The DMZ

Thomas Pornin

00:43

@AviD Yes, I got de-modded, and (apparently) they asked @Hendrik to assume the job. Not that I did much anyway.

For the question, well, theoretically, ASN.1 is generic, and the question just happens to be related to a cryptographic context on a mere coincidence. It is less crypto than programming.

Terry Chia

01:24

Morning folks.

cpusage.com Interesting startup.

Stack Exchange

04:14

Not sure why I just taught everyone to flawlessly impersonate me to pretty much anyone I know. Just remember to constantly bring up how cool it is that birds are dinosaurs and you'll be set.

5

AviD

07:30

@RoryAlsop this ones for you: cracked.com/quick-fixes/how-to-turn-anything-into-steak

Polynomial

07:51

@AviD That's so Billy Mays-esque

Hendrik Brummermann

08:10

@AviD I don't think it is a good fit for crypto. It might be appropriate for programmers, at least they list data structures in their FAQ.

@ThomasPornin Oh, I did not know that. They asked me whether I wanted to help with the moderation of crypto, without giving any background information.

Rory Alsop

09:09

morning!

Lucas Kauffman

10:02

Rory McCune

10:44

that's an interesting last message to join to!

AviD

@Iszi nothing specific, no. there are bunch of kinda-sortas in password-management, though in truth none that I was really thrilled about.

not that this one is so much better...

@ThomasPornin in your case, it was probably a promotion above a simple moderator.

are you guys also reading this one as a list question?

1

Q: Plausible deniability for phones

I have sensitive data on my computers and phones. I use Trycrypt's plausible deniability system on my computers. When law enforcement/border patrol or my spouse asks for access I type in the password for the decoy system. I need this badly for my phone. Does anyone know how to install a plausible...

encryption

other than @josh's answer, it is a list. But his answer does provide some real redeeming value...

Thomas Pornin

11:15

@AviD Well, it won't be a list (or at least not a very listy one) until there are several products which offer the requested service. @josh's answer highlights the fact that the question is ill-defined.

AviD

@ThomasPornin okay, not so much of a list, rather a product recommendation request. (list-of-one is still a list :) ).

@josh's answer kinda answers the question that should have been asked. you think the q should be closed?

Polynomial

11:30

Haha, this is so true...

"She's 16 and performing on X-Factor, what an inspiration" ... A MAN JUST JUMPED FROM THE EDGE OF FUCKING SPACE!!!!

Tweeted by RobbieH46 on October 14, 2012 at 7:11 PM

2

AviD

I think this is a policy we should adopt here, too:

-3

A: FAQ: When is it appropriate to "be a dick" on Skeptics?

It is ethically required to "be a dick" all the time, as this is the only way to keep the devils and politicians from taking over. Politeness is the enemy of truth, it is the enemy of progress, and one must be as rude as possible to get ideas across in a straightforward way. This can be done with...

I mean, the rest of us, besides @ScottPack who already has.

3

Terry Chia

11:46

@AviD you mean we aren't already?

AviD

@TerryChia I think we're doing a good job so far, but I can't help but think we could do more. So much more.

Terry Chia

@AviD We should have a badge that rewards dickish behaviour. It could be called scott as he is the shining beacon in this chat room.

AviD

We should have a badge that rewards scottish behaviour. It could be called dick as that is the shining beacon in all chat rooms.

Polynomial

selectallfromuserswheredickequalstrue

Terry Chia

@AviD Scottish being in reference to the person or the country?

AviD

12:02

@TerryChia heh, good point.

Scott Pack

12:14

I hate all y'all.

AviD

@ScottPack @TerryChia so both, I guess.

gmorning @scotty!

Thomas Pornin

12:33

@AviD As a generic rule, I am all for measured and unexaggerated hammering, especially for questions which have received a good answer.

In particular for questions which have received a good answer from me.

But this also extends to good answers from somebody else.

Polynomial

12:58

@ThomasPornin Feel like dropping your bear-boot down on this one? security.stackexchange.com/questions/22634/hurr-durr-owncloud

Thomas Pornin

13:47

@Polynomial I am doing it right now.

