The DMZ

Scott Pack

00:31

@Gilles That is...wow.

Stack Exchange

05:20

I don't know what's worse--the fact that after 15 years of using tar I still can't keep the flags straight, or that after 15 years of technological advancement I'm still mucking with tar flags that were 15 years old when I started.

AviD

07:50

hahaha, there is a whole site dedicated to the crappiness of PHP: phpwtf.org

Terry Chia

@AviD nice

AviD

@TerryChia not so much, no.

seriously, there more I read about PHP, the more I realize - it's even worse than I thought.

e.g. I used to not like Ruby, mainly for being hipsterish. But I started learning a little bit, and it really is well designed.

I think I would count RoR today as my favorite hipster language.

Tinned_Tuna

09:18

I've got an irrational hate of Ruby

AviD

@Tinned_Tuna that is irrational.

Now, if you had a hate for PHP, that would be completely rational.

heh, it's fun to hate on php. :D

really though, I used also have an irrational hate of Ruby. then I bothered learning it just a bit.

'course, I've also become a fan of MVC-type apps, REST-ish websites, and ORMs for most types of development, and RoR just happens to hit those very nicely.

Tinned_Tuna

I like Java or maybe Groovy for that...

I'm not a massive fan of MVC, but REST with an ORM-backend is lovely

Although, I think that by structuring the app as a static HTML page with a JavaScript RPC engine and a REST-ish API, you're basically doing MVC, except you're moving the V onto the client.

AviD

09:43

@Tinned_Tuna are.... are you talking about... about something like... node.js?? shudder

Tinned_Tuna

@AviD God. No. I use Java/Groovy on the backend (Typically Java) and Java-compiled-to-JS on the front end. (Typically)

(via GWT)

AviD

whew. okay then. you said javascript rpc, and I balked.

you did actually say view on the client but I couldnt see at that point.

I guess I get the point of the whole SPA architecture, but I just dont really get it.

Tinned_Tuna

10:00

Well, in our case, the view is effectively a static HTML page jam-packed with GWT/JavaScript, which populates the page with data from various RPC calls.

AviD

10:13

ah, so more of a MVMC/V thing. That, I like.

have a good weekend guys - gotta drive.

Tinned_Tuna

10:26

see you laters

Lucas Kauffman

10:40

oh herro

Rory Alsop

herro Rucas

Lucas Kauffman

@RoryAlsop how ale you Loly Arsop?

Rory Alsop

@LucasKauffman not too bad - busy sanitising war stories, case studies and engagement notes to pop into our security database as part of my handover before I leave

how about you?

Lucas Kauffman

@RoryAlsop finishing a pentest at a client, never run neXpose when there are HIPS in place

Rory Alsop

@LucasKauffman heh

Lucas Kauffman

10:56

@RoryAlsop neXpose is an automated scanner from Rapid7

it just triggered about 100 AV's and the client was almost about to jump in network contingency

Rory Alsop

@LucasKauffman yep, I have used it

agressive scanners are fun - in that bad way

Lucas Kauffman

true

Tinned_Tuna

penn testing (given the permission to do so) should be completely silent

you don't want your target to know you were there. You want to come back in 3 weeks time and say "Yo, shit's broken. Here's proof."

and for them to look into their audits and have nothing

Lucas Kauffman

@Tinned_Tuna not really, it depends on the type your client wants

if you do a silent scan, it will take more time

Tinned_Tuna

> (given the permission to do so)

Rory Alsop

10:58

@Tinned_Tuna well, not necessarily - it is often of value to see the response the client comes up with; including whether they spotted your attack, how they mobilised etc

Lucas Kauffman

more time = more budget

Tinned_Tuna

Yes, but it more accurately models a determined attacker.

Lucas Kauffman

@RoryAlsop It's hard not to spot nexpose, it's like running around blowing things up with a bazooka

Rory Alsop

And typically, reporting major flaws as you find them is pretty common - as it removes your risk that a real attacker will compromise them between the time you spotted the flaw and the time you told them about it

@LucasKauffman hahahaha - very true. Watching network segments slowly die!

