The DMZ

forest

04:18

@TomK. Oh neat.

> and demonstrate its applicability to a real-world scenario with the SpiderMonkey JavaScript engine.

I wonder if that relies on accurate performance.now() or JIT...

Oh damn, it looks like the new v1 variant requires smaller gadgets...

> Our attacker code is an adapted regular V1 PoC code for
JavaScript JIT engines, with just the first array access replaced
by the call to the victim function. The time measurement is
done using the SharedArrayBuffer technique, which reads the
content of such a buffer while it is being incremented in the
background by a web worker that is running in parallel.

Interesting.

> JIT engine authors have already reacted with countermea-
sures [41], [11] in order to mitigate Spectre V1 in the context
of browsers. These countermeasures mostly address sources
for high-precision timers. Diluting the timing and disabling
homebrew sources such as SharedArrayBuffers mitigate this
version of JavaScript SPLITSPECTRE.

> On top of timing-related countermeasures, the V8 engine
also masks addresses and array indices in JITted code before
dereferences. While this mitigates a standard Spectre V1
attack, it does not help with SPLITSPECTRE, where the bounds
check is actually not exercised in JITted code, but the engine
code itself.

Yet another reason why I always disable JIT. :D

Rory Alsop

06:20

@J.J you don't need a huge CV. Make it succinct, relevant to you, and be prepared to talk about it

Anonymous

09:07

@RoryAlsop Hah, I think I did okay. I applied for like 12 jobs yesterday so with any luck I'll hear back today or Monday on a few :D

forest

github.com/BlackBip/Ti-Basic-BTC-Miner

Bitcoin mining software for the TI-83 calculator. :D

Blinding fast hashrate at 0.0001 H/S!

Anonymous

@forest Morning.

forest

morning

Anonymous

I am so tired, literally dying over here...

forest

Literally huh

Anonymous

09:12

Yeah I think so.

forest

I mean I guess we all are.

Anonymous

I can see a lot of light and I'm having flashbacks :p

Anonymous

Heh.

forest

:p

Anonymous

There are so many poorly scoped jobs on LinkedIn.

forest

09:13

Did you not get a job at NCC Group?

Anonymous

Yesterday I saw a Junior Pen Tester role that wanted 7 years IT expereince, 3 of which are pen testing, degree in CompSci or Cyber-Sec and an OSCP.

Anonymous

I didn't "get" the job. I have the recruiter as an immediate contact, if I am close to passing my OSCP by the end of my contract here, I will contact him and he will put me through for an interview.

forest

ah

Anonymous

But that's on the basis I pass or am close to passing the OSCP by February 5th.

forest

You think you're likely to pass?

Anonymous

09:14

And I've still not bought the material so probably not.

Anonymous

Don't have my PC still...

Anonymous

So I'm studying, but just outside resources, I don't want to waste any lab time.

forest

ah

Anonymous

I mean, I can do stuff on this laptop, but when you're trying to write code and research at the same time on a not-so powerful laptop it's a pain.

forest

It doesn't take much computing power to do that.

I mean not unless you're compiling huge projects.

Anonymous

09:15

No, but then I don't have another monitor either.

Anonymous

So it's a pain because alt-tabbing constantly.

Anonymous

I need to feel comfortable to focus.

forest

I use tmux for that (Linux).

Lets me work very efficiently with one monitor.

Anonymous

You only have one monitor? :O

Anonymous

Maybe I am just too privileged, but I've always had at least 2.

forest

09:16

Why would I need more?

Anonymous

I find it really uncomfortable to have less.

forest

As long as the code fits in 72 columns...

That's enough for me.

Though I do like 1080p. Lots of room for multiple panels.

Anonymous

Well, fair play I guess :p

Anonymous

As I said, I'm probably just too privileged.

Anonymous

I get agitated easily & alt-tabbing a lot makes me very agitated :p

forest

09:19

With tmux, everything is done by keybinding.

So I can rearrange tile layouts very quickly, open or close tiles...

^b, j -> goes down one tile, ^b, c -> creates a new tile, etc.