Thomas Pornin

14:08

THIS IS DONE.

Polynomial

lol

@ThomasPornin Took the words right out of my mouth with the seeding problem.

timestamps are hideously anaemic in the entropy department.

Thomas Pornin

14:26

@Polynomial Current time is not a secret.

Lucas Kauffman

God why do we still use IE7

Thomas Pornin

@LucasKauffman In my case, that's because I don't have the choice. This is an administrative decision (or, rather, an administrative lack of decision).

Lucas Kauffman

Same here they have some special proxy thingies that prevent me from using a different browser

ATM I'd actually be happy with IE9

Polynomial

is it called UberCyberSecureProxy™?

Thomas Pornin

@LucasKauffman Here, they apparently rely on my lawfulness for not using another browser. Which is why I do some of my browsing (including this very chat interface) from another machine, that I contact through RDP.

This complies to the local rules (no other browser, no installation of extra software) and it even is more secure (if trouble arises, it will strike the machine into which I RDPize, not my desktop system).

Lucas Kauffman

14:38

@polymonial something I need to find away around without violating company policy :(

Thomas Pornin

@LucasKauffman The RDP thing may work, if you have a target system on the outside (and configure it to do the RDP over port 443). Of course, performance is poor (don't try to look at videos).

Lucas Kauffman

That's the problem I am only allowed to browse all the rest is blocked outgoing the only way to get to the Internet is by using the web proxy :(

Cause I have ssh running on 443 for just this thing

Thomas Pornin

@LucasKauffman For HTTPS, the proxy protocol goes with a "CONNECT" and, afterwards, that's just bidirectional binary data forward.

See agroman.net/corkscrew

Some advanced proxies could notice that the traffic is still not a SSL handshake, and block it. Some such proxies even perform MitM attacks (with a special root installed in the desktop systems), which is kind of hard to bypass.

Lucas Kauffman

The problem is getting through the proxy I'm still finding out what credentials it's using

@Thomas yea indeed :(

AviD

another solution, and this is probably my bias and spoiledness, is to only work at enlightened companies. :-)

probably one of the reasons I work for myself, too...

Thomas Pornin

15:06

@LucasKauffman In a Windows setup, it might reuse your authentication (hence Kerberos, Active Directory... the whole thing).

Rory McCune

15:32

@ThomasPornin @LucasKauffman I'd agree in most cases where you're not being prompted for creds, it's the windows auth. which is being used. Failing that have you tried with no auth? Surprisingly I've seen places that have a proxy and force access via that but don't authenticate it...

Terry Chia

2

Q: Software Life-cycle of Hacking

At my local university, there is a small student computing club of about 20 students. The club has several small teams with specific areas of focus, such as mobile development, robotics, game development, and hacking / security. I am introducing some basic agile development concepts to a couple...

development-process security hacking life-cycle

Any of you folks wanna pop over there to give a better answer?

David

16:05

Good morning, folks

AviD

@TerryChia oo interesting. I thought it was going to be about something else, then he went a different way.

that said, I dont think that there is a good answer - too many disparate types to compare anything.

Terry Chia

@AviD I feel that their standards over at programmers are slightly more lax than ours. at least when browsing through their questions.

AviD

@TerryChia's answer is the closest, or at least in the right direction, but didnt go far enough.

@TerryChia for sure. They really built the "good subjective" criteria.

Terry Chia

@AviD I have a brief idea of what it is about. but i don't really have much firsthand experience to actually go further with more details into each development methodology.

AviD

I did flag it to move here - I cant be bothered writing up a good long answer over there :)

@TerryChia well thats my point - experience in one is very different from another. You gave two good examples, to start with, but its still more than that.

Terry Chia

16:14

Is it a better fit here though? The question is really more about the software methodology, instead of a specific security concern.

AviD

actually, the asker had a good point (and why I think it would be better here) - the maintainence aspect will make for some pretty big distinctions between the types.

compare metasploit to a 0day to stuxnet to skiddies to.... etc.

Terry Chia

@AviD Hmm, my take on the question is not so much on impact of the code. Sure, the exploits available in Metasploit have a very different impact compared to 0-days, but all exploits start as 0-days. From a code standpoint - are they really that much different?

