The DMZ

MechMK1

9:01 AM

Hey, how's everyone?

A. Hersean

Mostly fine. You?

MechMK1

Same. Just had a meeting, which went well.

Now I'm mostly just managing projects instead of actually pentesting.

A. Hersean

I refused promotions to management position. I did it for 1 year on a project, and that was enough for me to know that I do not like it.

MechMK1

I'm not in a management position

Nobody in their right mind would put me in management.

But I do have a customer I am assigned to, and I have to manage those projects

And I fucking hate it

Not the customer themselves, they're nice people. I hate the act of managing. Calling here, calling there, oh this guy is on vacation, better delay everything then...

A. Hersean

So, you are effectively in a (part-time) management position, without the monetary compensation.

MechMK1

9:15 AM

20

Q: Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?

I installed Windows NT 3.1 on a Compaq ProSignia 3080 system, because of several reasons: I know that this machine was running Windows NT 3.1 when it was in productive use. And I think this machine was one of the machines Microsoft explicitly targeted with Windows NT. For improved performance, I ...

@A.Hersean Yeah

A. Hersean

Quit?

MechMK1

@A.Hersean No, it's a chill job to be honest

A. Hersean

So, that's not so bad.

MechMK1

I start at 10 or 11, then quit at 16 or such

There are days where I basically just watch YouTube videos

A. Hersean

Don't you have some technical tasks in parallel?

MechMK1

9:17 AM

It depends if I have a project

If not, well, tough shit

YouTube it is

A. Hersean

^_^

MechMK1

I'm definitely not going to go out of my way to find work to do

So I volunteered to be the SPOC for this customer, because a.) then I can say I'm SPOC for a customer, and b.) people won't believe I'm not doing anything productive

And sometimes, I actually am productive

A. Hersean

Right now, we have too much work to do, without enough people. We are so understaffed (and hirering).

MechMK1

Not my fault if I am planned for 2PD for a recheck and then I check all vulns in 10 minutes

@A.Hersean I'd imagine a lot of people are looking for a job now anyways

A. Hersean

@MechMK1 That's the curse to be too competent ^^

@MechMK1 Yeah, but we refuse most applicants.

MechMK1

9:21 AM

@A.Hersean I'm not particularly competent - that specific customer just happens to be very incompetent and actually didn't fix any vulns

I can't go into details due to NDA, but...

AVGN - WHAT THE FUCK WERE THEY THINKING

►

A. Hersean

And since we are a priori understaffed only for the next 6 month, the direction does not want to hire too much because then we could become overstaffed.

I know that kind of clients.

MechMK1

Who on earth design a system this fucking shitty, has a pentest, two years to fix, and doesn't manage to fix ANYTHING?!

@A.Hersean I hope you can manage the next few months. Just refuse to perform, because management could see that as a sign that you don't need more people anyways

We had that at the local gov't after a "reform"

Departments were systematically bled out to "make the departments leaner" and then people dropped like flies from burnout

A. Hersean

Management understands the situation, and we risk being late in delivering and having to pay penalties. But it's a risk they are willing to pay. They do not force us to work overtime either, like in lots of startups, so they are pretty cool on this matter compared to other work places.

MechMK1

Good, good. Because usually this shit goes like this: "We're temporarily understaffed, but it's just temporary, so give your best and push through" - "Oh, looks like we weren't understaffed at all and we can manage with 30% less people. Perfect."

A. Hersean

The motto remains "quality of quantity", so we must take the time need to perform the tasks. But we still feel the pressure, because we like our work and would like to finish it in time.

MechMK1

9:28 AM

Then I wish you the best

A. Hersean

@MechMK1 Management knows that a lot of people would quit if they put stuff like this in place. The turnover is still quite high because in my city there's a lot of jobs in cybersecurity so it's easy to find another job.

MechMK1

Also just saw a weird deleted question. Guy says he "scanned his internal network"; then claims he scanned his public IP. Says he didn't set up any port forwarding, then is suprised that no ports are open.

@A.Hersean Why do people go for other jobs then instead of this one?

A. Hersean

@MechMK1 More technical/specialized tasks, better pay, "the grass is greener on the other side of the fence", less pressure (with lesser pay), etc.

MechMK1

@A.Hersean Seems like your company needs to up their game then

I know I could earn more money with other companies, but the fact that I have so little pressure to perform my tasks is worth its weight in gold

A. Hersean

Not really. It's just that not everybody seeks the same thing in thair job.

MechMK1

9:34 AM

That is true

Things used to be way worse here

A. Hersean

I know ex-colleagues that went to other companies that offered dream jobs (for them), but did not deliver. One of them quit after 6 months. The other is still there, but ended up doing exactly the same job as back in our company.

MechMK1

You see, there is a bit of an imbalance

My company offered me an incredible bonus system, which would have lead to me receiving ~300€ more per month

That system was "cut" 1 month after I started

I didn't consent to this, and essentially, was hired with a bait-and-switch tactic.

So I don't feel bad at all if I am tasked to do a pentest for 5 PD and only work 1.5 PD on it realistically.

After all, if they can unilaterally change the compensation they give me for my work, then it's only fair for me to unilaterally change the amount of work I put in.

A. Hersean

That's (for them) the taste of karma when it comes back.

MechMK1

Exactly. So honestly, I don't feel bad about it.

A. Hersean

We rarely have more time than enough to perform our tasks. We could almost always do more if we had more time. And since we like to produce quality work (related to why we refuse lots of applicants, and also to the good cooperative work atmosphere in the workplace), we rarely do the minimum (we can do it when the client is a real ass).

MechMK1

9:48 AM

Well, the quality of pentests I have ranges from "Oh my God, this is amazing" to "Please kill me now"

Also, completely unrelated: I love answers.microsoft.com.

I love how the answers provided by "experts" have no correlation with the questions whatsoever.

Q: "Why does Resource Monitor show P:4 instead of F:? What is this weird format?"
A: "Make a backup of your Windows installation."

A. Hersean

The arse client usually get few vulnerabilities (we can avoid exploring some for when the clients come back) with harsh reports detailing even minor stuff. We usually emphasize the nice things when we find some, but not for those those clients.

MechMK1

@A.Hersean I have this one sentence in my report, which is just basically "You're a complete fucking idiot and everything you touch will end up in failure"

Although worded more professionally

A. Hersean

@MechMK1 They pollute my searches to resolve the absurdities of MS stuff.

MechMK1

@A.Hersean I absolutely love how fucking stupid they are.

Q: "I want to use the Japanese IME with a QWERTZ keyboard. How can I set it up to be QWERTZ instead of QWERTY?"
A: "Update your Anti-Virus."

A. Hersean

Do you remember the Blackhat talk on "Time AI"? We had a similar client that wanted a certification...

MechMK1

9:52 AM

@A.Hersean Oh god

A. Hersean

We are not sure that this client will come back with a fixed version.

MechMK1

@A.Hersean Better that way

A. Hersean

But they need a certification to extort money to their investors.

MechMK1

Q: "When running the Windows Media Creation Tool, I get error 0xE0007BA2. What should I do?"
A: "Run the Windows Media Creation Tool."

@A.Hersean That's why we don't certify

And I say in every kickoff meeting: "The goal of a penetration test is not to prove the absence of vulnerabilities. It is impossible to do that. The goal of a penetration test is to discover vulnerabilities, so that they can be fixed and make the product more secure.

I'm 100% certain if I fed a chatbot with all questions and answers from Super User tagged "windows" and then let it write automated answers to questions, it would do a better job that Microsoft's "Experts"

A. Hersean

We don't technically certify. We are a contractor for a national agency that can deliver certifications. We write evaluation reports (the evaluations usually are of 20 to 30 work days), and based on our findings the agency delivers (or not) the certification.

MechMK1

9:56 AM

@A.Hersean Ah, i see

A. Hersean

We also do pentests of a few days, but that's by other people.

MechMK1

Pentests are so fun, because I can basically tell people they're idiots without having to do better

But I can't disclose any funny vulns I had

A. Hersean

The bullshit "Time AI"-like company came for an evaluation however.

MechMK1

Anyways, time to make lunch

A. Hersean

See ya

MechMK1

9:59 AM

See ya

reed

10:17 AM

0

Q: Security technologies that implements security through "organic-like" obscurity?

Are there any advanced security technologies, for example, establishing a secured connection, which first require authentication based on security through organic-like changing obscurity of secrecy? I'm not a fan of "regular" security through obscurity, because hackers will eventually discover an...

account-security reverse-engineering algorithm

That question was insane. It's like reinventing the wheel, but making it square

nobody

10:31 AM

@reed Uh, no not square, its trying to make it a shape that I can't even imagine

Journeyman Geek

10:43 AM

non eculidian?

the very sight of it drives men to slobbering madness?

@MechMK1 ._.

MechMK1

11:11 AM

@JourneymanGeek Trust me, I've had this exact problem.

Would you like to know what fixed it?

Journeyman Geek

@MechMK1 more the answer

I consider the MCT fickle and generally use other tools :D

MechMK1

@JourneymanGeek I am 100% convinced this is a situation like in xkcd

I recently had someone ask me to go get a computer and turn it on so I could restart it. He refused to move further in the script until I said I had done that.

Especially the tooltip

Journeyman Geek

lol

MechMK1

I believe that's what you get when you want to provide tech support to people who don't even know what they are doing.

Like, okay, imagine you open up a GitHub issue for a project. You provide detailed steps to reproduce the issue, provide a stacktrace, perhaps even a debugable memory dump. And the answers you will get are going to be amazing.

Now imagine doing the exact same thing on answers.microsoft.com. You will be asked "did you try restarting the application?" or "Did you try updating Windows?" or "Did you try disabling Anti-Virus?"

Journeyman Geek

ah yeah

MechMK1

11:21 AM

And because they expect that the "input" for questions is going to be nearly unusable, the answers they provide and are expected to provide are going to be nearly unusable.

And to be honest, "Did you try rebooting your computer?" or "Did you try restarting the application?" will probably resolve a good chunk of all issues.

For example, I once had OpenVPN problems, where my connection was continuously reset every couple of seconds. I resolved it by rebooting my machine. Why was it an issue in the first place? I'd love to know, but I probably never will

Journeyman Geek

12:02 PM

sure

that's often the first thing I try

MechMK1

The problem is that more often than not, their support doesn't exceed that level of generic error handling

Journeyman Geek

Well they're probably poorly paid and/or will get in trouble if they go off script

MechMK1

Yeah, and that's the thing

If someone labels themselves as a "Microsoft Certified Professional", I INSTANTLY assume they will not be able to help me.

reed

12:18 PM

but is answers.microsoft.com a place for "official" support? I never understand if such communities (also on Google, etc.) are by enthusiasts for enthusiasts, or if they are something more official

sometimes I suspect (or rather, I'm pretty sure) lots of products rely on support by volunteers, hoping they will help clients use their products, instead of investing in real official support

A. Hersean

@MechMK1 It's like the CEH certification. You do it if your boss asks it. But you do not put it on your CV if you want to be credible.

MechMK1

@A.Hersean Yeah, literally. Though sadly, I have to put it on my internal CV

@reed I believe that the "Microsoft MVPs" are being paid, but that's just a gut feeling

Otherwise I'd see no reason why someone would spend their time giving shitty answers to shitty questions

You don't even gain updoots like on SE

A. Hersean

@reed It's both. That's half the problem. The other half is that the professionals usually are not that much better than enthusiasts.

(The 1st half implying that the few good answers are drowned under poor ones.)

reed

I might be wrong, but I suspect there's something wrong with the way technology works. If a product has a problem, the problem should be fixed by whoever created (and sold) that product. Right now, in the world, millions of poor guys are fixing Microsoft's problems, while not being paid by Microsoft

A. Hersean

That's the historical way it works with MS.

reed

12:25 PM

but Microsoft is just an example, the same would apply to most tech, I guess

A. Hersean

Now that more and more of their products are on github, one can open issues.

@reed Depends. Most games end up with patches fixing most of their issues.

But for crappy IOT stuff, obviously not.

I think the culprit is this:

> THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

reed

YES! I told you "AS IS" is one of my favorite jokes

the joke is that "as is" is literally everywhere under the hood

MechMK1

1:01 PM

twitter.com/Stefenrc/status/1384004240356429831

I found the best tweet of all time

3

Q: Cyber Security vs. Digital Security

What is the difference between Cyber Security and Digital Security? They sound very similar (same) to me, But I have read that current techniques of Machine Learning can provide Digital Security, But not Cyber Security. So what is the difference?

terminology

Digital Security is when you secure your digits, and Cyber Security is when you secure your cyber. — MechMK1 47 secs ago

Anonymous

my life has resorted to this

Anonymous

crazygames.com/game/swords-and-sandals-2

A. Hersean

In French, "digital" still retains its original meaning of "with digits" (AKA fingers). "Digital" gets translated to "numeric". So, "Digital security" would be gloves.

MechMK1

@A.Hersean Digital security is when you wear protective gloves.

@J-- my life has resorted to telling they/them kids that their 17 different self-diagnosed mental illnesses aren't real

Already have two of them a complete mental breakdown over it

Anonymous

lol

MechMK1

1:14 PM

"No, we swear, we have ADHD, ADD, BPD, DID, BFG, HGD, HFS+, etc...."

Journeyman Geek

...... HFS+ ? Oh my, I don't know anyone who got that and lived.

MechMK1