The DMZ

MechMK1

8:36 AM

@A.Hersean I guess __-in-the-Middle is the most inclusive then

@FireQuacker Oh you know it!

@UwU Yeah, I'm actively making fun of the "everything is ___ist" thing that is going around

I still remember the debate about whether the "master/slave" paradigm was racist

And the github issues "Fire this guy from the project because he made a rape joke in 2007 on Twitter"

MechMK1

9:08 AM

A comment I made on The Workplace got deleted :D

Probably too offensive to tell someone they did a bad thing

MechMK1

9:20 AM

If you could include any three characters into Smash, which one would you include?

M'vy

Is Political Correctness a character somewhere? Cause if yes, it will be the doom of everyone

MechMK1

@M'vy I'd honestly pick Remilia Scarlet as a sword archetype, Marisa Kirisame as a zoner and Yukari Yakumo as a tech-based character

Final Smash of Remilia would be a huge magical attack with her spear Gungnir, similar to Ridley's Skewer, but more visually entertaining

Final Smash of Marisa would be MASTER SPAAAARK, which is basically a huge beam like Samus Aran

Final Smash of Yukari would be the Border of Life and Death, basically a clone of Zelda's final smash

MechMK1

9:41 AM

The fact that Touhou is actually quite big in Japan puts this "Touhou in Smash Ultimate" thing in this uncanny valley of "Maybe it might be possible"

Conor Mancone

11:36 AM

Irony:

zdnet.com/article/dod-disa-discloses-data-breach

MechMK1

@ConorMancone Well, they are a prominent target

More difficult to remain secure if people actively attack you every day

Conor Mancone

An agency inside of the DOD, which is in charge of secure communications and IT support, had their systems breached

@MechMK1 Indeed, but I still find it funny! This is actually one of (I think) the best arguments against the recent push for putting backdoors in encryption

MechMK1

@ConorMancone The people who argue for backdooring encryption still think there is a difference between "consumer" and "military"/"government" encryption

Yes, even people from the government think there is.

Conor Mancone

Especially if a government agency somewhere has easy and direct access to a large number of external and "secure" systems , it will simply become too big of a target

MechMK1

And you have to say: Do you want that the algorithms used to secure your nation's most confidential data have a single point of failure?

Conor Mancone

11:41 AM

What was the malware campaign that caused a large amount of damage and turned out to be propogated by a 0-day that some branch of the US government was holding onto but accidentally leaked?

@MechMK1 why yes, yes I do

This is going to bug me until I remember which one it is... It's on the tip of my tongue....

MechMK1

ETERNALBLUE

Conor Mancone

YES!!! I had "deep blue" stuck in my head and knew that wasn't it

MechMK1

Yes, eternalblue was such a shitshow

But when I try to convince people that backdoors are not a good idea, I use lock analogies

I say "Imagine there was only one producer of locks, and everybody had to use those. Do you want those locks to be secure? or not?"

And if they say they want those locks to be secure, then the result is that the bad people will also have access to secure locks.

And if they say they want insecure locks, then ask them why they want a lock in the first place.

"But can't we give the bad guys bad locks?" - No, we can't. There is only one company, and we can either make all locks good, or all locks bad.

Conor Mancone

1:20 PM

Locks are definitely the go-to analogy for anything security related. I still really hate the modern discussion about "responsible encryption". I vomit a little everytime I hear that phrase...

MechMK1

@ConorMancone It's such a loaded topic

You can make anything sound arguably in your favour by adding loaded terms like "responsible" to it

"responsible", "common-sense", etc...

Because it not-so-subtly implies that those who argue against you are irresponsible and lack common sense.

E.g. "We don't want to ban anonymity, we just want to make responsible identity laws to prevent anonymous hate crimes"

Conor Mancone

Unfortunately various governments are smart enough to choose their words in such a way to make their points sound as appealing as possible. More unfortunately, they aren't smart enough to be trusted with backdoors everywhere (although to be fair, no one is, which is pretty much the point)

MechMK1

I remember a time where you could call people "retarded" without getting banned or called a Nazi or without people trying to call your employer and getting you fired

I swear to God if I ever have a company and someone calls me and explains that one of my employees used the word "Retarded" online, then I'd say it's their damn right to do so

@ConorMancone Putting backdoors into every encryption algorithm on the planet is not a good idea. But on Government, it is. Government, not even once.