AviD

@TerryChia Maintenance.

Terry Chia

I think the tool/framework vs exploit code for a specific situation is what the asker is looking for, especially in the context of Programmers.SE.

AviD

or in other words, lifetime.

Terry Chia

16:19

@AviD Care to elaborate?

AviD

@TerryChia two big aspects here, both coming back to the expected lifetime of the produced software.

one, is how quickly the software needs to pop up - obviously 0days want to come out quicker, packaged products can spend some more time packaging.

two is how long in the future the software will be used - versioning, reuse, etc as opposed to a one-off fire-and-forget exploit missile.

combined in that are also requirements around stability, and so forth.

then on the other end you have the "militarized" hacks such as stuxnet, which is kind of an extreme on one scale, and the other extreme on the other.

Terry Chia

@AviD Ah, but there is a different between the exploit code found in Metasploit and the framework itself no?

AviD

so, what I was saying was that given these two (not necessasrily complete) scales, you noted two specific datapoints on it.

@TerryChia mebbe, mebbe no. Some of the exploits are rushed out, to take advantage of a specific 0day - some are properly engineered for long term use.

and again, compare to other types of exploitware.

Terry Chia

@AviD I see your point - but in the context of the question: I really doubt exploit codes follow a software development lifecycle. But software like the various scanners do.

AviD

@TerryChia that is my point.

packaged software does. one-off exploits do not. viruses might, depending. weaponized malware does, extremely so. crimeware, probably, again depending.

which is kind of what your answer was trying to say, but not strongly enough, imo.

or rather, not dickishly enough.

2

since I'm too lazy to write up a proper answer for p.se, and since it probably wont move over here, I would support you expanding your answer with my input, if you want to.

Lucas Kauffman

16:35

@RoryMcCune defo with auth, have tried a lot of things, next thing is to install wireshark and see what happens

Terry Chia

@AviD I'll see what I can do.

@LucasKauffman I don't get why companies think restricting the software choices available to pen-testers are a good idea. ;)

Lucas Kauffman

@TerryChia we actually get our own network though, but if I want to use the internal network I can't. However I do have local admin so in the end I can do what I want. The problem is there are policies, I don't want to circumvent them if I don't have to

David

Guys, I was just thinking about SmartCards again

Is it possible to have the functionality of a SmartCard, except instead of a card, in a USB flash drive?

at least for authentication purposes (windows login, maybe signing emails, etc)

AviD

sure, take a look at e.g. alladin etoken.

Jeff Ferland

The problem with a flash drive is that you can read / write to the memory. What makes a smart card so special is that you send it data which is processed and sent back.

David

16:41

@AviD I mean like my personal flash drive

Jeff Ferland

Reading the private key is impossible; something that is impossible to implement on a regular flash drive.

Iszi

@JeffFerland Couldn't a USB device (not a flash drive) be configured to act the same?

David

@JeffFerland true, but cant you make it read-only using software?

not the most secure, but would probably defeat noobies

Lucas Kauffman

@Iszi then it would be a smartcard the size of a pendrive?

GODAMNIT are there any free security trainings?

Iszi

@LucasKauffman Actually, we'd probably be looking at a smartcard + reader in a pendrive case.

Jeff Ferland

16:42

@David Well, there is that pain-in-the-ass S3 software that comes on some USB drives. Those present the media to the OS as something different. However they do that might be a step in the right direction.

@Iszi Yes

David

hrmm

it'd be insecure as shit, but better slightly more secure than nothing

AviD

the aks etoken is obviously not a regular flash drive. its the same functionality as a smartcard, but implemented with a usb interface.

Iszi

@AviD More or less what I was suggesting/expecting.

@LucasKauffman How are we defining "free" and "security trainings"?

Lucas Kauffman

something like elearnsecurity

but then a lot more modules

AviD

@Iszi hmm. seems they were acquired by safenet a few years ago...

was talking about something like this: safenet-inc.com/products/data-protection/…

Iszi

16:48

OMG. My weekend project has got to be to sort through my bookmarks. Nevermind the mess in my other folders, I've got one labeled "Unchecked/Unsorted" that has a metric crap-tonne that need to be gone through.

