The DMZ

packs

00:32

@GrahamLee So, depending on how they measure block, it could still be a really big honkin range.

Strictly speaking, there are only 5 homes on my block. However, throw an apartment building into the mix...phew

@nealmcb I wouldn't go so far as to say "all about" but having certain pieces of PII dating might be easier....

nealmcb

@packs Well, the quote from Wikipedia suggests that it is explicitly about dating: "information that can be used to uniquely identify, contact, or locate a single person". [hmm - where is the emoticon for "/me ducks"]

@Iszi In my defense, I'll note that Iszi's comment about "interesting notation" prepped me to be on the lookout for strange wording when I read that snippet....

packs

00:48

Typical IT male. Blame it on the female contingent.

Rory Alsop

@packs et al - stalking

to be fair, it should be pretty easy to find anyone

if a zip code gives the rough area, their facebook account will have pictures of the house :-)

as an example - see what happens when you google your name, city and state

packs

Oh yeah, check out pipl

It's a nice aggregator of a lot of public record documents

Rory Alsop

yeah just discovered pipl

packs

Apparently, my name is common enough that it can make sussing out the information a bit tricksome, but still fun.

Rory Alsop

and then of course there is the information leakage through spouse's online presence

@packs - have you looked at your top google result

scary innit?

mind you - my Pipl page has everything!

packs

00:55

Yeah, that's what I noticed. I couldn't find anything about me, but she showed up.

Rory Alsop

even has my terrible Edinburgh marathon time (I was injured, okay)

packs

There was a pretty neat tool that was shown during the Offensive Security training. What was that...

/me looks

Rory Alsop

Maltego?

It's pretty good fun - the plugins already written do everything

packs

Yup, that's it.

Rory Alsop

It is good at showing just what you can get out of a social network like facebook without really being allowed to - the API is so open

packs

01:00

You saw the news about that dating site right?

Rory Alsop

LOL - aye

packs

That gave me a good chuckle

packs

01:12

It'll be interesting to see what HBK actually wants to do.

Rory Alsop

@packs - yeah, it doesn't sound like something a pen tester would want to do... sounds more like script kiddy. Hopefully I'm wrong and it is just a badly worded question

packs

I can see that kind of thing in an educational setting, pushing the boundaries of what can be done and all.

But, as you said, I smell carp.

Iszi

01:58

@RoryAlsop OMFG... don't get me started on that.

@packs ?

packs

13:31

@Iszi We were talking about this question

0

Q: Disabling windows firewall remotely

i use metasploit for pentesting windows 2003 sp2 server but when windows firewall is on i am not able to perform pentest successfully is there any way to disable firewall remotly?

nealmcb

16:23

@RoryAlsop I think a pen tester might want to do it, but I think it is an admin (SF) question, not security.

Rory Alsop

@nealmcb - I think you may have a point

packs

17:44

@nealmcb Again, context does matter.

Security Version: Can we disable the remote host's firewall without the admin's involvement.

nealmcb

Of course we can! Just need a 0-day :)

packs

SF Version: Our pentesters want us allow carte blanche access through firewalls from their scanner, how can we do this remotely

nealmcb

@packs well stated

packs

@nealmcb Linguistic dispute :) I'm using "Can we" to mean "are we currently capable of doing so with the tools and mechanisms currently at our disposal"

The SF version is very familiar to me. We (the security office) perform frequent vulnerability assessments of the servers on campus, and will often have the scanners given that kind of access so that we can get a better picture. Compensating controls be damned!

nealmcb

Alternative for security version: What indirect attacks does a firewall not address?

packs

17:49

@nealmcb Excellent!

I.e., can we make use of the fragments issue in iptables do what we want?

nealmcb

good! "What indirect or stealthy attacks does...."

packs

This is feeling very Socratic.

nealmcb

lol

Iszi

18:08

@packs Same in my shop - Foundstone can't run a proper credentialed scan without disabling Windows Firewall and Simple File Sharing first.

packs

With nessus, the firewall doesn't need to be disabled, it just needs the various and sundry wmi ports open.

That part can be automated fairly easily with GPOs.

