The DMZ

ThoriumBR

00:00

I try to teach her to find why someone could be trusted instead of the opposite...

if she is wrong for not trusting someone that could be trusted isn't as damaging as trusting someone that she shouldn't

forest

Trust isn't binary either.

You can trust someone up to a point without putting yourself at unnecessary risk.

belkarx

@forest Threats are different when you're young though, as is the method you use to get your point across. 7 year old? 'Don't trust strangers because they might take you away'. 16 year old? 'don't trust your "friends", don't trust your partners, don't trust anyone ... why? because they may abuse it and that won't go well for you. Oh you think they're always going to be there for you? Stats say otherwise. You think you're special and will prove me wrong? Alr guess we'll see then'

@forest That is the best way to do things. Never full trust, and ration it appropriately

forest

It's important not to instill fear though.

belkarx

Embed a deep cynicism instead

Should be effective

forest

Agreed.

You know, I wonder if there are any research papers into formal threat modeling involving this kind of thing.

It's a shame that all everyone wants to do is use tired old talking points and misleading statistics rather than build an effective, even if rather simple, threat model for conflicts in life. It's just a more effective way to think about risk.

belkarx

00:18

@forest Social threats?

forest

yeah

Now not every threat model needs a team of brainstormers and a data flow diagram, but it's better to be able to think about risk in an abstract sense rather than as black and white rules and maxims.

belkarx

Do you have any resources for learning about threat modelling?

ThoriumBR

risk management is a good point...

I always tell her: "use your intelligence to tell if it's a good idea"

she don't, because she is too young yet, but she will remember later

forest

There's a great book by Adam Shostak (or whatever his name is. A Microsoft guy). It's called something like "Threat Modeling: Designing For Security". It's not Windows-specific, although it is rather computer-centric.

belkarx

Thanks :)

Found it: shostack.org/books/threat-modeling-book

forest

00:25

It's the best intro into what threat modeling is and how it's done by organizations (or individuals).

There are better resources if you want specifics (threat modeling an API is going to be different from threat modeling a rogue employee).

ThoriumBR

that's something I admire:
> Our site works best with Javascript enabled, however we have done our best to minimize any negative impacts to your experience without it.

forest

:P

You can just pirate it and pay for it from the site later if you liked it.

belkarx

@forest Much appreciated. I'm just looking for an overview as I haven't looked into it beyond the core concepts; the methodolog interests me

ThoriumBR

I use noscript everywhere, and infuriates me when I open a site and it's a blank page "This site needs Javascript to work"

belkarx

@forest The best way to do things honestly

forest

00:29

@ThoriumBR It's often easy enough to open inspect element and just delete the overlay. It usually works.

@belkarx I don't think it's dishonest. Why pay for something you don't want?

ThoriumBR

Reader Mode usually solves the problem...

forest

If you do end up liking it, then pay for it.

belkarx

@forest Missed a comma. Meant that's (honestly) the best way to do things

I agree with you

forest

oh lol

ThoriumBR

I am pirating everything I own... I found out some of my games can't run after updating to Win 10 because DRM.

forest

00:31

wow

ThoriumBR

and I had an ebook somewhere that got deleted from my library because I am in Brazil and the publisher lost publishing rights here...

forest

Holy shit.

ThoriumBR

so I buy, activate my key, download, and crack everything afterwards... or just activate the key and torrent it, crack already embedded.

forest

I rarely play games I need to crack (I don't play a lot of games).

belkarx

Wait how do you go about cracking games

ThoriumBR

00:34

DRM only stops clueless pirates from pirating your game and non-expert gamers from playing it

forest

You download cracks or apply cracks.

Or keygens etc.

belkarx

I see

ThoriumBR

I download the no-cd or no-steam versions... my library is full of games I never downloaded from steam, but I torrented somewhere. And I use sandboxie so I can see if the crack is doing funny things that it shouldn't, and sandboxie denies internet access if you want to.

online games are different, so I have no choice but use the DRM-tainted version

earlier today a colleague had issues accessing one internal site, sometimes dns resolved the name, a minute later it didn't, and kept doing so repeatedly. I found out the TTL on the domain is 30 seconds. Who in his sane mind would configure a domain with 30 seconds TTL? It's not a fast-flux dns for a botnet c&c!

even 30 minutes is too short.

forest

How do you know? :P

It might be a C2 and you don't even know!

ThoriumBR

dig +ttlunits +noauthority +noquestion +noadditional +nostats example.com

@forest it would be a terrible C&C, it was an internal domain, not reachable outside of our VPN

the only acceptable use for a short TTL is when you are migrating the domain from one host to the other. You put a 5 min TTL one day before the migration, migrate the host, and update the DNS records putting a sane value back (4 hours or so).

so after you migrate the zone and change DNS pointers, worst case clients would have the old address on the cache for 5 minutes

(tried running the command again, NXDOMAIN... why? It's because the VPN is disconnected...)

they increased the value... to 5 minutes! come on, 5 minutes?

good talking to you guys tonight... see you tomorrow!

belkarx

00:47

Bye, thanks

forest

o/

belkarx

How valuable are certifications if you plan to go into cybersec? Are there reasonable alternative ways to get experience?

forest

Depends on what job you're looking for.

And tbh I hate the term "cybersecurity". It's a buzzword. Infosec is superior.

belkarx

Ah okay

@forest What should I be looking for

forest

Well, what kind of thing interests you in infosec?

It's a gigantic field.

belkarx

00:58

I'm not very inclined towards pentesting, but beyond that everything seems interesting (I don't have any deep knowledge in anything yet unfortunately, I've been building a knowledge base so I have context).

I quite enjoy linux and scripting so sysadmin-ing something to start may be a good idea (given I can convince someone to hire me), and after that ... embedded/IoT? Something more low level maybe, or perhaps an "analyst" (another buzzword pertaining to a somewhat less hands-on type of job from what I've heard)

forest

Pentesting is also a pretty big subset of infosec, but that does narrow it down.

And to be honest, certs aren't everything. Knowing your stuff is what's really important.

belkarx

Getting hired without certs requires a certain (social) networking finesse though

forest

Not necessarily. Some good CVEs in your name and a strong GitHub repository will go a long way.

belkarx

Ooh CVE hunting, I'll have to look into that

forest

There are also lots of ways to find CVEs.

Fuzzing is a good place to start (at least, it's what I'm personally familiar with).

belkarx

01:04

Can you recommend a fuzzer?

forest

Depends on what you want to fuzz. AFL is a good general-purpose one.

belkarx

Thanks

forest

Then there are things like Syzkaller for fuzzing syscalls, and various fuzzers that integrate with QEMU.

What I'd do is find some simple(ish) command line tool that parses some sort of file, and run AFL on it. The older or more obscure the tool/format, the more likely you are to find low-hanging bugs.

It's also a good idea to read up on how fuzzing works, if you don't already know. Modern coverage-based fuzzing is so much more than "throw random input at a program until it crashes". And it gets even more complex if you start to look at deterministic fuzzers or symbolic execution.

belkarx

That sounds really interesting. Thanks for the advice

forest

The tl;dr is that coverage-based fuzzing (which AFL uses) sends pseudo-random inputs to an executable, but also checks to see what inputs cause the program to take a different execution path. The input is then adjusted in order to try to find as many different permutation paths as possible. The result is that a fuzzer can quickly generate a valid JPEG image without any prior-knowledge of the file format (which is quite complex). For that to work, you usually have to use e.g. afl-gcc to compile.

That'll help you the most if you're interest is binary exploitation, systems security, etc. Relevant certs for that would be things like OSCP and OSCE (although they're Windows-centric and I don't much like the company behind them).

belkarx

01:28

Fascinating

belkarx

02:15

Is a docker container sufficient to sandbox fuzzing?

forest

04:00

@belkarx Yeah. Fuzzing isn't something that you need to sandbox for security reasons (unless you're fuzzing something malicious) so much as to prevent a malfunctioning application from messing up your filesystem.

For example if you fuzz an archiver like tar, a bug triggered by fuzzing might cause it to clobber your filesystem with a bunch of random corrupt files. So for all intents and purposes, even a chroot is enough for most cases.

ThoriumBR

17:09

0

Q: AES - Is it sensitive to let anyone encrypt a message only you can decrypt?

I have an application in which some data can be encrypted through AES. Such data can emanate from multiple sources I may not know. For practical reasons I want those sources to be able to encrypt values themselves, without being able to decrypt them later on (only my application would be). I was ...

aes

what the heck is this thing?

It's not a classic XY-problem, it's a quadratic XY-problem where X is another XY-problem.

2

A. Hersean

Yeah, I had that though too.

You expressed it better than I could.

ThoriumBR

and looks like Y is another XY-problem too...

It's a multi-layered XY-problem: when you ask clarification about a layer, you get another convoluted layer bellow:
layer 1: user wants to encrypt things with AES
layer 2: it's not the user that encrypts, it's the system
layer 3: user shares files with other users
layer 4: users don't share files, they share an encrypted configuration file WITH CREDENTIALS

forest

21:44

With credentials included?

ThoriumBR

22:30

yes, included...

encrypted using AES, but included

forest

wow

belkarx

23:34

wow. Who designs something like that and thinks it's a good idea ... and why aes

forest

Better than writing their own cipher I guess.

Transcript for