The DMZ

nealmcb

05:58

@RoryAlsop @RoryAlsop Note that back in the days of Empire, GMT meant UTC-12 (aka GMAT) to astronomers.

AviD

08:55

@Iszi when you happen to be here... wanted to discuss your toctou question...

3

Q: How can TOCTTOU vulnerabilities within the Windows OS be mitigated?

What are some ways to mitigate the time-of-check-to-time-of-use issues that apply to Windows permissions? Example: End-user is added to the local Administrators group in order to install software, printers, etc. The user's account is removed from the Administrators group while the user is logg...

Rory Alsop

@nealmcb All the info I can find defines GMT as the time at the Greenwich Meridian, which obviously pops through London. Where did you get the UTC-12 ref?

and morning @AviD

Graham Lee

11:33

busy in here, then

Looks like this question hasn't got any better recently, so I'm thinking of closing it.

0

Q: How can ensure that the user changes the default password?

One way I have read about is, to have a default password which says the"admin'sname"rocks sort of a password. Most users change that. Can you think of anything else?

passwords password-management

packs

12:26

@GrahamLee I find that rather unfortunate. I see the potential for it to actually be a useful question to have on the site.

Clarification: I find it unfortunate that it hasn't gotten any better, not that you are thinking of closing it.

Graham Lee

yeah

mind you, it's only been a day, maybe I should give @thunderror more time to respond.

packs

13:39

@nealmcb I just saw the comment you posted to my answer about reporting abuses to the IP range contact over on SF. Wow. That's a big honkin question you asked in such as small place :)

Iszi

13:58

Mornin' all.

@AviD Tag, you're it.

@GrahamLee I'm not in disagreement.

Graham Lee

14:23

:)

packs

14:33

@Iszi Good Morning Sunshine

nealmcb

@packs Yeah - I guess so. The eternal optimist here.... serverfault.com/questions/228546/…

packs

I think that would be a pretty epic question for the security site.

nealmcb

@RoryAlsop Heh - funny you should ask - I did find myself compelled to make sure Wikipedia had all the right info before responding to you :) en.wikipedia.org/wiki/Greenwich_Mean_Time

packs

Short answer, no, I don't know of any, and I think it might be best as a mixture of business practice and tech. I also think there would be a number of different answers, and types of answers, on that one.

And I would love to see what everyone had to say :)

nealmcb

14:55

0

Q: Tools to identify and report hacking attempts from inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Who regularly reports hacking attempts from inside the networks of reputable organizations (e.g. within a university)? What tools exist to help identify such attacks and make such reports? Identifying the sorts of abuse that are useful to ...

tools ids reports

@packs Look good?

packs

I like it

I'll try and get something together to contribute. Too many damned projects going on!

in The Comms Room, 6 mins ago, by Murali Suriar

http://www.nro.net/news/icann-nro-live-stream <- ICANN/NRO press conference about v4 'exhaustion', for those who are interested.

Iszi

15:12

@packs Anyone else having problems with that stream?

packs

Let me pull it up and see

Not so far.

Feedback is a bitch

Iszi

Gosh, it's horrible for me.

I wonder if the stream is available somewhere else.

packs

There are a couple of different streams down below

Iszi

@packs Ah, indeed. Thanks.

Hehe... "and their fridges..."

Still stuttering for me on the low-bandwidth connection.

Not quite so bad though.

packs

I wonder if they're using a cdn

inspects

Iszi

15:17

Love his accent - "et-see-ter-ah"

packs

Looks like it's being hosted by Merit Networks up in Ann Arbor, but their domain name is an edu. I'm probably getting it over the I2, so likely network congestion instead of server overload

nealmcb

@packs Is there a hashtag for commentary?

packs

@nealmcb hashtag?

nealmcb

15:39

lmgtfy.com/?q=hashtag

packs

Ah, twitter.

I haven't gotten into that yet

@nealmcb boo!

nealmcb

Rude - seems like se rewrites "lmgtfy" as google.

Iszi

15:55

Something I'd like to get opinion on: In the U.S., should I scan channels 12-14 when hunting for rogue WiFi devices?

packs

@Iszi I do not believe you can purchase, anymore, equipment in the US that will actually broadcast on those frequencies.

They're used in Japan, so if your users imported something it could happen

Iszi

@packs Yeah, but dial your paranoidometer up to 11, and you get... well, you've already answered that.

@packs Is it only Japan?

packs

In the early days you could buy some equipment in the US that did 12-14, but it had tighter regs

Let's check the source of all knowledge

List of WLAN channels

The List of WLAN channels is the legally allowed IEEE 802.11 or more commonly Wi-Fi Wireless LAN channels. The 802.11 workgroup currently documents use in three distinct frequency ranges, 2.4 GHz, 3.6 GHz and 4.9/5.0 GHz bands. Each range is divided into multitude of channels. Countries apply their own regulations to both the allowable channels, allowed users and maximum power levels within these frequency ranges. In some countries, such as the United States, licensed Amateur Radio operators may use some of the channels at much higher power for long distance wireless acce...

So 12/13 are available in other parts of the world, but according to that only Japan allows the use of 14

Iszi

I love the ambiguous "Most of the World" categorization.

packs

Really, the use of those channels comes down to regulatory bodies.

There are plenty of places in the world that don't regulate radio signals

Iszi

16:01

Yeah, we do have regular international visitors - and some from Japan even.

Also, I think our environment probably has a larger-than-average population of Amateur Radio operators, who are typically licensed to use more RF than your average Joe User.

packs

I actually read an analysis that recommended using channels 1,5,9,13 instead of 1,6,11. Apparently, the interference was negligible and packet loss percentages were low enough to be effectively non-existent. Pretty enlightening read.

What I don't know, however, is whether the harmonics would result in higher-order interference that would affect commercial or airplane broadcasts

nealmcb

16:17

@packs Thanks for the link to the NRO press conference about Free Pool of IPv4 Address Space Depleted - how did I miss hearing about that press conference ahead of time??

packs

@nealmcb I didn't hear about it either. Certainly not well publicized.

nealmcb

Around the same time that Katie Couric thought that "@" was pronounced "about", the IETF was digging in to how to make the Internet available to way more than 4 billion devices.

@packs nro.net/news/ipv4-free-pool-depleted

Rory Alsop

16:41

'ello 'ello 'ello (in a fake cockney accent)

nealmcb

I love it - this is for real :) 2620:0:1cfe:face:b00c::3

Rory Alsop

@nealmcb That's terrible - like personalised car number plates

:-)

although - in saying that, 2600:0:7e1e:3975:dead:beef:1 would be cool

packs

17:00

@RoryAlsop nyerd

Rory Alsop

@packs ayup

although I prefer g33k (isn't that what the kids say these days)

packs

@RoryAlsop Your answer about reporting brute forces pretty much sums up how I feel. I didn't want to outright say, "ISPs are lazy and don't care"

Rory Alsop

thay can't afford to care - they then lose their common carrier status if they analyse traffic

packs

I do trawl though our dhcp logs looking for folks that we receive reports on

Rory Alsop

and suddenly are liable for a whole host if issues

packs

17:04

Mm....common carrier

Rory Alsop

(ninja edit)

packs

Those are some fun laws for our lawyers to tell us what do to with :)

Rory Alsop

hahahaha

packs

I don't get paid enough to take on the liability of interpreting those kinds of things.

Hm. That sounds whiny. Translate into some linguistic form that is not :)

Rory Alsop

17:20

@packs - almost like Yoda, you sound

packs

Do, or do not, there is no whine.

Rory Alsop

perfect

packs

I love the X-Files. "From a dry skin sample you're concluding what, that he's some kind of a fat sucking vampire?"

Well, time to get back to the office and then to my excellently placed 1pm meeting.

Rory Alsop

enjoy

Iszi

18:57

@packs There are certain times of day within which meetings should just not be scheduled.

My opinion is as follows: Meetings should stay outside of the first hour of the day, a half-hour on each end of lunch, and the last half-hour of the day. Thus, for an 0800-1700 workday, with a 1200-1300 lunch, meeting times should be within 0900-1130 and 1330-1630.

Okay, I know I'm a little late in the game here, but I think I've just now realized why two of my questions could/should have stayed separate.

10

Q: Non-OEM Biometric Software?

Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if there is any third-party software that will do the same thing. This would be similar to how you...

authentication multi-factor biometrics

0

Q: Is there software available for two-factor, biometric authentication to the OS?