Anonymous

Heh, I'll have to check it out, I've heard of it - never used it.

Anonymous

Meanwhile, why do so many people ask for CEH? :O It is such a waste of $1000, it's not worth the paper it's printed on.

forest

Tmux is really great. Very customizable (since the defaults aren't perfect).

It really is. CEH is trash.

Anonymous

I'd never do it.

Anonymous

Even if someone paid for it.

Anonymous

09:22

Waste of time.

forest

I pirated the workshops once and tried it... Kinda sucked.

Really basic stuff, no good explanations.

Terrible exercises.

Anonymous

Have you seen how many of the questions don't even make sense?

forest

I haven't looked at it in ages.

Anonymous

I will try and dig it out, I saw a tweet where a question was literally not answerable.

Anonymous

It was something to do with netcat, it asked what netcat is and none of the answers were correct.

Anonymous

09:23

lol.

forest

Is it the one asking shit like "netcat is 1) a backdoor, 2) a text editor, 3) a bootloader"?

Anonymous

Yeah something like that.

forest

With them wanting you to say #1 because it's a "backdoor" in their mind.

Yeah lol

Anonymous

Yeah I'd have ticked backdoor too.

forest

CEH certifies hackers as ethical because they'll know so little they can't be dangerous.

Anonymous

09:24

Just because it was the least farfetched answer.

Anonymous

LMAO

forest

There needs to be a CUH, Certified Unethical Hacker.

3

Where you learn how to do script kiddie shit like make ransomware.

"Exercise 4A: Infect 5,000 victims with your ransomware"

Anonymous

I've already got my certification plan so I'm safe.

forest

"Exercise 4B: Send all the Bitcoins you receive to a nazi party"

Anonymous

OSCP < 6 month break for Crypto study < OSCE < 6 month break for interesting topic < OSEE.

Anonymous

09:26

So with any luck, OSEE by early 20s...

forest

:p

Not bad.

Anonymous

Or I could cut the 6 month breaks.

daya

@forest lol, Just went to #twit but unfortunately no one is there

Anonymous

And powerhouse my way to OSEE.

Anonymous

I saw a guy get OSCP, OSCE & OSEE in like 2 years~

forest

09:27

@daya Wat, did I give you the wrong IRC server?

Anonymous

But I couldn't deduce whether he was a cheater or not.

forest

hm...

Maybe it was one of STS's sister servers.

I think it might have started with "net".

daya

@forest It was irc.smashthestack.org and then #twit

forest

@daya Lemme find it, one sec.

Netgarage!

That was it.

irc.netgarage.org

Channel #twit

@daya Try that.

daya

@forest let me try

Anonymous

09:29

All I want is a research position :(

Anonymous

Someone pay me to study, please.

Anonymous

You could pay me minimum wage if it meant I got paid to study :D

forest

@J.J A research position takes a lot more experience.

Anonymous

Yeah I know :D

Anonymous

I don't expect to get one for a very long time.

Anonymous

09:30

That's why I decided I think I should get a pen test role for a couple of years.

Anonymous

I feel like if I get a pen test role and don't just metasploit fucking everything.

forest

One nice thing about research is you can just publish it in the open and people will come to you to hire you. Plus you'll get a lot done.

Anonymous

I will learn a lot.

Anonymous

Too many pen testers just loading metasploit man.

Anonymous

I guess there are time constraints so I get that.

Anonymous

09:31

But for me the whole fun part of pen testing is researching exploits.

Anonymous

Carrying them out is boring.

Anonymous

It's pressing a few buttons and some "magic" happens.

Anonymous

But understanding what that "magic" is, is far more interesting than doing it.

forest

You'll almost never find a situation where it's that easy.

daya

@forest no one is here too!

forest

09:32

Sometimes even if you don't need to use a 0day, you still have to use existing exploits in a novel or clever way.

@daya Maybe it was #twits.

Ask in #help or something. I know it's there.

Anonymous

What do you mean Forest? :p

Anonymous

I think a lot of networks are vulnerable to a shit load of the MS modules to be honest.