Tinned_Tuna

I suppose you'd hopefully not find any major flaws ;-)

Lucas Kauffman

11:01

@Tinned_Tuna the approach we mostly take is scanning everything agressively and also set up some scenarios (for instance, what could a helpdesk employee do?)

and we then go through the list and try to find the juicy stuff the scanner can't find (for instance what type of data is available on open FTPs or shares)

Tinned_Tuna

How determined, psychopathic a helpdesk worker are we talking about? :-p

Lucas Kauffman

:p

Tinned_Tuna

although, at some point of psychopathy, being a helpdesk worker doesn't really matter...

Lucas Kauffman

@RoryAlsop are you moving to London?

Rory Alsop

@LucasKauffman oh no - definitely not. They'd need to at least double my salary for me to even vaguely consider it.

London has no mountains - I am an hour away from them. And I'm an hour away from 2 different seas. There are areas with no people for miles

London has none of this

also

it is London

Lucas Kauffman

11:05

@RoryAlsop How you doing today gov'na?

Rory Alsop

more people in London than in all of Scotland

@LucasKauffman :-)

Lucas Kauffman

and less sheep!

Rory Alsop

@LucasKauffman true

Tinned_Tuna

@RoryAlsop more... opportunity!

Rory Alsop

and haggis

Lucas Kauffman

11:06

and no haggis!

indeed :p

Rory Alsop

@Tinned_Tuna hahahahaha

Lucas Kauffman

@RoryAlsop you planning to go for CISO?

Rory Alsop

@LucasKauffman at some point, yes. This role takes me a couple of steps closer

Lucas Kauffman

@RoryAlsop excellent

@RoryAlsop if you ever are in need of some good old big 4 pentests ;D

@RoryAlsop do you also play bagpipes?

3

Colin Cassidy

11:39

@RoryAlsop Sadly London is an hour away from London. Start in London travel for an hour, still in London..

Rory Alsop

@LucasKauffman Will remember that :-)

@LucasKauffman not yet...

Rory Alsop

11:59

ooooo - got my 100k network wide. Ya and w00t and stuff

Lucas Kauffman

@RoryAlsop gratz

Polynomial

nice one :D

Lucas Kauffman

How I feel when people say they’re compliant and don’t need pentests: tmblr.co/ZJ5JTucwRup7 via @sec_reactions

Lucas Kauffman

12:59

@RoryMcCune do you play the bagpipes?

Rory McCune

@LucasKauffman .... no can't say as I do

Terry Chia

►

Adam McKissock

13:16

@TerryChia How dare you?! You just made an enemy for life!

Terry Chia

@AdamMcKissock Hey, it's in The Simpsons so it MUST be true! :P

Polynomial

@TerryChia Love it.

Adnan

13:43

FINLAND!!! yle.fi/uutiset/…

I guess that's the Finnish version of Verizon's Bob

Terry Chia

The latest TBBT episode is just hilarious.

Scott Pack

14:14

So I can't be bothered to read the transcript. Did anyone say anything worthwhile last night?

Adnan

I wasn't here then, so probably no.

Rory McCune

@ScottPack well there was some more heartily justified perl bashing, but apart from that I don't think so.

Scott Pack

@RoryMcCune %s/heartily/hardly/ There, I fixed that for you. Common mistake, they're very nearly homophones.

Terry Chia

Let's just agree to hate PHP.

2

Rory McCune

I want to make a joke based on homophones, but nothings coming to mind..

although I have good reason to like perl this week as I got some easy findings thanks to someone using it.

Scott Pack

14:29

@RoryMcCune I understand your concern. Homophone is deceptively an inherently unfunny word.

Adam McKissock

@TerryChia NEVAH!

Rory McCune

@AdamMcKissock yeah damn right, how would pentesters get lots of easy high severity findings if it weren't for PHP

Scott Pack

@RoryMcCune I want to disagree on principle, but phpMyAdmin and Webmin forbid it.

Rory McCune

phpmyadmin, the tendancy of all PHP devs to leave at least one instance of phpinfo() in every live site....

Scott Pack

As terrible as this may be, it has become my practice that, for post incident forensics, the first thing I look for on a linux box is a webserver and if so then phpmyadmin.

It's pretty terrible how frequently that was the initial ingress point.

lynks

14:39

@ScottPack whats really terrible is that people have to decide to change the default config, which is loopback access only.

at least in the debian repos

Scott Pack

@lynks That depends on the packager.

Polynomial

OH SHIT

I was meant to be on a bus 10 minutes ago.