Iszi

@packs Yeah, we probably don't need to disable the firewall entirely either, but "that's the way it's been done" and it minimizes headache.

packs

I actually went through a lot of headache with the Windows guys to get past the "We'll just turn it off and stop trying to fiddle."

Iszi

Well, we do turn it back on when we're done... if it was on to start with.

packs

On the linux side there's a script that sets up the firewall, scanner account, sudoers, etc, etc, and sets a timer to turn it self back off. So it works out a bit better.

@Iszi I notice your qualifier :) That was a hard fought battle, but one I'm proud of. Any system that has a host firewall has it enabled with sane rules.

Again, it was a big headache to get going, but I'm particularly proud of it.

Iszi

18:13

@packs That battle is above my pay grade right now.

packs

I mentioned this to Avi a little while ago. I think I ended up getting really lucky. It has worked out that of all the groups within IT, the sysadmins are the ones I (at least) work the most with.

It's really helped with getting procedures like that through.

Usually there's less of me laying down the Security Hammer, and more us just figure out how to get it done.

I blame it on judicious use of post-work beers and completely non-work lunches :)

Iszi

@packs Wish that happened around here more often. Any major changes like this one usually cause a bit of a stir that has to be run up the ladder.

packs

That sucks.

Iszi

We have several groups of sysadmins we work with though, so there's varying degrees of cooperativeness. Fortunately more groups are gradually starting to better about it. Gotta go easy on them though, if we want to keep it that way.

packs

Especially the crotchety old unix beards.

Is your primary job duty computer or information security?

Not like audit, or just part time or something?

Iszi

18:21

@packs Oddly, I think I can say the "old unix beards" are probably the least of our problems.

@packs Mind spelling that out for me? I'm not sure I fully recognize the distinction.

@packs We're mostly a compliance shop, roughly split into two halves. One half mostly facilitates documentation of the security plans, the other half is the more technical side - doing hands-on validation, incident response, etc. I'm in the latter group.

packs

So take your typical information assets, HR files, financials, student records, etc. Depending on how your department is scoped you may only be involved in protecting those assets as far as they relate to computer files (whether at rest or in transit). Or you may be scoped to protect them no matter where they exist, whether on a file server or in a file cabinet.

Iszi

@packs Thought that was what you meant - just wanted to be sure. Yeah, we're pretty much focused on computer security.

packs

Normally that's where you could draw your distinction. Now days the Venn diagram is usually pretty heavily weighed towards computers, even if you deal with the other stuff.

When dealing with other people in the field, I actually tend not to draw a big distinction. The biggest difference being that I might be more interested in lock picking than you are :)

I like the way you guys are split up, that definitely helps with the focus.

Iszi

@packs Actually, that and hot-wiring are sort of on my "bucket list" - skills I'm (perhaps oddly) interested in learning, regardless of whether I'll ever actually use them.

packs

Unfortunately, we're scoped to broadly to really split up duties that well, which definitely has it's downsides.

We don't have the same guy both review/approve a design and validate it, but we're on the same team.

Not ideal, but it's about the best we can manage with our staffing.

Iszi

18:33

The split also helps make finding Juniors a bit easier, when the time comes. One person on the other side of the house was essentially an Admin Assistant before she joined our group, and I pretty much came straight from desktop support.

packs

Are you guys part of IT?

Iszi

@packs Depends who you ask.

packs

Lovely :)

Iszi

Technically, we report directly to the top - separate from the sysadmin groups. Often times though, it's as if we answer to the same management as them.

packs

I can see how that culture could hinder getting certain policies through.

Iszi

18:36

@packs Oh, you mean like host-based firewalls? ;-)

packs

@Iszi Mebbe :)

Iszi

It also doesn't help that we did at one point fit into the same report structure as the sysadmins.

packs

We are a part of IT, which helps with the whole notion of 'one of us'. But the sysadmins, desktop support, networks, etc are all separate departments and all of our 'Directors' report to the CIO. So there's really not any of that weirdness about reporting.

My boss is an equal to the boss of ${random_sys_admin}, etc.

@Iszi So clearly the reorg helped clear things up for you guys

Iszi

Loads.

packs

On another note, have fun at your dance?