Anonymous

I mean, maybe not huge companies.

Anonymous

But decently sized ones for sure.

Anonymous

But thats what I mean.

Anonymous

09:34

The exploitation process for me is boring

daya

@forest yep! there are 35 people here

forest

In #twits?

daya

yep

forest

Cool. So tweets will be posted there periodically.

It's really great.

Just idle there for a few days for a very nice list.

Anonymous

This website is so broken.

Anonymous

09:38

It says "please use a 6 character password"

Anonymous

You use a 24 character password still returns an error saying "please use a 6 character password"

Anonymous

Nice.

forest

Which website?

>mfw "hunter2" is too long and complex for that website

Anonymous

A UK job site.

daya

@forest Sure, but no one is talking here

Anonymous

09:39

cv... something something.

forest

@daya Yeah, it's not a place where people talk. People idle there so they can see the log of interesting tweets that are posted from time to time by a bot.

Anonymous

Okay.

Anonymous

Fuck this site

daya

@forest I see

Anonymous

WHAT1

Anonymous

09:42

This job I'm applying for is asking for current salary.

forest

??

Anonymous

Why the fuck would they need to know that?

Anonymous

Is that normal!? O.o

forest

Yes it is.

Anonymous

:O

Anonymous

09:43

Why......

forest

They're asking so they have enough information to offer you the lowest salary.

Anonymous

That's shady.

Anonymous

And pretty wrong if you ask me.

forest

If you have a low salary, they're going to be happy to give you just slightly more. If you have a high salary, they want to have information to try to negotiate it down.

Yes it is wrong. That's capitalism for you.

Anonymous

That is so gross.

Anonymous

09:44

It's a "mandatory" field as well.

Anonymous

Hah!

forest

yup

2

A: Why do job applications ask for desired salary? What are the consequences of giving a number too low or too high?

If you give a salary that is too low: Either the company concludes from your salary that you cannot be qualified for the job, or will quickly leave for a better paying job, and not hire you. Or they do hire you, and pay less than you deserve. In any case bidding too low is always bad for you. I...

(Though this is for asking for your desired salary, but still)

Anonymous

I kinda' understand desired.

Anonymous

I do not understand current/previous at all

forest

For big companies especially, you're just a number.

They only care about squeezing you dry for the lowest salary they can.

Some companies are a bit better and don't do that.

Anonymous

09:47

Yeah I'm applying for a range of different size companies right now.

Anonymous

Problem is most of these posts are posted by the recuriter and they just say "for my client"

forest

Now, there are other explanations that are less malicious. For example, they might want to know if you're over or under qualified (if you had a $100k/year last job, they know they'll just lose you to another company). But that's not as common.

Anonymous

So unless they think you're right for the job, you don't know much about who you're applying for.

Anonymous

But, just because you apply doesn't mean you need to accept a contract I guess so.

forest

Remember that this is a battle of wits between you and the companies.

Anonymous

09:50

In that case, I will never get a job :p

forest

You want to get the best job with the best salary. They want to give you the worst job with the worst salary. You need to use your smarts to get what you want.

Anonymous

Well, I'll never win that battle lol.

Anonymous

But, I'm still trying. I don't want to be doing this job for another year.

Anonymous

It's boring, I just want a more security focused role.

Anonymous

If I spend another year here doing more non-sec stuff I am just slowing myself down and falling behind.

Anonymous

09:53

At least, that's how I see it.

forest

One thing I've done is manage controversial or oft-attacked websites or services (in a sysadmin role), which gets me paid decently without having an employer, while still ensuring that the job is heavily security-focused.

E.g. failovers, reverse proxies (GRE tunnels), database encryption, etc.

Anonymous

I was actually looking at a sysadmin role.

Anonymous

But, I feel like I am not equipped to do one.

forest

It can be fun, but it can also suck up your time.

It really depends on how many servers you manage.

Like going to manage 500 nearly-identical servers in a datacenter is way different from personally managing one or two smaller servers. The former is pretty much about learning how to automate anything and everything. The latter is more like managing a personal project, just with higher uptime and without fucking around on prod.

