The DMZ

« first day (3465 days earlier) ← previous day next day → last day (1713 days later) »

Fire Quacker

12:40

The Impending Doom of Expiring Root CAs and Legacy Clients - Scott Helme

1 hour later…

meagar

13:45

If I hypothetically had $300 to spend on "learning" before the end the quarter, what would you all suggest?

Fire Quacker

14:04

@meagar What stage are you at in switching to infosec? Like, do you have a specific type of job that you're aiming for yet?

meagar

... CISO?

More realistically, I'm an extremely senior developer, with a reasonable knowledge of appsec, and I'm looking to round out my knowledge of pen-testing, and generally broaden my knowledge of how to build secure distributed systems.

My actual title is "Security Architect", but... there the CISO position at my company is vacant :p

I already have a Cybrary subscription, because I had $300 to spend last quarter. Are there good courses on pen testing tools on, say Linux Academy? That's $379/year which would eat up the $300 nicely.

Fire Quacker

MechMK1 is a pentester so he might know some resources

I don't know how CISO operates in your company, but you may not want to get into that unless you enjoy doing things like fighting other executives to get approval for better security policies

meagar

14:20

I do, I just don't have the authority to win those fights right now :p

Actually our VP of engineering is great and usually wins those fights for us right now, so I can't complain

Fire Quacker

Have you studied much in the way of networking? OSI model, TCP/IP, Ethernet, etc?

Knowing how networks operate isn't necessary for everything, but it can be very helpful sometimes

Tom K.

14:38

@meagar There are courses for people who want to be CISOs

but you can skip most of this and just read the last 200 tweets of twitter.com/accidentalciso and/or twitter.com/NoFilterCISO (who stepped back from being a CISO a while back, so you might need to scroll down a little)

other suggestions: as you said already, buy a good course on udemy/coursera/whatever and most importantly take the time and do it

spend 100 pound for a VIP subscription to hack the box (1 year) and hack some retired boxes, read the walkthrough when you are stuck for longer than X minutes (depends on how much time you have)

spend the rest of the money on IppSec's patreon and use ippsec.rocks a lot

@meagar it's more effective to learn about architectures - but my guess is that you know about these already.

1 hour later…

Fire Quacker

16:13

I entered [email protected] into Have I Been Pwned and found that it's been pwned on 119 breached sites and 76 pastes.

Makes me curious. How often do developers forget to take the test accounts out of the database?

[email protected] was on 162 breached sites and 138 pastes.

Tom K.

I regularly register with emails like [email protected]

and [email protected]

Fire Quacker

I use mailinator (or one of its aliases)

Tom K.

yeah, if the site really checks I use 10minutemail

don't know mailinator though

Fire Quacker

Mailinator.com creates a mailbox whenever an email arrives and deletes the email after a few hours

Tom K.

huh

Fire Quacker

16:18

But it seems like most websites would reject addresses at example.com as not being valid

Many sites reject mailinator.com addresses already

Tom K.

@FireQuacker I'm pretty sure they don't

Fire Quacker

It's to protect from spam/robot accounts

Tom K.

yeah, same with 10minutemail

3 hours later…

meagar

19:44

Lots of sites still don't do any form of email validation

Even Shopify, which is a bazillion dollar platform and in virtually every other respect a model for security, doesn't require you to verify your email before using their product (source: Was a developer there for two years)

I guess kind of relevant side story, Shopify runs their own sort of internal Have I Been Pwned, and rejects credentials at signup/password reset that appear in breach data. Their internal breach database contains so many leaked bcrypt hashes for things like [email protected] that for a while, after that service was deployed, attempting to register [email protected] would timeout as it attempted to check the password you gave it against thousands of bcrypt hashes.

ThoriumBR

@meagar interesting... but if only the hashes leaked, and not the salts, how would they know if the password was leaked too?

meagar

BCrypt "hashes" contain the salt

The output of BCrypt is a string in the form $2a$... that contains encoded within it the cost factor, salt and hash, everything you need to start testing candidate passwords against it.

ThoriumBR

I was thinking about the other hashes...

a lot of people still uses md5 today

I was doing a code review for a government agency this month, and they stored the passwords as pure md5 hashes, no salt at all...

meagar

Yeah. Typically with breach data the hash and (if present) salt are stored together, usually in the same string column, sometimes in a separate column. I think Magento for example uses MD5 and stores is hashes in the form md5hash$salt

@ThoriumBR That's fine... if everybody is using super long completely random passwords with zero password reuse :|

Nobody who works for a government agency would ever reuse a password though.

Err, /sarcasm if that wasn't clear enough.

ThoriumBR

That is not the worst part... there's an admin section, where there's no password, only a shared username...

every single person that had access once knew the username... and it was hard-coded, and never changed in 12 years.

and it was so basic that any 7yo trying to get access would look at the site and in 2 minutes would guess the username

imagine an admin section of a government system, with absolutely no logging at all besides apache's access and error log, behind a reverse proxy that logs only the IP of the proxy, with a shared username...

and we were asked to audit the mess... and no code change was allowed because we would "damage the system" or something like that

2 hours later…

reed

21:57

-3

Q: Where to save botnet files? Are botnets easily detected? The path matters?

So my question stands, if i reach millions of computers with my own program, creating a botnet, or any kind of program which normally does not get caught to antivirus. If I save my files that belong to the botnet to the same path always, does not matter where they are, consider them obfuscated,...

I was about to vote to close that question because it breaks the rules, but then I realized I don't know what rule it breaks. Lots of people ask about "illegal" stuff here, but we suppose they are pentesters and have permission to attack the system. In this case I guess the issue is that he's asking about a botnet...

Fire Quacker

Lemme look on meta...

Q: Clarify our stance on black hat questions

In the site FAQ, it is written: Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a v...

discussion acceptable-question acceptable-answer site-faq black-hat

Q: Suspicious Questions

Just wondering some questions I see on security.stackexchange.com seem very destructive. Some questions it's quite obvious what they are trying to do is illegal like "How do I hack my neighbors wifi" Should I answer these questions? or should I flag the question? I am unsure I don't feel it is ri...

discussion

At the time the answer on that second one was posted, I think Pops might have still been an employee

reed

22:19

Let's just say then that you can ask whatever you want, legal or illegal, but the point is how you ask it. That question is probably badly written, and lacks research. Maybe

« first day (3465 days earlier) ← previous day next day → last day (1713 days later) »

all rooms