Scott Pack

Polynomial

haha

OHHYEEEEAH

Rory McCune

@ScottPack yeah my webserver gets scanned for phpmyadmin and it's associates on a daily basis. So anyone running vuln. versions of it will be toast pretty quickly.

lynks

14:42

we run phppgadmin locked down to the vpn ip

which i hope should be ok

Scott Pack

@RoryMcCune There are, frequently enough, command execution vulnerabilities to make it awesome.

Adam McKissock

Will you lot stop saying oh no, otherwise the god-dammed kool-aid guy is gonna keep coming through the wall!

lynks

does anyone know whether the real-mode IVT is completely overwritten by the protected-mode IDT or if some remnants of it remain. eg: real-mode has INT 0x09 for keyboard hardware interrupt, is this still the case once a full OS has booted?

Polynomial

@lynks I know that the hardware keyboard interrupts still work, because Windows hooks them for Ctrl+Alt+Del.

but I don't know whether it's a different interrupt, or whether they re-map it in protected mode.

lynks

@Polynomial ahh that's a good clue, thanks. im trying to get a picture in my head of how real->protected switch looks in a modern os.

Polynomial

14:48

have you checked the osdev wiki?

pretty sure they have an IRC channel on freenode, too. might be helpful.

lynks

yeah ive been browsing the wiki, its rather good

Thomas Pornin

15:11

@lynks When the kernel sets the address of the table for interrupt handlers, it sets it for all interrupts at once; it does not get to choose on a per-interrupt basis.

Also, I very much doubt that handlers meant for real mode (16-bit code) will be invoked once a 32-bit or 64-bit kernel has assumed control. The mode-switching costs alone would be a killer.

My own DOS-extender from the mid-1990s did forward interrupts to the 16-bit handlers (with vm86 emulation of 16-bit code when using 32-bit protected mode) but that was because I still used the underlying Ms-Dos for hardware management.

lynks

@ThomasPornin so that INT 0x09 would still sit right at the top of memory, but never be used?

Thomas Pornin

In Windows systems from the NT line (i.e. Windows 2000, XP and later), there is no underlying Ms-Dos

lynks

or does the kernel supplant its own IDT from 0x00 on up?

Rory Alsop

on the topic of php:

chat.stackoverflow.com/rooms/11/php

Thomas Pornin

the kernel has no choice: it setups a table for all interrupt values (0t to 255) and loads the address of that table with the appropriate opcode (sidt I think)

in each entry, there must be a pointer to the handler, which must be 32-bit or 64-bit code

the table needs not reside at address 0

lynks

15:16

@ThomasPornin I see, so the IDT can reside anywhere, provided the idt register points to it

Thomas Pornin

exactly

lynks

@ThomasPornin and sidt is a ring 0 instruction?

Thomas Pornin

absolutely

if you allow userland to fiddle with interrupts then you have pretty much lost security

lynks

@ThomasPornin heh, so a kernel bug leading to arbitrary ring 0 execution could remap the whole IDT

Thomas Pornin

@lynks Yes, but it usually goes the other way round: a kernel bug allowing the remap of the whole IDT will be used to gain arbitrary ring 0 code execution

lynks

15:18

scarey

sure, i can see how that is more likely

i guess that is pretty much the ultimate keylogger; remapped keyboard hardware interrupt to memory-resident instructions.

@ThomasPornin thanks again for your insights, I'm making a point of learning OS internals, so I will probably be bugging you repeatedly.

Adnan

@Polynomial, fan of Anathema?

Iszi

15:47

This gave me a much needed laugh.

Option Mnemonics: tar xzvf = Xtract Ze Vucking Files [said in thick German accent]

Tweeted by climagic on February 1, 2013 at 2:22 PM

lynks

16:09

@Iszi xD although usage of -v is questionable

Rory Alsop

16:32

@lynks what's wrong with verbose?

lynks

@RoryAlsop i like to live dangerously

sometimes i turn my monitor off altogether

monitor-off sysadminning with an onscreen keyboard is the sport of kings

3

Rory Alsop

@lynks Headless servers TFW

lynks

yeah nobody runs a desktop manager, but i thought the onscreen keyboard would be a nice addition to the game.

Thomas Pornin

@RoryAlsop If there are lots of small files and you run that through a SSH session over a not-so-fast link, then you may suffer.

Rory Alsop

@ThomasPornin very true. Usually I only use -v when initially testing a script. Once it works the -v is removed (at least until debug time :-)

lynks

16:46

@RoryAlsop real men &> /dev/null everything output is for lamers.

Rory McCune

has anyone heard much about ingress yet?

Saw a ref. to it looks kind of fun (although invites are in short supply)

Jeff Ferland

@RoryMcCune I've got an invite

Rory Alsop

@RoryMcCune ooooh - looks cool. Wonder where invites come from

Rory McCune

@JeffFerland cool would be interested to hear what it's like :)

Jeff Ferland

As soon as I can get my monitor to work again I'll tell you

Rory McCune

16:55

@JeffFerland also if you get any more invites to pass on ....

@RoryAlsop so far there's a subreddit with loads of people asking and not a lot giving and you can register on the homepage

Jeff Ferland

Oh, lame, I have no invites at all and have never handed any out.

They've got that thing locked up tight :(

Rory McCune

so I registered with 3 of my e-mail accounts..

@JeffFerland yeah, I think it's fairly early days for it yet, hopefully more will pop up as time goes by...

plus.google.com/102161590687970928094/posts/T722vatAd9K?hl=en this was a fun account of an ingress operation in London

Jeff Ferland

Oh, wait... I got two codes because I used two email addressess. So one is still live.

Anyway, it's a lot like geocaching but you know what you're after

I had fun with it for two days, then got busy with life.

Rory McCune

yeah and apparently you attack portals that the other side control. Do see that it could get a bit dodgy if people get a bit too invested in it, could cause fights..

Jeff Ferland

@RoryMcCune Well, you're a fool if you get that invested because they simply don't last.

Rory McCune

16:59

indeed I just know how some people get quite over interested in MMORPGs..

I generally don't play 'em 'cause of the massive time sink I don't have time for..

Scott Pack

@JeffFerland If your monitor doesn't work, then do you have a screen reader set up?

@JeffFerland I must say, I am impressed with your blind typing skills.

Jeff Ferland

@ScottPack I have to keep tilting and flexing it until it stops flickering

Scott Pack

@JeffFerland You should start lifting. That'll make your flexing less wobbly.

Rory McCune

If you're looking at new monitors I'd recommend some of the Korean 27" ones. Just got my second one, very shiney (5120x1440 now :)

Jeff Ferland

My laptop is just... aged....

Scott Pack

17:14

What is it?

Adnan

17:24

@JeffFerland They become more experienced, that's a good thing

Iszi

Anyone else get really annoyed when a service seems to hang at "Stopping"?

Adnan

@Iszi Freakin' Apache!!

Scott Pack

17:46

@Iszi No, but my systems are run well and don't do that.

Thomas Pornin

@Iszi I got that with "Certificate Propagation". Windows could not stop it. When I tried again, the whole machine crashed solid.

Reboot, reboot, reboot all the servers !

Iszi

►

@Iszi NSFW (language in audio)

Ever have one of those days when you know something exists, somewhere in your Inbox/Desktop/etc., but you just can't seem to put together the right search terms to find it? Then, you start wondering if it's really there - but you're certain it was there at some point, so you start wondering WTF happened to it?

David

18:19

Morning everyone

Jeff Ferland

@David West coast?

Iszi

@David Bah.

David

@JeffFerland west coast, best coast

Iszi

Ah, that's why I couldn't find it. Doesn't help when key search terms are in the encrypted part of the e-mail.

Jeff Ferland

@David Hmm, 2 hours is far for me to drive for a beer. You should drive out here, then buy me a beer.

Speaking of beers, @RoryMcCune and @RoryAlsop, I'm planning on flying to London the 2nd week of March, renting a motorcycle, and riding to Scotland. Beer?

Rory McCune

18:39

@JeffFerland sounds cool, if I'm about and not off on a job, always cool to add another person to the list of Sec.SE people I've met :)

David

@JeffFerland wat lol

unless you intend on giving me a high-paying job, nothx

Jeff Ferland

You're new at this "networking" thing, right?

2

David

2 hours is too far lol

Scott Pack

@JeffFerland Personally, I look forward to sharing beer(s) with you.

Jeff Ferland

@ScottPack Just looked at a map again. Wish I'd been paying more attention when I planned my road trip out here. Athens would have been an easy place to pass through on the way.

:(

Rory Alsop

18:47

@JeffFerland Oooh - yes...unless you are in Scotland between 6 and 12 of March, as I will be having beers with @AviD in Tel Aviv

Jeff Ferland

@RoryAlsop 9-17, so I'll make my road trip the later part of the week, then.

Rory Alsop

excellent - in which case. a) I will be between jobs b) I can has beers and c) if you need a place to crash just west of Edinburgh, I have a spare room

Jeff Ferland

By the way, that's 7 hours of driving after a 10 hour international flight. What have you got to say for yourself now, @David?

Scott Pack

19:01

@JeffFerland I would have even set you up for a night. Cuz, you know, I'm awesome like that.

David

@JeffFerland i dont follow

what are we talking about?

Stack Exchange

19:50

Blog - Stack Exchange: Why We (Still) Believe in Working Remotely

David Fullerton on February 01, 2013

It’s 2013, almost three years after we first raised money and started growing beyond the first four employees. At the time, Jeff wrote a great blog post about working remotely, basically laying out our plan for how we were going to make it work. Now we’re a few years in and it’s time to update it with, well, what actually happened.

First, where are we now? Stack Exchange now employs 75 people, roughly evenly split between sales (and sales ops and marketing) and product (development, ops, design, community management). The product side is where our remote working happens: we have 16 full-time re …

Rory Alsop

20:13

^ heh heh - equating the Forest of Dean to The Shire :-)

Scott Pack

@RoryAlsop It is very nearly Welsh.

Lucas Kauffman

21:23

I learned today that welsh are considered sheep shaggers?

Polynomial

Yes. Yes they are.

oh, and that CLI magic joke (twitter link in the starred posts) is stolen from QDB: qdb.us/305221

Lucas Kauffman

Tar.gz is no problem. Tar.bz2 is!

Polynomial

@LucasKauffman you can still use tar -xzf <file> to extract that.

well, pretty sure you can anyway.

Thomas Pornin

21:39

@Polynomial It depends on the OS. On Linux, you will need tar xjf with the j meaning "uncompress wiht bunzip2".

Polynomial

ah

Thomas Pornin

The tar utility on *BSD systems (including MacOS X) is smart enough to recognize bzip2-compressed data, so tar xzf will work for .tar.bz2

But the tar utility on Linux is GNU tar, and it is not smart

Scott Pack

@LucasKauffman Today?

@LucasKauffman If you can't remember -j for bzip2 then you can still use bunzip then just tar -xf

I mean, honestly, it's been years since I had to look at the tar manpage. The commands are the same >99% of the time.

Gilles

@ThomasPornin yes, it is

tar tf foo works if foo is a tar.gz or tar.bz2 archive (regardless of the name, tar looks at the magic header)

Polynomial

I've got a BT5 VM loaded up, lemme try

yep, works on a bz2

tar -xvf derp.tar.bz2 works fine

Thomas Pornin

21:54

@Gilles Ooh, tar has evolved. Good news. A few years ago, it was not able to do that.

Polynomial

:)

Gilles

@ThomasPornin it was new in 1.15

2004-11-26 Sergey Poznyakoff <[email protected]>

* configure.ac: Raised version number to 1.14.91
* scripts/tarcat: New file
* scripts/Makefile.am: Added tarcat
* src/buffer.c (hit_eof): Changed type to boolean
(read_full_records,reading_from_pipe): New variables
(check_compressed_archive,open_compressed_archive): New functions
(open_archive): Autodetect compressed archives and act accordingly.
Set reading_from_pipe. This fixes controversial set of changes
introduced 2004-05-11,2004-03-22.

FreeBSD may well have had it first

The first mention in the FreeBSD man page is in 5.3 released in November 2004

so FreeBSD did have it first, by a short margin (or by a bigger margin if the feature started undocumented, which is a definite possibility)

Jeff Ferland

22:26

I actually have no problem with the flags for tar. shrug

Lucas Kauffman

22:44

BOOOOOOOBBBBBIIIEEES

4

Lucas Kauffman

23:15

Right time to block me while I'm still partially Sober

Scott Pack

23:34

@LucasKauffman Partially? That's no fun.

Transcript for