Anonymous

Sysadmin role would enable me to be more security involved for sure.

Anonymous

09:57

But, I don't think I know enough about *Nix or Windows or just OS-ses and applications in general to do it.

Anonymous

So I've been hesitant to apply.

Anonymous

I doubt myself way too much and I know it.

forest

Install Linux, start using it and become a power user.

It helps.

Anonymous

Well Forest, I use *Nix on my PC.

Anonymous

Which I currently do not have in my posession and even if I did I would have no ability to use it right now.

forest

09:57

What distro?

Anonymous

Hah, just Ubuntu.

Anonymous

It's the first one I used.

forest

I suggest taking up something like Slackware or Gentoo (I use the latter, personally), since it will enable you to learn a lot more about the inners of the system.

Anonymous

So I literally just stayed on it.

forest

Once you're comfortable with them, a sysadmin role should become way easier.

Like for me, all I had to do was learn how to set up and manage a LAMP stack.

The rest was just natural since I was so used to it.

Anonymous

09:59

What I don't want to do is this - I don't want to apply for a job I cannot do, get it and then be that guy everyone calls a "blagger"

Anonymous

That's not me.

Anonymous

I won't do something I don't understand, I feel embarrased.

forest

So do something similar as a hobby.

And remember, you'll start out low.

Anonymous

Well, I'm in a junior role and I'm only applying for junior roles.

Anonymous

I could apply for an internship but that's going backwards.

forest

10:00

A friend of mine (in Russia, in case it differs in the UK) went to a job interview for a major datacenter/webhost company. In the interview he was waaaay overqualified. In like three weeks he became a senior network administrator.

Anonymous

Especially not when I am trying to save up to move out.

Anonymous

And I don't want to go backwards...

Anonymous

Money doesn't bother me a lot, but I do need a lot of it to move out.

Anonymous

So in this scenario, I cannot be doing an internship, it's not viable for me.

forest

But when he started out, his interview questions were stuff like "how do you run dpkg to update on 500 servers at once" (with the answer obviously being to use a loop in bash to SSH). His answer was the while IFS= read -r ip; do ssh ip "$stuff"; done < iplist.txt, and the interviewer had no idea that that even worked (all he knew about was crappy xargs).

So you don't have to worry about not being able to do your job.

Anonymous

10:02

I just don't want to be that one guy in the work place that everyone knows is a blagger.

forest

You'll start with a role that's painfully easy.

And you'll either stay there, or work your way up.

Anonymous

I'd feel like shit if I walked into the office everyday and was considered a blagger.

Anonymous

Like, I've cheated none of my exams.

Anonymous

I've studied for all of them properly.

Anonymous

I've not stolen questions or anything and I feel like I know the content.

Anonymous

10:02

So if I walked into a job and was too out of my depth.

Anonymous

I'd be so embarrased I'd never want to return..

forest

You don't have to worry about that.

As I said, you'll start low and either stay or climb.

Anonymous

Yeah but I overthink and worry about a lot of things I don't need to, that's just me :D

Anonymous

Either way, applied for like 15 more jobs this morning so we'll see what comes of those.

Anonymous

Mostly all of them are just a SOC analyst position but it is close to what I am doing now just with more emphasis on security than networking.

forest

10:06

Are those the kind you want?

Anonymous

Well, it's the best thing I am going to get.

Anonymous

I want a junior pen test role.

Anonymous

But every single one says "OSCP required"

Anonymous

Not a single one says that working towards OSCP is fine.

Anonymous

Which makes me really fuckin' mad but I cannot afford to be out of work after my job here that's the thing.

Anonymous

10:07

I need to move out soon so.. I'm a bit stuck.

forest

Do you have a rainy day fund?

Just something in case nothing works out for a little bit?

Anonymous

Well, I have a bit but.

Anonymous

I need that money to go visit my girlfriend really.

forest

Oh man don't put relationships before a sustainable wage.

Anonymous

Yeah I know but like.

Anonymous

10:10

I am staying with my dad right now, but I have no space.