Iszi

18:41

@packs Yeah, a bit.

First stop was pictures, then food. After that, we went to the cafeteria for the actual dance. Two seconds inside of that door, my daughter ran off as if I didn't exist.

packs

Yeah...I'm looking forward to that..?

Iszi

She came back after a bit. And then she was off again, and back and forth like that most of the night. We did dance together for a few songs somewhere along the way.

@packs You've got a little girl? Or just planning on one?

packs

I have one, she's nearly 2. Still young enough to enjoy my company, except for when she wants her mother :)

Iszi

Yeah, fun times ahead...

packs

I figure I have between 9 and 12 years before everything goes to shit, so I might as well enjoy them.

Iszi

18:53

Heh... by that math, I've still got 4-7 years.

packs

oh noes

Iszi

She still thinks I'm the best daddy ever... even if I don't deserve it.

packs

Ah, then you probably do still have that much time left :)

Iszi

@packs One can only hope and pray.

packs

20:23

@Iszi Speaking of which, someone just woke up, and it doesn't sound happy. This should be fun :)

Feeds

Stack Overflow Blog: Suggested Edits and Edit Review

Posted by Jeff Atwood on February 5th, 2011

The Stack Exchange engine draws inspiration from a number of sources.

We continue to be great admirers of Wikipedia, but we’ve always missed out on one crucial aspect of their system: we never allowed anonymous users to edit content. No, that requires earning some priviliges through participation — specifically, the retag privilege at 500 reputation and the full editing privilege at 2000 reputation.

Well, as of today, I’m proud to announce that we allow anonymous and new users to edit content in our system! The surface area of this change is huge — it means the millions of drive-by anonymous users that visit our sites every day can submit an improvement or correction to a post or wiki. Furthermore, you can earn up to +1000 reputation (but no more) for submitting valid edits. …

Rory Alsop

21:01

Evening all

nealmcb

/me waves

Rory Alsop

/me waves back - interesting update, this low rep user edit review - which can give users with below 1k rep the opportunity to rapidly uprep without posting questions or answers

hopefully it will work out well - so far the number of things popping up in my approve queue has been easily manageable. I feel sorry for the guys over at SO or the other trilogy sites. Some have hundreds in their queue every day!

@nealmcb - liked your comment on my education question. Wish I had an answer - part of me thinks I should arrange a different approach for every industry, but I'm hoping that at such an early point in their careers it should be similar education and buy in required for most if not all.

nealmcb

21:27

@RoryAlsop Here's a brainstorm. Kids seem to like games. Can you fund the development of some good games or courses on games or who-knows-what that really emphasize at least the highly-unusual job of developing something with security from who-knows-what attack? Have teams of white hats and black hats with the white hats trying to develop and protect something of value. The mindset in security is so different from most dev tasks, and it seems like it would fit into a game-oriented world.

packs

@nealmcb Those kinds of war games do happen at some of the cons. I imagine that it could work well, but the implementation would be pretty hard. I can see it being real easy to mess that up pretty bad.

I'll have to talk to my boss about something like that. He's been approached a few times by the department chair that teaches IT about teaching security like courses.

The biggest hurdle would be finding a way to balance the teams in some meaningful way, unless you used it repeatedly (changing up the team memberships) over the course of the term.

nealmcb

21:53

Yeah - I'd imagine you'd want to change the teams around.

packs

22:26

It would also have the benefit of providing something approaching actual experience.

I think I would probably enroll in that class.

Iszi

Off-topic, does anyone know if anyone makes SOHO VoIP/Wireless routers anymore?

nealmcb

Nice quote from Ben Adida: "Security is about stopping the bad guys from stealing your data. Privacy is about controlling the good guys’ handling of your data. (Ron Rivest is said to have phrased this most eloquently, but I can’t find his quotation.)"

benlog.com/articles/2011/01/26/…

Rory Alsop

22:48

@nealmcb There was a good article in New Scientist on exactly this. Turning everything into games. See the popularity of achievements in things like Foursquare etc. The problem with the capture the flag events that the big cons have is as @packs says - you would often have one team which would be ahead of the others and that lead would grow, so mixing it up would be necessary

Transcript for