request! make a question "private" (mod-only), not deleted. Would be easier to set to reopen... perhaps the "private question" feature could even automatically timeout after X days... — AviD yesterday

Iszi

@AviD I'd jump in and suggest that the removal of "private question" status not be automated, and be contingent upon some evidence that the vendor has been notified. But, I don't feel like stirring the pot any more. Plus, enforcement could be a messy ad-hoc process.

AviD

@Iszi I agree about the possibility of automation, that shouldnt be the default. and I never suggested enforcement, but rather tools to support moderators handling this properly.

Iszi

@AviD I meant enforcing that something be closed until moderators receive confirmation that the issue has been submitted to (and, ideally, acknowledged by) the vendor.

If SE were to come to a consensus that we should be in the business of enforcing responsible disclosure, and SEI were to give us mechanisms to facilitate that, I'd say un-locking such questions should require at least the concurrence of two moderators.

<ADD> I really wish my chat rep was actually my site rep somewhere. Preferably here. That'd be cool. Otherwise, it's just a tease.</ADD>

AviD

14:27

@Iszi highly unlikely.

@Iszi heh. how much of it is the 100 free rep on new sites where you dont do anything?

Iszi

@AviD I wouldn't be surprised if it was nearly as much as the non-free rep. [Goes to look.]

Why isn't the accounts page where it used to be? I hate when they move stuff like that.

Seems I have <200 rep on 19 sites.

Oh, not as big a portion as I thought. Only about 10% of my network rep is from sites where I have <200.

AviD

@Iszi SOMEBODY MOVED MY CHEESE!!

3

Iszi

I've only got >1k on 6 sites (including Meta Stack Overflow), and the remainder of my network rep totals to 4,181.

AviD

oh man, stackexchange jumped the shark! they had a perfect game going, now they ruined it all!

Bruno

I'm not sure I'd see the point of private questions. Who would answer them? If they're only visible to the moderators, I'm not sure they'd also necessarily be the best people to answer or make a judgement as to whether this is about an actual vulnerability.

AviD

14:35

collegehumor.com/video/6671247/jake-and-amir-facebook-design

@Bruno they're not meant to be answered.

its like deletion, but special case - less visible and temporary.

Bruno

Ah, this would make sense.

Iszi

@Bruno In the case of this website, I think our moderators mostly have enough appropriate background to recognize what's a security vulnerability and what's not. The real trick will be figuring out whether or not it's a yet-undisclosed zero-day vulnerability. And for both of those factors, I'm sure we've got at least a few reputable users who have the appropriate knowledge and skills to assist the moderators in making an appropriate determination.

Bruno

Yes, I agree, I'm not sure this is the case on other SE sites.

Iszi

@Bruno On the other sites where vulnerabilities are likely to be posted, the case should be the same. Especially for a place like Stack Overflow where there's (presumably, based on reputation) so many experienced professionals.

Now, I certainly wouldn't be asking the moderators or community at Role-playing Games to be making these decisions...

Rory Alsop

@Iszi heh - but really, such a question might be offtopic over there - you could get it migrated here :-)

Bruno

14:41

Having been on SO for a while, it seems that the "value" of reputation varies.

Iszi

@RoryAlsop Could you imagine if the question were on-topic? I think that's one of the few sites that could make such a stretch.

@Bruno I'm sure that, among the 2k+ users with 10k+ rep, you could find enough who know what they're doing to support the system.

AviD

@Iszi oh wow. A Security Professional Role Playing Game.

Bruno

@RoryAlsop something like what flaw in your PRNG dice throws will allow your enemy to predict your moves?

AviD

"Hax0rs and Dragons"!!

Iszi

@AviD Nah, I was thinking more of existing RPGs set in the future where characters are allowed to hack. But that'd be cool, too.

AviD

14:44

@Iszi allowed to hack the game? Crazy.

so, rules are rules only as much as you dont know how to break them?

Iszi

@AviD Not the game. The PCs are hackers.

I could see someone trying to bring a real-world exploit into an RPG there.

