The DMZ - 2020-12-01

« first day (3638 days earlier) ← previous day next day → last day (1232 days later) »

10:35 AM

@A.Hersean Ehh, it probably is too broad

@FireQuacker Are you at all surprized?

Whenever I have to do a major upgrade, I don't see it as "This thing got so much better", but instead see it as "I wonder what functionality they're going to take away from me now"

1 hour later…

11:46 AM

@FireQuacker XP was the good thing for a long time. Then Win 7 was the best option for ages. Now Win 10 can be made rather secure, but functionality has gone to the dogs, so after all these years I'm moving more and more stuff back to Linux

Then of course that will all end up on Windows anyway :-)

Understandable. Look how Apple removed the headphone jack with the iPhone 7 and people literally drilled into their phones because some guy online said it would work

@MechMK1 that was hilarious

and people threw their phones on the microwave because of "wireless charging"

@RoryAlsop Or when 4chan said you could microwave your phone to charge it

people believe anything on the internet

12:00 PM

Remember "iOS 7 makes your phone waterproof"

[citation needed]

The Great iPhone Massacre

dailymail.co.uk/news/article-2768976/…

user image

Secret Hack To Get Headphone Jack on the iPhone 7

Thanks!

12:11 PM

Or the Send Me To Heaven game :DDDDDDDD

That was the best

@MechMK1 yeah, I miss it!

I had it on my phone, but my marks were very low... I was more interested on the physics than in the records

it's already available... I believe it was pulled of play store, if I am not mistaken...

At least android still has it

I love the 1star reviews: "Dropped my phone. Need a new one. Thanks, asshole"

Like...bro, when you did GET /CommonSense HTTP/1.0 did it return a 404 or what?

The leaderboards for Send Me to Heaven show some players have managed to get their phones as high as 40 meters (131 feet). Svarovsky did a little investigating to learn how that impressive score was achieved and discovered some players are using slingshots.

source: wired.com/2013/09/send-me-to-heaven-app

@MechMK1 usually it returns a 302 to some catch-all URL...

Pfff, you're not even using a mortar to send your phone flying

I was thinking about a model rocket...

or renting the NASA 0G airplane...

Or do like Felix Baumgartner, and drop from the stratosphere...

12:21 PM

I hadn't heard about the send me to heaven one - that's pretty good

I'm sure you could also emulate the gyroscope and accelerometer

> The method Svarovsky uses to calculate the height means Send Me to Heaven won't work with extreme stunts, like hurling it from a cliff or take it skydiving. Any time your phone falls further than it rose, the app returns an error.

you can, but that's not fun

you could take a look on that "egg drop challenges" and use the same techniques...

"On August 22, 1994, David Donoghue threw an egg out of a helicopter onto a golf course in the UK, from a height of 213 meters"

I just don't think my arm could launch my phone that high... or if anybody could

12:36 PM

It also reminds me of the I am Rich app for a clean $999

I Am Rich is an iOS application developed by Armin Heinrich and which was distributed using the App Store. When launched, the screen only contains a glowing red gem and an icon that, when pressed, displays the following mantra in large text: I am richI deserv [sic] itI am good,healthy & successful The application is described as "a work of art with no hidden function at all", with its only purpose being to show other people that they were able to afford it; I Am Rich was sold on the App Store for US$999.99 (equivalent to $1,187 in 2019), €799.99, and GB£599.99 (equivalent to £806.54 in 2019), the...

Eyyyy, got another Populist badge

I guess that was for security.stackexchange.com/q/241493/127837

1:28 PM

Yup

Good answer from you though, you got my upvote

I still think it's fucking retarded what he is trying to do

I agree

But it's not the 1st time I encounter retarded management with stupid requirements

In my opinion, management with no tech experience should stay the fuck away from giving tech requirements

Usually they are deluded in thinking they know (a lot) about tech

That's why I made my first argument "look how everyone else is doing it"

Sure, you might not be able to convince management with data like "But this protocol already offers..."

But your chances of convincing them with "If it's good enough for literally every other company on the planet, it's good enough for us"

@A.Hersean I once saw management requiring to have the Oracle database on a public IP and accessible from the internet, because VPN are expensive and our devs must work from anywhere...

I said that I could do that, no problem, as long as they signed a document where I stated why that was a terrible idea, and they took full responsibility for their solution in a case of stolen data

they backed off instantly

so that's my protocol with stupid management: I outline the pros of my approach, the cons and risks of theirs, and ask them to sign a document where they acknowledge the risks and take responsibility for that approach, forever. It never ever fails!

if you are a contractor, of course... if it's your company management, it does not work.

1:50 PM

If it's your company, you just have to send an email stating that you think it's a bad idea, as you wrote. The point is to leave a written trace so that later you can prove that you wrote them "I told you so".

2:13 PM

@A.Hersean that does not always work... and I have experience with that as well...

I told my manager A LOT about some issues, he disregarded, we planned an environment without high availability, and it went his way

2:27 PM

@MechMK1 I believe your answer can be improved with just two points
1. Discussing forward secrecy. I think all TLS ciphers in 1.3 implement it, but mentioning it out loud would shut the leakage of the private key X MiTM.
2. Discussing that MiTM is somewhat not possible because TLS has a very strict sequence and anything that goes rogue (to the listener) is rejected from the other side.

Your answer came to say everyone uses it, use it.
But I guess you were trying to talk on a managerial level?
I think no answer actually discussed these major points on how TLS achieves it, and why adding any…

But like is that question really that much asked that it has 9 upvotes? Is it not agreed upon? :P

2:49 PM

@ElieSaad I agree with you completely. I could have added the forward secrecy part, but at the time, I didn't really think of it. You're right that all TLS 1.3 ciphers have it, and some 1.2 ciphers do as well.

Indeed, I didn't want to get too technical, since it didn't really seem like a technical discussion, more of a "How can I convince my boss that...", which sadly is all too common here

And management is more easily convinced by "We should do it because Google, Amazon, etc. do it" rather than "We should do it because <long technical explanation>"

@ElieSaad Upvotes represent that it's a good question, not necessarily that one also has this question. I have to admit that I personally misuse the question-upvote feature a little either to encourage new users who just asked their first question, or because it's an interesting question

3:13 PM

0

Q: Kali linux and metasploitable

Hello So i need to exploit metapoitable using msfconsole. I don't know what search commend to use. i have tried mysql, and samba but does not work? so can anyone show me what i have to do Thank you

Another "I downloaded Kali how do I hack lol" question

3:30 PM

Pretty sure a homework question. A lot of ethical hacker courses do this, don't teach anything, to guide the students.

@ThoriumBR The point is not to make the management make better choices, it is to avoid legal responsibility when the shit hits the fan.

@ElieSaad That's not really a course then, is it? I expect a course to teach me a little, then let me practice on my own

@MechMK1 That's why I despise a lot of security programs.

@ElieSaad I had the misfortune of having to do the "Certified Ethical Hacker" program...

God it was bad. It was so bad.

May 2 at 23:14, by MechMK1

Identify the ports that are allowed by the firewall in an organization.

a. Port 443 and Port 69
b. Port 80 and Port 69
c. Port 80 and Port 110
d. Port 80 and Port 443

How may I give my respects? Hahaha.

3:42 PM

May 2 at 23:05, by MechMK1

In the Permanent Denial-of-service, the attacker will uses the ‘Bricking a system’ method, in order to __________

a. Send fraudulent hardware updates to the victims
b. Launch a massive denial of service attacks and compromise websites
c. Exploit weaknesses in programming source code
d. Send malicious email attached to the victim

Oh lawd, take this cup away from me.

Just wait until I get the slides out :D

It's d, just let the d in :D
Works both for the puns and the question :p

@MechMK1 Wait wait how did I subscribe to this newsletter!

If you look up "non sequitur" in the dictionary it just shows some of the CEH learning slides.

Hahaha

3:43 PM

chat.stackexchange.com/search?q=ceh&room=151

If you search for CEH you find some wonderful examples of the CEH being awful :D

https://chat.stackexchange.com/transcript/151?m=54611643#54611643
I hope you forever remember this message, despite the context.

I do, i really do

The whole course was just horrible. I pity people who took this course, paid it out of their own pockets, thinking it would actually qualify them to work as pentester

@MechMK1 I noticed that in your answer you linked to bettercrypto.org ; I just read it a bit, and it appears to be outdated. For example bettercrypto.org/#_nginx accepts TLS 1.0. I would instead suggest the EU reference on cryptographic mechanisms : sogis.eu/uk/supporting_doc_en.html

Oh, not pentester. I mean 𝕮𝖊𝖗𝖙𝖎𝖋𝖎𝖊𝖉 𝕰𝖙𝖍𝖎𝖈𝖆𝖑 𝕳𝖆𝖈𝖐𝖊𝖗

I didn't even pay for OSCP with my own money. I wanna do OSWE, but like I am not gonna pay it till someone sponsors me as well. But CEH .... Hahaha

I wanted to go through that link! Let me check it out now as I have some time.

3:47 PM

@A.Hersean You're right. I should bring that up to my company, since we recommend bettercrypto

Anyways, I gotta go now for real this time

^D

Ciao!

Yeah, last update was done in 2019: github.com/BetterCrypto/Applied-Crypto-Hardening

@A.Hersean 46 pages. That sounds like a winner compared to other crypto docs and refs. I'll give this a read. Thanks for sharing!

« first day (3638 days earlier) ← previous day next day → last day (1232 days later) »

Transcript for

Dec '201

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile