I try to teach her to find why someone could be trusted instead of the opposite...

if she is wrong for not trusting someone that could be trusted isn't as damaging as trusting someone that she shouldn't

Trust isn't binary either.

@forest Threats are different when you're young though, as is the method you use to get your point across. 7 year old? 'Don't trust strangers because they might take you away'. 16 year old? 'don't trust your "friends", don't trust your partners, don't trust anyone ... why? because they may abuse it and that won't go well for you. Oh you think they're always going to be there for you? Stats say otherwise. You think you're special and will prove me wrong? Alr guess we'll see then'

@forest That is the best way to do things. Never full trust, and ration it appropriately

It's important not to instill fear though.

Embed a deep cynicism instead

Should be effective

Agreed.

You know, I wonder if there are any research papers into formal threat modeling involving this kind of thing.

It's a shame that all everyone wants to do is use tired old talking points and misleading statistics rather than build an effective, even if rather simple, threat model for conflicts in life. It's just a more effective way to think about risk.

@forest Social threats?

yeah

Now not every threat model needs a team of brainstormers and a data flow diagram, but it's better to be able to think about risk in an abstract sense rather than as black and white rules and maxims.

Do you have any resources for learning about threat modelling?

risk management is a good point...

I always tell her: "use your intelligence to tell if it's a good idea"

she don't, because she is too young yet, but she will remember later

There's a great book by Adam Shostak (or whatever his name is. A Microsoft guy). It's called something like "Threat Modeling: Designing For Security". It's not Windows-specific, although it is rather computer-centric.

Thanks :)

Found it: shostack.org/books/threat-modeling-book

It's the best intro into what threat modeling is and how it's done by organizations (or individuals).

There are better resources if you want specifics (threat modeling an API is going to be different from threat modeling a rogue employee).

:P

You can just pirate it and pay for it from the site later if you liked it.

@forest Much appreciated. I'm just looking for an overview as I haven't looked into it beyond the core concepts; the methodolog interests me

I use noscript everywhere, and infuriates me when I open a site and it's a blank page "This site needs Javascript to work"

@forest The best way to do things honestly

@ThoriumBR It's often easy enough to open inspect element and just delete the overlay. It usually works.

@belkarx I don't think it's dishonest. Why pay for something you don't want?

Reader Mode usually solves the problem...

If you do end up liking it, then pay for it.

@forest Missed a comma. Meant that's (honestly) the best way to do things

I agree with you

oh lol

I am pirating everything I own... I found out some of my games can't run after updating to Win 10 because DRM.

wow

and I had an ebook somewhere that got deleted from my library because I am in Brazil and the publisher lost publishing rights here...

Holy shit.

so I buy, activate my key, download, and crack everything afterwards... or just activate the key and torrent it, crack already embedded.

I rarely play games I need to crack (I don't play a lot of games).

Wait how do you go about cracking games

DRM only stops clueless pirates from pirating your game and non-expert gamers from playing it

You download cracks or apply cracks.

Or keygens etc.

I see

I download the no-cd or no-steam versions... my library is full of games I never downloaded from steam, but I torrented somewhere. And I use sandboxie so I can see if the crack is doing funny things that it shouldn't, and sandboxie denies internet access if you want to.

online games are different, so I have no choice but use the DRM-tainted version

earlier today a colleague had issues accessing one internal site, sometimes dns resolved the name, a minute later it didn't, and kept doing so repeatedly. I found out the TTL on the domain is 30 seconds. Who in his sane mind would configure a domain with 30 seconds TTL? It's not a fast-flux dns for a botnet c&c!

even 30 minutes is too short.

How do you know? :P

It might be a C2 and you don't even know!

dig +ttlunits +noauthority +noquestion +noadditional +nostats example.com

@forest it would be a terrible C&C, it was an internal domain, not reachable outside of our VPN

the only acceptable use for a short TTL is when you are migrating the domain from one host to the other. You put a 5 min TTL one day before the migration, migrate the host, and update the DNS records putting a sane value back (4 hours or so).

so after you migrate the zone and change DNS pointers, worst case clients would have the old address on the cache for 5 minutes

(tried running the command again, NXDOMAIN... why? It's because the VPN is disconnected...)

they increased the value... to 5 minutes! come on, 5 minutes?

good talking to you guys tonight... see you tomorrow!

Bye, thanks

o/

How valuable are certifications if you plan to go into cybersec? Are there reasonable alternative ways to get experience?

Depends on what job you're looking for.

And tbh I hate the term "cybersecurity". It's a buzzword. Infosec is superior.

Ah okay

@forest What should I be looking for

Well, what kind of thing interests you in infosec?

It's a gigantic field.

I'm not very inclined towards pentesting, but beyond that everything seems interesting (I don't have any deep knowledge in anything yet unfortunately, I've been building a knowledge base so I have context).

I quite enjoy linux and scripting so sysadmin-ing something to start may be a good idea (given I can convince someone to hire me), and after that ... embedded/IoT? Something more low level maybe, or perhaps an "analyst" (another buzzword pertaining to a somewhat less hands-on type of job from what I've heard)

Pentesting is also a pretty big subset of infosec, but that does narrow it down.

And to be honest, certs aren't everything. Knowing your stuff is what's really important.

Getting hired without certs requires a certain (social) networking finesse though

Not necessarily. Some good CVEs in your name and a strong GitHub repository will go a long way.

Ooh CVE hunting, I'll have to look into that

There are also lots of ways to find CVEs.

Fuzzing is a good place to start (at least, it's what I'm personally familiar with).

Can you recommend a fuzzer?

Depends on what you want to fuzz. AFL is a good general-purpose one.

Thanks

Then there are things like Syzkaller for fuzzing syscalls, and various fuzzers that integrate with QEMU.

What I'd do is find some simple(ish) command line tool that parses some sort of file, and run AFL on it. The older or more obscure the tool/format, the more likely you are to find low-hanging bugs.

It's also a good idea to read up on how fuzzing works, if you don't already know. Modern coverage-based fuzzing is so much more than "throw random input at a program until it crashes". And it gets even more complex if you start to look at deterministic fuzzers or symbolic execution.

That sounds really interesting. Thanks for the advice

The tl;dr is that coverage-based fuzzing (which AFL uses) sends pseudo-random inputs to an executable, but also checks to see what inputs cause the program to take a different execution path. The input is then adjusted in order to try to find as many different permutation paths as possible. The result is that a fuzzer can quickly generate a valid JPEG image without any prior-knowledge of the file format (which is quite complex). For that to work, you usually have to use e.g. afl-gcc to compile.

That'll help you the most if you're interest is binary exploitation, systems security, etc. Relevant certs for that would be things like OSCP and OSCE (although they're Windows-centric and I don't much like the company behind them).

Fascinating

Is a docker container sufficient to sandbox fuzzing?

@belkarx Yeah. Fuzzing isn't something that you need to sandbox for security reasons (unless you're fuzzing something malicious) so much as to prevent a malfunctioning application from messing up your filesystem.

For example if you fuzz an archiver like tar, a bug triggered by fuzzing might cause it to clobber your filesystem with a bunch of random corrupt files. So for all intents and purposes, even a chroot is enough for most cases.

what the heck is this thing?

It's not a classic XY-problem, it's a quadratic XY-problem where X is another XY-problem.

Yeah, I had that though too.

You expressed it better than I could.

and looks like Y is another XY-problem too...

With credentials included?

yes, included...

encrypted using AES, but included

wow

wow. Who designs something like that and thinks it's a good idea ... and why aes

Better than writing their own cipher I guess.