The DMZ - 2011-02-03

« first day (49 days earlier) ← previous day next day → last day (4819 days later) »

5:58 AM

@RoryAlsop @RoryAlsop Note that back in the days of Empire, GMT meant UTC-12 (aka GMAT) to astronomers.

3 hours later…

8:55 AM

@Iszi when you happen to be here... wanted to discuss your toctou question...

3

Q: How can TOCTTOU vulnerabilities within the Windows OS be mitigated?

What are some ways to mitigate the time-of-check-to-time-of-use issues that apply to Windows permissions? Example: End-user is added to the local Administrators group in order to install software, printers, etc. The user's account is removed from the Administrators group while the user is logg...

windows tocttou

@nealmcb All the info I can find defines GMT as the time at the Greenwich Meridian, which obviously pops through London. Where did you get the UTC-12 ref?

and morning @AviD

3 hours later…

11:33 AM

busy in here, then

Looks like this question hasn't got any better recently, so I'm thinking of closing it.

0

Q: How can ensure that the user changes the default password?

One way I have read about is, to have a default password which says the"admin'sname"rocks sort of a password. Most users change that. Can you think of anything else?

passwords password-management

12:26 PM

@GrahamLee I find that rather unfortunate. I see the potential for it to actually be a useful question to have on the site.

Clarification: I find it unfortunate that it hasn't gotten any better, not that you are thinking of closing it.

yeah

mind you, it's only been a day, maybe I should give @thunderror more time to respond.

1 hour later…

1:39 PM

@nealmcb I just saw the comment you posted to my answer about reporting abuses to the IP range contact over on SF. Wow. That's a big honkin question you asked in such as small place :)

1:58 PM

Mornin' all.

@AviD Tag, you're it.

@GrahamLee I'm not in disagreement.

2:23 PM

:)

2:33 PM

@Iszi Good Morning Sunshine

@packs Yeah - I guess so. The eternal optimist here.... serverfault.com/questions/228546/…

I think that would be a pretty epic question for the security site.

@RoryAlsop Heh - funny you should ask - I did find myself compelled to make sure Wikipedia had all the right info before responding to you :) en.wikipedia.org/wiki/Greenwich_Mean_Time

Short answer, no, I don't know of any, and I think it might be best as a mixture of business practice and tech. I also think there would be a number of different answers, and types of answers, on that one.

And I would love to see what everyone had to say :)

2:55 PM

0

Q: Tools to identify and report hacking attempts from inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Who regularly reports hacking attempts from inside the networks of reputable organizations (e.g. within a university)? What tools exist to help identify such attacks and make such reports? Identifying the sorts of abuse that are useful to ...

tools ids reports

@packs Look good?

I like it

I'll try and get something together to contribute. Too many damned projects going on!

in The Comms Room, 6 mins ago, by Murali Suriar

http://www.nro.net/news/icann-nro-live-stream <- ICANN/NRO press conference about v4 'exhaustion', for those who are interested.

3:12 PM

@packs Anyone else having problems with that stream?

Let me pull it up and see

Not so far.

Feedback is a bitch

Gosh, it's horrible for me.

I wonder if the stream is available somewhere else.

There are a couple of different streams down below

@packs Ah, indeed. Thanks.

Hehe... "and their fridges..."

Still stuttering for me on the low-bandwidth connection.

Not quite so bad though.

I wonder if they're using a cdn

inspects

3:17 PM

Love his accent - "et-see-ter-ah"

Looks like it's being hosted by Merit Networks up in Ann Arbor, but their domain name is an edu. I'm probably getting it over the I2, so likely network congestion instead of server overload

@packs Is there a hashtag for commentary?

@nealmcb hashtag?

3:39 PM

lmgtfy.com/?q=hashtag

Ah, twitter.

I haven't gotten into that yet

@nealmcb boo!

Rude - seems like se rewrites "lmgtfy" as google.

3:55 PM

Something I'd like to get opinion on: In the U.S., should I scan channels 12-14 when hunting for rogue WiFi devices?