AviD

@Iszi ahh. mine's better.

@Iszi interesting.... "I cast SQL Injection!" ... "Roll D20."

Iszi

@AviD Okay, but the rules are still rules if someone else knows how to keep you from breaking them - otherwise, we just have anarchy.

AviD

@Iszi so, kinda like real life? Wild.

Iszi

Unrelated...

AviD

14:47

hehe

glad my new house will be fully wired, but will still need to figure that out for smartphones (and guests)

Iszi

Oooooh. Totally just got a new product idea!

Ethernet adapter for smartphones, with PoE!

Even better: Ethernet-to-microUSB adapter with PoE!

AviD

@Iszi excellent. I would buy at least a couple of those.

Iszi

...oh, and Ethernet-to-iDock for the iDevices that just have to be special.

@AviD Know who'd be more likely to use it than the general consumer market? Pentesters, I bet.

AviD

i bought a couple of smartphones for my kids, but no 3g plan. so they can only access those magic internet bits from my own wireless....

@Iszi excellent, go kickstarter it up. I'll be your first signup.

Iszi

@AviD I wouldn't know where to begin to start on that. No programming or EE background to speak of.

I imagine the biggest hinderance would be getting the smartphone to accept the microUSB or iDock as an avenue for Internet access.

AviD

14:54

@Iszi that shouldnt stop you, millions of VC dollars have been raised on less than that.

Iszi

Looks like I'm not the first to think of it...

encrypted.google.com/search?&q=ethernet%20to%20microusb

AviD

@Iszi oo cool

Iszi

Come to think, I wonder if PoE and microUSB can even be made compatible?

Bruno

PoE tends to be 24V or 48V, isn't it? That wouldn't work too well with a USB port, I think.

Although you would always take split the power first and reduce the voltage, before re-powering via USB.

Iszi

I really don't imagine a home user market for it at all, the more I think about it. Sure, there's going to be your geeks that'll want one or two but most home users will prefer to put their smart-devices on wireless than bind them to a jack. But pentesters and network engineers would have a field day with it - especially if it came with Android/iOS network analysis apps.

AviD

15:05

@Iszi i like the pentester aspect... but for home markets, what about all those with the smartphones with a non-wireless house?

Iszi

@AviD I have a hard time imagining a non-wireless house these days. And I expect the product price would be not far from that of an el-cheapo wireless SOHO router.

AviD

yeah, I guess thats true

Iszi

15:47

Know what's really annoying? When a program has an auto-update feature - I mean it really can do updates itself, when it detects that they are available - but the "Check for Updates" button just points you to the product site.

In this case, I'm talking about Flash.

More frustration: The page shows what version you have installed, and what versions are available, but doesn't have any direct download links for updates. Whose genius idea was this?

David

16:42

Is CompTIA Security+ not a well-respected certification in IT Security?

Going through the various certification posts, I don't see it mentioned at all

Iszi

17:08

@David It's very entry-level, just like A+ and Network+.

David

yeah

i skipped over any certs with the part-time jobs ive had

(not in security)

makerofthings7

Does anyone have a recommendation for a Password cracker for Office Documents?

Or would this be on topic for Sec.SE?

My intent is whitehat, but am always conflicted when posting things on Sec.SE that could be used for either purpose...

Iszi

@makerofthings7 Also, it would fit "product recommendation" which is off-topic for any SE.

Rory Alsop

18:17

@makerofthings7 however, here in chat we can discuss it :-) Elcomsoft seem to have a good share of the market here. YMMV

Iszi

@RoryAlsop Wow. That's some damn expensive software.

elcomsoft.com/eprb.html

Rory Alsop

@Iszi oh - they have obviously realised the value of their product. It used to be incredibly cheap

that cost is obviously just to raise the bar above the casual hacker

Iszi

@RoryAlsop That cost is for the full bundle of their products. The Office cracker alone is $50 for "home users".

Scott Pack

Oh, hey @David

Iszi

Everything's running smooth for today's launch, scheduled in 12 minutes. spaceflightnow.com/atlas/av031/status.html

David

18:30

hi @ScottPack

Scott Pack

@David Did you manage to get any useful commentary from us?

David

ionno lol

If you remember me mentioning internship w/ Northrop Grumman

they phone interviewed me @ 1030am on a saturday

and i totally bombed it

Scott Pack

18:48

Ouch

David

sounded like an idiot lol

it was totally unexpected

the questions were quite simple, looking back

nealmcb

@RoryAlsop Howdy! Thanks. But that's a question for crypto, if anywhere.

David

i just didnt know how to explain them to a person verbally

Scott Pack

@David It happens. That's, unfortunately, only something that really comes with practice.

David

yeah

@ScottPack possibly could have done better if i had not just woken up and if i knew there was going to be a technical interview!

Iszi

19:13

@David Nasty trick with those phone interviews there... making sure you're awake.

David

@Iszi the whole call was totally unexpected

who works...on a saturday...?!

Scott Pack

It's true that I've only ever served on search committees for technical jobs, but if there was a phone interview it was pretty much always a technical quiz.

@David I have to assume private industry.

David

I guess

the job sounded boring, but hey free security clearance!

Iszi

@David Oh, yeah. Missed that bit. I guess they wanted to test your ability to respond to an on-call event?

David

@Iszi no, it was just a technical quiz

asked stuff like MAC vs IP, DHCP, DNS

about some class i took 3 years ago that i couldnt remember which class it was

Iszi

19:19

@David Right... testing your cognitive function at a time when you're generally un-prepared. Sounds like a good way to test your potential on-call performance to me.

A little rude, perhaps, but good.

David

ionno, it was the first contact with them

they siad the job was monitoring the Marines network

for suspicious activity

and he said it was boring lol

well, implied

Rory Alsop

21:19

more suitable for crypto?:

3

Q: Wiener's attack on RSA

I have a challenge about RSA: Using small keys improves performance. However, it has been shown (Wiener, 1990) that if d<=0.25 log(N), the private exponent d can be reconstructed from the public key (N,e). Smart, Inc. uses special private keys designed such that they are: Larger than the mi...

untagged

ah - @Ninefingers - just saw your comment

@Ninefingers - but do you want this one? Already flagged for move to crypto:

2

Q: Voting System, is there a hole here?

I had this idea a few years ago and improved it today as I notice a hole or two. I believe I have the system down right but If there was a hole the first time there may be a hole this time. I believe the below will have a voter voting anonymously and impossible to tamper with unless the party han...

encryption authentication

Ninefingers

@RoryAlsop On the first one, I think so. On the second... don't really know. Electronic voting is more bitcoin-y if you see what I mean, further out than the crypto crypto crypto normally deals with. In short, I do not know and anyone with an opinion either way, please share!

Gilles

@Ninefingers I think topically it's ok on either (but crypto.se does lean towards the mathier crypto), but I'm not sure it's ok for SE. I couldn't find the courage to read it through.

Ninefingers

@Gilles That's partly why I'm delegating saying either way. It's the end of the week, 10.30pm here. I'm not safe behind the mod tools!

Rory Alsop

@Ninefingers :-)

@AviD and I did discuss, briefly, the fact it seemed to be a 'help review my code' kind of question

I guess we can watch for votes/flags on it

Iszi

21:35

So tempted to just troll this thread...

0

Q: What data should be logged?

Imagine having a web application. You then decide that you want to create your own logging system, for whatever reason. What data should be logged to put a very good logging system in place? I was thinking about the following: Date and time of access for every user User IP Number of consequent...

logging

With this...

Gilles

@RoryAlsop someone's answered it. I'm reluctant to NaRQ-close an answered question

Iszi

Rory Alsop

@Iszi YESSS! Hahahaha

Iszi

@RoryAlsop Wait... is that... MODERATOR APPROVAL? [evil grin]

Rory Alsop

(I ain't seen or heard nuffink, awright... :-)

Iszi

21:38

Ok. Time to start the weekend, now. L8rz!

Rory Alsop

@Iszi Cya

Transcript for