Terry Chia

@AviD Made a couple of small edits, have a look. Not gonna bother to write anymore though.

Gonna head to bed. Have a nice day you folks in the rest of the world.

AviD

@TerryChia well, I'd already upvoted you, so I cant do that again.

but the commenthread on the q expanded a bit, and i think he gets the point.

course, I coulda got me some upclicks if id put our convo and my comments into an answer... :)

Iszi

@AviD Said it before, and I'll say it again: I often wish we could up-vote edits.

AviD

what's the opposite of a repwhore? repprude?

haha, lovely... for all you Mac fans out there:

2

Jeff Ferland

New policy: you create the tag, you write the wiki for it.

packer

@Polynomial that's you ^^^

Iszi

17:02

@JeffFerland Could have been worse. Could have made it fudge-packer.

Jeff Ferland

@AviD How much extra do you have to pay for the PC case to not look like a teenager's idea of good taste?

Iszi

@JeffFerland Actually, I'm pretty sure that'd make it cheaper.

AviD

@Iszi or scott-packer.

@JeffFerland yeah, thats extra for the gaming cases.

Jeff Ferland

@Iszi I remember when modded cases were really awesome because people did the work and it was a source of pride and accomplishment. Now people just buy the crap.

Iszi

@JeffFerland Kinda like ham radio, eh?

Thomas Pornin

17:04

@AviD Now you know: PC users are just cheapstakes.

AviD

@ThomasPornin cheapskates, or care about ROI?

Iszi

@AviD I see two "MasterCard ad" responses to that one: For the PC - "Having a system you can use the way you want to: Priceless". For the Mac - "Having a system that 'just works': Priceless".

Thomas Pornin

@AviD ROI for a computer ? I prefer to think of machines as consumables. Which they tend to be.

AviD

@ThomasPornin okay, not roi, then value for cash. is there a managementese buzzword for that?

Iszi

@AviD ROIry?

Jeff Ferland

17:08

@Iszi You still have to work at getting SDR to play nice :P

aright, time to get me to work

Thomas Pornin

@AviD "Ostentatious display of wealth"

An obviously expensive computer is the right thing to have in businesses which must inspire trust and awe, e.g. banks and jewelers.

Iszi

@JeffFerland Oh, crap. It's still that time of day? Drat.

Iszi

17:35

@AviD Sent that to a friend, got this back...

Interestingly, I also prefer American muscle over foreign exotic.

Polynomial

I really really wish I could get US prices for computer parts.

it's ridiculous, especially with sites like newegg.

even after you take exchange rate and tax into account, it's still 10% cheaper.

Iszi

@Polynomial Hrm? 'Supwitdat?

Polynomial

@Iszi UK retailers set the prices high, so even though there's competition they always make a crazy profit.

whereas the profit margins are much smaller in the USA, but they sell more in bulk.

so places like newegg probably have a few tens of thousands of orders a day

Iszi

@Polynomial So, you're saying U.K. retailers are like this...?

Polynomial

whereas OcUK probably get a few hundred.

something like that, yeah.

the first rule of acquisition is be a total dick-lobe.

Iszi

17:46

@Polynomial Actually, it's "Once you have their money, you never give it back."

Polynomial

that used to be the case, actually.

you couldn't RMA anything if you'd plugged it in.

which was ridiculous. eventually trading standards stopped that bullshit, but it didn't happen until about 2004.

Iszi

I like rule #94: "Females and finances don't mix."

Reminds me of a bash.org quote...

bash.org/?11181

Polynomial

lol

this is still my favourite: qdb.us/300391

Rory Alsop

That took me a while to catch up to the present. Evening all :-)

Polynomial

Afterafternoon :)

Rory Alsop

17:52

@Iszi I like the noise of a big Chevy V8, and dislike most screamy V12's...but I really love my burbling 2.5l flat-four - which is Japanese :-)

Iszi

@Polynomial Awesome.

Rory Alsop

@Polynomial that is epic

Iszi

@RoryAlsop Yeah, I'm having to get used to an I4 myself, these days. Never owned anything smaller than an I6 until now. But, gas prices and all tend to influence these things.

Mine's still Merkin though.

Haven't owned an import yet.

Polynomial

so I heard something pretty crazy today

Rory Alsop

@Iszi :-) Always loved the cost/performance aspect of Subarus. £20k gives me 400bhp and a 0-60 in 4.2 seconds and a 195mph top speed. In a family wagon which I take camping :-)

instant win

Polynomial

17:55

according to some insiders at a "large anti-malware company" (no idea which), there's a new bit of state-sponsored APT-style malware around

and it uses some existing known Windows privilege escalations to gain SYSTEM, then loads bunch of AV drivers with legit signatures and uses them to mess with the system

now that is smart.

Rory Alsop

and a tad scary

Polynomial

guessing that'll probably pop up on The Twitters in the next few weeks

well, from the sounds of it it's highly targeted, so it's no so scary for the every day person

but it's still incredibly smart and slightly worrying

and really breaks the concept of driver signing as a definitive security measure

I'm not exactly clear on the details, though; I heard this through a friend that read it on a private discussion board where a bunch of AV techs were hanging out.

Iszi

@RoryAlsop All my previous cars had >250 HP (except the Jeep). This one's <180. Not bad on fuel costs over a ~120-mile round-trip commute, though.

Lucas Kauffman

I only have 112 HP :(

company car needs to be eco

Rory Alsop

@Iszi I swapped my wife's 340HP Subaru for a 115HP Honda Jazz. Bit less exciting, but her mpg has gone up from 24 to 52 :-)

Polynomial

18:04

I have 0.23 HP. I'm not as powerful as a horse.

Iszi

Definitely feels like I'm driving with half an engine. But, the I4's these days aren't quite as wimpy as they used to be.

Rory Alsop

@Polynomial I bet you have measured it and that is the actual figure, no?

Iszi

@RoryAlsop Yeah, my DD swap took me from 15.5 to somewhere between 26 - 28.

Polynomial

@RoryAlsop Based on rough kinetic energy output while running.

Lucas Kauffman

@RoryAlsop that car must have been an awesome toy to drive no?

Polynomial

18:05

@RoryAlsop To be fair, I did measure against a small horse.

6

Out of context, that sounds soooooooooo wrong.

Rory Alsop

@LucasKauffman not as fun as mine. Think her 0-60 was only 5.8 seconds

@Polynomial it is starred for posterity

Lucas Kauffman

erh

@RoryAlsop what did you drive?

Rory Alsop

@LucasKauffman I have a Litchfield spec Forester STi:

►

the old one was an Impreza with all the Prodrive mods :-)

Lucas Kauffman

holly

that looks like an suv

Polynomial

By the way, on a slightly political note (but still on the topic of security), Gary McKinnon's extradition decision is made tomorrow.

Lucas Kauffman

18:08

it sounds like a rally car

and seems to drive like a rally car o.o

Rory Alsop

@LucasKauffman a small SUV. Same chassis and engine as the Impreza

it makes Vicky Butler Henderson squeal

instant win

for a while I had Recaro children's seats in it

me == petrolhead

Polynomial

if you get a sec (and you have Twitter), drop JanisSharp (GM's mother) a tweet if support of the hard work she's been doing.

Rory Alsop

@Polynomial GM?

Lucas Kauffman

General Motors?

Polynomial

Gary McKinnon (read my previous)

his extradition appeal case is decided tomorrow

Rory Alsop

18:10

ahhh - yes, I get confused every time I see her name and his in a news article

Polynomial

the USA want him extradited, and several doctors have all said that he's not mentally healthy enough to go, and would very likely take his own life

plus it's totally bullshit that they're trying to extradite him anyway

he broke UK law, in the UK, in an effort to prove to the US that their systems weren't secure.

Rory Alsop

He was never a very well lad - and from the perspective of what hackers do, his wasn't anywhere up there compared to some - who haven't ever been threatened with extradition

Polynomial

he has Aspergers Syndrome, there's no way he had full comprehension of the gravity of his actions. the dude should be given a slap on the wrist and a job.

but because the US was made to look silly, they're butthurt and out for blood

Rory Alsop

different topic - anyone who wants to comment on ISACA's audit and assurance guidance - it is up for public comment at: isaca.org/standardexposure

Lucas Kauffman

@RoryAlsop you aware of any good free elearnings for pentesting? I havent got budget until next year to get a proper certificate :(

Rory Alsop

18:14

@LucasKauffman don't you get access to the internal eXtreme Hacking course? Speak to Lars Weimar or the Frankfurt lads.

Polynomial

@LucasKauffman Do you really need to get a cert?

Lucas Kauffman

@RoryAlsop yea I have extreme hacking next year, Erik teaches it actually, might just ask to get my hands on the docs

Polynomial

the only one I can really think of that is vaguely worth it is CISSP.

Rory Alsop

@LucasKauffman a lot of it you can go through yourself. There is an excellent vulnerable banking app you'll have access to as well.

Lucas Kauffman

@Polynomial yes and no, I dont have to, but I want to, I want something that vouches for my skills. I'm defo doing OSCP when I get to staff 2

Polynomial

18:16

@LucasKauffman I guess. Most places just ignore them, though.

Lucas Kauffman

@RoryAlsop I already owned that one I think, it was part of my prep for the RBS assault course

Rory Alsop

from the perspective of certs, as @Poly says, CISSP is useful on a CV or proposal, and then things like OSCP, and further down the line CISM

@LucasKauffman cool

Lucas Kauffman

@Polynomial also problem with CISSP is that I need to have 5 years of experience :(

Polynomial

I was originally looking round at CEH / CompTIA Security+, but I got warned off them by pretty much everyone in the security business.

Iszi

@LucasKauffman You can get Associate of (ISC)^2 meanwhile.

Polynomial

18:18

@Iszi Isn't that basically "give us some money and you can have a certificate"?

Lucas Kauffman

yea but E&Y only pay from senior 2 or 3 I think

Iszi

@Polynomial Dunno why on CEH. But I can understand with Sec+. It's very entry-level, so really not much worthwhile.

@Polynomial No, you have to pass the same test as full CISSP.

Rory Alsop

@Iszi CEH is really a cert that says you know how some tools work

Polynomial

@Iszi Hmm, ok.

@RoryAlsop Exactly.

CEH is basically "I know how to do the metasploits"

Iszi

@RoryAlsop True enough.

Rory Alsop

18:19

in saying that, when hiring grads it gives us an idea that they know something in security

Polynomial

CISSP is basically "I know lots of shit about all sorts of crazy syssec/netsec/appsec theory and information security management"

which is good.

Lucas Kauffman

@Polynomial yea I already read the CISSP book, it's a lot of theory but nothing really complex and no hands on

Polynomial

exactly

CISSP is good if you're an information officer.

Iszi

And I guess, at least according to a certain chessbird, CVEs are basically saying "I pwns j00!"

Polynomial

CVEs on your CV are pretty good.

but they only express one side of it - "I can find bugs in systems"

Lucas Kauffman

18:21

In practice it's worth almost nothing when doing pentesting, the only thing that you might even remotely do with it is become CISO or do some regulating/standardising

Polynomial

it doesn't say anything about your theoretical or practical knowledge of mitigating those problems

or anything about your risk management skills

Rory Alsop

@Polynomial well, here we see CISSP as a reasonable step for thos with a bit of tech, on their way to something else

Polynomial

yeah

Rory Alsop

CISM much more useful for the management side

and SANS/OSCP etc for real hands on

Polynomial

if you've got a bunch of CVEs to your name and a CEH cert, then you're in for a good time on the job market as a pentester.

not a senior pentester, but a pentester

Iszi

18:22

@RoryAlsop s/SANS/GIAC

Rory Alsop

and ideally CREST in the UK

@Iszi erm, yep :-)

Polynomial

@RoryAlsop Been meaning to look into that.

Lucas Kauffman

@RoryAlsop yea me and other Rory were talking about CREST the other day, it's like ticket to pro pentesting right?

Iszi

CEH is also recognized by the U.S. Gov't.

Rory Alsop

@LucasKauffman it is getting closer to being a requirement for quite a few large orgs

definitely aiming at the gold standard

Polynomial

18:24

then again, I don't have a single CVE to my name, but I have both wide and deep programming knowledge, plus a lot of security theory. so I don't do too badly on the job offer front.

Iszi

CEH + U.S. Gov. job = CNDA

Polynomial

@Iszi I misread that as = CANADA

David

Don't mess with me, I'm a CEH

lol...

Polynomial

lol

Rory Alsop

one of the things I have looked into is the EC|Council's C|CISO cert. Again - it's just a cert, but can maybe open doors

David

18:25

Lucas Kauffman

@RoryAlsop mmm suggest I would be able to get in a sale or 2 , you think I might be able to convince the partner in letting me get training earlier?

Rory Alsop

@LucasKauffman partners at the Big-4 love Business Cases (capitalised deliberately :-)

so you'd need to have a good argument as to what the benefits were

get Erik's input as well :-)

Polynomial

@David Don't mess with me, I'm an MCSE!

Rory Alsop

@David I thought you were joking!

Lucas Kauffman

@RoryAlsop if I get a sale it's going to be on Erik's account anyway since he's the manager, anyways you guys at deloite interested in a pentest ;D?

Rory Alsop

18:27

hahahaha - I'm at PwC. How dare you!

Polynomial

or, even more fun

Lucas Kauffman

Really? I thought you were Deloite :o

Polynomial

"Don't mess with me, I'm MOS"

Rory Alsop

@LucasKauffman nah - the two I haven't tried are Deloitte and KPMG

David

me: Don't mess with me, I'm too lazy to get any certifications

Rory Alsop

18:28

@David I think this needs sending to memegenerator. Back soon...

Lucas Kauffman

@RoryAlsop KPMG took some blows though, I think one more and it's going to be the big 3

especially the big fraud case here in Belgium a few years ago

Polynomial

@David I prefer "Don't mess with me, I spend my time actually learning things instead of chasing after pointless certifications"

it's a bit long winded, but... :P

Rory Alsop

and then we have folks like Grant Thornton and Baker Tilly waiting in the wings (at least in the UK)

Lucas Kauffman

@RoryAlsop not really, we bought Grant Thornton :P

Rory Alsop

@LucasKauffman in Belgium? Cool

they seem to still be separate here

Lucas Kauffman

18:30

yea, pretty sad for the newcomers, some of them started working at GT because they did not want to work for the big 4, suddenly they hear that from january they will actually have to anyway

Polynomial

btw

anyone else bugged by the fact that there's no apostrophe in "don't" in that CEH advert?

Iszi

@Polynomial I wasn't until now. Thanks a lot. :-P

Polynomial

lol

David

@Polynomial or make it say "I'm a CEH"

Lucas Kauffman

@RoryAlsop and I have already got 4 weeks of audit :'(

Stack Exchange

18:33

Blog - Stack Exchange: SE Podcast #33 – It’s Back!

Alex Miller on October 15, 2012

It’s Back! Welcome to episode #33 of the Stack Exchange podcast. We’ve got a brand new co-host (Jay Hanlon, our new VP of Community Growth) plus our guest this week is David Fullerton, VP of Engineering at Stack Exchange.

So what’s new in the seven months since our last podcast? Check out the new and improved review queue! If you’ve got enough reputation, you can see the review button at the top of any Stack Exchange site. The new system is clearer to use and it’s fast thanks to a ton of AJAX goodness. …

Rory Alsop

@LucasKauffman ooo - the joy

Well - got a week without kids (they are at their granny's for mid-term) so guess what I am doing tonight: writing an article for the ISACA journal and finishing up a presentation for the Chartered Institute of Internal Auditors. The excitement is almost palpable...

Lucas Kauffman

@RoryAlsop ooh is it a PwC exclusive or can I have a peek?

Rory Alsop

@LucasKauffman the ISACA one is a 'me' article and the presentation will be as president of ISACA Scotland, so definitely not PwC branded - so yes I can ping you a copy

Lucas Kauffman

awesome

Polynomial

AviD

18:44

curious - I've only seen/heard CREST mentioned at all in the UK. wondering if its used or noticed anywhere else?

@Polynomial niiice.

David

@Polynomial (with my collar popped)

Polynomial

@AviD I've heard CREST mentioned on LiquidMatrix Security Podcast a few times, and they're mainly Canadian.

AviD

@Polynomial no, I meant someplace real.

Polynomial

@AviD lol

Rory Alsop

@AviD It began in UK as a replacement for CHECK (which is very public sector focused, and not updated fast enough to meet private sector requirements) but it is now gaining interest in US, Canada, Germany and South Africa

AviD

18:48

btw @RoryAlsop talking about family cars - I just got a new Ford S-Max - roomy 7-seater, Ford-style power... unfortunately my lease was up on my beloved Honda FRV. wonderful 6 seater, as luxurious as you can get for a family sized car.

Iszi

The only CREST I'm really familiar with is...

Rory McCune

@RoryAlsop and australia :)

Iszi

AviD

@RoryAlsop is it? @Iszi @ScottPack, either of you seen or heard of CREST locally?

Rory Alsop

@RoryMcCune oh yeah, that's right :-)

cheers

AviD

18:49

@Iszi yeah, thats what I always thought of...

Rory McCune

CREST is a good one (IMO) I've done a lot of exams over the years but it's definitely the best (and don't get me started on the CISSP :oP)

AviD

@RoryMcCune Ive recently let my cissp expire.

Iszi

I wish the CEH was more like the CPT, but less cheap-feeling.

Rory McCune

@AviD yeah I've strongly considered it but I do consultancy and it's a checkbox on a lot of tenders

AviD

I like the idea of it, I love the idea of continuing education - but the implementation sucked.

Iszi

18:50

CPT is pretty much CEH + practical exam requiring a pentest against 2 VMs.

AviD

not to mention the steep yearly fees.

Rory Alsop

@AviD I'm not renewing mine...

Rory McCune

the fact that you get CPE's for attending vendor presentations says it all

AviD

the only thing more worthless than a clueless certification, is a 12 year old out-of-date certification.

Rory McCune

you can have one book a year but unlimited vendor stuff....

AviD

18:51

@RoryMcCune yeah, exactly.

Rory McCune

that too, my missus was reading the CISSP guide recently and I had to ask if it was a really old version 'cause some of the questions she was asking made me think it must be...

turns out it was a recent one.

AviD

@RoryMcCune yeah, thats kind of what rook said - only real reason for it, is RFP responses.

especially government and large corporates.

Rory McCune

@AviD yeah pretty much have to have it for that unfortuntely

Rory Alsop

@RoryMcCune until you become a PHB

Rory McCune

I have to go remember all my learning for the last 3 years soon to make sure I retain it...

Rory Alsop

18:52

then you have people who have it :-)

AviD

@RoryMcCune well, since I'm a spoilt git, I can be choosy about my clients :).

Rory McCune

@RoryAlsop well there's that. I've applied to get on to the CREST assessor panel so that should be a lot more fun making sure it stays relevant

Iszi

Ok. Enough with the noise in here. Gotta go do some actual work now.

Rory McCune

if I get on <fingers crossed>

Rory Alsop

@RoryMcCune excellent - can I vote for you :-)

@Iszi TTFN

Rory McCune

18:53

@RoryAlsop possibly not but if you know anyone who's on it feel free to tell them how great I am :)

So did people see the nice bit of fail from Santander today ? (seclists.org/fulldisclosure/2012/Oct/101)

that's actually a little surprising, I'd have thought for sure that all the banks would've got the message about storing PANs in the clear by now...

Rory Alsop

@RoryMcCune a little surprising?

Rory McCune

well I'd say completely shocking but I've worked in banking before :op

and I'm sure it will have been flagged and will be on a risk register somewhere.....

Polynomial

19:21

hahahahahaha

oh what have I done

2

AviD

who likes Venn diagrams...? Everybody loves Venn diagrams!

Rory Alsop

19:55

Transcript for