I was reading about a story maybe it was on here or youtube, where they tried everything to get into someones computer network and the only thing that worked was people picking up USBsticks off the floor and carrying them in
is there no faster way to find the salt of an md5 hash than brute force? (given the source text, a segment of the hash and the way the salt is mixed in)
I'd not heard of rootkits before and this is pretty scary, could it hide things from ps and top? I always check there when I'm being paranoid about viruses
@xce If you want to hide from ps and top, then you must somehow patch the kernel (the live kernel, and/or the kernel image on disk, for the next reboot).
If you are root, you can patch the kernel at will.
so you could potentially have a legitimate kernel module that does it.. and maybe trick a user into installing (like when they do sudo make install) or use an exploit
> If a CA became known as untrustworthy then they would likely be removed from browsers default installation lists, but I'm not aware of any occurances where that's happened.
@RoryMcCune That rather sucks to have to deal with. Apparently, before I started here, the operation provided a cell phone and pager to all on-call employees, but they were strictly business only. After that turned out to be a management nightmare they moved to employee provided phones with reimbursement.
@LucasKauffman well when I was at EY ( a while back) they built up a decent sized testing team, but over the couple of years after that AFAIK they've all left....
@LucasKauffman purely supposition on my part but I think that some of the partners at the Big4 don't get pen testing and security and when I was there there was a push to make more senior people do sales, which doesn't go down well with a lot of techy types (and was a big bit of why I left)
@LucasKauffman also when I was there if testing was quiet, the testers got assigned to audit stuff sometimes, which didn't go too well :OP
@LucasKauffman well sometimes it can be interesting, but I wasn't a fan. A lot of time there's a prescriptive methodology to follow and you're not allowed to stray from it. That starts to be a problem if you know the tech quite well and it turns out the methodology isn't perfect....
@TerryChia ahh in that case I'd say work for a dedicated testing company. There you should be "the talent" ie you're bringing in the money, so they'll likely treat testing staff better :) (who me, cynical....)
@TerryChia for me working in industry has a problem where they want people to fit into their idea of progression, so delivery person --> senior delivery person --> manager. if you don't want to be a manager that can be a bummer...
I see. As a pen tester, do you get to focus on a specific area, web apps pen testing or network pen testing for example, or are you expected to be familiar with both?
@RoryMcCune that's what they told me too, but tbh I don't mind that idea at all, I've always liked managing and leading projects
@RoryMcCune btw how flexible were they for their security personel to attend conferences?
Theres a conference in Belgium in october and I'd like to attend it, problem is I don't know if I should as if I can go when I've only been working there for a month and a half
@TerryChia well I do a bit of everything to be honest, I'd like to specialise but it depends on the company (bigger = better chance of specialising) and the work they get
@LucasKauffman that'll likely be down to local management, you'd hope they'd want people to! Is that Brucon your thinking of? I'm going to that one (last week in September IIRC)
@ThomasPornin @ThomasPornin yeah I know what you mean, worked in some large corporates that were really restrictive about technology, made creating innovative solutions a real pain!
Does Apple have a policy regarding how long they will continue to release and support security fixes for each OS X release? I've looked around the Internet, and found some forum posts that claim "only for the current, and most recent previous, versions" but none appear to have an official refere...
@LucasKauffman security. The training courses are nice but pretty expensive, and there's none of them I'm so focused on that I can justify the money this year...
@TerryChia Ah yes, the most time-efficient sysadmin operations are those which are already done, immediately followed by those which are done by someone else.
@Iszi Yeah, I've never seen anything official in writing from Apple. The $CURVER-1 support plan has been espoused by Apple Certified Techs for aeons, though. It also seems to hold true.
I ended up upgrading my laptop to 10.7 on Friday as a result.
This, thankfully work owned, laptop is a first generation Unibody (with the hinged door to access the harddrive and battery). It's the oldest MacBook supported on 10.8. Hopefully 10.8 lasts longer than 10.7.
my last mac took me 4 days to get installed and after that I decided it wasn't worth since I had to buy a wifi dongle because my internal wifi card wasn't supported by any kext yet
"I don't think I'm doing anything wrong by voiding the OS license" <-- voiding the OS license is what you've done wrong
whether you care or not is up to you. The biggest issue I see with it is that people are paying for a product that isn't what they want.
so your money is saying to apple "this is what I want" (unless you didn't pay.. I guess that it possible too) when your actions (which apple isn't aware of) says that it's not
it's similar with jailbreaking the iPod, everyone is telling apple they like devices you don't have root on.. but actually they don't
@ScottPack yeah the lack of tethering without jailbreak is a pain. I got really lucky and snagged iTether in the one day before they pulled it, so now I have unlimited tethered data data for £5/month
In my case, 200MB is the cheapest plan I can get on my Android phone. My wife called up to ask about enabling WiFi Hotspot on her phone, but they wouldn't turn it on unless she upgraded to the 2GB plan or higher.
I, however, am running a non-AT&T rom (also at the 200MB plan) which lets me turn it on at will.
Yeah, the US is pretty well shafted by both cellular and Internet providers. I get a discount through work, but it's pretty minimal on both percentage and what it applies to.
rather than skype I'd like a protocol that people can implement like how we have TCP and such, that way people don't have to use the skype black-box program or servers
seems safer to me
maybe bandwidth is stoping it from happening.. but don't people talk on online games like XBOX and stuff ?
@ThomasPornin I need something that I have root so I can install things without restrictions. Been doing some projects that involve red5, unrealirc, ffmpeg,etc..
@RoryMcCune I've reviewed linode and they looked promising. I'm just holding off because I want to give myself some time to try to get the best deal. Mostly just want the most resource bang for my buck essentially.
Can you name any anonymous proxy software that don't use VPN connections? Basically, I'm analyzing different encrypted traffic and now I need to analyse a simple anonymity proxy traffic. I'm analyzing from the client side (my own traffic).
I need something like HotSpot Shield but that doesn't u...
You can’t fix what you can’t measure, so the first thing we did as a part of our Summer of Love campaign was try to measure friendliness in an objective and repeatable way. We gathered 7000 comments from Stack Overflow and submitted them to Mechanical Turk. For each comment, we asked 20 people to rate the comment as Friendly, Unfriendly, or “Neutral/Unclear.”
There are different ways of massaging the data, but I do want to give you a flavor for the kind of comments we’re talking about when we’re talking about unfriendly comments. Here is a snapshot of the com …
There used to, maybe still exists, a service that used them to transcribe business cards.
You would take a picture of the business card with your phone, submit it to the transcription service with their app, then you would receive back (in some length of time) a vcard.
Lovely. Wall to wall sun the entire trip up. Cloud over now and the forecast is wet:)
Just getting the kids to sleep and will sit round our fire for a bit.good to get away- have been supposed to be on leave for a week already and worked 39 hours last week.
@RoryAlsop yeah will show you around once we get it all sorted (don't think I'm allowed to have people over till we've tidied up the huge amount of mess!)
@RoryAlsop security.stackexchange.com/questions/17932/… was closed as exact duplicate of security.stackexchange.com/questions/13570/…. However, @D.W. 's question says about resources accessible to "someone with limited programming experience". Maybe it doesn't take much difference but it as a result closed question is slightly more broad. So are those questions actually duplicates?
I have a Cisco ASA 5540 running the following Software/Manager version:
Cisco Adaptive Security Appliance Software Version 8.2(2)17
Device Manager Version 6.3(2)
I use ASDM to make changes to the firewall on a constant basis with no issues. Recently, I needed to SSH into the firewall to make s...
How do Yubi keys work? Are there any alternatives?
Can you name any anonymous proxy software that don't use VPN connections? Basically, I'm analyzing different encrypted traffic and now I need to analyse a simple anonymity proxy traffic. I'm analyzing from the client side (my own traffic).
I need something like HotSpot Shield but that doesn't u...
I have a Cisco ASA 5540 running the following Software/Manager version:
Cisco Adaptive Security Appliance Software Version 8.2(2)17
Device Manager Version 6.3(2)
I use ASDM to make changes to the firewall on a constant basis with no issues. Recently, I needed to SSH into the firewall to make s...