Anonymous

(Sleeping on sofa)

Anonymous

So I need to move out.

forest

damn

Anonymous

And I cannot move out without money and I don't get paid enough here to move out.

Anonymous

And thanks to my mother my dad is just as broke.

forest

10:11

Oh wow

Anonymous

Anyway, I shouldn't go into that.

Anonymous

But my mother is evil.

Anonymous

Yeah welcome to my family, dads well paying job is worthless.

Anonymous

He'd earn more if he went and got a job stacking shelves because at least my mother couldn't take it.

Anonymous

Stupid fucking child maintenance laws are dumb, basically allow women to fleece the fuck out of their ex-partner.

forest

10:13

Yep, it's like that in many countries.

Anonymous

If equality is required anywhere, it's there for sure.

Anonymous

Despite all of that my father gave me all the money for OSCP for my 18th.

forest

It's one of the places where sexism goes both ways.

Anonymous

My mother gave me a grand total of £1 in the form of a birthday card.

forest

wow

Anonymous

10:14

Fuckin' stupid brainless woman.

Anonymous

/shrug

Anonymous

So I just need to get a role better than this one until I pass OSCP then I think I can get a JPT role easily.

daya

@forest Was using Irssi and just wondering why it allows to enter password in plaintext
I was registering my nick as `/msg nickserv REGISTER <password> <Email>`

Is it okay?>

forest

@daya That's part of the IRC protocol. Connect with TLS to mitigate dangers. Don't use a password that you've used elsewhere.

M'vy

Just connect over SSL if possible

But yeah, don't reuse these passwords

daya

10:20

hmm @M'vy @forest

M'vy

Basically you can't consider IRC as 'secure'

forest

Especially not as they often store passwords in plaintext.

That's why you use OTR for truly secure (confidential) PMs.

daya

@forest WTF Really?

forest

@daya IRC is very old. It's so old and the protocol is so simple that you can connect using telnet. Yes, telnet. Raw, plaintext, telnet.

daya

@forest Indeed, I also read IRC has lost 60% of it's users since 2003

forest

10:26

Well it was at its height in 2003.

But the major IRC servers (Freenode, Rizon, Efnet, Undernet, DALnet) are still big.

daya

Yep

One thing came to mind: I observed many times, In Windows 10 lock screen It allows us to connect or disconnect to a WiFi network , yes on lock screen. It is obviously a risk if a attacker got physical access to your PC for about 1-2 minutes. no?

forest

Yes.

daya

Then why Microsoft did this? and it's surely not the case that this thought doesn't came to their mind.

May be for convenience of users..

forest

Who knows

daya

But one thing I really appreciate of Microsoft is WSL

I mean it's nice if you have to use a Linux terminal and it's core functionalities quickly

forest

10:37

Yeah except they did that to screw over Linux.

And they still have broken fork().

daya

Obvoiusly. It's not a replacement for Linux but it's good

And taking about desktop env, which one you use?

forest

I don't use a DE.

I use just a bare window manager called CWM.

daya

Nice

I always learn new things from you :p

Anonymous

^ thats because he's a savant

forest

lol I wish

Anonymous

10:42

Hehe

daya

@J.J Yeah I mean I always appreciate the people who has knowledge and are happy to share

But unfortunately there are not many people out there

Anonymous

I think you're wrong.

Anonymous

I think there are a lot of people out there willing to share.

Anonymous

You just don't know about those people.

Anonymous

Granted, there are people that are very elitist at times, don't get me wrong.

Anonymous

10:47

But I think those are few and far between in InfoSec, at least in my experience.

forest

I dunno, there's a lot of them when you get deeper in.

Like it's probably the biggest problem that plagues infosec. :D

daya

@J.J Yeah may be I just don't know

Anonymous

Really? I'm yet to experience many people like that @forest

Anonymous

I've come across a few.

forest

It gets really bad when you get into binary exploitation or kernel security.

Anonymous

10:49

But is that for monetary reasons?

Anonymous

Because if yes, I understand a little.

forest

Comex, halvar, spender, theo, x0rz (to some extent)..

Nah not really money. Just personality reasons.

Anonymous

Oh, then that's a problem.

Anonymous

I'm not involved in such fields as I am not a savant like yourself so don't understand any of that shit.

Anonymous

Although recently I am picking up C.

forest

10:50

I'm no savant. I suck at binary exploitation. :P

Anonymous

I say picking up, I am slowly picking it up and being very confused.

daya

@J.J Yes, Due to the fact in the env I live nobody talks about infosec and even in college they just talk about coding. coding, coding competitons etc.

Or May be some people still thinks Hacking as dark magic and don't talk about it

Anonymous

@daya Well, programming and security fit each other quite nicely.

daya

Yeah I know but..

Anonymous

A lot of InfoSec pros come from programming.

daya

10:55

Sure

Okay

I gotta go

Anonymous

Take care.

M'vy

Info Security is still quite young

forest

It really is. And evolving very rapidly.

Just think, not to long ago "ROP" wasn't even a term!

Anonymous

Young = Good :p

Anonymous

;)

forest

10:59

Very true.

Anonymous

:D

forest

Make sure none of your UK colleagues read that out of context.

M'vy

I'd disagree on this. Mostly because young means, not enough experience feedback

Anonymous

HAHAHAHA

forest

@M'vy But it means it's still exciting.

Anonymous

11:01

@forest There's nobody around today really so I think I am safe.

Anonymous

The guy that sits next to me is working from home as well so that's nice.

M'vy

ofc

Anonymous

I get to talk to people without him looking over my shoulder like some kind of prison guard :p

Rory Alsop

Have you folks started looking at nccblackhat.com

Seems like a fun wee challenge

forest

> What is the Registry Domain ID for nccgroup.com

lol

Rory Alsop

11:04

Clue if you are stuck on step 1 - this may get different answers depending on which whois service you use

Anonymous

Oh, this was running whilst Blackhat was running?

Anonymous

Damn :(

Anonymous

I wonder if you could've won something.

Rory Alsop

I dunno if it's finished or not

I scanned the QR code on the day and have done nothing else with it

Anonymous

Damn, I didn't see this.

Anonymous

14:37

Does anyone here have any experience with CREST exams? :thinking:

Anonymous

A friend of mine said he advises me to take the CREST CPSA before doing OSCP because then when I get OSCP I will also be granted the CREST CRT.

Rory Alsop

20:37

@J.J yeah. I haven't done it (I'm too out of touch with pen testing) but I helped on the standards committee when they were setting up, and now CREST is the essential one to get many UK contacts for testing. It pretty much replaces CHECK for government, and it is required for bigger/regulated companies

Lemme see if I can get a CREST person to comment

Rоry McCune

@J.J So it depends. If your goal is to get CREST qualified, you're probably just easier taking the CRT and don't bother with either CPSA or OSCP

IIRC getting CRT includes the written exam part which is the CPSA

if you want to take the OSCP then you can do that and then upgrade to CRT

well if you think of the CRT as an upgrade ofc :)

if you're a tester in the UK I'd recommend taking the CREST exams as a lot of pentest companies rate them

Bryan Romero

Hi

Anonymous

21:18

@RoryAlsop Alright, thanks.

Anonymous

@RоryMcCune You're quite right, getting CRT involves the written too. As for OSCP, I think it's much better than the CRT in my humble opinion so I don't see it as an upgrade.

Anonymous

Problem is, with my two CCNAs I'm struggling to find a lot of security roles where I meet their requirements, hence my thoughts for some cybersec cert.

Rory Alsop

Yes - CCNA is not useful for a security career :-)

(it was my first cert too)

Anonymous

21:31

But @RоryMcCune is quite right, CREST is huge in the UK.

Anonymous

@RoryAlsop Well, I do have CCNA Security as well, but all it means is I can use a firewall, well an ASA.

Anonymous

But, I don't want to be doing this role after my contract expires, I just want to get a more security orientated role.

Anonymous

NOC -> SOC is all I'm after.

Transcript for