Many fingerprint readers and other biometric authentication devices come with software for single-factor authentication to the OS. Is there any third-party software (F/OSS or otherwise) available for making OS authentication a two-factor process, such as by requiring both a fingerprint and a pas...

authentication multi-factor biometrics

The first is asking specifically for Non-OEM biometric authentication software, regardless of whether it is for single-factor or multi-factor authentication. The second is asking for any software that specifically does multi-factor biometric authentication.

Now they've been merged into one question that adds a requirement of the first to the second, and turns a requirement of the second into more of an option.

@AviD Is it too late to re-split them?

packs

19:15

@Iszi I completely agree. I do have a weekly meeting at 1330, and that's perfect. Gives me enough time to get back to the office, drop off my stuff, get some coffee, etc.

Graham Lee

19:39

wow, I'm almost here at the same time as conversations are occurring

nealmcb

@GrahamLee Howdy!

Graham Lee

gday

Iszi

@GrahamLee Heyo

nealmcb

@GrahamLee I'd say not to close it since there are some useful answers. But perhaps now, after 2 days with no response, it is time for us to rewrite the question so it makes sense.

(and matches the responses as best we can)

Iszi

Okay, strike my comment about the merged question - I just realized I was asking for third-party software in the second question body, even though I hadn't included it in the title.

Graham Lee

19:45

@nealmcb The problem is that neither you nor I can predict what "default passwords" the asker is looking at.

We can end up making the question specific enough that it doesn't address the problem any more.

nealmcb

That's why I'd make it general, so the answers still fit

Graham Lee

....@nealmcb though a generic "how do I audit and address use of generic passwords in my estate" might be a good question.

packs

@GrahamLee I would recommend finding a good law firm that specializes in estate planning.

nealmcb

Put me in your will and I'll take care of generic passwords in your estate :)

Graham Lee

:P

packs

19:48

@nealmcb I think we've come across something else that doesn't translate well across large bodies of water :)

Graham Lee

I've just realised that that question doesn't mean what I thought it means.

nealmcb

@packs I doubt most law firms are leaders in password management....

Graham Lee

If it means what I now think it means, then it's a good question that needs re-wording.

Inconceivable!

nealmcb

We're good at finding needles in haystacks :)

packs

@GrahamLee Aren't you a thousand or so miles from Sicily?

Graham Lee

19:51

I think it means this: "When I register a new user on my network, I give them a default password in their registration pack. How do I ensure that they change this password?"

packs

@nealmcb However, lawyers are awesome at hoarding information and not giving anything out....

Iszi

@GrahamLee We don't know if he's talking about a new user on a network, or to an application, or a local computer, or which OS...

packs

I agree, @GrahamLee that he certainly meant something to that affect. This is, unfortunately, one of those problems that actually does have strong technical implications.

Graham Lee

(I previously thought it meant "when I buy a new piece of hardware from $supplier, it has a default administrative password. How do I make sure these passwords are changed on all of my hardware"

?

)

you see, this is why I'm loath to re-word the question myself.

nealmcb

@GrahamLee I'd make it generic enough to deal with both questions, since that has been answered nicely

packs

19:54

I see what you mean, @GrahamLee. What this kid asks works both ways

nealmcb

It's not the best way to do a question, but seems easiest here

packs

With sufficient generification @nealmcb is right. Both problems can be addressed with the same answer. There just might be better answers depending on what specific situation and technology we're addressing.

nealmcb

I'm thinking of rory's high-rated existing answer, which does a bit of specifics on various possibilities.

Graham Lee

OK, I'll finish extinguishing compiler warnings from this client's project, then I'll give it an edit.

Well, I'll get to the point where I'm bored, anyway. Not fixing 700 warnings tonight.

packs

@GrahamLee That's why I always use -Wall -Werror

Graham Lee

19:59

so do I. not this guy

packs

Compile early and often?

Graham Lee

I've been a TDD advocate for a while now (in fact I'm writing a book on TDD for iOS developers) - start with a clean project, end with a clean project that does a little more than it did just now.

But sometimes you come across a project that's been going for years without anyone addressing the warnings.

packs

TDD?

Graham Lee

test-driven development

packs

ah

Graham Lee

20:09

0

Q: How can I ensure that default passwords are no longer in use?

There are two situations in which 'default' passwords get used on a network: A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial password. A new piece of hardware is deployed. In its factory state it has a default admin passwo...

passwords password-management

"my work here is done"

packs

Heh, that's exactly what I said a few months ago after emailing someone a nessus report that had a system with a total CVSS of 750.

Seeing his face was pretty funny :)

Graham Lee

:D

packs

As I recall that system got retired a week or so later...Guess it was easier

Graham Lee

Nuke it from orbit. It's the only safe way.

packs

20:24

You didn't really need that service, did you?

Speaking of, this dude wants us to tell him how to secure a Windows 2000 box. I don't really have any good response to that except CIS.

I hear Microsoft puts out some good guides, but it would take more of a MS expert than me to find them.

Graham Lee

yeah, I'd just look on the NSA website. I doubt there's anything up to date for win2k though

packs

Hm. He just asked it on SF too

There had better not be anything up to date for 2k.

Graham Lee

are MS even patching it any more?

nsa.gov/ia/guidance/security_configuration_guides/… only has 2k3, XP and Vista (no 7 or 2k8 yet)

packs

Holy Crap

Support for Windows 2000 ended on July 13, 2010!

Graham Lee

so the MHTML vuln, for instance, is wide open

packs

20:34

from support.microsoft.com/ph/1131

Graham Lee

or is IE counted differently?

packs

I can't believe it was still receiving patches for that long.

Unlikely.

Graham Lee

I hvae a license for some version of Windows, but hardly ever use it

ooh, I have 7 Ultimate. Shiny.

packs

I do use a Windows laptop, but that's primarily because we've recently migrated to Exchange.

Something I haven't taken the time to figure out yet, is preventing Evolution from working.

Graham Lee

I thought at some point that I'd get customers wanting me to work on their Windows Phone 7 apps, so I'd better get Windows/Visual Studio.

Turns out there aren't any.

packs

20:37

Customers or Windows Phone 7 apps?

Graham Lee

the second

luckily, there are customers.

AviD

20:57

good evening

how y'all doin?

echo

Graham Lee

yo

nealmcb

I just ripped off @GrahamLee's NSA link for the linux hardening question :)

Graham Lee

@nealmcb boo! I demand some rep! or something

nealmcb

/me gives Graham Lee a coupon for increased attentiveness to Graham's forthcoming good answers and questions, for upvoting as appropriate :) (And I'd really give you credit if you had only mentioned that Linux is covered there as well....)

I look forward to NSA covering Ubuntu Server....

Graham Lee

let me be the first to mention that Mac OS X is covered

hmmm, I'd answer some questions to take you up on that, but there are too many good answers already

though I'm proud of the "step one: get a job at Microsoft" answer :)

nealmcb

21:12

@GrahamLee Ahh, the bounteous charity of my heart yielded up a grateful citation to Graham in a comment there. Did I mention how modest I am also? :)

Graham Lee

@nealmcb I can almost feel the ice in my heart shifting slightly.

nealmcb

@GrahamLee Careful there - that stuff can be sharp! Seriously now, I'm happy to be more generous somehow, or let you enter that answer, or whatever if you like....

Graham Lee

nah, it's alright. I'm not much of a rep-chaser anyway ;)

Currently, my opinion of stack exchange is hovering around "I would like to harvest organs from people who complain about questioners' accept rates in comments", except that I've found out some useful things from it today ;)

nealmcb

@GrahamLee I'm puzzled. Are people complaining too quickly? I'm a bit frustrated myself when questioners don't bother to read or sort out or help folks come up with an answer that is actually helpful. It's just part of the feedback loop, I figure. Not because rep is so important, but so the site gets better.

Graham Lee

@nealmcb it just seems like a snarky comment. "Well I would answer, except that I don't think you're going to give me points, and I'm here for the points, so I won't answer."

nealmcb

21:32

@GrahamLee Oh, well, the quote is so much more sad. Hmmm, what virtual "organs" could one harvest online?

Graham Lee

I'm sure there are people on FarmVille would pay for anything that could be turned into virtual fertiliser

nealmcb

lol

Graham Lee

pub!

packs

Wow, you're going to the pub at the same time that I would be getting ready for bed

@GrahamLee I really like your answer on how to harden 2k. Very nice :)

nealmcb

21:56

@packs Yeah - I chuckled too. But he left out Linux as an upgrade path :/

packs

I try to avoid flamewars whenever possible :)

Have a pleasant ${UTC-5}{Evening}

nealmcb

22:17

@packs Ahh - just the symbol I needed there: ⸮

Transcript for