@Iszi I do not believe you can purchase, anymore, equipment in the US that will actually broadcast on those frequencies.

They're used in Japan, so if your users imported something it could happen

@packs Yeah, but dial your paranoidometer up to 11, and you get... well, you've already answered that.

@packs Is it only Japan?

In the early days you could buy some equipment in the US that did 12-14, but it had tighter regs

Let's check the source of all knowledge

List of WLAN channels

The List of WLAN channels is the legally allowed IEEE 802.11 or more commonly Wi-Fi Wireless LAN channels. The 802.11 workgroup currently documents use in three distinct frequency ranges, 2.4 GHz, 3.6 GHz and 4.9/5.0 GHz bands. Each range is divided into multitude of channels. Countries apply their own regulations to both the allowable channels, allowed users and maximum power levels within these frequency ranges. In some countries, such as the United States, licensed Amateur Radio operators may use some of the channels at much higher power for long distance wireless acce...

So 12/13 are available in other parts of the world, but according to that only Japan allows the use of 14

I love the ambiguous "Most of the World" categorization.

Really, the use of those channels comes down to regulatory bodies.

There are plenty of places in the world that don't regulate radio signals

4:01 PM

Yeah, we do have regular international visitors - and some from Japan even.

Also, I think our environment probably has a larger-than-average population of Amateur Radio operators, who are typically licensed to use more RF than your average Joe User.

I actually read an analysis that recommended using channels 1,5,9,13 instead of 1,6,11. Apparently, the interference was negligible and packet loss percentages were low enough to be effectively non-existent. Pretty enlightening read.

What I don't know, however, is whether the harmonics would result in higher-order interference that would affect commercial or airplane broadcasts

4:17 PM

@packs Thanks for the link to the NRO press conference about Free Pool of IPv4 Address Space Depleted - how did I miss hearing about that press conference ahead of time??

@nealmcb I didn't hear about it either. Certainly not well publicized.

Around the same time that Katie Couric thought that "@" was pronounced "about", the IETF was digging in to how to make the Internet available to way more than 4 billion devices.

@packs nro.net/news/ipv4-free-pool-depleted

4:41 PM

'ello 'ello 'ello (in a fake cockney accent)

I love it - this is for real :) 2620:0:1cfe:face:b00c::3

@nealmcb That's terrible - like personalised car number plates

:-)

although - in saying that, 2600:0:7e1e:3975:dead:beef:1 would be cool

5:00 PM

@RoryAlsop nyerd

@packs ayup

although I prefer g33k (isn't that what the kids say these days)

@RoryAlsop Your answer about reporting brute forces pretty much sums up how I feel. I didn't want to outright say, "ISPs are lazy and don't care"

thay can't afford to care - they then lose their common carrier status if they analyse traffic

I do trawl though our dhcp logs looking for folks that we receive reports on

and suddenly are liable for a whole host if issues

5:04 PM

Mm....common carrier

(ninja edit)

Those are some fun laws for our lawyers to tell us what do to with :)

hahahaha

I don't get paid enough to take on the liability of interpreting those kinds of things.

Hm. That sounds whiny. Translate into some linguistic form that is not :)

5:20 PM

@packs - almost like Yoda, you sound

Do, or do not, there is no whine.

perfect

I love the X-Files. "From a dry skin sample you're concluding what, that he's some kind of a fat sucking vampire?"

Well, time to get back to the office and then to my excellently placed 1pm meeting.

enjoy

2 hours later…

6:57 PM

@packs There are certain times of day within which meetings should just not be scheduled.

My opinion is as follows: Meetings should stay outside of the first hour of the day, a half-hour on each end of lunch, and the last half-hour of the day. Thus, for an 0800-1700 workday, with a 1200-1300 lunch, meeting times should be within 0900-1130 and 1330-1630.

Okay, I know I'm a little late in the game here, but I think I've just now realized why two of my questions could/should have stayed separate.

10

Q: Non-OEM Biometric Software?

Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if there is any third-party software that will do the same thing. This would be similar to how you...

authentication multi-factor biometrics

0

Q: Is there software available for two-factor, biometric authentication to the OS?

Many fingerprint readers and other biometric authentication devices come with software for single-factor authentication to the OS. Is there any third-party software (F/OSS or otherwise) available for making OS authentication a two-factor process, such as by requiring both a fingerprint and a pas...

authentication multi-factor biometrics

The first is asking specifically for Non-OEM biometric authentication software, regardless of whether it is for single-factor or multi-factor authentication. The second is asking for any software that specifically does multi-factor biometric authentication.

Now they've been merged into one question that adds a requirement of the first to the second, and turns a requirement of the second into more of an option.

@AviD Is it too late to re-split them?

7:15 PM

@Iszi I completely agree. I do have a weekly meeting at 1330, and that's perfect. Gives me enough time to get back to the office, drop off my stuff, get some coffee, etc.

7:39 PM

wow, I'm almost here at the same time as conversations are occurring

@GrahamLee Howdy!

gday

@GrahamLee Heyo

@GrahamLee I'd say not to close it since there are some useful answers. But perhaps now, after 2 days with no response, it is time for us to rewrite the question so it makes sense.

(and matches the responses as best we can)

Okay, strike my comment about the merged question - I just realized I was asking for third-party software in the second question body, even though I hadn't included it in the title.

7:45 PM

@nealmcb The problem is that neither you nor I can predict what "default passwords" the asker is looking at.

We can end up making the question specific enough that it doesn't address the problem any more.

That's why I'd make it general, so the answers still fit

....@nealmcb though a generic "how do I audit and address use of generic passwords in my estate" might be a good question.

@GrahamLee I would recommend finding a good law firm that specializes in estate planning.

Put me in your will and I'll take care of generic passwords in your estate :)

:P

7:48 PM

@nealmcb I think we've come across something else that doesn't translate well across large bodies of water :)

I've just realised that that question doesn't mean what I thought it means.

@packs I doubt most law firms are leaders in password management....

If it means what I now think it means, then it's a good question that needs re-wording.

Inconceivable!

We're good at finding needles in haystacks :)

@GrahamLee Aren't you a thousand or so miles from Sicily?

7:51 PM

I think it means this: "When I register a new user on my network, I give them a default password in their registration pack. How do I ensure that they change this password?"

@nealmcb However, lawyers are awesome at hoarding information and not giving anything out....

@GrahamLee We don't know if he's talking about a new user on a network, or to an application, or a local computer, or which OS...

I agree, @GrahamLee that he certainly meant something to that affect. This is, unfortunately, one of those problems that actually does have strong technical implications.

(I previously thought it meant "when I buy a new piece of hardware from $supplier, it has a default administrative password. How do I make sure these passwords are changed on all of my hardware"

?

)

you see, this is why I'm loath to re-word the question myself.

@GrahamLee I'd make it generic enough to deal with both questions, since that has been answered nicely

7:54 PM

I see what you mean, @GrahamLee. What this kid asks works both ways

It's not the best way to do a question, but seems easiest here

With sufficient generification @nealmcb is right. Both problems can be addressed with the same answer. There just might be better answers depending on what specific situation and technology we're addressing.

I'm thinking of rory's high-rated existing answer, which does a bit of specifics on various possibilities.

OK, I'll finish extinguishing compiler warnings from this client's project, then I'll give it an edit.

Well, I'll get to the point where I'm bored, anyway. Not fixing 700 warnings tonight.

@GrahamLee That's why I always use -Wall -Werror

7:59 PM

so do I. not this guy

Compile early and often?

I've been a TDD advocate for a while now (in fact I'm writing a book on TDD for iOS developers) - start with a clean project, end with a clean project that does a little more than it did just now.

But sometimes you come across a project that's been going for years without anyone addressing the warnings.

TDD?

test-driven development

ah

8:09 PM

0

Q: How can I ensure that default passwords are no longer in use?

There are two situations in which 'default' passwords get used on a network: A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial password. A new piece of hardware is deployed. In its factory state it has a default admin passwo...

passwords password-management

"my work here is done"

Heh, that's exactly what I said a few months ago after emailing someone a nessus report that had a system with a total CVSS of 750.

