The DMZ

Anthony

00:11

Evening folks!

Perhaps can someone share tips or good practices on assessing whether particular type of phishing strategy is in the wild at a given time? How have other companies been keeping up with the relevancy of specific phishing tactics?

John Zhau

06:35

If I wanna do some analysis on firmware and hardware of things I own but don't have a bug bounty policy and find some vulnerabilities, and all of it is as a hoobiest because I'm not working for a company, how should I report it? Is it like reporting software vulnerabilities or would it be more troublesome because companies don't like having their stuff torn apart and analyzed?

MechMK1

07:03

@JohnZhau Responsible disclosure without a bug bounty program is always a wager

The company behind may be really happy to have someone reporting a vulnerability, or they might not give a shit at all, or in the worst case, see you as malicious actor and sue you

@JohnZhau Say, why do you never participate in discussions here? I see you asking a lot of questions, but never really talk otherwise

MechMK1

07:21

My biggest problem with Chrome right now is that hiding the bookmark bar in one window hides it in all windows. I hate that so much

Tom K.

07:41

@JohnZhau do you know the The Many Hats CLub?

MechMK1

07:52

@TomK. I remember JJ talking about it. he's quite active there AFAIK

Tom K.

didn't ask for me ;)

MechMK1

I don't quite understand

Tom K.

there's a channel where people discuss disclosure practice and help with disclosing vulns to orgs - for instance they act as proxies between the researcher and the org

MechMK1

That's very nice. I know some stories from inside our company, where disclosure of vuln took ages. I can imagine that an individual would have long given up

Tom K.

it's probably fitting for you, John

yeah, I think Anders here on sec.se tried to disclose an XSS vuln to SE and it took.. at least well over a year

MechMK1

08:04

Some companies seem to have the approach that if they don't acknowledge that it exists, then it doesn't exist.

Tom K.

I wouldn't see it so glum - it's probably just not-so well designed processes, stuck emails and so forth

MechMK1

I've seen enough companies from the inside to know at least a not insignificant part operates like that.

It's usually the kind where there is a strong blame culture, and vulnerabilities are considered more like "Who is to blame?" rather "How can we fix and prevent this in the future?"

Tom K.

sure, people fearing repercussions where none are due, because their company culture sucks is equally possible

@JohnZhau twitter.com/themanyhatsclub

and above messages

John Zhau

I ask a lof because I'm a beginner and I get curious about a lot of things. I study things in offense and defense, software and hardware.

I don't talk much for several reasons probably

I don't get notifications for the chat and I don't go to chats much

MechMK1

@JohnZhau Nothing wrong with asking. It's good that you learn. I just asked since I was worried there may be a reason you don't talk

John Zhau

08:13

I guess either the interesting stuff are over a scroll behind and/or the stuff directly on the screen just the interest me immediately.

MechMK1

@TomK. It's always a mixture of things. I've seen great company cultures, where the managers made it clear that nobody gets reprimanded for vulnerabilities in the code, and I've seen not so great companies who see security as an afterthought that just costs money and adds nothing

John Zhau

I usually don't scroll back much in chats

Tom K.

this discord channel is very beginner friendly

it has a newb-zone and a student-zone and whatnot

John Zhau

I don't use discord yet but I'll use it some day

Tom K.

a lot of people are there to help and nothing else

okay (:

did you read my disclosure comment?

John Zhau

08:14

I'm here to help, to learn and to get some occasional reps

:3

Tom K.

there's a channel where people discuss disclosure practice and help with disclosing vulns to orgs - for instance they act as proxies between the researcher and the org

John Zhau

Yeah I read all the stuff answering my questions

Tom K.

I thought that might be interesting to you

John Zhau

many hats club

I have a twitter account but don't really use it...

MechMK1

Say, does anyone here have some more experience with forensics?

John Zhau

08:16

i don't

MechMK1

@MechMK1 "If I could recover the exact data of these 100 iterations, it would mean a 1TB hard drive could hold 100 TB of data. That's not how it works." The physical disk platters of a 1TB hard drive probably could hold 100TB of data, e.g. if you manually placed each bit of data with a scanning electron microscope - the physical limit is probably much much larger - it is the size of the electronics that read and write data at a reasonable speed that limits it. Back in the day, the exact same floppy disks held different amounts of data depending on what kind of floppy disk drive you had... — Steve 38 mins ago

... indeed, if physical wear of the components in the hard drive means that the position of the data track has moved by a microscopically small amount, it's entirely possible that bits of the ORIGINAL data are recoverable even after new data has been written in a slightly different physical position thousands of times. The forensic team only need to recover the ORIGINAL data, not all 100 intermediate iterations. — Steve 36 mins ago

I wonder if there is some truth to that, or if that guy is just talking nonsense. I don't know enough to judge that

John Zhau

Unless compression is involved, I think the physical limit would be the absolute limit

Electromagnetics don't leave traces in the middle like analog mediums like blood stains

MechMK1

@JohnZhau Blood mages used blood stains as storage medium for ages. The first record of ominous chanting ("Ohhhhhhhh Vol. 1", can highly recommend) was on such a disk.

John Zhau

We usually effectively wipe a disk by writing all zeros or random stuff to all the bits right? How would you recover that?

Tom K.

@JohnZhau yes, that's it

MechMK1

08:20

Apparently, if the head isn't aligned perfectly with the sector, you could not overwrite the data and still have original traces.

It sounds plausible in a way, but makes me wonder how reliable this is, or if it's one of those "Back in the 90s there was a paper that said it was theoretically possible"

John Zhau

I think just writing all the bits should be digitally 100% clean. Any traces left would be recoverable only by using analogous means like examining the physical bits, or at least that's what I think

I think we often do multiple wipes instead of just 1 for highly confidential and sensitive data

Google's putting their drives through shredders all the time. I don't think they overwrite everything bit-by-bit, but with all they do to clean their drives, I think it's probably effectively unrecoverable.

MechMK1

Well, that is the question. How specialized would your equipment need to be? How high are your chances of recovery?

Physically destroying the devices is a rather secure way of doing it. I always burn all my sensitive documents

John Zhau

Also, there should be a huge difference between HDD & SSD right?

MechMK1

There is

John Zhau

Physical imperfections like the reader head not being well-aligned shouldn't be a problem with SSDs

Tom K.

08:25

there was this forum post... can't find it of the top off my head: it basically says: "I challenge people to recover files from this X GB SSD. I overwrote everything with zeros from /dev/zero with dd - once. Btw I already contacted 3 forensics labs, and they all said: no, they wouldn't do it. two already wanted to hang up, when they heard dd. I give you 5000$."

John Zhau

With SSDs, everything's electrical with no moving parts, so if we write to all the bits we can write to, it should be pretty much unrecoverable. Any bit that's supposed to be writable but couldn't be reached may be reported?

Tom K.

that's one theory!!!1!

John Zhau

I know very little about forensics so that's all just my theory...

MechMK1

@TomK. That sounds very impractical to do. You'd need access to the physical medium. How would you transport it to someone taking up the challenge?

John Zhau

a NOOB theory!!!

Tom K.

08:27

but people speak about bit flips and software fails and whatnot

@MechMK1 they mail it to you

MechMK1

@TomK. Cool, free new hard drive

Tom K.

it was like.. 150GB?

more like 300g of trash

MechMK1

@JohnZhau The thing with SSDs is that they do dynamic wear leveling, meaning that you only have a "logical" view of the SSD. That means if you ask for the byte at 0x00000000, you get that byte, regardless of where it "actually" resides

John Zhau

"... when they heard dd ..." what's with dd?

MechMK1

Hey my server ran on a 150 GB HDD for over 4 years :D

Tom K.

08:29

@JohnZhau it's been around since... the 80s? it's well tested. things don't go wrong with dd

John Zhau

*shouldn't

I always assume Murphy's law

Tom K.

the 70s

MechMK1

>things don't go wrong with DD

unless suddenly your device identifiers change and you happily sudo dd if=ubuntu-16.04-desktop-amd64.iso of=/dev/sdc and wonder why your USB won't boot, and why suddenly you can't connect to your music library anymore

And then it dawns on you

Journeyman Geek

lol

@MechMK1 use device ids ._.

also I need to play with the ZFS equivilent of that at some point

MechMK1

I should have just not been so extremely dumb

The funny thing is, this was the second time I lost my music collection

the first time was when I dropped my hard drive...onto my backup hard drive

Journeyman Geek

08:36

@MechMK1 if it makes you feel any better...

there's a good reason I keep 3 copies

MechMK1

Some of that music was so obscure that I once sent an e-mail to one of the members of the band, asking if they had a copy of their demo tape

I did get the demo back, by the way

And I did learn how to configure linux so that certain storage mediums always get the same device ID and same mount point

Tom K.

funnily... even the wikipedia article for `dd` says:
> On modern hard-disk drives, zeroing the drive will render most data it contains permanently irrecoverable. However, with other kinds of drives such as flash memories, much data may still be recoverable by data remanence.

weird.. am I using the wrong ticks or is the markup for code no longer working?

MechMK1

08:55

Quotes don't work well in multi line posts

> this should work fine

While this
> should not

> but you can
> quote all of a
> multi line post and
> it should work

Actually, formatting doesn't work on multi line posts for some weird reason.

John Zhau

09:14

When posting questions and answers, having a single > puts all the lines (until a blank line) in a quote block

> line1
line2
line3

worked

MechMK1

Yes but chat is different

John Zhau

> line1
> line2
> line3

`>` on 1st line

> L1
L2
L3

`>` on all lines

> L1
> L2
> L3

MechMK1

Yeah, what I meant was that chat isn't 100% the same syntax as Q/A

John Zhau

>test1
test2

MechMK1

My gf called me and told me she probably screwed up her german certification because she misunderstood the instructions

John Zhau

09:16

ok this is weird. Sometimes it works, sometimes not

MechMK1

Damn...

John Zhau

I went into a Computer Architecture exam without a cheatsheet. I expected the professor to provide us with an ISA (Instruction Set Architecture) but apparently we were supposed to print out the one used as an example in class...

MechMK1

We once had an exam where we were allowed a calculator and we didn't have one

I ended up just writing down the full calculations I would have done and simplified them as much as possible

Sure, I didn't get full points, but only had like one point each deducted for not writing down the result

John Zhau

I had a C++/OOP exam. I mainly use Python so 3/4 of the questions I couldn't get to run because I forgot about using pointer arrays. The rest was pretty good but couldn't compile because of the pointer & object management problems. I expected to fail but I when I got the results back it was my best exam done this year.

not complaining tho

MechMK1

My worst ever exam was applied cryptography

"Well, I failed that exam"
Teacher: "Don't say that yet, you don't know for sure"
"I didn't answer 4 of the 6 questions"
Teacher: "...oh"

John Zhau

09:23

University is nothing like high school

MechMK1

We weren't allowed a calculator in the crypto exam. Instead, we had a huge sheet provided to us where every single possible permutation of three values was provided

John Zhau

For Discrete Maths we had 90 minutes to answer about 30 questions. That was a lot of questions.

MechMK1

Like a^b mod c, a^c mod b, a^(b mod c) mod c, etc...

Damn....

John Zhau

None of which was multiple choice if I remember correctly

MechMK1

The only exam I ever had like that was Personal identification and Biometrics

While not multiple choice, most answers were either words or sentences

John Zhau

09:25

Which is more brutal, university exams or the OSCP?

MechMK1

Like "Not in scope"

I didn't do OSCP, but I can tell university exams fall into a 4 quadrant map

based on how easy the teacher makes the exam seem, versus how easy the exam is

"Seems easy, is easy" => I know you're not here because of this subject, so I don't want to put stones in your way
"Seems hard, is hard" => git gud, scrub
"Seems hard, is easy" => I just wanted you to learn for the exam
"Seems easy, is hard" => Fuck you, that's for never attending class

John Zhau

There's a professor for my Algorithms and Data Structure class. He's one of the worst teachers I've seen in terms of teaching methods. Some of his favorite phrases are "Listen to me", "You must agree with me that...", "You're wrong". A lot of the things he says just straight up discourage any kind of opinions and ideas from the students.

"Memorize this", "Read this formula", "Here's the code. Read it carefully", "Read this definition 3 times". These phrases have little to no meaning to students.

MechMK1

Not everything is a matter of opinion, but a good teacher would explain to a student why they're wrong

I guess a lot of teachers are just done with the antics of some students

Here are some quotes from my time at university:

Teacher: "This page is very important. Did everybody understand this? If not, please raise your hand now, because if we continue, you need this fundamental knowledge"
Student: "Uhh...could you please repeat that? I'm a bit stoned and didn't pay attention"

Teacher: "What the hell is Mr. <student name> doing back there? Is he eating chalk?"

John Zhau

Him saying we'd have to write C++ on paper by hand to implement the algorithms was the last straw for many. Usually almost everyone in the class signs up for the exam, but this time very few did.

MechMK1

Student: "Is this on the exam?"
Teacher: "No, I'm just standing here, talking about math because I know nothing better to do with my time. Do you think I'm here because I like all of you so much? Certainly not!"

Teacher enters the class, only 3 students are there.
Teacher: "Oh fuck, why do I always get friday afternoon class?"

John Zhau

09:33

I'd like a teacher who'd actually say that tho...

MechMK1

Student: "Say, you think he forgot about the class?"
The teacher is standing in front of the blackboard for 10 minutes already, waiting for people to get quiet

John Zhau

Some of my professors just say "Shut up"

MechMK1

Our professors were usually much more subtle, like "Excuse me if I interrupt your lovely conversation, but I would have to ask you to continue it outside. Attendance is not mandatory, and if you think you have something better to do than to pay attention, you're free to go. Just please don't interrupt the other students"

John Zhau

That sound's so polite it's posh

MechMK1

Austria is always like this. Like, being polite while being really underhanded at the same time

Sarcasm is part of the language and expression among people

Derpy

09:37

@JohnZhau Also know as "standard Mathematical analysis teacher" in most universities

John Zhau

@Derpy which?

Derpy

That behavior. At least in my country it feels like the majority of the teachers in university Mathematical analysis related courses are just there because either a) they have to or b) it is more money.

John Zhau

Researchers have to rely on either a company or a university. In a uni, they usually have to teach. With companies, there seems to be less freedom.

Derpy

Don't care if you understand, don't care to at least try to make the subject more likeable, don't care to craft a final text that actually test understanding instead of just memory and so on.

John Zhau

I got a teaching certificate because initally I was gonna become a researcher an work with a university...

partly because

Derpy

09:42

@JohnZhau yep, I know. What I meant is that for some reason in my personal experience the "I don't care if my students actually learn something" is somehow worse in that field.

I once had a teacher whose lessons were basically him just copying down his own notes from a stack of paper sheets on the blackboard.

And.... one time... he managed to "buffer overflow" if you get what I mean.

He kept placing each sheet back on the bottom of the stack... so after a while he looped and started copying what he already copied at the start of the lesson again

So much he didn't care for what he was doing that he didn't notice.

A student then warned him.

MechMK1

Ah yes, the single linked list that creates a loop

Derpy

He stopped, and said that since he had no more material to copy, the lesson would end one full hour before due

Students asked if the leftover hours could instead be used for some questions they had....

He simply replied to read the notes again, and that he already did the lesson and had no reason/obligation to waste more time.

MechMK1

Some teachers are just shit

Again, there are 4 quadrants of teachers in my experience. One axis for how well they know their field, one axis for how well they can teach

Derpy

Yep, and the fact that some teachers are just people that wanted to be researchers and just have to teach to keep their position doesn't help at all.

MechMK1

"Skilled in the field, skilled as teacher" => Extremely rare. Feel blessed and learn as much as you can.
"Skilled in the field, unskilled as teacher" => Teacher will usually pick out one or a handful of "promising" students, care about teaching them, the rest will be left behind.
"Unskilled in the field, skilled as teacher" => The teacher will ensure that everyone has a good grasp on the basics. You'll get solid base education, but don't expect very advanced concepts
"Unskilled in the field, unskilled as teacher" => You might as well skip class. You will learn nothing in the best case, and …

Like a teacher, who insisted once on prefixing all classes wit Class_ and all namespaces with Namespace_

Derpy

09:53

@MechMK1 THAT is the worse you saw?

MechMK1

When asked why the .NET framework doesn't have Namespace_System.Class_Console, he replied, and I quote "Because Microsoft doesn't know what they're doing"

@Derpy No, that was just a very humorous example

Derpy

I had a DB theory teacher that used ACCESS as his "DB Engine" of choice.

MechMK1

I had a fellow student who had a professor who insisted on completing all programming tasks in his own invented language

"So people couldn't look up answers on the internet"

Derpy

And thanks to Access weird SQL standards.... he had the habit to name all bit fields as questions.

So, you didn't had a "Gender" bit field (and just forget for a second the fact that gender is the best example for a binary choice....)... nope, he would call the field "IsMale?"

MechMK1

Weird...

