« first day (3402 days earlier)      last day (98 days later) » 

8:27 AM
DMZ, please distract me from work
 
 
3 hours later…
11:16 AM
Everyone, including myself, is working from home now. We're using meeting apps like Zoom. Assuming the meeting app's communication is insecure (like how Zoom is lacking on E2E encryption), what would you use to make the Zoom app's communication more secured?
My 1st thought is to have the company/university host a VPN server.
actually I'm gonna post that question
 
11:31 AM
@JohnZhau How to make an unspecific meeting app more secure? Or how to make Zoom more secure?
 
Assume unspecific
Zoom is a good example for now though
 
Prefer on-premise solutions over cloud solutions
Zoom is widely popular, but it's really shit
And their security techniques are...questionable at best
 
Google Meets still works but some of our professors are using Zoom
I had to install an extra app...
from the AUR...
 
Using extra apps for everything can be annoying
Especially if you don't trust these apps either
Zoom is so popular because, as far as I am aware, you don't need an app
 
btw is my question OK or should I just delete it?
I couldn't load Zoom on my browser for some reason so I had to install it...
 
11:36 AM
Seems fine to me
I honestly prefer MS Teams
 
I have kind of a hard time finding a good guide for securing my PC. Most of the posts I find are rather basic and/or use common sense. I wanna try doing some more hardcore blue team stuff on my PC. I've learned about Snort so far and I'm using firejail on most apps. Any tips?
I would use Tor but my WiFi is already hellishly slow...
and I can't really trust free VPNs...
 
Most "How do I secure my PC?" guides that go completely in-depth are defending against adversaries you don't have
Since you mentioned VPNs: Why would you use a VPN?
 
VPNs help to encrypt the traffic. Also, a good 3rd party VPN can bypass location restrictions.
 
You know what also encrypts traffic? HTTPS, which is what 95% of the internet uses these days
 
This is just for fun and learning. I probably won't be targeted enough to need a corporate level security system but it's nice to learn anyway.
This is mostly for learning.
and fun
I don't have much money to put in a safe but I still want a high-security safe. A bit of that feeling.
 
11:44 AM
Well, here is the point: VPNs do fulfill a purpose, but that purpose isn't to secure your traffic
 
Even if I don't need a VPN right now, I still would like to use one.
 
But for what?
 
Just cause I like it?
For fun and learning.
 
To learn what?
 
Defensive security.
 
11:46 AM
You have fallen into this advertising trap, that makes you believe using a VPN has anything to do with security
 
I'm mainly looking around at anomoly detection right now.
 
It does, but not in the way you think
Do you know how you can actually use a VPN for security?
 
Well VPN does help to avoid spoofing at least, right?
Imma go look up some more on VPNs
 
Spoofing of what?
 
Wifi APs?
All those VPN ads on YouTube... MINUTES OF ACADEMY TRAINING WASTED??!
 
11:49 AM
Yes, they're all bullshit
What a VPN does is connect you to a remote "local" network as if you were there
 
I do know (I hope) that a VPN can make me be "in a local server", as in give me a temp key
Yay at least I got 1 thing right
 
So imagine you have a server inside your home network that is not accessible outside. You can use a VPN to connect to your home network and act as if you were home
 
So using a VPN with Zoom, is that no good?
 
It won't help with any of the fundamental design flaws of Zoom
 
Do VPNs not provide traffic encryption?
 
11:56 AM
Yes, between you and the VPN gateway
But as I said, most traffic is already encrypted anyways
Double encryption will not make it safer
 
If 2 people use a company VPN to talk to each other on Zoom, which lacks E2E encryption, does that make it safe? Since It's A <-> VPN <-> B
 
No, because everything is still happening on the Zoom servers
So Zoom can theoretically spy on you
The way it actually looks like is A <=> VPN <=> Zoom <=> VPN <=> B
 
I was wrong and I'm happy about it.
I suppose an outsider can spy on the VPN <-> Zoom line then?
 
Exactly!
A VPN doesn't make your internet more secure. It just changes your "entry point" to the internet
 
12:41 PM
@MechMK1 Sorry, I'm slow today. Here's the article my wife and I were talking about that made me angry. Now that I think about it though, I really wish I did have drones floating around outside my house to monitor me 24/7 and yell at me to go back inside... Letting my dog go to the bathroom inside shouldn't be a big deal at all! It's really a shame that we're not as cool as China :(
@JohnZhau I think you're off to a good start, but a bit more specificity to answer schroeder's question wouldn't hurt. Are you worried about zoom seeing your meeting contents? About external actors "hacking" your feed and jumping into your meeting? Etc...
 
@ConorMancone I'll read that immediately :D
 
Oi, I had the VPN discussion with my boss a few days ago
They're really pitching it hard on YouTube, aren't they?
Every disaster is an opportunity for someone, be it government or salesman...
 
Yeah, it's horrible
 
In other news, there are a lot of new companies pitching amazingly accurate fever detecting cameras
Don't buy them
I mean, if you want to shell out a few thousand, that's fine, but the cameras aren't going to keep you very safe
 
1:00 PM
Times of uncertainty are golden ages for snake oil peddlers.
 
1:26 PM
TBH my meetings don't really involve sensitive information and usually only the lecturer talks so there's not much to worry about. However, I was considering how many have their meetings flying around unencrypted.
 
Well, it's still a matter of principle. I'm not doing anything sensitive right now, but if someone crawled up the wall and insisted on staring into my apartment through my windows, I'd feel creeped out
And I'd also get my gun
Just in case
He'd like to see it
Because it's really cool
 
I'm usually a track of all trades type. I like learning lots of different stuff, from networking and binary exploit to lock picking and electronics. Do you often have such types on your team or is it mostly people specializing in a few things?
 
We have both. We have people that want to try everything, and we have people who are like "Reverse Engineering is what I do. I eat, I sleep, I reverse."
 
1:55 PM
Just out of curiosity, what's the longest operation you've had?
 
Which I was a part of or which I did completely on my own from start to finish?
 
either
I just like asking these random questions tbh
 
Longest one is still going
Longest one on my own was 2 weeks
 
How often do you get 1-person operations?
 
2:02 PM
I'm gonna die sooner or later anyway
I once thought "When I'm one my death bed, I wanna hear a national top secret fact just before I die"
 
I could be sarcastic and say "Unlike other people, who are generally immortal", but instead I opt for the friendlier "As we all do"
 
I'm now doing things I quite hated just a few years ago, like reading long articles and watching conferences.
New enjoyments
 
Conferences can be dope, especially if you're like 40 minutes in and the guy says a joke so incredibly offensive that your first reaction is "holy shit!" and your second reaction is to look around who is offended the most.
And then you return to listening to a guy speak about microprocessor architectures
 
I kinda wanna one day see a boring DEFCON presenter get cuffed by a fed live on stage with my own eyes.
 
Has that ever happened?
 
2:10 PM
idk bit it sounds interesting
my good 'ol random thoughts
 
Blackhat might be interesting to go to some day
I've never been to a conference
 
Thanks to those random thoughts, I often get ideas for small projects and things to try.
 
Not anytime soon due to...*rolls d20* "The Unpleasantness"
 
Shmoocon is another one
I stumbled across this talk recently:
 
Ransomware Response?
1.) Take your system offline
2.) Restore from backup
3.) Fix your entry vector
 
2:16 PM
Ah, but you skipped a step
You should have verified that it really was ransomware
 
I assume my files don't randomly encrypt themselves
 
Yeah, but you're checking in that case
If you start out from User reports that there is ransomware you will need to verify that they didn't just get a pop up while browsing the internet, or an extortion email
 
Luckily, nobody will ever have to report to me that there is ransomware
The only person who would do that is me
And if I would have to do that
Well, see above
 
Is it usually 1 operation for 1 person at a time or does 1 person often work on multiple operations?
 
First of all, we call them projects
And usually it's more people per project, not more projects per people
 
2:27 PM
So 1 person usually doesn't get multiple projects at once?
 
No, why would they?
 
figures
 
So, time for me to go
See you around
 
c ya boiiiiiii
Imagine me dabbing right now
Because I am
 
2:31 PM
We usually don't even say "thanks" on SE, as far as I know
 
But ironically
@JohnZhau The DMZ is different
You can say whatever the fuck you want :D
 
but bye
 
yeet
 
but the FBI may be on us
 
2:53 PM
@MechMK1 that's not quite the whole picture. The reality is that NHS staff have always been able to refuse to treat non-critical patients who are aggressive or physically violent. Now harassment, bullying and discrimination are included.
This does not include critically ill patients (probably because they can't be violent, aggressive or harassing)
And it's about time - I'm very happy they have brought this in
My wife is a nurse - used to by in Cardiothoracic ITU - and even there they had patients who would try to attack staff, spitting on them, swearing at them etc
 
@RoryAlsop I think it's a step in the wrong direction. Sure, I think it's absolutely wrong from people to act violent or aggressive, especially if they then expect that person to help them
@RoryAlsop I've worked in a hospital. Some patients can truly be...difficult
Especially those who suffer from substance withdrawal
 
My wife is a nurse - she had many years in cardiothoracic intensive care wards, some in psych, some in more general wards. The number of times she and colleagues suffered attacks and bullying is horrific. If people harass her or other staff I'm more than happy they get booted out the door
 
@RoryAlsop From a personal point of view, I really understand it
But from a philosophical point of view, I think it sets a bad precedent
 
@MechMK1 A service that will provide care that is free at point of need to all is great, but not if you want to attack those providing it. That, in my mind, is the attackers way of saying they don't want care
 
Because as I argued before, who gets to decide what is "sexist" or "racist"?
 
3:01 PM
@MechMK1 that's pretty easy, honestly
and in fact is written into guidance in the UK
so it's already decided
 
Can you show me, please?
 
I'll get a look later on - am flitting between meetings right now
 
Yeah, I was so too
Everybody loves their meetings these days
I hope at least yours will be informative
 
@MechMK1 this next one will be, at least
 
So like when Count Dankula made a joke?
And the judge ruled that context doesn't matter? Seems a bit weird to me
 
3:07 PM
@MechMK1 Count Dankula was deliberately racist to offend people. He wasn't even an edge case where it could be argued that conext was important
 
3:17 PM
@RoryAlsop And? In my opinion, nobody has the right to not be offended. Comedy is subjective, and I personally found his video hilarious.
I believe threatening to send someone to jail over a joke is beyond authoritarian.
 
 
3 hours later…
6:20 PM
Has anyone done testing of a client app's SSL cert verification?
There's a few scenarios I'm struggling to test
e.g. I want to set up a server that returns a chain of two certs, where both are self-signed
can't figure how to get openssl s_server to return two certs
The scenario I really want to try is a chain of (1) A valid, root-signed leaf certificate and (2) A certificate for the correct CN, signed by the leaf certificate
 

« first day (3402 days earlier)      last day (98 days later) »