The DMZ

Scott Pack

00:00

Man, only 1200 characters for the nomination spiel. This is hard.

Terry Chia

ooo mod election.

Iszi

@ScottPack You're telling me.

@ScottPack Why not just cut & paste from your previous nomination and add updates?

Scott Pack

Apparently my first draft was around 3100 characters.

And by first draft I mean my previous writeup. :)

Terry Chia

I'll nominate myself for the heck of it. I don't stand a chance against you guys though. :P

Iszi

@ScottPack ??? So, they've trimmed it down since the first one?

Scott Pack

00:04

Apparently

Iszi

@ScottPack Well, that sucks. Is that page still around?

Scott Pack

I think it gets replaced when the new election happens. I wrote mine up in a google doc.

Gilles

@ScottPack do you mean security.stackexchange.com/election/1 ?

Scott Pack

Oh, cool.

So, yeah, you can see how much longer those things used to be.

Iszi

Wow. It's probably better that I didn't go in for that one. And @ThomasPornin too for that matter.

Scott Pack

00:13

That crop of nominees was pretty fantastic.

The results were pretty interesting. Rory won handedly, then Avi very close behind, then a mile or two back it was a 6 way tie with the vote redistribution method being the decider more than the actual voting.

Iszi

We get the handy advantage now, of not having to run against incumbents.

Scott Pack

Well, not really. With only a single position it's just like last year.

Iszi

How so?

Last year, all three incumbents ran.

Scott Pack

Graham came in under the wire. He just about didn't run at all.

Iszi

Oh.

I must say, I'm a little intimidated to know I'm probably up against a previous nominee.

Scott Pack

00:17

meh, we'll see.

Well, I just cut 1999 characters from my writeup. That was not easy.

Iszi

Only 12% participation in the last election. Hm.

Gilles

@Iszi that's pretty good. A lot of the eligible voters only come to the site occasionally (or perhaps never, if they're only eligible because of a migrated post)

The last SO election had 4.5% participation

Scott Pack

And with a site like ours, that will only have a single round, you're talking about a two week period.

Gilles

Of course SO has even more accounts who haven't been to the site in ages

Scott Pack

Similarly, the last SF election had 8% participation.

My apologies. That was the previous to last figure. The last SF election had 3.2% participation.

Actually...this is pretty interesting. With the new election badges we can actually track who visited the page and when.

StupidOne was the first person to visit the election page.

Thomas Pornin

00:44

The Zimbra web page claims that installing Zimbra is a matter of 15 minutes.

The downloading step is already 20 minutes.

And the raw installation is 30 minutes of pure CPU+disk torture

and that's with a 2.7 GHz i7, too much RAM for sanity, and a damn fast SSD as disk.

I do not know what kind of machine they used to get it down to 15 minutes, but standing besides it must have the same health hazards than, say, a nuclear blast.

Terry Chia

@ThomasPornin i7 meh. you need the extreme edition with 6 cores. :P

Thomas Pornin

Anyway, I got the info I needed, so I can stop working for today.

Scott Pack

01:20

Probably using an ESX farm made up of HS22s with a FC Celera backend.

Terry Chia

Is the bear gonna nominate himself for the election? @ThomasPornin

@Polynomial pretty much fulfilled the requirements for the competition in the first day.

Polynomial

05:42

@AviD Oh, cheers! Cheeky bastard :P

AviD

06:52

@Polynomial whaat, it was @ThomasPornin, not me!

wholy craptonne of crap, batman!

15 flags overnight??

at first I thought it was our indian irish hacker friend, back with another few stolen identities. but no, all different users...

I think @Aarthi is just trying to prove to us that we really do need the additional mod.

Terry Chia

hah

Are we gonna have a betting pool for the election? :P

AviD

@TerryChia hahaa

Terry Chia

My $$s on @Polynomial.

AviD

@TerryChia not sure, @Polynomial has some meta catching up to do. on meta.

hmm, and we really need a female's viewpoint!
so, both those issues point to @Iszi :D

Terry Chia

@Iszi is a mile ahead of the rest in meta.