Protip: Micro-Aggressions can be countered by Micro-Not-Giving-A-Fuck

UwU

2:05 PM

I've been digging around the most downvoted questions on ISSE and it's

just a joyous experience

MechMK1

@UwU What did you dig up?

UwU

My favorite is this one

-12

Q: Viable way to ruin a milk corporation?

Hack into their system and change the "Sell by" date so that it is immediately bad. How long do you think until they notice, if you pull it off?

MechMK1

The deleted answer:
> That seems like a lot of work. Have you considered cowpox?

To be honest, I only wanted to get to 10k rep so I could see deleted posts

UwU

Amazing

MechMK1

We have some really good deleted answer

Let me quickly look one up

UwU

2:13 PM

This one is bizarre

-9

Q: Need more options

since I learned coding I was writing on a 7 year old laptop, sadly it's gone now, so I need a new one. I've been thinking all night about wjat I can do, I could only think of some small posssibilities, I asked here because maybe some of you could give me more options. I have a Drive-by download ...

virus

MechMK1

pastebin.com/0XgCnBCw

This one was too long to paste here

@UwU I like the fact that everyone takes this guy serious

UwU

Snowden is that you?

It's just so..... so edgy

why is it so edgy

MechMK1

Every time a kid got mad at me on the internet and threatened to hack me, I would openly invite them to do so

@UwU Edge is the currency of angsty teenagers

UwU

-6

Q: I want to learn hacking but unable to connect to internet

I'm not sure if this is offtopic or not but i'll ask it anyway. Im 15 and i am into web design and development, working on PHP and MySQL. And i want to learn hacking but unfortunately my windows computer doesn't have access to the internet. There are some open public wifi connections but my pc's ...

php wifi

ah yes

wanting to hack at 15

MechMK1

The problem is that those who want to learn "how to hack" want to do it to impress their peers and seem cool and mysterious

It has nothing to do with a desire to become knowledgable

UwU

2:17 PM

he doesn't realize it's boring as shit

MechMK1

Well, not always. But you can only really understand the cool parts if you are part of the real hackers

UwU

having that leaked Zynga database doesn't make you cool

maybe xxs makes you look cool

it made me feel cool when I learned it

MechMK1

The cool parts are something like "Look, I can write to this part of memory after spending 200 hours researching how to do that" and not "I press one button and facebook is down"

All of those hacker fantasies, because that's what it is if we're honest, are just fueled by movies

You could just as well say I want to be a ninja

UwU

-6

Q: White Hat Communities

I've been searching Google for a bit and I'm having difficulty finding credible White Hat forums. For example, when one wants to discuss bitcoin they go to bitcointalk, is there a white hat equivalent? Edit: My goal is to assemble an appendix of communities that an individual learning about c...

career

Fire Quacker

But... I'm a ninja hacker already...

UwU

2:20 PM

Loving the comments on this one

MechMK1

@FireQuacker Yeah, but you were that before it was mainstream

The funny thing is that Sec.SE is a white hat community

The DMZ is this dark mysterious place where the arcane knowledge of cyber security is gifted to only the most promising aspirants, and also where MechMK1 comes to shitpost monday to friday.

UwU

wonderful

Fire Quacker

@MechMK1 I dunno. There are a few users who have interesting... stories

UwU

-6

Q: How i can stop already sent email?

I have a Gmail account. Unfortunately I have sent an email from my Gmail account. How I can stop or back this email ?

email email-spoofing

first stage of grief

MechMK1

@FireQuacker Rory is kind of an important guy, Conor has a PhD, schroeder worked for a bank, etc...

Fire Quacker

2:23 PM

How about forest?

MechMK1

I know enough about forest to know that the less I know of forest the better it is for me.

But man, I miss him

@UwU Reminds me of the guy who made a bomb threat to his university, then tried to play it off as a prank

UwU

oh yikes

"it was just a prank guys please don't send the police"

MechMK1

Yeah that was a big oof moment for him

UwU

I had three threats called on my highschool

one was so bad they told us not to come

Fire Quacker

How is one called in threat worse than another?