Seeing his face was pretty funny :)

:D

As I recall that system got retired a week or so later...Guess it was easier

Nuke it from orbit. It's the only safe way.

8:24 PM

You didn't really need that service, did you?

Speaking of, this dude wants us to tell him how to secure a Windows 2000 box. I don't really have any good response to that except CIS.

I hear Microsoft puts out some good guides, but it would take more of a MS expert than me to find them.

yeah, I'd just look on the NSA website. I doubt there's anything up to date for win2k though

Hm. He just asked it on SF too

There had better not be anything up to date for 2k.

are MS even patching it any more?

nsa.gov/ia/guidance/security_configuration_guides/… only has 2k3, XP and Vista (no 7 or 2k8 yet)

Holy Crap

Support for Windows 2000 ended on July 13, 2010!

so the MHTML vuln, for instance, is wide open

8:34 PM

from support.microsoft.com/ph/1131

or is IE counted differently?

I can't believe it was still receiving patches for that long.

Unlikely.

I hvae a license for some version of Windows, but hardly ever use it

ooh, I have 7 Ultimate. Shiny.

I do use a Windows laptop, but that's primarily because we've recently migrated to Exchange.

Something I haven't taken the time to figure out yet, is preventing Evolution from working.

I thought at some point that I'd get customers wanting me to work on their Windows Phone 7 apps, so I'd better get Windows/Visual Studio.

Turns out there aren't any.

8:37 PM

Customers or Windows Phone 7 apps?

the second

luckily, there are customers.

8:57 PM

good evening

how y'all doin?

echo

yo

I just ripped off @GrahamLee's NSA link for the linux hardening question :)

@nealmcb boo! I demand some rep! or something

/me gives Graham Lee a coupon for increased attentiveness to Graham's forthcoming good answers and questions, for upvoting as appropriate :) (And I'd really give you credit if you had only mentioned that Linux is covered there as well....)

I look forward to NSA covering Ubuntu Server....

let me be the first to mention that Mac OS X is covered

hmmm, I'd answer some questions to take you up on that, but there are too many good answers already

though I'm proud of the "step one: get a job at Microsoft" answer :)

9:12 PM

@GrahamLee Ahh, the bounteous charity of my heart yielded up a grateful citation to Graham in a comment there. Did I mention how modest I am also? :)

@nealmcb I can almost feel the ice in my heart shifting slightly.

@GrahamLee Careful there - that stuff can be sharp! Seriously now, I'm happy to be more generous somehow, or let you enter that answer, or whatever if you like....

nah, it's alright. I'm not much of a rep-chaser anyway ;)

Currently, my opinion of stack exchange is hovering around "I would like to harvest organs from people who complain about questioners' accept rates in comments", except that I've found out some useful things from it today ;)

@GrahamLee I'm puzzled. Are people complaining too quickly? I'm a bit frustrated myself when questioners don't bother to read or sort out or help folks come up with an answer that is actually helpful. It's just part of the feedback loop, I figure. Not because rep is so important, but so the site gets better.

@nealmcb it just seems like a snarky comment. "Well I would answer, except that I don't think you're going to give me points, and I'm here for the points, so I won't answer."

9:32 PM

@GrahamLee Oh, well, the quote is so much more sad. Hmmm, what virtual "organs" could one harvest online?

I'm sure there are people on FarmVille would pay for anything that could be turned into virtual fertiliser

lol

pub!

Wow, you're going to the pub at the same time that I would be getting ready for bed

@GrahamLee I really like your answer on how to harden 2k. Very nice :)

9:56 PM

@packs Yeah - I chuckled too. But he left out Linux as an upgrade path :/

I try to avoid flamewars whenever possible :)

Have a pleasant ${UTC-5}{Evening}

10:17 PM

@packs Ahh - just the symbol I needed there: ⸮

« first day (49 days earlier) ← previous day next day → last day (4819 days later) »

Transcript for

Feb '113

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile