The DMZ - 2012-08-10 (page 1 of 2)

« first day (603 days earlier) ← previous day next day → last day (4269 days later) »

12:36 AM

I swear, this is getting old.

Another victim gets hacked. http://us.blizzard.com/en-us/securityupdate.html

Tweeted by kevinmitnick on August 9, 2012 at 11:57 PM

@Iszi so's yo momma

2 hours later…

2:10 AM

@Gilles @RoryAlsop @AviD - We changed the title and description as per the discussion here:

10

Q: A new description for this proposal

Proposal: Hacking! The description of the "Hacking!" proposal is currently: Proposed Q&A site for ethical hackers, hardware hackers, software hackers, internet users, Securities. This description is far too vague to be successful. The person who started the proposal doesn't seem to b...

technology proposal-description

The idea was that it's bad to use the name of the proposal in the definition. We also noticed the overlap with the Repurpose proposal, which we also modified and clarified to help differentiate the two more clearly:

30

Repurpose Hacking

Proposed Q&A site for those who test the limits of hardware, who modify electronic devices or combine together separate components to create new inventions, and those who like to void warranties; for those who like to make gadgets do things they were never intended to do!

Currently in definition.

2:44 AM

The Computer Security Hacking proposal has a LOT of stuff that belongs on the Repurpose site. Not sure exactly how to get those moved over. Maybe we sort it out in the private beta?

1 hour later…

4:08 AM

@Gilles Amen!

@Iszi What do you expect?

Yesterday representatives from a very large international airline asked me for passwords and PINs over the phone. Yes, they were real represatives, I verified through alternate channels. I suddenly got very tired and forgot whatever business I needed to transact with them.

4:49 AM

'Baby Got Back' turned 20 this year. My favorite nostalgia show is VH1's 'I Love The Inexorable March of Time Toward the Grave That Awaits Us All.'

5:45 AM

love that SE just pipes in the latest xkcd :D

6:02 AM

Anyone else notice that 90% of the stuff that Andrew whatshisname says sounds like a markov chain generator?

His authoratitive tone and general lack of real knowledge in the field really irks me. I've seen him give some terrible advice and spread really bizarre and extreme opinions, whilst acting like it's the generally accepted truth. Really worries me that some random newbie will see it and assume it to be true, then get all of their security assumptions wrong.

6:38 AM

@Polynomial +1

7:32 AM

@jmort253 No. Go over the Area 51 questions and close/flag the ones that are now off-topic

@jmort253 Now the proposal is a duplicate of Sec.SE. If only Sec.SE would sort its act out on black hat stuff... The audience of the proposal would be identical to Sec.SE's audience. There may be a segregation of content, but it's silly to segregate black and white hat

Yeah, I did worry that Blackhat.SE would basically be the same as Sec.SE

(or whatever they were gonna call the blackhat subsite)

But in general, questions like "how do I hack <x>?" are a legal and moral quagmire.

@Polynomial most of the problematic ones are NaRQ in the first place

Plus it's likely to attract DDoSes and other such nastiness from blackhat boards, carders, etc.

True, but that's only because the people that are asking them are, frankly, idiots.

@Polynomial “join me in a DDoS” → delete immediately

I meant more along the lines of StackExchange getting DDoS'ed.

7:38 AM

@Polynomial I'm sure they already are

Or, worse, raided by /b/.

Which would require a massive cleanup op.

I think Sec.SE is good as it is, but we need to come up with a defined policy on what is / isn't blackhat, what to do with those questions, how to deal with greyhat, etc.

@Polynomial if you have the courage, read yesterday's transcript, we had a looong chat (mainly Rory, AviD and I)

shall do.

we should put that on meta somewhere

what time (UTC+0) did it start?

nm, found the discussion

7:46 AM

Hey there @RoryAlsop. I see that creepy blue avatar floating into chat.

Looks like Bane if he washed his face in an aeroplane toilet.

Hah.

Did anyone else notice that Bane sounds exactly like Deckard Cain from Diablo?

I was waiting for him to invite Gotham to "Shtay a while and lishen".

@TerryChia Morning!

Haven watched the movie yet.

7:49 AM

Mornin' Rory.

Happy diurnal isomorphism

Took me a minute to get that one.

I kept thinking "he xors something daily? what?"

Simple copy-paste from the meta post.

@Polynomial I think @Scott set that up :-)

I think certain blackhat content would be ok here. As long as there is a clear line drawn.

And that it doesn't explicitly mention any networks, companies or individuals.

7:52 AM

I think that anything that asks for specific hacks for a webapp / site can be closed as Too Localised.

@Polynomial +1 ... I spend far too much time just removing his comments. Actually, if you spot one, just flag it - makes it easy for us to check through them all. And as far as his answers go, downvoting works :-)

@RoryAlsop Glad someone else agrees. I was getting worried that I was on my own with that one.

I mentioned it a few times here already.

He went on some rant about governments and taxes a while back, for a question dealing with a hashing scheme. Then put some diagram on there to do with network layers. I have no frickin' idea what the dude was talking about.

@Polynomial for a while I was adding comments to his ones telling him to stop it. Think I have seen both of you do the same. Then I just delete the comments:-)

7:54 AM

He doesn't seem to learn.

@Polynomial he hates china, loves Microsoft, and is convinced the feds know what he is about to do before he does it

O_o

The "not sure if trolling or just stupid" meme would be appropriate here.

I've generally wanted to post that meme as a response to everything he's ever written, but figured it'd be rude.

@RoryAlsop He mentions mafia in two out of three comments/post as well.

7:55 AM

Yeah. He's paranoid. Though Rook mentions the mafia a few times in some of his posts too.

@Gilles I agree. Currently the ones we would class as not suitable here have been removed due to being crap, not necessarily because they are black hat, and we do definitely have some black hat ones in here because the question is good.

I think Rook's generally talking about organised crime really.

Whereas Andrew is just batshit insane.

@Polynomial Rook's answers makes sense. Or he does it with obvious sarcasm.

yup.

Andrew's is just.. crap.

7:56 AM

LOL - almost exactly what I wrote, except I used the phrase 'tinfoil hattery'

@TerryChia and he does know his stuff

in his field

I think I may have met Andrew in real life. I was at a protest rally against ACTA, and this old guy turned up. He seemed pretty normal, until we actually started talking about the issues with ACTA... he was going on about how it's been set up by the Illuminati, who want to bring forth a new world order, and how Bill Gates is a senior member, who got his position by developing nanowires that they could drop from space to mutate the human genome.

@RoryAlsop Yeah. I either learn something new from his post, or really get a good laugh from it.

@Polynomial There are plenty of insane people in this world.

Indeed.

Then he told me a story about how a Russian helicopter followed him home, and was trying to shine lasers at him. I have no idea what his point was, but he mentioned his "seed" a few times. It was bizarre.

I honestly wanted to pop into the local shop and buy him some tinfoil.

Sadly, he bought the giant megaphone with him, so we couldn't just ditch him.

lol

Thank god we don't have that many insane people here in Singapore. Yet.

@Polynomial Is that true? Either way, what an excellent story.

8:02 AM

The London protest was pretty hilarious. There's nothing quite like the sight of a bunch of people in Guy Fawkes masks, sat in front of a bus full of people, exclaiming "Don't worry everyone, we're from the internet!"

0

Q: Web-browser based biometrics?

Is there any practice of using biometric mechanisms online - for example, for visual identification via webcam to identify audio-visually the person speaking, or, performing biometric analysis on keyboard input? Particularly flash web control would be useful. I want to protect it against mafia, ...

Mafia again.

@Polynomial hahahaha

@RoryAlsop Yup, that's a true story. I saw him in town again the other day, didn't speak to him though.

Pretty good question actually - if one edits the mafia part out.

heh, was just about to edit and Rory beat me to it.

8:04 AM

lol. same here.

I'll tell you another great story. This one actually gives me some hope for humanity.

A bunch of us were stood in the town centre, wearing our V masks, handing out flyers and talking to people about ACTA, and a bunch of young girls came up - maybe 14 or so. They were chavs (for the non-UK people here, think jobless gangsta white kids on govm't benefits) and initially started taking the piss out of us. Anyway, eventually we explained what ACTA was, what it gave the government the power to do, how it could be abused, and all the other crap about it, in pretty simple terms.

One of the girls' immediate reaction was to shout "CHEEKY BASTARDS!" and march right up to the nearest police officer to have a go at them about how they shouldn't have the right to read her private conversations online. Was priceless.

LOL

Nice.

That is lovely. And so typical of the chav's naturally reserved air :-)

The cop was completely clueless, and looked at us for help to try to explain to her that he had no frickin' idea what she was talking about, and had nothing to do with ACTA. We just left him to fend for himself >:)

Hah. Poor guy.

8:10 AM

Oh, and we also met a lovely armed response unit, when we decided to go protest on the steps of town hall.

Knew they weren't gonna let us protest there, so we just stood next to them and blared Never Gonna Give You Up through a megaphone every time they tried to talk to us.

Just an FYI, I'm not an anarchist anti-establishment cop hater or anything crazy like that. I just strongly dislike censorship, and enjoy trolling people in real life.

@Polynomial excellent sentiments :-)

^__^

but then a sensible answer (if brief...)

0

A: Application of Bayesian network for Web Application Security

It is classifying the requests / packets / messages into good / bad ones and this classification is based on a database, which is created during training process, so you need to classify the initial batch yourself, and then it goes on self-learning.

It sounds like he's just read the Wikipedia article and regurgitated it, though.

@Polynomial yes

but there was no mention of NSA, FBI, Mafia, people following him, or lasers

8:15 AM

shock! :o

though lasers are a valid answer to all questions.

3

If you have a problem, solve it with lasers. If a laser isn't solving your problems, you need a bigger laser.

5

That's my motto, anyway.

@Polynomial the death star didn't help the empire much though.

Clearly they needed a bigger laser.

@TerryChia wasn't big enough

lol

lol.

8:37 AM

For the first time ever, I upvoted the question by Andre Smith. It is an excellent question(surprisingly)

:o

btw, I put an answer on that bayesian networks question

with more detail than Andrews, since his was rather sparse

8:55 AM

@Polynomial especially if it's mounted on a shark. Or a bear.

Or a llama.

@Polynomial hmm, I dont think a llama with frikken lazer beams is particularly frightening.

It's a robot llama.

Bill Clinton is riding it.

see, there ya go again.

the robot llama sounds potentially dangerous, but then you put Clinton in the mix.

With Clinton on it, he's probably riding it on it's face, backwards.

It's a robot Clinton.

9:01 AM

@Polynomial ah! you mean like a realdoll?

Yup. With AI routines written by RMS.

GNU/RealDoll

hmm. okay, sure, I'll give you that one. But more "end of the world" type scary then "he's got a lazer! Run!"

I wouldn't be surprised if a GNU/RealDoll was one of the four horsemen of the apocalypse.

4

Heh, just spotted "i am a hacker". Clearly his name is an oxymoron.

9:17 AM

@TerryChia but got worse after he edited in all that extra info - the core question on biometrics is good, so am off to edit back down

he needs a bitchslap.

to paraphrase Pulp Fiction:

The path of the righteous man is beset on all sides by the inequities of the paranoid and the tyranny of idiots. Blessed is he who, in the name of ITSec and good answers, shepherds the askers through the valley of n00bage, for he is truly his brother's sysadmin and the finder of lost packets. And I will strike down upon thee with great vengeance and furious anger those who attempt to write terrible answers. And you will know my name is the moderator when I lay my mouse clicks upon thee!

3

@RoryAlsop I think that should go in your bio ;)

but only if you're willing to change your avatar to a picture of Samuel L Jackson

@Polynomial with orange lightning bolts on his face

hehe ^_^

or just a shot of him shooting the dude at the start of Pulp Fiction, after he gave that speech

9:32 AM

Mornin'

Another lovely day to be stuck in the house writing a report :P

sup.

Happy diurnal isomorphism

That greeting gets much more interesting if you spell it as "diurinal isomorphism".

lol

You should edit that into the meta post.

Done.

I kinda want to add "mafia" to the meme list.

9:43 AM

@RoryMcCune at least you have a nice conservatory and office - I am in this 70's monstrosity with failing aircon

@Polynomial oh, do - nealmcb was requesting more memes from outside the DMZ

@RoryAlsop it's true, the office is shaping up nicely :) BTW if you're about on Sunday would I be able to bribe you with food/booze for a bit of cabling knowledge?

