DMZ, please distract me from work

Everyone, including myself, is working from home now. We're using meeting apps like Zoom. Assuming the meeting app's communication is insecure (like how Zoom is lacking on E2E encryption), what would you use to make the Zoom app's communication more secured?

My 1st thought is to have the company/university host a VPN server.

actually I'm gonna post that question

@JohnZhau How to make an unspecific meeting app more secure? Or how to make Zoom more secure?

Assume unspecific

Zoom is a good example for now though

Prefer on-premise solutions over cloud solutions

Zoom is widely popular, but it's really shit

And their security techniques are...questionable at best

Google Meets still works but some of our professors are using Zoom

I had to install an extra app...

from the AUR...

Using extra apps for everything can be annoying

Especially if you don't trust these apps either

Zoom is so popular because, as far as I am aware, you don't need an app

btw is my question OK or should I just delete it?

I couldn't load Zoom on my browser for some reason so I had to install it...

Seems fine to me

I honestly prefer MS Teams

I have kind of a hard time finding a good guide for securing my PC. Most of the posts I find are rather basic and/or use common sense. I wanna try doing some more hardcore blue team stuff on my PC. I've learned about Snort so far and I'm using firejail on most apps. Any tips?

I would use Tor but my WiFi is already hellishly slow...

and I can't really trust free VPNs...

Most "How do I secure my PC?" guides that go completely in-depth are defending against adversaries you don't have

Since you mentioned VPNs: Why would you use a VPN?

VPNs help to encrypt the traffic. Also, a good 3rd party VPN can bypass location restrictions.

You know what also encrypts traffic? HTTPS, which is what 95% of the internet uses these days

This is just for fun and learning. I probably won't be targeted enough to need a corporate level security system but it's nice to learn anyway.

This is mostly for learning.

and fun

I don't have much money to put in a safe but I still want a high-security safe. A bit of that feeling.

Well, here is the point: VPNs do fulfill a purpose, but that purpose isn't to secure your traffic

Even if I don't need a VPN right now, I still would like to use one.

But for what?

Just cause I like it?

For fun and learning.

To learn what?

Defensive security.

You have fallen into this advertising trap, that makes you believe using a VPN has anything to do with security

I'm mainly looking around at anomoly detection right now.

It does, but not in the way you think

Do you know how you can actually use a VPN for security?

Well VPN does help to avoid spoofing at least, right?

Imma go look up some more on VPNs

Spoofing of what?

Wifi APs?

All those VPN ads on YouTube... MINUTES OF ACADEMY TRAINING WASTED??!

Yes, they're all bullshit

What a VPN does is connect you to a remote "local" network as if you were there

I do know (I hope) that a VPN can make me be "in a local server", as in give me a temp key

Yay at least I got 1 thing right

So imagine you have a server inside your home network that is not accessible outside. You can use a VPN to connect to your home network and act as if you were home

So using a VPN with Zoom, is that no good?

It won't help with any of the fundamental design flaws of Zoom

Do VPNs not provide traffic encryption?

Yes, between you and the VPN gateway

But as I said, most traffic is already encrypted anyways

Double encryption will not make it safer

If 2 people use a company VPN to talk to each other on Zoom, which lacks E2E encryption, does that make it safe? Since It's A <-> VPN <-> B

No, because everything is still happening on the Zoom servers

So Zoom can theoretically spy on you

The way it actually looks like is A <=> VPN <=> Zoom <=> VPN <=> B

I was wrong and I'm happy about it.

I suppose an outsider can spy on the VPN <-> Zoom line then?

Exactly!

A VPN doesn't make your internet more secure. It just changes your "entry point" to the internet

@MechMK1 Sorry, I'm slow today. Here's the article my wife and I were talking about that made me angry. Now that I think about it though, I really wish I did have drones floating around outside my house to monitor me 24/7 and yell at me to go back inside... Letting my dog go to the bathroom inside shouldn't be a big deal at all! It's really a shame that we're not as cool as China :(

usatoday.com/story/news/world/2020/04/01/…

@JohnZhau I think you're off to a good start, but a bit more specificity to answer schroeder's question wouldn't hurt. Are you worried about zoom seeing your meeting contents? About external actors "hacking" your feed and jumping into your meeting? Etc...

@ConorMancone I'll read that immediately :D

Oi, I had the VPN discussion with my boss a few days ago

They're really pitching it hard on YouTube, aren't they?

Every disaster is an opportunity for someone, be it government or salesman...

Yeah, it's horrible

In other news, there are a lot of new companies pitching amazingly accurate fever detecting cameras

Don't buy them

I mean, if you want to shell out a few thousand, that's fine, but the cameras aren't going to keep you very safe

Times of uncertainty are golden ages for snake oil peddlers.

TBH my meetings don't really involve sensitive information and usually only the lecturer talks so there's not much to worry about. However, I was considering how many have their meetings flying around unencrypted.

Well, it's still a matter of principle. I'm not doing anything sensitive right now, but if someone crawled up the wall and insisted on staring into my apartment through my windows, I'd feel creeped out

And I'd also get my gun

Just in case

He'd like to see it

Because it's really cool

I'm usually a track of all trades type. I like learning lots of different stuff, from networking and binary exploit to lock picking and electronics. Do you often have such types on your team or is it mostly people specializing in a few things?

We have both. We have people that want to try everything, and we have people who are like "Reverse Engineering is what I do. I eat, I sleep, I reverse."

Just out of curiosity, what's the longest operation you've had?

Which I was a part of or which I did completely on my own from start to finish?

either

I just like asking these random questions tbh

Longest one is still going

How often do you get 1-person operations?

I'm gonna die sooner or later anyway

I once thought "When I'm one my death bed, I wanna hear a national top secret fact just before I die"

I could be sarcastic and say "Unlike other people, who are generally immortal", but instead I opt for the friendlier "As we all do"

I'm now doing things I quite hated just a few years ago, like reading long articles and watching conferences.

New enjoyments

Conferences can be dope, especially if you're like 40 minutes in and the guy says a joke so incredibly offensive that your first reaction is "holy shit!" and your second reaction is to look around who is offended the most.

And then you return to listening to a guy speak about microprocessor architectures

I kinda wanna one day see a boring DEFCON presenter get cuffed by a fed live on stage with my own eyes.

Has that ever happened?

idk bit it sounds interesting

my good 'ol random thoughts

Blackhat might be interesting to go to some day

I've never been to a conference

Thanks to those random thoughts, I often get ideas for small projects and things to try.

Not anytime soon due to...*rolls d20* "The Unpleasantness"

Shmoocon is another one

I stumbled across this talk recently:

Ransomware Response?

1.) Take your system offline

2.) Restore from backup

3.) Fix your entry vector

Ah, but you skipped a step

You should have verified that it really was ransomware

I assume my files don't randomly encrypt themselves

Yeah, but you're checking in that case

If you start out from User reports that there is ransomware you will need to verify that they didn't just get a pop up while browsing the internet, or an extortion email

Luckily, nobody will ever have to report to me that there is ransomware

The only person who would do that is me

And if I would have to do that

Well, see above

Is it usually 1 operation for 1 person at a time or does 1 person often work on multiple operations?

First of all, we call them projects

And usually it's more people per project, not more projects per people

So 1 person usually doesn't get multiple projects at once?

No, why would they?

figures

So, time for me to go

See you around

cya

c ya boiiiiiii

Imagine me dabbing right now

Because I am

We usually don't even say "thanks" on SE, as far as I know

But ironically

@JohnZhau The DMZ is different

You can say whatever the fuck you want :D

but bye

yeet

but the FBI may be on us

@MechMK1 that's not quite the whole picture. The reality is that NHS staff have always been able to refuse to treat non-critical patients who are aggressive or physically violent. Now harassment, bullying and discrimination are included.

This does not include critically ill patients (probably because they can't be violent, aggressive or harassing)

And it's about time - I'm very happy they have brought this in

My wife is a nurse - used to by in Cardiothoracic ITU - and even there they had patients who would try to attack staff, spitting on them, swearing at them etc

@RoryAlsop I think it's a step in the wrong direction. Sure, I think it's absolutely wrong from people to act violent or aggressive, especially if they then expect that person to help them

@RoryAlsop I've worked in a hospital. Some patients can truly be...difficult

Especially those who suffer from substance withdrawal

My wife is a nurse - she had many years in cardiothoracic intensive care wards, some in psych, some in more general wards. The number of times she and colleagues suffered attacks and bullying is horrific. If people harass her or other staff I'm more than happy they get booted out the door

@RoryAlsop From a personal point of view, I really understand it

But from a philosophical point of view, I think it sets a bad precedent

@MechMK1 A service that will provide care that is free at point of need to all is great, but not if you want to attack those providing it. That, in my mind, is the attackers way of saying they don't want care

Because as I argued before, who gets to decide what is "sexist" or "racist"?

@MechMK1 that's pretty easy, honestly

and in fact is written into guidance in the UK

so it's already decided

Can you show me, please?

I'll get a look later on - am flitting between meetings right now

Yeah, I was so too

Everybody loves their meetings these days

I hope at least yours will be informative

@MechMK1 this next one will be, at least

oh - starter googling: en.wikipedia.org/wiki/Hate_speech_laws_in_the_United_Kingdom

So like when Count Dankula made a joke?

And the judge ruled that context doesn't matter? Seems a bit weird to me

@MechMK1 Count Dankula was deliberately racist to offend people. He wasn't even an edge case where it could be argued that conext was important

@RoryAlsop And? In my opinion, nobody has the right to not be offended. Comedy is subjective, and I personally found his video hilarious.

I believe threatening to send someone to jail over a joke is beyond authoritarian.

Has anyone done testing of a client app's SSL cert verification?

There's a few scenarios I'm struggling to test

e.g. I want to set up a server that returns a chain of two certs, where both are self-signed

can't figure how to get openssl s_server to return two certs

The scenario I really want to try is a chain of (1) A valid, root-signed leaf certificate and (2) A certificate for the correct CN, signed by the leaf certificate