I think the best proof how bad a teacher is is the "average" student

After 5 years of programming class with him, people didn't know what an array was

they used a .txt file and modified it line by line

That was their array

Derpy

10:00

@MechMK1 Had one that claimed that DOS meant "Document Operating System", because it was an operating system based on managing documents.

MechMK1

@Derpy That's one claim easily refuted. How would they react to that?

Derpy

@MechMK1 "I know, you don't and I am the one that decides your score so I would be more careful on what you say"

MechMK1

Ah, the asshole kind of teacher

Mr. Power Fantasy, as I like to call them

Derpy

@MechMK1 same guy that claimed an url can have this format....

> www://www.example.com

MechMK1

Technically speaking, he is correct

Derpy

10:05

trust me, didn't mean what you probably are thinking of.

MechMK1

I know what you mean

Derpy

He compared WWW to HTTP and FTP

MechMK1

> compared WWW to HTTP

I would have loved to hear

Derpy

something along the lines that WWW is a Web Transfer Protocol.... I guess my brain tried to remove/censor that memory.

I kinda remember someone then asking why they didn't call it "WTP"

MechMK1

I have no TTY and I must scream

It's called the world wide web because the world narrow web didn't have enough bandwidth

Derpy

10:13

@MechMK1 what can I say... I had to live with many teacher that probably fell in the fourth quadrant you mentioned before.

MechMK1

Yeah, it's shitty. I had one that was really good in his field, but couldn't teach that well. Luckily, I was part of that "chosen" group and had the time of my life

Derpy

Some errors... I can understand. Some... I still wonder how they got in their position.

MechMK1

Though for the other 25 students...must have been awful

Derpy

Once a guy had the idea to take a screenshot of the Windows desktop with Minefield open. Set that as a wallpaper.

Result: a full hour spent looking for the "virus" that some student installed because "minefield isn't in task manager and it starts automatically on boot"

MechMK1

nobody checked if you could play it?

Derpy

10:16

At that time, I was just a student and I guess I could have felt for it... But a teacher, supposedly one that had years of experience in IT....

@MechMK1 It was a prank aimed at the teacher I guess, no one spoke.

MechMK1

@Derpy Damn...

reed

@Derpy That is awesome. It would have been more fun tough to create a wallpaper with a custom error message. Googling that error message would lead to a blog post, written on purpose, with weird instructions to follow...

Derpy

@reed yep, I guess that one could have done that. Yet it probably was a 5 minute joke with little to no preparation.

Yet not the worse I heard.

The worse was a rumor I never got to verify (but... knowing that teacher it sounded quite possible)

Someone switched the cover of the "O" and "Q" key on a keyboard.

reed

but I guess anyone who has at least a little experience with computers would notice the difference between an unresponsive window, and a fake window embedded in the wallpaper

Derpy

And the teacher was wondering why pressing "O" printed "Q" on screen.

reed

10:22

I mean, if everything is responsive, but a single window doesn't move or anything...

Derpy

@reed virus, obviously.

Anyway, if you find it reasonable to not notice that someone switched Q and O on a keyboard let me tell this. We are talking about a Typing class teacher.

Isn't the basic of typing to NOT look at the keys when you type?

Memorize the layout?

and you tell me that replacing the label on the key throws you off? :P

(not to mention that a Typing class teacher really thought a keyboard started with OWERTY)

reed

sounds like an urban legend, a joke. I mean, switching letters to a typing class teacher is like swapping emacs for vim to a programmer

MechMK1

It's even better when you reorder all the keys on the keyboard to be alphabetical, and at the same time install a custom keymap on every PC in class to actually print that letter

Is it high-effort? Yes.

Is it worth every second? Yes!

Derpy

@reed I know, as I said I can't say I saw that happen. Yet it seemed quite possible because of the teacher in question.

reed

@MechMK1, well, at that point, why not install a script that sometimes (at random times) maps some random letters to some other random letters? You know, the worst kind of bugs are the ones that aren't reproducible. So now hitting T produces a D, but then you try it again and it works ok. LOL

Derpy

10:33

@reed don't need that, already happens for CTRL+C on remote desktop on Windows based machines

reed

This is what malware should be like. You know, the good old times when malware was stupid, when it was used to flip your desktop upside down

Derpy

remember the old Hitchcock virus?

Whose only purpose was to play the Hitchcock movies themes ~~on boot~~ at random times?

MechMK1

@reed I had a keyboard like that once

It was one of those shitty apple USB keyboards

And after cleaning it, it would sometimes produce random characters

The guy at the store said he had never seen anything like that before

Though props to him, I was immediately given a replacement, no questions asked

Tom K.

@MechMK1 I wouldn't really attribute this to a person

it's just how corporations handle refunds nowadays

or maybe in the last 5 years

just no questions asked, send it in, you get a new one - if it's under a certain threshold

it's just cheaper than checking for fraud

MechMK1

11:22

Yeah, but to me as customer, it was a pleasant experience

Though I know that such refund programs are used to scam stores a lot

Especially apple, given their incredibly braindead policy on repair shops

Independent repair shops can't just order replacement parts, like screens, home buttons, etc...

So what do people do? They buy iPhones, replace the original screen with a knockoff and then send the phone back

I understand it's hard for a company to strike a balance between customer goodwill and their own willingness to get scammed.

Tom K.

@MechMK1 I would be pretty surprised if this worked on a wider scale

MechMK1

11:37

@TomK. Not as a business, but people do that quite regularly to make some money. iPhone screens sell well, and there is constant demand

Sadly, some less-than-moral individuals like to exploit such systems for their own benefit. My father, for instance, used to buy CDs, dump them as MP3s and then bring the CD back. For he longest time, stores actually allowed you to bring back CDs if you didn't like them

Later when borrowing DVDs became a thing, he did the same thing with DVDs. Every day he'd borrow a new DVD, get home, copy it, then bring it back

Derpy

@MechMK1 Then EbGames/GameStop caught up and gave its own personnel the ability to do that

MechMK1

Wait, what?

Derpy

@MechMK1 It is a known fact from multiple sources that that company used to have a policy - now allegedly gone - that allowed employees to "rent" games.

Since they sell what people call "gutted copies" as new with the pretest that "they store the box separately from the actual disk to fight shoplifters" ... you guess the rest.

Missing / already used download codes, used games sold as new, and so on

MechMK1

Yes, that's why I stopped physical copies altogether

Derpy

A friend of mine once even got a "new" copy of a gameboy advance game (so.. chart based game) that already had a saved game on it.

10+ hours reported on the save, too....

MechMK1

11:47

Digital downloads really changed the landscape

Derpy

@MechMK1 yep, and then Disney decides that they no longer offer the download for stuff you bought.

MechMK1

@Derpy It's all a legal gray area nobody had to deal with yet

For example: You purchase a card in a digital card game. Do you have the right that the card remains how it is?

You purchase a game on steam, but it gets patched and is almost not recognizable anymore. Do you have a right to get your money back?

Derpy

@MechMK1 their customer kinda have since AFAIK that already happened for some games they made in the past. The example was not made up.

MechMK1

@Derpy I know this example, but what I mean is there is no court ruling on it yet AFAIK

Tom K.

I would be careful to say that there is "none of $something", if I'm not an expert in the field ;)

in some state, or in some jurisdiction or in some distant time.. there might have been

MechMK1

11:56

"I know for sure there is no court ruling on this"
"How do you know?"
"Some idiot in a chat room on information security said so"
"Did he cite any sources?"
"What the fuck are sources?"

Tom K.

wait, are you the idiot in this case? ;)

MechMK1

There is a safe bet to make here :D

Derpy

12:38

@MechMK1 but... to call you so, the guy shouldn't be trusting you.

Exchange should look more like this:

> "I know for sure there is no court ruling on this"
"How do you know?"
"A scientist in a chat room on information security said so."
"Did he cite any sources?"
"[static noise] guh? are you listening? I told you he said it."

MechMK1

"Do you have any source?"
"I AM THE SOURCE"

Fire Quacker

12:52

@MechMK1 Ready for a new reason to hate Chrome? Google is reportedly planning to hide the URL path in the address bar

MechMK1

FUCK NO!!!

Apple did that and I hate them for it

Fire Quacker

I guess it's related to their theory that URLs are not user-friendly and need to be replaced

Derpy

What's next? Hiding file extensions by default so that people could be tricked into running an .exe thinking it is a picture????
...
.....
Oh, wait a sec.....

MechMK1

We're doomed, aren't we?

Conor Mancone

@MechMK1 That is exactly how I feel about that

Derpy

12:58

@MechMK1 Is that Nasa plan for sending an exploration team on Mars still going? I think they have better hopes to survive than us.

MechMK1

Google wants to abandon URLs.
The DMZ abandons earth in return

Derpy

@MechMK1 where do I have to sign?

MechMK1

On the surface of mars

:D

Tom K.

@MechMK1 they don't do it on macOS, do they? O.o

MechMK1

@TomK. Yes, on safari, the url is hidden for all HTTP sites

Tom K.

13:02

so you always see the URI?

Fire Quacker

At some point usability for common users and usability for advanced uses diverge entirely

MechMK1

You see the domain, but not the URL

Derpy

@MechMK1 I think we could do better. There is still some vague indication of the domain. Let's replace it with the meta description tag value.

Gotta think about all those poor little phishing sites needing help to hide themselves.

MechMK1

@Derpy Yes, I was about to suggest that. I think the modern content aware age sites should get to decide what to put there

Tom K.

dunno what my opinion is on this...

if a users clicks on the URL bar, does she see the full URL?

on Chrome or Safari that is

MechMK1

13:06

Possibly. I assume so. I hope so.

Derpy

@MechMK1 I mean, how can an honest thief get their site to look like the original and steal some well-deserved money if those bad, ugly, evil infosec guys can just check the url to see if it matches.

Fire Quacker

@TomK. Clicking on the address bar will display the full URL, as will switching tabs.

Tom K.

I mean... sure, open redirects and such are easier to hide with this "feature". OTOH typical users wouldn't be able to detect those vulns by inspecting URLs anyway

ah, thanks @FireQuacker

and, those vulns are exploited now anyways, while users are able to inspect full URLs easily

MechMK1

Generally yes, but if I got a link like "myrealbankdomain.com/?redirect=evil.com/steal_all_your_data.php"; I would get suspicious

Tom K.

I'm somewhat sure that you get a warning on Chrome that says "you are being routed to evil.com. are you sure you wanna go there?"

Derpy

13:10

probable real reason: try to reduce the number of "smart users" that understand enough of an url to bypass common annoyances on many sites like constant "log-in" pop-ups and such

Tom K.

to generalize my statement above, if browser vendors implement this, I'm not really concerned, if there are also other controls implemented like - for instance - warnings or errors against common attacks wrt URL parameters

MechMK1

I oppose the change. Browsers are getting less transparent every moment. I want to show that such changes are not okay, at least not in my book

Tom K.

why is transparency an inherent value for browsers?

POV everyday users

Fire Quacker

Here's a long-form opinion piece about hiding the URL: adactio.com/journal/6786

MechMK1

I honestly don't care about everyday users, I care about myself. And I hate the trend that modern OS's just hide everything away from the user, as if they're too stupid to understand what's going on. You can see it so clearly from Windows 7 to Windows 10. 7 treats you like an adult, 10 treats you like a kid too dumb to tie his own shoes

Tom K.

13:19

as an infosec person, it is very helpful to care about everyday users

because most of the work we do is - in the end - for everyday users

MechMK1

Literally 0 everyday users ever complained about the URL bar containing a URL

Fire Quacker

But would they complain about how every site these days has a giant URL with a bunch of gibberish?

I would expect that Chrome has done (or will do) some testing of users

Tom K.

@MechMK1 maybe, that's why the people in infosec have to play proxy towards vendors. and it's not about UX, it's about how a transparent URL bar helps everyday users to make informed decisions

MechMK1

Exactly, that's why I can't understand why they'd introduce this change

Fire Quacker

Perhaps removing the rest of the URL will help people focus on the domain name?

Derpy

13:23

Codeless Code, case 89 - The Concubine's Fog

> Said Banzen, “Fog makes an excellent curtain, but a poor wall.”

Fire Quacker

That way they would be less likely to get fooled by http://htt.tp/com/google.com/

Tom K.

that's a nice edge case

Derpy

And how you fix this? Obviously not by replacing the fog with a wall. Nope, you break your users legs so they can't walk thru the fog.

ThoriumBR

@MechMK1 this usually does not happen, but you buy an offline game that needs to get online for authorization, and the authorization servers goes offline and you cannot play anymore...

Fire Quacker

@Derpy Your analogy is really violent...

MechMK1

13:26

No no, he got a point

Derpy

If I remember correctly, Instagram "login popup" used to be avoidable just by applying some CSS to hide the pop-over.

Tom K.

yeah, I kinda have the feeling this channel has become the "cynics support group" O.o

Derpy

Now, browsers wants to cut the ability for end users to define custom css rules.

Sites tried to manage security thru a fog wall, and when the users just walked thru the fog... they now try to make it so they won't be able to walk anymore.

Notice - I am not advocating client side modifications to bypass poorly made restriction on a site.

Just saying that if people do that it is your fault for thinking CSS is a security device

ThoriumBR

@Derpy I just moved to a new house, on a new road that still does not appear on ancient "customer services databases"... the zip code is generic for the entire neighborhood, so when I tried to move my internet to the new address, it wasn't possible. The "change address" form does not allow you to type the address, as the form fields are all "disabled." right click, inspect element, delete the "disabled" and done!

@Derpy Nuke Anything Enhanced... It's one of the first extensions I get every time I install Firefox

MechMK1

I had to do that for CEH :D

The field wouldn't allow my phone number, because it was too long

Derpy

13:30

Furthermore, custom CSS has a far bigger purpose... people with eyesight problems can use that to make sites more readable.

Fire Quacker

If browsers EVER take away the F12 developer tools, I'll... be very annoyed.

Tom K.

@Derpy I'm not really sure what you are advocating for, it seems you are just rambling

ThoriumBR

https://securityboulevard.com/2020/06/south-africas-postbank-is-replacing-12-million-bank-cards-after-major-security-breach/

looks like they never heard about HSM... how can someone PRINT the master key?

The Sunday Times, which obtained a forensic report completed in July 2019, provided a detailed description of the events. It appears that the master key was exposed in July 2018 during a data center move. It was compromised “after being stored in clear text on one laptop (at a minimum) and remains compromised to the present day,” the report said.

Tom K.

yikes

ThoriumBR

some times we see really "dumb" questions on Security, and I wonder what those people work with... maybe they are senior security specialists in places like that...

MechMK1

13:35

Man, I hope not...

ThoriumBR

man, keeping the master key for a bank on a laptop because of a datacenter move?

Derpy

@TomK. just commenting on the article before that referenced how Chrome removed the ability for end users to use custom stylesheets and the fact that my cynical sides sees that not as a "simplify their lives" but more of a "now they can't use CSS to bypass site poorly crafted restrictions. Next step, kill F12"

ThoriumBR

why not tweet it?

Tom K.

maybe it was a secure laptop /s

ThoriumBR

I use Vivaldi as my main browser, have been using it since the first alpha. I saw it on slashdot (people from Opera rebelled against the way it was going, and created a new browser to bring back Opera as it was) and installed it.

It runs on webkit, can use all chrome extensions, his embedded tracker and ad protection is very good, and it's very light

and I doubt they will take away F12...

@TomK. a secure shared windows 7 laptop...

Tom K.

13:38

yeah.. that would start a rebellion

@ThoriumBR no updates means no change, no changes means no crashes, no crashes means no data loss!

Fire Quacker

@ThoriumBR It's secure because the password is "secret". Nobody will ever guess that...

ThoriumBR

this is baffling: "being stored in clear text on one laptop (at a minimum)"
the *at a minimum* part means they don't even know how many people have the copy of the master key

if there's no password, nobody can guess it...

MechMK1

"When you press Alt+Q, it automatically logs you in as admin. Nobody could guess that"

Tom K.

presses alt+q

MechMK1

GOD DAMNIT BOYS WE'VE BEEN HACKED

Tom K.

13:42

🚨 🚨 🚨

i am boooored

Derpy

@ThoriumBR Remind me the good old

> "an expert is a person that knows more and more about less and less.... to the point of knowing everything about nothing"

Tom K.

I had one meeting today. Topic: software tests for a new web app.
Question: Tom, what do you think are high, mid and low priority things we should do?
me: well, I think high priority would be penetration tests or vulnerability scans and a code review
some other security dude: Well actually... we *did do* a Burp scan already, so we can mark the vulnerability scan as done
me: uuhmmm.... come again?

MechMK1

"Running AppSpider is basically as good as a penetration test"

Tom K.

sure, WHAT ELSE IS THERE TO KNOW?

MechMK1

Listen, we know how to write good software. We fixed all the vulnerabilities already. Anything we didn't fix isn't worth fixing.

Transcript for