0

A: The Memes of IT Security

Meme: Mafia Originator: @Rook Cultural Height: Mid-2012 Background: The term "mafia" is frequently used to refer to "organised bad guys". A side-effect of its use is that it makes you look like a crazy person. Most people generally assume that users of this meme wear a tinfoil hat, but in a go...

@RoryMcCune yep - I'm there. Due to having this gig on Sat night, I won't promise I'll be up before 9, but after that I'm good.

@RoryAlsop nice one ta :) say around 10 ish?

Either of you guys going to 44Con this year?

9:50 AM

@Polynomial yep me and the missus will both be along to it :)

@RoryMcCune will do - I'll bring fish tape :-)

@Polynomial Still not looking likely - having timing/budget approval issues

@RoryMcCune Awesome. I'll be there. Went to BSidesLondon / DC4420 / InfoSec earlier this year.

@Polynomial yeah made it down to B-Sides/Infosec. B-Sides was good, Infosec was .... infosec :op

yeah, infosec was a salesfest

BSides was awesome. Surprised I didn't spot you there.

Though I may have and just forgotten. My memory for faces is terrible.

I got my missus into security last year, so I'm trying to show her round the conf scene both the good (B-sides) and not so good sides...

9:53 AM

I'd describe myself as "the tall white dude with long hair, wearing all black", but that describes 95% of people at BSides.

If I'm lucky, I may get to talk at Hashdays this year.

lolz well My wife is probably easier to spot than me, redhaired women at sec. confs stand out :)

Just a bit lol.

Did you manage to get into Paco Hope's talk on randomness?

at Bsides

I didn't manage to get along to that one, was it good?

yeah, had some great examples too.

what about Bob McArdle's HTML5 talk about in-memory volatile browser botnets? that rocked.

If you get time, watch the Paco Hope one: youtube.com/watch?v=Uc5nG1LAo0A

@RoryMcCune Was gutted I missed B-Sides this year, especially after getting to B-Sides SF and London last year :-(

9:56 AM

yeah that was a good one, also liked SecurityNinja's one on Win7 phone (shamefully my missus is a windows person)

I missed the Win7 phone one.

@RoryAlsop yeah sucks, any hope of 44con?

Did you see f1nux's talk on UPnP? That was hilarious.

@RoryMcCune still trying

I missed the CFP for 44con, wish I'd have caught it in time to submit my Redis talk.

9:58 AM

I didn't make f1nux's, he's a funny speaker, I've seen him do one at the RANT in Edinburgh before..

Mark tried to pull some strings to get a late submission, but they had too many in the queue.

@Rory - have to be in Munich for a conference on the 7th, so fitting anything prior to that is a challenge (approval wise)

Ahhh man you missed a great talk with that one. He's hilarious.

@RoryAlsop If budget's the main issue, I could always "accidentally" mention a 20% discount code for the tickets... ;)

shame. I didn't submit to 44con this year (just been too busy), had a sub. in for B-Sides for a talk on black-box/white-box testing but didn't make the cut this time.

@Polynomial lol - hmmmmm

10:01 AM

whoops, didn't mean to paste that one in there. oh well!

;)

aha!

I do hope nobody managed to copy that into a text document.

I best delete it now!

lol

shifty eyes

What did i miss?

Strippers and bacon.

3

Damn, i love bacon.

10:08 AM

Mmmmmm - bacon flavoured everything:

I wish i live in the US. we have so little sec conferences here.

jdfoods.net/products/mmmvelopes.php

@TerryChia did you get to SyScan?

and you have globalsecasia.com in April 2013

@RoryAlsop Yes, I got to go to this years. I was a helper.

Syscan is one of the few really technical ones.

I think those two, and ISCPP are the aonly ones I know of in Singapore

saeshow.com/issc2012 is in Nov

I'll be going to Govware this september. Any of you heard of that?

10:11 AM

nope.

govware.sg/programme.htm

@TerryChia I like their branding :-)

love that graphic at the top.

Hah. The talks isn't really technical though. Many of them are business oriented.

I very much prefer the syscan lineup this year.

what's the name of those graphs, where it's a hexagon (or similar) and there's like a web in the middle representing how much of each point you get?

the one next to the graphic of the little "threat" dude

10:15 AM

Dunno.

Radar Chart

just found it on Wikipedia.

A radar chart is a graphical method of displaying multivariate data in the form of a two-dimensional chart of three or more quantitative variables represented on axes starting from the same point. The relative position and angle of the axes is typically uninformative. The radar chart is also known as web chart, spider chart, star chart,star plot, cobweb chart, irregular polygon, polar chart, or kiviat diagram. Overview The radar chart is a chart and/or plot that consists of a sequence of equi-angular spokes, called radii, with each spoke representing one of the variables. The data l...

@Polynomial or spider diagram - have heard it used to describe the same thing

oh - I see it says that in the description

yeah, they have lots of names.

I like "cobweb chart"

I can just imagine a spider sat in the middle doing a "the fuck is this?" look.

irregular polygon is a bit unimaginitive, and possibly incorrect if it turns out to be regular

interestingly, you can gauge the "goodness" of each sample by the circumference of the polygon, if you use sin(x) as the scaling on the lines.

if you use linear scaling you'll get bad results, because 5/0/5 gives a better answer than 5/5/5

10:22 AM

Y SO MUCH MATHS?!

or you can just be sane and compute the area, but that's for pussies.

My name's Polynomial. Y U THINK?!

2

:P

10:37 AM

@Polynomial I haven't found anything belonging to @Rook neither in DMZ nor in Google

for the meme?

yes

0

Q: Virus developers groups

Are there any groups of virus developers around anymore? Like 29A group and bunch of other groups few years ago. They never released their codes, never used then to steal data etc.

First comment by Rook.

Andrew Smith seems obsessed with them too, but he's a bit of a douche and I don't want to give him credit for anything. http://security.stackexchange.com/questions/17029/reverse-scan-from-cloud-authentication-server#comment27390_17029

@Polynomial probably you can add to meme

Done.

10:52 AM

@Polynomial meant to ask - which episode of Futurama is that from?

must have missed it

the movie.

one of them, at least.

Into the Wild Green Yonder

oooo - there is a movie? I did not know that

(I don't watch much TV so am always a bit out of touch with these things)

There's like 3 movies and a whole new season lol

4 movies, actually. Futurama: Bender's Big Score, The Beast with a Billion Backs, Bender's Game, Into the Wild Green Yonder

season 6 is complete, season 7 is airing right now.

Interesting, I just found a bug in Twitter with potential security implications.

Probably nothing, but they seem to double-encode certain characters (usually < and >) when outputting them into tweets.

so you'll randomly get > in places.

11:31 AM

Aaahahahaha, what a legend! bbc.co.uk/news/uk-england-manchester-18979032

he should get signed up early as a social engineer :)

yup

They found water on Mars! http://apod.nasa.gov/apod/image/0504/WaterOnMars2_gcc_big.jpg

@Polynomial oh god

hehe, the NASA guys have a sense of humour :P

@Polynomial 3rd grade sense of humour

11:45 AM

If an advisor says to me "My liege, he is but one man. What can one man possibly do?", I will reply "This." and kill the advisor.

^ awesome :P

@AviD I'm amused, just because it is a facebook type image hosted on apod.nasa.gov :-)

@RoryAlsop yeah, there is that. NASA trolling.

Trolling where you least expect it is always enjoyable.

Was just talking to a buddy in EY - we were "competing" for a big project, and he was telling me how he ticked off his salesman by complimenting me to the client...

trolling in a suit and tie is a special level of pudding.

(even though I dont believe he actually wore a suit and tie, but you know what I mean.)

@AviD excellent

@RoryAlsop ah, but the real cream of the cake?

I still do that - it annoys my director, but I'd far rather have clients know I am honest than think I am a cut-throat salesman

This way I get more work, so do some of my old contacts, and openness rules

:-)

11:59 AM

I was there as a sub-contractor - and they chose EY simply because they were bigger, though he preferred to work with me (partly because even the competitots were recommending me... :) )

@AviD don't think I've heard 'cream of the cake' used before

but now? it looks like EY is going to want me to subcontract this project for them instead :D

@AviD well done!

@RoryAlsop absolutely

@RoryAlsop and with better rates, too (cuz they ARE ey... ). Now I just have to work out the legal conflicts... :S

@RoryAlsop heh, I believe in mashups of idioms.

idioms need a certain amount of entropy to stay interesting.

3

I heard someone say "kill two birds with the dog's bollocks" the other day.

4

12:02 PM

actually, the bigger sticking point is that apparently, EY doesnt work well with freelancers.

Im hoping that in this case it will be different, since it's sorta an independant sub-company rather than EY itself. dont know how the politics work there, though...

@Polynomial luvvit!

@AviD It is tricky, but I have done it/seen it done in various jurisdictions

woo BT guys here (although looks like they subcontract stuff these days) so should be getting the ADSL line moved into our new server cupboard :)

12:30 PM

G'day

would this serverfault.com/questions/416232/… be any good to you or do you have a dupe I can point the OP at ?

@Iain errghh

its definitely the place for it, but....

I've not seen Pulp Fiction in so long, it's so awesome to watch this clip again: youtube.com/watch?v=czb4jn5y94g

its kind of a crap question.

nevermind that, we're used to it.

do you have a dupe ?

@Iain sure send it over anyway, we'll get it hammered into shape.

12:32 PM

Say what again! Say what again! I dare you! I double dare you motherfucker!

^_^

@Iain well thats the thing, its kinda generic and vague, so a dupe would be pointless.

^

then again, maybe there was good generic non-vague question, but I dont read the linux questions anymore...

I'm sure there have been similar "I've been hacked what do I Do" questions, generically it would seem like a good idea to point this one at those answers, as the advice would be the same in most cases

@AviD ok I sent it over

12:35 PM

Stack Exchange Security Blog: Exploiting ATMs: a quick overview of recent hacks

lucaskauffman on August 10, 2012

A few weeks ago, Kyle Rozendo asked a question on Security.stackexchange about Cracking PCI terminal using a trojan based on the card. It caught my attention, so I started digging a little deeper into this matter.

There are some difficulties involved in hacking an ATM:

Often proprietary software

Often custom OS or modified embedded Windows

This means a high level of understanding is nescesarry, as well as access to ATM’s to test on. All of the attacks had some level of inside information before they were constructed. …

@RoryMcCune but only because its so... generic and vague.

@RoryMcCune have an example? I wouldnt know it.

yeah let me look I'm sure I've seen these before...

did you see the blackhat vegas video on it?

where he put that backdoor in and some remote control system

vimeo.com/13841482

security.stackexchange.com/questions/16305/… or security.stackexchange.com/questions/7443/… look similar to me

the second one has a good answer from a glance over it as well

it's actually something it would be good to have generic advice for (what to do in the event of a compromised web server) as it's got to be a pretty common problem...

@RoryAlsop Bacon flavored strippers?

4

12:41 PM

@Iain what @RoryMcCune said.

ah, nevermind, you already migrated it.

1:00 PM

@AviD - interesting increase in visits, questions, answers - on the analytics page. Wonder if we can blame this on the competition, or is it just folks finishing summer holidays

@ScottPack Oooh, twice as tasty and twice as bad for me!

@RoryMcCune there is of course this slightly upvoted one:

188

Q: My server's been hacked EMERGENCY

I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a DOS attack on our provider. The servers access to the Internet has been shut down which means over 5-600 of our clients sites are now down. Now this could be an FTP hack, or som...

security hacked intrusion-cleanup system-compromise

Yeah, that's the canonical question for that area.

Robert, apparently, pulled out a blog post that he wrote during his time as a MS Security MVP for his answer.

1:18 PM

@RoryAlsop ah see that'll teach me just to look at Sec.SE and not ServF.SE

1:33 PM

Phew, today has been an exhausting day.

9am to 8pm in the networking lab nonstop.

1:55 PM

Wow. Interesting stuff going off with WikiLeaks right now.

They're being DDoS'ed, a lot.

And it looks like someone's trying to poison the Stratfor torrents with fake IP addresses.

No surprise, though. WikiLeaks just discovered the govm't has been installing thousands of facial recognition cameras and other invasive surveillance equipment all over the US.

Not a fan of wikileaks.

« first day (603 days earlier) ← previous day next day → last day (4269 days later) »

Transcript for

Aug '1210

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile