The DMZ - 2019-09-19

« first day (3199 days earlier) ← previous day next day → last day (1671 days later) »

12:28 AM

@CaffeineAddiction What made him a snake oil salesman? I don't have any immediate suggestions off the top of my head, but what area are you in? That might help

Either way though, you'll have the most success if you already have a good idea of what you need. To pick a slightly different example, a brick and mortar store that decides they need ecommerce will have a terrible chance of success if all they know is that they need ecommerce

I would generally suggest that you have some meetings and figure out what you actually need to protect (in terms of data, infrastructure, networks, employees, etc...), what you are doing for security now, and then talk to as many vendors as possible. Explain where you are, where you want to be, and see what they have to say.

CaffeineAddiction

1:10 AM

fin tech ... we have a VPN and a static webpage

everything else is internal offices or colos

CaffeineAddiction

1:29 AM

I guess snake oil salesmen was the wrong name ... he was a fear monger

he also said that part of our security rating was based on our static webpages cert

6 hours later…

7:49 AM

cat /home/mechmk1/randomJokeWhenIEnterTheDMZ

@Derpy I would argue, since it's business focussed, that you should not build your infrastructure on it. It's for evaluation purposes, but not guaranteed to remain this way.

@AndrolGenhald I remember when I bought the Warcraft movie on Blu-Ray and wanted to watch it on my computer. It took me hours to get everything to work. In the end I just torrented it anyways. Would have been much faster.

As I said before, Pirates already offer a free product. If you're a content producer, don't let the pirates also have a better product than you.

@CaffeineAddiction Look at security companies in your country and look at their track record. Reputable companies will have been in the business for a long time, and have worked with many other reputable companies.

That doesn't mean that smaller startups can't be good, or that every company that has existed for 10 years is amazing

But whom would you rather trust? "Old Security Company", which has been in the business since 2002, who worked with companies like "Big Bank 1", "Big Bank 2", "Big Insurance Group", "Big Supermarket", "Big IT Company 1-8", etc.

Or "Fancy New Secuity Startup.io", who once worked for "Local IT Company"?

That being said, I am probably biased, given that I work for "Old Security Company"

I don't want this to come across as "MechMK1 shills for his company" :D

8:54 AM

@MechMK1 And then you have the "Kaspersky is evil and they are spying us" scandals :P

@Derpy Yes, but those are from russia where all the evil hackers come from

9:23 AM

@MechMK1 I should resist I should resist I should resist....

Sorry, failed

Hmmm? :D

> In Soviet Russia your antivirus hacks you

wired.com/2011/01/sms-suicide-bomber

> In Soviet Russia, Spam deletes you.

(yep, I am not really buying into those claims. At least, I wouldn't consider that much more surprising than other claims that vendor X antivirus has backdoor for local governments Y)

I don't use Anti-Virus software anyways

Common Sense and a good gut feeling are way better than any AV could ever be

10:04 AM

@CaffeineAddiction Especially for a fintech, on the list of things to worry about the VPN and static webpage would be pretty low on my list. Well, the VPN would at least be on the list... but if you want to increase your security posture there is much more than that to think about. If you co-locate I'd be very concerned about the potential for schenanigans from other people on your network...

The security of your office computers would be a primary concern, access to confidential business information from employees who don't need it, and most of all security of email accounts and password for your users. I'd especially worry about vulnerability to phishing, and implications for any third-party services you use.

One "fun fact" that I spread far and wide is that 50% of all data breaches start internally (i.e. with employees). Your a fintech company and presumably have a lot of private data on hand. How easy is it for a random employee to, whether on purpose or accident, publish sensitive data or copy it onto their personal devices?

As a fintech company your data and your employees are probably the most valuable things you have. Those are what you should probably be focused on protecting, wherever they live.

@ConorMancone This should actually be a dedicated answer to a dedicated question

10:30 AM

@ConorMancone security.stackexchange.com/q/218279/163495

Look, another DRM question

@MechMK1 I'm not sure I'd really call that DRM

When people ask stuff like that though, I'm really curious what sort of mental picture they have of how things work, like what could possibly make you think that's even remotely possible?

"How can I restrict an attacker from gaining access to an asset, yet still provide the attacker with access to an asset with specific restrictions in place?" sounds a lot like DRM to me.

I suppose

"How can I prevent people from reading my HTML source code/copying my images/use my 3D models/etc. are all variations of the same question?"

And a desire to hire the mailto: link in a contact form is therefore, more or less, DRM

11:17 AM

@MechMK1 Maybe we need a community question for "how do I hide things inside a browser?" since that particular variation of "DRM" question seems to definitely come up a lot.

11:42 AM

@ConorMancone I'm all for it

Maybe "How can I let users view/use content on my website, but prevent them from copying it?"

Though it makes me wonder, how does netflix prevent people from ripping movies?

@ConorMancone

How can I allow users to view/use content from my website, but prevent them from copying it?

I have a website, in which I provide certain assets to my users, such as Images, Audio or other media files.
I would like users to be able to view these assets and my website, but I want to prevent them from being able to copy them.

For media assets, this means:
- Users should not be able to save the media on their computer

For my website, this means:
- Users should not be able to see the source code

How about it?

12:16 PM

@MechMK1 They use wildvine, which I've always kind of though idly about trying to break for the fun of it, but I'll probably never get around to it

they also don't send anything higher than 720p unless you have some stupid hardware drm that I think is based on SGX

which is total bullshit and why I hate them

you pay for 4k and get 720p because they treat you like a criminal

I cancelled my netflix account long ago

@MechMK1 I know that (a long, long time ago) used to user silverlight, and I'm sure that was for content protection. That probably gave them better control over things like certificate pinning to prevent MitM. These days I have no idea!

Oh, well Androl knows!

:)

> Silverlight

Bwahahahahahaha

Seriously!

it's effective drm because no one sane wants to deal with it

lol

12:19 PM

Just for kicks I launched netflix in firefox with OWasp zap turned on. I wanted to see if they had some fancy certificate pinning that would even let me play a movie

I didn't get that far, but I did get this:

drive.google.com/file/d/1xmVkggLrcmQPVz35mqyrlGcZPEsdOw73/…

(honestly have no idea how bad silverlight really is tbh, but basically everyone hated it, so...)

(screenshot) I'm guessing they are using some sort of DRM plugin? Is that what you would expect from wildvine @AndrolGenhald?

yep, that's wildvine

it's drm that google created, that got standardized by the w3c

@MechMK1 I think that sounds pretty good.

@AndrolGenhald 🤮

it's actually why the eff resigned from w3c eff.org/deeplinks/2017/09/…

12:21 PM

Yes, I remember that!

What a fucking joke

-3

Q: Honeypot for hunting browser zero-days, rootkits and malware

I would like to create a honeypot (bot) to hunt browser zero-days (and browser extensions). What is the best way to find those 0days automatically (I would like to create a sandboxed bot which would visit websites and check if they are trying to exploit browser vulnerability). I think that just t...

malware web-browser honeypot zero-day bot

Read the edited part.NOTE

Such a douche

@VipulNair I hadn't downvoted that question before, but I certainly have now...

I'm going to flag it for a mod... I'd just edit out some of that myself but a mod may have a better idea of how to deal with it...

And that's a flag from me :D

@VipulNair Good catch

393 2 15

web-browser xss zero-day sqlmap linux php black-box

Look at his about as well

Wow.Did we hurt him that much.

lol. This is why we can't have nice things

12:30 PM

He mad :D

> Such behavior should not be tolerated

My top tags are passwords and authentication. snif he doesn't like me :(

Mine are crypto and custom-scheme

@MechMK1 Oh, yup, you too! Closed his question and have password/authentication as top tags

Aka. "Don't roll your own. Srsly"

Where can I see my top tags then?

Ah, here

Yes, of course those are the top tags: Because they are the most commonly asked tags

mine are passwords and encryption, guess I'm alright :P

12:34 PM

@MechMK1 Yes, 100% However, they are clearly the only things I know anything about.

People are hilarious

I'm starting to get random downvotes again

I wonder if there's an easy way to see vote counts per tag, or if you need a data explorer query for that

Ohhh boi, it's starting to get fun

He seems really really mad

The biggest irony for me is the fact that his edited-in answer doesn't actually answer his own question. He links to something used as a honeypot client (which I'm sure can be useful and is probably a concept used by google, etc), but it doesn't have anything to say about detecting zero days, which is what his question was actually about.

Tempted to comment to that effect, although that would be rather immature of me...

Please do, I beg you!

I want to see the chaos unfold

If you don't, then I will

12:37 PM

lol, you are not helpful

okay, okay

> Chat message was flagged as not helpful

:D

@MechMK1 a quick advice ... you may want to avoid direct namecalling since it is a very fast way to get you on the wrong side of the mods burination stick. While he does indeed feel rude.... if you do the same you risk to get flagged too.

@Derpy I guess calling him an a*****e was perhaps a bit rude

Too bad I can't delete chat posts anymore

Oh boy

Okay, I need to do some work now, lol! @MechMK1, let me know if you decide to post a question about DRM in browsers!

@ConorMancone I'll refine it a bit more, then let you know

@Derpy I've always considered the chat to be a much more relaxed environment, where it was more about the people and less about the topic

Of course, I know that "Be nice" still applies here

12:43 PM

this question is actually what made me curious and prompted me to look into it a bit earlier this year security.stackexchange.com/q/206811/151903

But I consider calling someone who isn't here based on their actions names is different than calling someone names directly in their face

If I could edit my chat message, I could perhaps reword it as "What an incredibly unpleasant fellow to be around"

@MechMK1 don't worry, it is not like I will flag the post. Just reminding you that someone could and that is a fast way to get you to become the villain.

Wouldn't have been the first time. I know I usually play "Go fast and break things" with the rules, but I doubt I am going anywhere near "being banned" territory

@MechMK1 Just for full disclosure, a friend of mine in the Tavern main chat room was suspended from chat for a while for name calling against April after that twitter "incident", and she isn't even a Stack user. The fact that you are calling someone who isn't here wouldn't make it any better. And some could argue it would probably make it worse.

I appreciate the concern, and I'll try to be more "nice" in the future

But what has been said has been said and I'll live with it

12:50 PM

@MechMK1 Again, don't take this as me trying to scold you, just an advice to be more careful to avoid problems

I understand it, don't worry

Good. Back to my "fix the not-working Azure Functions some coworker left me" job then.

... did I say "Fixing"? Make that "rewrite"

Good luck

@AndrolGenhald That's an interesting question. Do you have any general thoughts about a community wiki on protecting content in the browser? Certainly that question is about that general topic, but we seem to get a lot of questions that are about simpler topics (aka the question this morning about hiding the mailto in the html page).

@Derpy If I had a dollar for everytime I had to rewrite something that someone else left me... The painful ones are when the employee was only around for a few months and you have to rewrite everything they did for the entire time they were around...

@ConorMancone The question MechMK1 proposed looks ok to me

1:01 PM

-1. your answer is classical and is absolutely correct, but is so boring, this is not what is all that "hacking" about. IT security is about finding creative solutions. - You can obfuscate your HTML code with some browser bugs & features (described e.g. on html5sec.org). I think it should be possible completely without CSS & JS. Client has a copy of that HTML code in his browser so he has the whole time of the universe to deobfuscate it, but it should be worth spending time on deobfuscating it. — notyourdolly 7 mins ago

"I downvoted your answer because it is correct, but I felt bored by it"

This can't be legitimate

never actually used mailto: in a form, but...it looks like it opens your own email client...which will necessarily need to have the recipient's address...

@AndrolGenhald Yes, it's not the best way to solve the problem

But I personally think I answer questions, not solve problems

My point is, downvoting an answer for the reason that it is not entertaining or "1337" enough is frankly absurd

@MechMK1 Your answer is correct, and his comment is definitely wrong. You've obviously made him made and now have a stalker. Which is weird, because you weren't even the first one to vote to close his question. I wonder why he's stalking you?

Because I wrote an answer and had a discussion with him

@ConorMancone I can already tell that schröder is going to come here in 10 minutes and ask who the hell fed the trolls again

@MechMK1 I was just about to say you should really stop engaging with him and flag it

1:09 PM

Flag as what though?

@MechMK1 he has a crush on you.My man

I have to disappoint him then. I have a girlfriend, and I love her dearly.

hahaha

It's funny though how every time this guy shows up he makes nothing but problems

i feel the guy is very young tho

like 16-17\

he definately has a listening issue and only wants to speak

1:17 PM

Possibly, though I do find myself in that category a lot as well. I think, at least

And his suggestions of writing buggy HTML code that browsers would barely be able to get into shape, but web crawlers wouldn't, is just hilariously horrible.

This is one of the great parts about being a Christian. My entire worldview revolves around the fact that the world is filled with broken people. As a result when someone gets his panties in the wad over his question being poorly received, and starts to get spiteful over it, I get to sit back and say "I'm just surprised that that didn't go worse"

@MechMK1 not that I think your all worked up over this, but I wouldn't worry about it. The thing that I like to remind myself is that someone who gets so worked up about nothing is someone who is very, very miserable all the time. Basically, he is his own punishment :)

@ConorMancone I don't mind either way

I used to get really upset over downvotes, especially without any comments

But now I just don't care anymore

Also: Mentioning your religious worldviews on the internet. Very brave :D

RPG.SE Chat went ballistic after I had asked if DnD considered moral alignments to be relative or absolute

Quickly turned into a religious debate

@MechMK1 lol! That's awesome. Best. Question. Ever.

To be fair, it was not asked directly like that

It was more like "How can a character be considered "good" if the world they are surrounded in is not black-and-white good or evil?"

My example was Warhammer 40k: To the Orks, the act of going to war and killing other, weaker races, is considered "The only true way of life", and in a way would be considered "Lawful" and "Good".

To a human, the brutal murder of anything that moves may not be considered so clearly moral.

Hence my question, if there is some absolute moral stance, or if moral is relative to e.g. the society the character comes from, or even the individual

1:40 PM

I always like the example of "What if we had evolved from tigers instead of apes?" The ultimate good would be "be stronger than the next guy" and scaring off/killing anyone who entered your territory would be the right thing to do. We'd have completely different ideas of right and wrong.

Yes, that's where the idea of moral ambiguity comes from

What is "mercy" for me is "weakness" for an Ork.

The obvious answer is to kill all the Orks, and then there will only be one definition of right and wrong left :)

@ConorMancone if you were tiger you wouldn't evolve to be conscious/smart/human like in the first place

Reminds me of a very dark joke better left untold in public

@VipulNair Yes, that is probably true. Doesn't destroy the underlying point though. At least on our world, Intelligence and "sociality" tend to go hand in hand.

1:44 PM

@VipulNair And all the furries would have a thing for being hairless with smooth skin instead

"Skinnies", so to say

whats up with furries anyway?

haha

I don't know if I am allowed to judge people based on them being furries or not

Could be interpreted as bigotry against their sexual orientation

That being said, I am entitled to form my own opinion of them, and I know very well how I feel about furries

Not judging.Asking.

Could you specify "What's up with...?" then, please

Is it like fun or something?What goes through their minds?

I am just poking around anyway.nothing serious

1:47 PM

Sexual attraction to anthropomorphized animals

Out of all the strange fetishes people have, that one is probably one of the least weird. Did you know that wikipedia has an entire list of people who have died from autoerotic asphyxiation? Seriously, there's enough people for there to be its own dedicated list... The first example goes all the way back to the 1700s (IIRC)

@MechMK1 that was more "How to turn RPG into Philosophy.SE"

Though that probably has to do with the way your biochemistry wrks

@ConorMancone but autoerotic asphyxiation makes complete sense.When there is lack of oxygen the orgasms are more intense i have read

Supposedly

Whereas I consider a "fetish" to be an attraction to an object or an act because said object or act itself is considered sexually attractive

@VipulNair Though if you are interested:
https://www.youtube.com/watch?v=GmULc5VANsw

1:51 PM

@VipulNair That doesn't make it less crazy...

@ConorMancone Human Sexuality doesn't need to make sense

Look at latex as a fetish

Latex is, essentially, rubber from a tree

Yet many many people consider it "fetish clothing", because reasons

We might as well live in a world where latex clothes are considered "normal" and clothes made from, e.g. cotton as "weirdly sexual"

It's arbitrary deep down

@VipulNair What I consider quite repulsive is that "rainfurrest" never explicitly stated that the event was "adults-only", which lead to quite some people going there with young kids

in the end we are all just monkeys with dopamine.

At the same time, there were people who had sexual intercourse outside the convention hall (essentially in public), and (in)famously, some guys even went around with excrement-filled diapers

Knowing all of this, it surprizes me why people are still surprized at the internet labelling the furry subculture as degenerate

@MechMK1 a life like this is crazy to me for entirely different reasons.You come to my country and you will see we dont have food and on the other parts of the world there crazy shit going on like rainfurrest

India, if I recall correctly?

The thing is simple: If people don't have any worries, they stop looking for purpose and become absolute degenerates

There was even a famous experiment with rats

Where a researcher made an enclosure with rats and gave them perfect housing, endless food, etc.

1:57 PM

Yes.India

Its crazy the problems america has and the problem poor countries have

What happened? The rats turned absolutely insane. Mothers started attacking their youngs, male rats would all gather in one corner and do nothing anymore, etc.

what was the experiment?

> One must imagine Sisyphus happy.

The Mouse Utopia Experiments | Down the Rabbit Hole

25 minutes long, but worth it

I dont see it applying to humans

Trust me, you will see it

2:01 PM

But something interesting to tell in a conversation thats for sure

The idea basically is, once we don't have a "struggle" anymore, we will inevitably fall into decadence and depravity

Chicks love hearing how "humanity is doomed"

I doubt so

@MechMK1 that makes sense considering sick shit the rich people get off to

I just think that we need a struggle to be happy, like Sisyphus did

@VipulNair Exactly

2:03 PM

a tough life is a happy one

yeah i believe that too

Basically

Or at least, one in which you can find purpose

Because that's what struggle does: It gives purpose

Like a movie

More or less

Where there needs to be a struggle for the protagonist to move forward

I remember when I was waiting for university to start

It was like 7 months or so

I had absolutely nothing to do

I played videogames all day, ate junkfood, etc.

It sounds awesome, but was the worst time of my life

I couldn't sleep anymore, I was depressed. Every day was gray in gray in gray

2:07 PM

stagnation is hell

In the video I linked to, at around 4:30, you can see that the rats had extremely high infant mortality

The reason was that the mothers did not care for their children

not a video fan

rationalwiki.org/wiki/Behavioral_sink

read this instead

Yes, basically

You can see the similarities to western society

Yeah.sure but i dont think this experiment proves much to that

Rats are a poor choice to begin with

And they wrote there is quite a lot of cherry picking

I'm not saying this is 1:1

But it gives an interesting lens to see through

2:11 PM

I mean mothers eat their infants in animals all the time.

My pet rabbits have done that

Yes quite fascinating to see this

Yes, it happens

But when you see the same results pop up time and time again, you ask yourself why

definately someone smart in the field should look into this

Cause you can see the stark difference between problems of a first world and third world country

Yes, absolutely

Humans are extremely complex

And trying to explain a complex phenomenon with simple analogies always fails

catch 22.If humans were smart enough to figure out their brains they wouldnt be smart enough

Why?

2:21 PM

Cause our brains wont be complex

hence not smart

Why not? Something can be complex and perfectly understood. Nowhere is it a written law that something cannot comprehend something more complex

It's a bit like magic. We say magic is not real, because everything we can explain is not magic

Even though for the layman, it is virtually indistinguishable

sure someday maybe we figure out our brain as well

But can you ever be sure "this" is all there is it

The basic idea was the brain is too complex which is why humans are conscious

But the brain just isnt smart enough to understand such a complex thing

Just philosophy.

I doubt that it is a hard rule that the brain is not smart enough to understand itself

And if the brain were not complex.Then we would just be apes.

Yeah you make good point there is no rule to it

It's just difficult, because any scientific research towards conciousness is always plagued by conotations

2:29 PM

That collective brains of many over the ages cant figure themselves out

For example, people with right-wing beliefs are generally physically stronger than those with left-wing beliefs.

This is due to how physically stronger people are more likely to opt political views based on self-reliance, rather than sharing of wealth.