UwU

2:25 PM

the kids doing it always get caught

apparently he had some proof there was a bomb in my school (?)

we weren't really allowed to know

MechMK1

**Situation:** An important exam is coming up and you did not learn enough. How do you react?
a.) Take the exam anyways, hope to get at least a passing grade and if not, take it again
b.) Call in at least three days before the exam and say you want to take the exam on another date.
c.) Go to your doctor and claim to be sick, so you get an excuse as to why you didn't attend.
d.) Send a fake bomb threat from an anonymous e-mail address to have the exam cancelled.

UwU

you can't hide behind spoofed emails and phone numbers for long

Fire Quacker

@MechMK1 That question is disturbingly relevant to me

MechMK1

@UwU At least, stupid teenagers who are too dumb to learn for an exam can't

@FireQuacker Pick A or B, trust me

Fire Quacker

It's gonna be A. I paid for the test already.

UwU

2:28 PM

Good on you

you'll pass

MechMK1

I believe in you

I winged so many of my tests, I don't even remember

I was a terrible student

Like, the worst kind

UwU

I have 3 exams next weej

*week

MechMK1

I'm not even dumb, just lazy as fuck

UwU

I know that feeling

I just don't want to learn shit that won't ever apply to me

MechMK1

"You know, you could achieve great things if you just put in some effort" - "Yeah, but I can achieve mediocre things by putting in no effort, and I can put in all the remaining effort into things I actually enjoy doing"

UwU

2:30 PM

I might not be the best cyber security expert out there, but I think I don't need Calc 3

oh lord

-6

Q: Someone claims to have hacked my WiFi. What do I do now?

My son plays Minecraft on the internet. Someone said they hacked into his WiFi. Our WiFi is locked and must have a passcode to access. Is it possible this happened and, if so what should we do?

wifi router

MechMK1

Well, this isn't a bad question

I think it's actually fairly reasonable

UwU

"My son plays Minecraft on the internet"

just that line

MechMK1

Yeah, but there are enough parents who have no idea about computers and they'd believe that

UwU

fair enough

MechMK1

It's not a bad question, just a question from someone who has no clue

Bad questions have no context, no clear goal, often not even a question

Fire Quacker

2:33 PM

Kind of wonder if it will be worth creating a canonical question to point all the "somebody hacked my wifi" people to

MechMK1

They're just loosely coupled ramblings held together by brief moments of lucid thought

UwU

like this one?

Fire Quacker

Particularly the clearly paranoid ones

UwU

-6

Q: where can I find list of zero day vulnerability?

I want to have list of zero day vulnerability, Could any one intuduce some site which annonce them?

zero-day vulnerability

MechMK1

The answer is soooo good though

UwU

2:34 PM

the answer is amazing

MechMK1

-1

Q: How did (in particular) Americans just go along with the concept of having to own and show "photo id" everywhere?

I remember hearing or seeing a documentary or something a "long" time ago, likely in the early 2000s, about how a lot of Americans (USAians) refused to show an "id" even when voting, where it might possibly be justified to demand some form of identification in order to prevent duplicate votes (if...

privacy physical identity tracking security-theater

This for example is a bad question

It's off-topic and basically just a rant

M'vy

opps

0

A: Someone claims to have hacked my WiFi. What do I do now?

It's psychological warfare, their true goal is to get you scared/angry enough to cut your son's funding, taking him out of the game. That being said, if you're running an off-the-shelf router you're quite vulnerable. Check this list of free and open-source router firmware and then either flash y...

UwU

Ah yes I see you are a man of culture as well

M'vy

Seems quite a bad advice to ask non technical person to go mess with non main-stream open source stuff

MechMK1

What? ahh I didn't see what M'vy posted

M'vy

2:37 PM

@UwU ;)

UwU

-5

Q: Adobe Photoshop has killed my creativity by introducing so much anti-privacy, anti-security, and dumbed-down bloat

I could pick so many angles to this, but I will focus on a very famous piece of software which has been utterly ruined in recent years: Adobe Photoshop. This is not a rant, but related both to software design and psychology. These days, it is not possible to install it on a PC without going thro...

privacy software security-theater cloud-storage software-engineering

Why don't these people just write an essay

MechMK1

Yeah, I saw that one

The platform I usually go to when I need to rant is...

I mean well, you're on it right now

UwU

-5

Q: Password of Information Security

Which one of the following statements about a password is TRUE ? a) It must be changed only if it is compromised b) It cannot contain special character symbols c) It must be registered with the system administrator d) It should be changed regularly

passwords

Quiz questions may be my favorite

MechMK1

People mis-using SE in general

It's part hilarious, part sad

A. Hersean

@MechMK1 That's humanity

MechMK1

2:39 PM

Do you want to see one of my finest troll-posts ever?

40

Q: How to deal with apathetic co-worker?

I work in gastronomy in a rather small restaurant. The co-worker I spend most of my work-day around has become more and more apathetic over the past few months. It was a very gradual change, so I am uncertain if it has to do with a specific event. I generally enjoy my job and try to be in a good...

colleagues europe

I'm really proud of that one

A. Hersean

@MechMK1 Rhetorical question. You will post it even if we write "no" just to troll us.

UwU

-5

Q: hashing, salting - but also sugar and pepper? Uncrackable?

What do you think is the best way to store a password in the database? I suggest: hashing using something way better than MD5. But what? salting with a very cryptic non-readable salt such as DonKEYFace or something "sugar" - some energy. Timestamp! and check it with the db later "pepper": has ...

passwords databases

MechMK1

@A.Hersean of course I would

UwU

"And please, do not just point to theory. Everyone knows that already. Do some calculations! Show me how quickly you could decipher this!"

MechMK1

@UwU "You can't crack this message, therefore it's safe" is the biggest fallacy in cryptography

UwU

2:41 PM

don't ask me to do more work than I want to for your question that you have put 0 effort into

MechMK1

Especially for amateur cryptographers, and I'm using that term loosely

UwU

I usually go by the idea that if people want to crack something, they will crack it

MechMK1

Well, in cryptography, you need to be sure of the claims that you are making, and how to prove them

For example, an attacker may not need to know the content of a message, only that two identical messages were sent to two different people

M'vy

Once you get in mind that security is a trade-off, you really don't care about these so much.

MechMK1

@M'vy In which way?

M'vy

2:43 PM

a.k.a. "Given sufficient resources, one can achieve to go around any security".

MechMK1

@M'vy Yeah, so all I need to do is to make this task more resource intensive than the asset is worth to the attacker

M'vy

Then security really is: how much resources you want to spend, to make it difficult enough to discourage someone who can't/won't invest that much resources

MechMK1

If you could spend 1.000.000.000 USD to get access to my 239.41 USD bank account, then you successfully wasted a lot of money for nothing.

M'vy

I mean, you could have trillion dollars invested in security to protect the gov stuff. If you are willing to invest a million you probably can find someone willing to extract info X for you without having to defeat the main security system they put in place.

MechMK1

@M'vy Yeah, but I've been preaching for a long time now that completely ignoring people is a terrible idea

So many companies are like "It's just reachable internal, so we're 100% safe"

No!

M'vy

2:47 PM

"Path of least resistance"

MechMK1

Your employees aren't nearly as trustworthy as you may think

UwU

Like the bar of chocolate for your password study

M'vy

They are trustworthy up to the amount you're willing to pay them to be trustworthy.

Fire Quacker

@M'vy Like this xkcd? xkcd.com/538

MechMK1

I tell you what, I'll go downstairs and give people chocolate in exchange for their Windows password and I'll get tons of them

M'vy

2:48 PM

And by pay, I don't mean necessarily money.

UwU

I don't understand why people don't just say some random shit and take the chocolate

I mean, that's what I would do

M'vy

It could be trust, loyalty, autonomy, well being, feeling protected etc

MechMK1

@UwU Maybe some did, how would you know?

UwU

God I hope some did

that gives me a little more faith in humanity

M'vy

@FireQuacker yep

UwU

2:50 PM

-5

Q: How could an attacker have gained remote access to my laptop?

I have a 15 yr old daughter who's become not only a certified Microsoft Expert, but by pure accident, it came to my attention she'd long ago created a SPLIT network connection on our internet, HIDDEN from my view. I've had numerous problems such as errors when trying to open certain web pages...e...

privacy access-control remote-desktop tunneling

how did we miss this prodigy child?

MechMK1

I honestly don't know what these people are trying to do

A low-effort troll maybe?

I recall a question on SO a few years back where a guy used the phrase "c+plus"

UwU

that sounds like something I would type

MechMK1

I doubt any of the above-stated is anything but fiction

Oh my god, it reminds me of that 15 year old kid!

It was soooo funny

There was a 15 year old kid who made a facebook account, pretending to be 25, ultra rich, having a sex-obsessed 18-year-old girlfriend, etc...

UwU

oh yikes

MechMK1

The funniest thing came when his mother discovered the account and ratted him out

UwU

2:54 PM

oh no

MechMK1

"My son has a very vivid imagination, and I'm sorry for everybody whom he may have offended"

Fire Quacker

@MechMK1 I mean, if you aren't technical in any way and you don't trust your kid, and then your helpful technician is one of those guys who mumbles a bunch of jargon and you don't understand what he's saying...

MechMK1

@FireQuacker the question isn't written in that way. It has too much jargon in it

People who know nothing usually state how they don't know anything about some topic

UwU

you gotta master the art of acting clueless

MechMK1

A good troll is one that convinces everyone he is no troll

UwU

2:56 PM

too stupid you're faking, too smart you're lying

MechMK1

Like Robert fucking S.

@RobertS. OK, so... I'm probably crazy but after reading your question I am seriously considering whether your coworker is called Squidward Tentacles and you work in the Krusty Krab — and the fact that your own name is essentially Bob is not helping at all. — walen Jun 5 '19 at 8:15

It took me so long to come up with that script

But you know what the best part about it is? It is, after taking all the comedy away, still a good question

M'vy

> While this may not be what you were asking, it might help. Your kid is clearly talented, and more to the point is obviously bored. Point her at the Certified Ethical Hacker qualification, it will take her mind off mischief and will set her on a decent, challenging and respectable career path doing something she loves. – Chet S May 6 '14 at 8:00

MechMK1

And that's what makes it such a good troll

UwU

Amazing

-4

Q: how can one find the honeypot

how can one find the honeypot while want to observe the other hackers.

honeypot

MechMK1

@M'vy If it's true, a good advice

M'vy

2:58 PM

mhmm

MechMK1

@UwU Usually winnie the pooh has one nearby, you gotta ask him

UwU

high quality response right there

M'vy

How do you find honeypot. Just smell the air for honey scent?

MechMK1

The "the" makes this question so good

M'vy

XD

Fire Quacker

2:59 PM

The big honeypot in the sky where all good hackers go!

MechMK1

"How can you determine if a server or service is a honeypot?" would be too on-topic. "How u find the honeypot?" is so much better

M'vy

The mother of all Honeypots

UwU

"while want to observe the other hackers"

other?

are you a hacker sir?

Fire Quacker

Clearly, they are a hacker and want to learn from others...

MechMK1

You don't know? All the cool hackers meet in the honeypot

Fire Quacker

3:00 PM

You thought they were going to use a honeypot for good things?

MechMK1

It makes me sad that the DMZ is not called "The Honeypot"

Fire Quacker

Honeypot would be more fitting

UwU

"bro you wanna hang out in the honeypot tonight?"

"sorry bro i'm hacking the NSA tonight"

MechMK1

@RoryAlsop Who do I need to pester to make a petition to rename the DMZ to "The Honeypot"?

@UwU I wish hacking was more like in Shadowrun

UwU

honestly though

"I rolled a 18."
"You get into the bank."
"Ez."

-4

Q: MPR I suppose somehow I found a way to make a super hacker angry with me

I suppose somehow I found a way to make a super hacker angry with me. I've lost three cellphones. It might have all started with the iPhone 4 getting locked then both androids to simlock. And I'm at three laptops to this ignorant Windows mpr rewriting boot that starts as soon as I turn on the scr...

attack-prevention

what qualifies as a super hacker?

MechMK1

3:04 PM

You clearly didn't ever play Shadowrun or you'd know it's played with a D6

UwU

yikes you caught me

MechMK1

Off to impostor jail you go

UwU

i swear my friend used a d20 when he played

MechMK1

Your friend played the illegal D20 edition

M'vy

@MechMK1 you can post on meta.sec.se

UwU

3:06 PM

sorry guess i'm not a nerd

MechMK1

How do people feel about this idea? Would you like to see the DMZ being renamed to "The Honeypot"?

UwU

I think that's a great idea

MechMK1

@UwU Everyone can be a nerd if they want

M'vy

Don't know, I'm used to it now ;)

UwU

-4

Q: Are the only people who can work in security those who were learning from 10 years old?

I'm a second years Master student in computer science. As time passes, the more my desire to work in computer security increases. I have many friends who are more experienced than I, who told me that I'll not be able to work in this area, because most of the people who are working in this area ...

linux

MechMK1

3:08 PM

0

Q: Can we rename the DMZ to "The Honeypot"?

I know it's a silly request, but I just feel like name would fit the theme of Information Security better. It was also inspired by this rather funny question, where somebody wanted to create a honeypot to watch other hackers. Would people like to see this change?

feature-request chat

UwU

10 year old hacker gang rise up

MechMK1

"This post was made by 10 year old hacker gang"

We put the kid in skiddie

UwU

"I know your ip address don't mess with me"

MechMK1

Yeah, as I said above I had plenty of kids say that to me

I even helped them

I told them what OS I was running, etc...

One tried to explain to me how they can hack my gmail account if I told them my e-mail address

It was funny

UwU

oh now that's just the best

They think that online accounts are just like real locks. You only need a paperclip and string to get into them.

MechMK1

3:14 PM

@UwU I actually once picked a lock with two paperclips

It was the coolest moment of my life. Everything else paled in comparison.

UwU

That's the key skill to picking up chicks

ba dum tss

MechMK1

Actually my girlfriend was completely unimpressed by that

M'vy

You might wanna use something a bit more flat and a paper clip actually

MechMK1

@M'vy It was a bit of an older lock already, so it was very easy to get the clip in

MechMK1

3:31 PM

Man, it's one of those "It's friday and MechMK1's report isn't done yet because he kept wasting time on the DMZ" posts

Fire Quacker

You got caught in The Honeypot

2

MechMK1

> mfw

Gregor y

8:25 PM

is there such a thing as roll your own non-crypto? ie doing something unique-ish to the password before it gets hashed so that you can say hey they had to illegally reverse the code in order to be using our internal APIs

Fire Quacker

So not a security feature but a sort of watermark to prove somebody was reverse engineering your stuff?

Gregor y

yeah

Conor Mancone

@MechMK1 So sad! In movies though picking locks is extremely easy, so I suppose you could always blame that on movies setting the bar really low

Fire Quacker

@Gregory Interesting. I don't think I've heard of anything like that

Not sure how necessary it would be. Is it that hard to show that somebody's reverse engineering your stuff? (IANAL)

Conor Mancone

This guy:

-1

Q: How to embedded exe file into png file such that when png file open then exe file also open with png?

No code yet.I have used binary and base64 to embedded exe and png file into png.But none of these method works for me.Because when I run png file exe is not run.I didn't why?I need help in this project saveFileDialog1.InitialDirectory = @"C:\"; saveFileDialog1.Filter = "PNG (.png)|.png|J...

.net

Reminds me of my very first attempt at programming (maybe I shared this story before?). I had an old DOS game that I loved to play, but it was a bit buggy and would always crash at the worst possible time. I had a vague understanding of "if" statements and what-not, so decided I could fix it myself. I opened the .exe file up in a text editor, fully convinced that I could find and fix the bugs

Naturally, opening a txt file in a text editor was a completely unsuccessful venture, and I was forced to conclude that I had absolutely no idea what I was doing and was a complete fool to even think that I knew what I was doing

Pretty much the text book example of the dunning-kruger effect.

Gregor y

8:48 PM

@FireQuacker I just see the boilerplate "Do not look at this code" legalese in the js files, and was wondering if it would be easier to prove that this was done if there was custom uh.. "obfuscation code?"

Rory Alsop

9:27 PM

@MechMK1 the correct route is to open a question on meta, however this was done previously and The DMZ was voted in

Fire Quacker

@RoryAlsop Ah, but "Honeypot" wasn't suggested at the time. Maybe the users these days are more clever :D

MechMK1 already opened a meta question: security.meta.stackexchange.com/questions/3353/…

Rory Alsop

Remember, honeypot is where you expect to trap enemies. DMZ may have good and bad mixing together in an environment that isn't safe but has done controls

Fire Quacker

As far as good and bad, the chat isn't too far different from the main site. And chat sure doesn't sit between Google (the "outside") and anything.

Meanwhile, chat could conceivably be a place where all the ~~cranky~~ sarcastic people (insider threats) get slowed down by participating...

Transcript for