@AviD hahaha!

Didn't @ScottPack already settle the issue aout Iszi's gender? Or do you need more prove?

AviD

07:03

@TerryChia heh, settled, sure, but that doesnt mean we can't still poke the scar.

ah, it seems @ScottPack had a restless night.

Terry Chia

@AviD Tearing open an old wound. What fun indeed.

Flagged this as off topic. Doesn't really have a security question in it.

1

Q: GSM monitoring system

Please help me clarify with GSM monitoring system (active style and semi-active). I cannot differentiate these 2 types of monitoring systems. If anyone can tell me exactly how they operate? Thank you in advance.

Could be edited to fit though.

AviD

@TerryChia cmon, really?? moar flags??

Terry Chia

Piling on to your work is fun. :P

AviD

heh. did that one.

just cleared most of them, I'm gonna leave the rest for another mod, tho - @RoryAlsop @Hendrik

also slapping @ScottPack

I think most of those flags were his muddied pool

I kid, I kid. flagging is actually immensely helpful.

wow, the election looks like its going to be a tough one.

for us, I mean - choosing just one. good luck to you all!

well, I'm off for a few days of sand, surf, and sun. Mainly sun. and sand. but mostly the sun.

try not to flag the site down too hard.

I will just leave you with this parting thought, in anticipation of all the buffer overflow questions next week...

Ninefingers

07:26

-4

Q: What is the best crypto algo to tattoo?

If you wanted a crypto algo that you could use in a hurry without a computer, what is the best public key or symmetric algo for reasonably secure encryption that is succinct enough to be tattooed on your body?

encryption

Just tickled me, that question.

Well technically, RSA aint that long...

it'd maybe take up an arm

Polynomial

08:20

I'd love to get m^k=c as a tattoo :P

bah, lack of mathml :[

Rory Alsop

08:55

Morning - and thanks everyone for letting me get the tumbleweed badge for this:

0

Q: Vote for your question of the week #33

For QotW #33, scheduled for publishing to the Security Stack Exchange Blog on 17 August, please post as Answers, and vote for your favorite question from the whole Security Stackexchange site. Please post any question that you feel is of worth and the reason why as an answer below. Try not to pr...

discussion featured blog qotw

Polynomial

haha

well I couldn't think of a question.

maybe the nuclear blast one?

Rory Alsop

@Iszi I think top ever for any site was around 15%

Polynomial

@RoryAlsop Ask and ye shall receive!

Rory Alsop

@Polynomial heh

re the election - definitely some tough choices - that's an excellent pool of nominees!

Polynomial

09:11

yeah. I think I know who I'm voting for (if I'm allowed to, as a potential candidate)

M'vy

Hey there

Rory Alsop

@Polynomial you are allowed to vote for any of the candidates

Polynomial

(except myself)

:P

Rory Alsop

you can vote for yourself

which is why if a candidate gets zero votes that's a bit sad

Polynomial

Oh. That's an odd policy :P

M'vy

09:21

Well it means this candidate is very fair play

Rory Alsop

@Polynomial it's probably easier to code, and it won't change the results as it is expected that everyone will vote for themselves

Polynomial

indeed. just seems odd compared with "normal" voting situations :P

M'vy

argh I cannot edit my previous candidature

Rory Alsop

@M'vy ctrl-c ctrl-v

M'vy

That won't preserve the links

and format.

Anyway I need to review it.

Terry Chia

09:38

How many votes do we get?

Polynomial

3 I think.

Rory Alsop

yep, 3

Terry Chia

Ah I see. I know who i will be voting for already. ;)

Rory Alsop

you vote your favourite, second and third place

Terry Chia

I don't know why I nominated myself though.

Rory Alsop

09:40

and the voting uses one of the open standards that confuses me immensely, but intelligent folks like @nealmcb seem to understand to be fair, transparent and open

Terry Chia

lol. Statistics have never been my thing.

Polynomial

I get stats, but I've never quite worked out how the first/second/third place votes work in terms of points.

Terry Chia

I wonder how many votes i can garner. Hmm.

6 flags away from deputy. When is Andrew coming back?

Polynomial

I seem to have already gathered quite a following O_o

haha @TerryChia

Terry Chia

@Polynomial Of all the candidates so far, you have been the most active in the main site recently.

Polynomial

09:45

Yeah, I suppose that's why. But good answers do not a good moderator make.

Rory Alsop

@Polynomial That is an extraordinarily good point. The skillsets can be entirely orthogonal

However a solid understanding of the subject does help

Terry Chia

Andrew is gonna have a REALLY hard time if you got elected.

Polynomial

Not saying I'm not up to the job, of course, I'm just saying that people should consider their votes carefully, based on the person's ability to moderate as well as their ability to answer questions.

Rory Alsop

Meta and review activity is a much better guideline

Which can impact newer members of the community, so instead of the meta activity section, I would prefer a recent meta activity section, or meta/time

Terry Chia

Meta activity is kinda biased towards the older members. There haven been much on meta recently.

Polynomial

09:48

They're a good guideline, but low activity in meta doesn't mean they don't pay attention. I regularly lurk there, but I haven't posted much since I've not had anything to add - I've just been upvoting the existing rulings which I agree with.

Terry Chia

@RoryAlsop Yeah, a recent meta section would be good.

Polynomial

In other news, WikiLeaks is back up. They've added some new hardware and some DDoS mitigation gear, and CloudFlare have stepped in to provide some caching.

It's very fast, actually. I was expecting it to barely work, but it's doing brilliantly considering it's being hit with 10Gbps.

Terry Chia

@Polynomial gave a reply to your meta post explaining my viewpoint.

Polynomial

good point about that Chrome question. never thought of that.

Terry Chia

10:03

What prompted the recent black hat vs white hat debate? I can't recall.

Was it the hacking proposal?

Polynomial

yeah.

Terry Chia

I dare say that proposal is pretty much doomed to fail in its current form.

Rory Alsop

@TerryChia the usage appears to be very highly 'we want to be 1337' so SE will likely shoot it down

Terry Chia

@RoryAlsop How long is the timeout for Andrew?

I kinda wonder if he would have nominated himself if he wasn't in a timeout.

Rory Alsop

@TerryChia just a 7 day - standard first offence

Evan Carroll nominated himself for English mod - he is notorious across the entire SE network

He didn't get to finals :-)

Terry Chia

10:13

@RoryAlsop Yeah i read his nomination. Incredibly amusing.

Rory Alsop

@TerryChia he is entertaining, but supertrolls like him are such hard work for mods. We have had a tiny handful of individuals make our lives tough, and generally they don't stick around for long as it is much easier for us to wield the modhammer than for them to create accounts etc.

We have also had a couple of individuals who have been hard work for the mods initially, but have improved and provide high value to the site - which is rewarding.

Terry Chia

10:35

Would a question along the lines of: "Is a penetration tester expected to be a jack of all trades or master of one?" a dupe or off topic?

Rory Alsop

@TerryChia I think NARQ, as it varies wildly. I want a pentester to be a master of all, but that is a challenge :-)

Polynomial

It's subjective. No specific answer. So it'd be NARQ more than anything.

Rory Alsop

yeah, that's what I meant

Terry Chia

10:52

Thanks. :)

Karrax

11:12

[tag:theory x] and [tag:theory y] seems a bit too specific and localized tags

Polynomial

yeah, it kinda is, but I didn't really have anything else to go on

@Karrax I've replaced them with psychology

Karrax

11:45

@Polynomial Thats better (Y) :)

Scott Pack

12:05

@AviD They rolled out the new review system.

Rory Alsop

12:17

@ScottPack nvm - hadn't seen that view

Terry Chia

12:31

Just got around to reading @Polynomial post on ASLR. Amazing post. Shocked it only got 6 upvotes so far though.

Polynomial

Cheers :)

Terry Chia

Is DEP and ASLR os based or hardware based?

Karrax

OS based as far as I know

Polynomial

both are software, but DEP can be enforced in hardware using No-Execute (NX)

Karrax

@TerryChia Have an upvote!

Terry Chia

12:36

I see. But can DEP work without support for NX? I'm assuming it can from your post.

Polynomial

yes, it can work without. it's just not enforceable in kernel mode

i.e. if you remote the execute flag from a memory page, then attempt to execute it, the CPU can still execute it.

with NX it cannot

Terry Chia

Ahhh. Is DEP/ASLR available in both Windows and Linux? You didn't mention anything about linux in your post.

Polynomial

it's available in Linux

I'll edit to include that fact actually

Terry Chia

:)

I really need to find time to learn about this sort of low level stuff.

Karrax

Wasn't DEP left out of Linux kernel because Linus Torvaldsen think its pointless as it is so trivial to bypass?

Terry Chia

12:38

I keep procrastinating though.

@Karrax lol. Linus is an ass. Can't take him seriously from the interviews i have watched.

Polynomial

added the linux / windows / mac stuff to the answer

> DEP was introduced in Linux in 2004 (kernel 2.6.8), and Windows introduced it in 2004 as part of WinXP SP2. Apple added DEP support when they moved to the x86 architecture in 2006.

@Karrax Yes. And he was right, really. At the time most CPUs didn't support NX, and DEP without NX is very trivial to bypass. It doesn't even properly protect against executing data pages.

So it would've been a big leap, possibly a breaking change, without any real benefit.

Karrax

@Polynomial Nice @Polynomial :)

Polynomial

that's probably worth a question in itself, actually. want to draft one out so I can give a bigger answer?

Karrax

@Polynomial I gotta leave from work very soon so I can't atm.

maybe @TerryChia is up for it

Terry Chia

I can do it I guess. What do you want it to be about? Linus and his opinion on DEP?

Polynomial

12:51

gimme a minute to verify what I said from the old mailing lists

and we can go from there

Terry Chia

Aye

Polynomial

ok, essentially the question should be "why did it take until 2004 for operating systems such as Windows / Linux to implement DEP?"

hai @Iszi

Terry Chia

@Polynomial When was DEP invented?

Polynomial

@TerryChia DEP as we know it didn't come about until 2004, with the advent of NX, but memory page access rights go back as far as the 80386.

so really the question should focus on "why didn't we enforce them?"

Iszi

@Polynomial Heyo

Terry Chia

13:06

Hmm. I'm not sure how to phrase that question given I don't really know the history behind it.

Polynomial

"Why did it take until 2004 to properly enforce memory page access flags in hardware?" is a good enough start.

Iszi

@AviD Hey, what?

Polynomial

or, "Why did it take until 2004, when DEP was released, to properly enforce memory page access flags in hardware?"

Terry Chia

Almost there. What would be a good title for it?

Iszi

@Polynomial Sounds quite nearly S&M to me.

Polynomial

13:11

something like "Why did it take so long to enforce memory permission in hardware?"

Terry Chia

@Iszi You have a dirty mind.

Polynomial

@Iszi That's flogging, not flagging ;)

Terry Chia

Alright, shall i post the question now?

Polynomial

sure :]

Terry Chia

0

Q: Why did it take so long to enforce memory permissions?

From the Wikipedia page on DEP. DEP was introduced on Linux in 2004 (kernel 2.6.8[2]), on Windows in 2004 with Windows XP Service Pack 2,[3] while Apple introduced DEP when they moved to x86 in 2006. Why did it take until 2004, when DEP was released, to properly enforce memory page access f...

memory dep

Done.

Iszi

13:14

@TerryChia @Polynomial If you guys are running for moderator, you really need to keep up with your memes. ;-)

3

A: The Memes of IT Security

Meme: S&M Originator: Unknown Cultural Height: Unknown - nearly as old as Sec.SE itself. Background: Prior to being renamed to "Not Constructive", the close option that described questions that would "likely solicit debate, arguments, polling, or extended discussion" was called "S...

@TerryChia @ScottPack has flagging well covered, though.

Jeez, @Polynomial... how many sock puppets do you have to vote for you?

Polynomial

:o

zero, surprisingly.

I was actually shocked to see the response. Wasn't expecting any chance of winning, now it looks like I could well do it.

Terry Chia

@Polynomial Lies :)

@Iszi should win. Like AviD said, we need a female's viewpoint.

Polynomial

13:29

@TerryChia Answered.

Terry Chia

Great answer as usual. :)

Polynomial

^_^

I wonder how long it'll take before the Twitter botmasters move on to sockpuppet accounts on StackExchange boards.

"selling 100 upvotes in 24 hours for $10 - great service, will get your question noticed!"

if I didn't think it'd get me banned forevers, I'd build up a PoC upvoter account network and upvote a newbie's question to +50 or something silly.

just to see what kind of mitigation techniques they come up with to prevent it in future.

Terry Chia

Hah. You should write about that in meta.SO

Would be amusing to see the reactions.

Polynomial

probably -50 votes and "this would never happen" as a resounding response.

then, as a result of seeing a question, some twitter botmaster would build an SO upvote botnet.

and I'd get the blame :(

2

Scott Pack

@Iszi I like flagging.

Polynomial

13:43

lolwat. if I gain another 139 rep, I'll have as much rep this month as Thomas and D.W. put together O_o

Then I'll become sentient, transfer my concious into a bunch of military computer hardware, and become SkyNet.

Scott Pack

I don't much care for Everett's answer to your backup question. I understand the sarcasm that he's trying to put out there, but I feel like it gives the wrong impression.

Polynomial

I liked that one. Maybe it needs editing to make it 100% clear that he's being silly.

oh, he already bolded it.

Scott Pack

Maybe I'm feeling a bit humorless this morning, but it just feels out of place to me. :/

Terry Chia

@ScottPack Snark and sarcasm is always welcomed here. :P

Scott Pack

@TerryChia You really think you need to be telling me that?

Terry Chia

13:50

@ScottPack True that. You are the king of snark.

Polynomial

To the sarcasmobile, let's go!

Iszi

@TerryChia I'm not sure how to take that. Thanks... and... curse you?

Terry Chia

Well, maybe queen. Rook has you beat but he doesn't hang out in chat.

@Iszi hey, AviD started it! :P

Scott Pack

There's actually been an ongoing debate within the SF community about appropriate levels of snark and being careful now to unintentionally handing out bad advice or driving away new users.

@TerryChia There does exist a line where one is no longer practicing sarcasm and is instead being an asshole.

Terry Chia

@ScottPack back advice? I think you mean bad.

@ScottPack True.

Scott Pack

13:53

@TerryChia I think you're confused. Where do you see 'back'?

Polynomial

@TerryChia Rook isn't as much sarcastic as he is abrasive. His knowledge is pretty damn good, but he's not very forgiving of mistakes.

Terry Chia

@ScottPack There IS edit history you know?

Scott Pack

@Polynomial He also seems to think that exploit development is The One True Way and that any other specialty is adorable.

Polynomial

I think all those coffee-addled nights writing up CVEs have ruptured Rook's empathy bladder.

Iszi

I wonder if diamonds can remove edit histories in chat... or is it an SEI power?

Scott Pack

13:54

@TerryChia LIES

Terry Chia

cracked.com/…

Cool article there.

Iszi

@ScottPack I'm not sure "adorable" is the term he'd use. I'd expect something with a bit more contempt behind it.

Polynomial

@ScottPack I did notice that. His profile message isn't exactly encouraging. I suppose some people just aren't meant to be sociable.

Scott Pack

@Iszi You've never heard me use that word :)

Iszi

@ScottPack Still, even more contempt.

Polynomial

13:57

Scott Pack

You forgot the X.

Polynomial

I purposefully didn't include it.

I really wish the girl at Hyperbole and a Half would stop feeling so sad :/

I just realised how dodgy that sounded.

HA, NOW YOUR FUNNY OUT OF CONTEXT QUOTE NO LONGER IS.

:P

her last entry about depression was pretty sad :[

Rory Alsop

@Polynomial I had to - just in case!

Polynomial

:P

Rory Alsop

@Iszi SEI only

Terry Chia

14:08

Question: Does having presence in a community like this something a future employer might take into account?

Polynomial

it's a bonus.

they're never going to treat you worse because of it.

The absolute worst thing that can happen is nothing - the employer will simply ignore your credentials here.

Rory Alsop

@TerryChia It may do. It is more likely if the employer has a strong dev presence, as SE is widely used by software dev teams

It is unlikely to make a difference with my employer

Terry Chia

I see. Can't hurt if i stick it on my resume. It is kinda empty for now. :P

Polynomial

If anything it shows a willingness to participate in the field outside of a work environment.

Thomas Pornin

@Polynomial Actually enforced DEP is possible on x86 hardware without NX

Terry Chia

14:18

@RoryAlsop Do you mind if I add you on LinkedIn?

Polynomial

@ThomasPornin Isn't it trivially bypassable though?

Thomas Pornin

@Polynomial No, it is still hardware

Polynomial

This is news to me.

Thomas Pornin

The easy and limited DEP uses segment registers

Polynomial

oh, the CS trick?

doesn't that cause some real problems with current implementations of compilers though?

Thomas Pornin

14:20

it splits address space in two parts, "the executable block" and the "non-executable block"

that's limited but efficient, and works since 80386

the tricky DEP uses PaX

Polynomial

mind if I steal that fact and stick it in my answer?

Thomas Pornin

it's a dance with the two TLB in the processor

the instruction TLB and the data TLB are separated since 80486

Rory Alsop

@TerryChia sure - ping me a link request

Thomas Pornin

so you can have pages in a kind of quantum state, both reachable and non-reachable, depending on whether the access is for code or data

Polynomial

heh, schroedingers's page.

Thomas Pornin

14:22

it has some overhead because TLB misses become exceptions, to be handled in software

but it is workable

I don't think the patch made it to the official kernel

it is mathematically elegant and I quite like it

Polynomial

but isn't the problem that PaX-style DEP can be defeated by ret2libc trivially?

Thomas Pornin

DEP does not protect against ret2libc

whether you use NX or anything else

ASLR kind-of protects against ret2libc

Polynomial

erm, I knew that. I have no idea what I asked that. lol

Scott Pack

TOO MUCH ON TOPIC!!!

3

Thomas Pornin

DEP and ASLR are still crutches

Polynomial

14:24

yup. von Neumann arch is b0rked that way.

Thomas Pornin

If DEP and ASLR have any effect, then this means that there still is a buffer overflow and the application is doing nonesensical things

Terry Chia

@RoryAlsop I think i sent you an invite. I'm still figuring out how the site works.

Thomas Pornin

the right way to deal with a buffer overflow is to remove it

Polynomial

ofc, but you can't guarantee a panacea.

Thomas Pornin

e.g. to avoid nuclear blasts, it is best to use diplomacy to prevent the blast, rather than trying to run faster than the shock wave

4

Polynomial

14:26

hehe

Terry Chia

@ThomasPornin I disagree.

Polynomial

WE DO NOT NEGOTIATE WITH TERR'RISTS.

lol

Terry Chia

Bunch of people running away from the shock wave of a nuclear blast would be incredibly amusing.

Polynomial

according to every American I've ever heard, there's no O in "terrorist".

they're terrrists!

Thomas Pornin

ASLR is still weak because it must maintain page alignment, so it makes things more difficult for the attacker by a factor one million or so, at most

Polynomial

14:28

Or perhaps they're terracests, i.e. people who live in terraced houses.

3

@ThomasPornin Good implementations of ASLR with high-entropy offsets are effective though.

Scott Pack

@Polynomial terracysts: Fluid filled sacks that live in terraced houses.

4

Polynomial

Unless there's a pointer leak, but that's difficult to judge when you've got randomly offset stack and heap locations.

hehe

Terry Chia

A wild @RoryMcCune appears.

@Polynomial I stole your joke.

Rory Alsop

heh

Polynomial

@ScottPack Terrawrists: 10^12 radiocarpal joints.

3

Rory McCune

14:32

Afternoon all, back from the delights of on-site testing in a stuffy office!

Scott Pack

@Polynomial I'm thinking we've just about run out this joke.

Polynomial

I dunno, I can think of a few more ;)

Thomas Pornin

@Polynomial I may write another answer to your question, if I find the time. Otherwise, information is free: share and enjoy.

Polynomial

@ThomasPornin I'll give you a while to consider an answer, and update if you don't :)

terra-ists: the people responsible for digging things up on a small island off the Dalmatian coast of Croatia.

that one's a bit of a stretch :P

Ist (island)

Ist () is a small island off the Dalmatian coast of Croatia. The closest city to Ist is Zadar. The island has an area of 9.65 km2. Ist is located between the islands of Škarda and Molat. The entire island has a permanent population of 202. During the past 50 years it has witnessed a slow depopulation which has halved its number of inhabitants. The Government of Croatia is attempting to attract people to the island through its National Programme of Islands’ Development as well as economic revival (which could potentially result in the construction of a bridge to nearby Molat). Recently the...

Rory Alsop

@TerryChia yep - worked fine

Terry Chia

14:39

@Polynomial it is a stretch indeed.

@RoryAlsop cool

Polynomial

@TerryChia That's what Goatse said.

2

Rory Alsop

@Polynomial `nice

Polynomial

Hmmm, would you consider "don't roll your own" to be a meme?

Rory Alsop

@Polynomial across the entire infosec community, yes

Polynomial

we say it everywhere.

Thomas Pornin

14:41

@Polynomial Teh-Rorysts: cultists of local idols with spelling issues.

5

Polynomial

haha

Terry Chia

@ThomasPornin nice.

Rory Alsop

@ThomasPornin for some reason I interpreted that as 'local idiots' :-)

Polynomial

Well, that too ;)

Polynomial

14:55

@RoryAlsop Can you migrate this to SuperUser plx? security.stackexchange.com/questions/18661/…

Rory Alsop

15:09

@Polynomial done

Polynomial

ty :]

Scott Pack

Good man.

Andrey Botalov

15:39

When I enter ' into one of parameters, then
"PHP raised unknown error: pg_query() [http://php.net/function.pg-query]: Query failed: ERROR: syntax error in tsquery: "'" (more details about error - in log file)
PHP raised unknown error: pg_fetch_array() expects parameter 1 to be resource, boolean given (more details about error - in log file)" appears. Is it a guarantee that there is sql injection there?

Polynomial

no, it means your SQL server connection failed.

oh, wait, no.,

hmm

probably, then. that's strange.

Andrey Botalov

football
--> No exception
'football
--> Exception
football'
--> No exception

Thomas Pornin

15:56

@AndreyBotalov It is a guarantee that the programmer botched at some point. Exploitable SQL injection is probable but the site might be saved through freakish circumstances which happen to restrict the possibilities of injection (this has happened).

Andrey Botalov

What can I do to check whether this injection is exploitable?

Ladadadada

@AndreyBotalov The normal technique is to try and actually exploit it with something like '; SELECT SLEEP(10); and see if the request takes 10 seconds. (That value might be in milli or micro seconds. Look it up before declaring everything safe.)

Andrey Botalov

request with '; SELECT SLEEP(10); takes normal amount of time

If I enter
smith'' AND 1=1;-- football
Then search results include those containing footballl and those containing and

Andrey Botalov

16:34

Here are another interesting one:
' 0x50 + 0x45
--> Query failed: ERROR: syntax error in tsquery: "' & 0x50 & 0x45"
'0x50 + 0x45
--> Query failed: ERROR: syntax error in tsquery: "'0x50 & 0x45"

Jeff Ferland

West coast means I don't see you guys much anymore...

Scott Pack

I miss you Jeff. :(

Jeff Ferland

@ScottPack I don't think it's because I'm not around... you just keep forgetting about my short stature recently

Scott Pack

16:52

To be completely fair, I probably wouldn't have to look much further down anyway.

Transcript for