So the actually correct claim to make would be "Physically stronger people are more likely to be right-wing"

But this argument alone has several co-notations. Being "strong" is considered an admirable attribute (primarily for men), and being "weak" is the opposite. Therefore, the scientific study has been criticized as some sort of right-wing propaganda

@ConorMancone security.stackexchange.com/users/147725/notyourdolly

Look at his profile description :D

@MechMK1 i pointed it out earlier hahaha.

Cut him some slack the guys is probably 16-17

Really? I must have missed that

I've revised my guess for his age. I now think he's 5 :)

hahahha.

2:35 PM

Just because I was a big jerk at 16-17 doesn't mean that I'll give other people slack for being jerks at that age. After all, if I did they would never learn! :)

Words to live by

yeah if i was here when i was 16 you all would hate me as well hahah

No, we're not unwelcoming to people who are young or new to Information Security

But at it's core, "Dolly"'s arguments are not rational, but highly emotional. "I downvote you, because I dislike what you say"

I meant i was jerk as well.

Everybody was a jerk as a teenager

2:39 PM

Yap

Oh man, I was such a terrible person. I at least managed to (mostly, sometimes, kinda) get over myself before graduating high school

I feel like I most grew in tertiary school, but then again, I can always look back 5 years in time and think "Man, I learned so much since then"

yap

So, on a different note, I found a local website (with a few thousand users even) that has absolutely zero security. I wasn't even doing any actual penetration testing. I just hit up an API endpoint and since, I was missing a required parameter, immediately found an SQLi vulnerability. They weren't using prepared queries or even escaping. Running PHP with display errors on, which is why I knew it was vulnerable without even doing anything

completely disaster.

Been trying to contact the owner for a couple weeks. No response of course.

How long do I give them before I start threatening full disclosure?

Did you give them a deadline?

2:42 PM

@MechMK1 Truer words have never been spoken

I would say 30 days for them to reply to you, otherwise you publicize

If they reply, you can ask them for an estimate

@MechMK1 So far I've just reached out a couple times in a non-confrontational way, something like "This is a problem. It's a big risk for your business and customers. I can give you suggestions on how to start fixing it"

Did they ever reply?

No

They never do!

@ConorMancone from the sound of it there will be many moer sqli,xss and even RCE on their site.

2:44 PM

Then as I said, write them to reply to you and present you a plan on how long they estimate the issue would take. If you don't get a reply within 30 days, then you will publicize the issue

issues*

wouldn't ignoring the whole thing be better?

For whom?

for everyone

I tried contacting them through their website as well as the email registered with DNS

I mean fixing one sqli wont fix anything.

2:46 PM

No, but fixing all their stuff would

@VipulNair It's a local app, one I have actually used in the past. My own information is probably in there. Of course the password is unique, but still....

If they operate in europe, threatining with GDPR works wonders too

It's a college town. They probably hired a college kid to make their application, who knows nothing about basic security. I actually sent a detailed "Security Report" with details, impact, and mitigation steps

US - no such luck

@ConorMancone Most likely what actually happened

i was merely saying that they definately have other security holes there and fixing one sqli would be like a drop in the river.

2:47 PM

"Hey guys, look! I got it to work"

@VipulNair Don't see it like a drop in the river. See it like one step towards a long goal.

i see

"secure" is a verb.

Nothing becomes "secure", ever

It's a constant process

That needs to be integrated into every step of development

And with a dumpster fire application, you need to start somewhere

makes sense

Would it make sense to rewrite everything? Yes, but the operators could at least hotfix the most glaring issues

@MechMK1 That was basically the conclusion of my report. "If you have to, you could just fix these issues. However, there are probably more hiding in there and it's probably more cost effective in the long run to just redo it right"

2:53 PM

@ConorMancone They might as well just downvote you

:D

@MechMK1 I normally make fun of Europe and their excessive regulations and regulatory bodies, but in the case of the GDPR I think they may have been on to something.... although the cookie warnings that now exist on every website everywhere drive me crazy. Talk about alert fatigue

@ConorMancone GDPR = Good Idea, Terrible Implementation

3:10 PM

@MechMK1 lol!

« first day (3199 days earlier) ← previous day next day → last day (1671 days later) »

Transcript for

Sep '1919

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile