The DMZ

D3C4FF

03:04

For the record. Fuck checkpoint and their god-awful support

Xander

03:20

@D3C4FF. Their support is something of a legend. I know network guys who won't buy their stuff simply because of how consistently useless the support is.

D3C4FF

@Xander yeah. If you wana give your boss an aneurysm reccomend checkpoint gear!

Whats the quickest way to convince a client that their website is a piece of crap and needs to be nuked from orbit and built from the ground up?

Terry Chia

@D3C4FF Nuke it from orbit.

D3C4FF

@TerryChia nuke it for em? :P

Terry Chia

@D3C4FF Nuke it in front of them.

That should convince them.

D3C4FF

@TerryChia haha if only i hadn't signed those pesky legal documents

@TerryChia you'd think when i show the MD his passwords in a meeting he'd shit bricks... but nope. Guy must be on heroin or something...

Oh, did i mention it was a critical utility company? -_-

"But what can an attacker actually do if they have full control of our network?" - CSO Quote of the week!

3

Terry Chia

03:46

@D3C4FF CSO as in chief security officer?

D3C4FF

@TerryChia The one and only

;___;

Terry Chia

@D3C4FF So when will they be firing him and hiring me?

D3C4FF

@TerryChia Probably about 4:59 today i hope...

Its days like this i die a little inside.

Terry Chia

Ah I figured it out. Incompetence is the #1 prerequisite for a Chief -insert something here- Officer job.

D3C4FF

Sorry @TerryChia based on your competence, skills and experience, we find you are far to qualified for this job. Try again after a few beers

D3C4FF

05:40

Someone should market the internet as an appetite suppressant. I've forgotten to eat for the past 14 hours. -_-

AviD

07:01

w00t, gold badge!

100

Q: How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database, and not any other type of attack, such as bruteforcing the login page of the application, keylo...

AviD

07:18

@D3C4FF what do you think about the answers to my SU PLL q? A little bit different from what we discussed here...

Though overall not too disappointing of response.

Rory Alsop

Yay @avid

Link to the pll question?

Rory Alsop

07:50

Heh Ponies @AviD

AviD

@RoryAlsop hoping maybe it will catch on :-)

0

Q: How to optimize PLL voltage

I am overclocking my Core i7 (Ivy Bridge 3770K), aiming for a moderate overclock. Currently I have it easily stable at a pleasant 4.4GHZ - BCLK defaulted at 100.00MHz, with the multiplier set to x44. While it is currently stable (tested using Prime95 torture test for a few hours), it does gen...

cooling overclocking voltage undervolting

I really am learning a ton about how a computer really works, from this overclocking experiment.

so many complex subsystems... so many disparate fields of study combined. Fascinating.

Terry Chia

@AviD Go replace the TIM in your CPU if you have the guts. ;)

AviD

Even if I wind up not keeping it highly overclocked, I still got something out of that.

@TerryChia replace it? I just put brand new one!

Terry Chia

@AviD I'm not sure we are talking about the same thing. The replacement I am talking about involves performing surgery on the processor.

This should be a decent article about it: pugetsystems.com/labs/articles/…

AviD

@TerryChia ohh, you mean in the processor, not on.

Terry Chia

07:55

Right, in.

AviD

as in ripping off the IHS, and putting it there... if I were to do that already, I would just go for soldering instead... :D

oh man, now I want to do that!

Terry Chia

It is said to be a huge improvement if you dare to do it.

The TIM Intel uses is crap from what I read.

AviD

@TerryChia but wow on the heat drop in that article....

I dont. I dont even own a soldering tool, for a reason.

Terry Chia

@AviD Yeah, it allows much more insane levels of overclocking.

AviD

My wife hides my saw, worried what I would do with it.

> This just goes to show that even when professionals are performing this modification, there is a decent chance of damage occurring to the CPU.

Yeah, I think I will have to pass on that one.

D3C4FF

08:14

Sup all

@TerryChia @AviD you can do Direct to Die cooling which bypasses the needs for one layer of metal and TIM.

That's even MORE badass :P

@AviD @TerryChia in addition, if your keen, you could also polish the IHS

Because of manufacturing, its hard to get a perfectly flat surface (mirror finish) so its possible to DIY that

I tried once. I got very bored.

Terry Chia

@D3C4FF I am not nearly that hardcore.

2

And yes, I know how that sounds.

D3C4FF

To late

xD

AviD

@D3C4FF standard sinks wouldnt connect to that well...

D3C4FF

@AviD Nope, going custom down that path like LN2 coolers etc

AviD

@D3C4FF yeah, count me like @TerryChia.

D3C4FF

08:19

overclock.net/t/1269943/…

xtremesystems.org/forums/… <- this right here is bad-ass.

Rory Alsop

And I thought I was geeky modding my car stereo with surface mount components...this is hard core!

AviD

08:35

well, yeah, you are. The delidding doesn't change that ;-)

Adnan

@D3C4FF Wait wait wait! Why would you wanna remove the IHS?

I probably don't know much stuff about computer hardware, but I know that a soldered IHS is pretty good at HSing (heat spreading). So really, why would one want to remove it?

AviD

@Adnan because it wasnt soldered.

medium quality TIM + glue.

Thats what the noise is about...

Adnan

@AviD So you remove it, and then what? Solder it?

Terry Chia

@Adnan Yes.

AviD

@Adnan well, @D3C4FF's article showed them basically replacing the TIM to a better one, and regluing it. Though solder would probably have even better affect.

Adnan

08:40

So I have just Googled a bit and there seems to be videos and articles about removing soldered IHS. Anybody can think of a reason?

AviD

@Adnan some want to run the chip IHS-less. Can run cooler.

Terry Chia

@Adnan I think like @D3C4FF mentioned earlier, direct to die cooling.

Adnan

@AviD @TerryChia So you remove the heat spreader in order to make your CPU cooler? Doesn't make any sense to me.

@D3C4FF Would you please shed some light on this one?

Terry Chia

@Adnan You remove the original IHS so you can attach something like a waterblock to it.

Adnan

@TerryChia Jihaaa! Okay, now I get it. Yes yes, I've heard that some people want to their coolers in direct contact to the die.

Thanks Terry.

I think that this @RobW guy is killing it with the browser extension questions. I'm truly impressed.

Someone with a great understanding of client-side web security. Not that common.

D3C4FF

08:51

@Adnan all good? :P

Adnan

@D3C4FF Yup, thanks to Terry and AviD. All good.

TildalWave

11:26

Slow day?

Adnan

11:38

"Everyone has a price man.... EVERYONE... Not sure if StackOverflow is worth as much as, but there's always a number where people will say f*ck it! I'll take the money. Just human nature...." – BFree Feb 15 '10 at 23:12

D3C4FF

@TildalWave 3rd day running. -_-

Adnan

@TildalWave Head-to-wall banging with jQuery Draggable/Droppable.

@D3C4FF Why did you change your avatar? The one with the sunset was pretty nice.

D3C4FF

@Adnan I've been meaning to ask about that. It just disappeared one day!!

TildalWave

@D3C4FF you changed your default chat profile to Area51 but didn't copy the profile from Sec.SE to all other sites (it's a button in edit profile)

D3C4FF

O_O How did i do that?

How do i set the defauly chat profile?

Adnan

11:42

@D3C4FF Just go to your chat profile and click [Change]

TildalWave

@D3C4FF you can select what profile to use if you click on your icon here, select user profile, then 'change' and start typing in IT sec... then select it from the list ;)

D3C4FF

Done. But the picture is still gone??

Adnan

@D3C4FF Refresh the chat

I see the old (new?) one :D

D3C4FF

YEAH BOII

Bitches love me cause i got sunsets

3

TildalWave

@D3C4FF alternatively, you can copy your Sec.SE profile to all other SE websites so you have the same avatar in others too

@D3C4FF BTW, do you often test windows 95 machines? :P

Adnan

11:45

@D3C4FF She occasionally checks the transcript here to see if I'm still talking about asses and cactus. But still, I'll be honest. Bitches love sunset.

D3C4FF

@TildalWave More often that i'd like to. Good thing i've been fucking with computers since before i was a teenager

@TildalWave Done already :P

@Adnan :D

TildalWave

@Adnan she? fear of cactuses (cacti)? ... blow-up doll? :))

Adnan

@TildalWave Okay okay. "He", if it makes @Terry and @AviD happy.

TildalWave

@Adnan well I know for sure that @TerryChia is cacophobic .... oups ... Freudian slip :))

Cactiphobic?

Adnan

@TildalWave Yeah, we're all cockophobics.

TildalWave

11:50

Prickophobia :))

Adnan

uups, I meant cacophobic. Damn Freudian penis

2

uups, slip slip, Freudian slip.

D3C4FF

xD

TildalWave

funny it appears you can add phobia to pretty much any word there is... let's see if there's such thing as vocabulophobia ..

D3C4FF

slutphobia?

amidoingitrite?

Terry Chia

@D3C4FF amidoingitritephobia

D3C4FF

11:53

@TerryChia amidoingitritephobiaphobia?

Adnan

@D3C4FF You misspelled slutophilia

D3C4FF

@Adnan Ooops my mistake!

phobiaphilia?

phalicphillia?

Adnan

Speaking of Freud

►

D3C4FF

I'm on a roll here.

Adnan

The above album is great for anyone who A- Likes Alan Parsons, B- Have read a couple of Freud's books.

TildalWave

11:56

@Adnan well that counts me out then :P

Adnan

@TildalWave Really? You haven't been in a Pink Floyd phase in your teenage years?

TildalWave

@Adnan I meant the books LOL

Adnan

@TildalWave Oops, I dropped the "OR" between A and B.

Rory Alsop

Hmmm Alan Parsons is not Pink Floyd. I like the latter, but am indifferent to the former

TildalWave

@RoryAlsop You realize you just admitted you like Pink Floyd? :)))

@RoryAlsop anyway... g'day! ;)

Is Dark Side of The Moon still all time bestselling album, or did some Justin Timberlake surpass that already?

Adnan

12:06

@RoryAlsop Parsons was an audio engineer who worked on The Dark Side of the Moon. He later made some of the best rock/prog. rock albums with Eric Woolfson.

@RoryAlsop Listening to The Alan Parsons Project's songs you can clearly hear the Floydian spirit in them.

TildalWave

►

@Adnan For some reason (?) Alan Parsons doesn't mix well with what I'm currently listening to :P

Adnan

@TildalWave NSFW

@RoryAlsop Well, at least that's just my opinion. I hope I didn't offend your musical taste.

TildalWave

@Adnan Neah, it's safe... not really Closer by Joy Division... that one can bring any good spirits to a breaking point tho LOL

Adnan

@TildalWave You need some weed to accompany that music, which is not safe for work.

Luc

12:24

This website is hilarious schneierfacts.com

Scott Pack

12:36

> Bruce Schneier mounts side-channel attacks through the front channel

That's hot.

Terry Chia

> An autographed picture of Bruce Schneier is all you need to securely wipe any hard-drive.

> There is no secure e-commerce - only stuff Bruce Schneier doesn't want.

Rory Alsop

@Tildal - you do remember how old I am, right? My Floyd collection is rather extensive, and is my preferred soundtrack for snowboarding and gliding.

@adnan - oh, I know who he is. I even have an APP album somewhere.

lynks

@Luc schneierfacts.com/facts/927

Scott Pack

rackerhacker.com/2013/04/15/seriously-stop-disabling-selinux

Controversy is fun sometimes.

Adnan

@RoryAlsop It difficult to associate you with 41, especially after seeing that security career talk.

Thomas Pornin

12:52

@TerryChia At that point, I should point out that I have been "Chief Technology Officer" for ten years (but I never worked out who I was the chief of).

3

Terry Chia

@ThomasPornin I am ashamed.

lynks

@ThomasPornin is my answer to that sequence-number question wrong? Isn't TCPRST a form of sequence number prediction?

Adnan

@D3C4FF No disrespect to your spelling/grammar-Nazip @Terry, but this doesn't feel right to me "Personally I've yet to find a modern system that has had this vulnerability.".

Do you mean "that has this vulnerability".

The way I understand it, almost all Operating Systems has had it at some point. Right?

Luc

@Adnan I'd say so too, but I'm a total grammar noob :)

Adnan

@Luc I'd say the same about myself as well. I'm concerned in this case only because it changes the meaning.

Luc

13:09

@Adnan Well I don't know the context, but would it matter if the system in question had the vuln or has the vuln? In this sentence it's clear that, as far as the writer knows, no modern system is vulnerable regardless. No modern system exists with it, so how does it change the meaning?

Thomas Pornin

@lynks Well, it is not "prediction" per se, rather "observation".,

Sequence number prediction is about making some connections of your own to a target server, and then working out what will be the sequence number for another connection that you cannot observe.

It is a tool for attackers who are not able to eavesdrop on their victim's connection.

lynks

@ThomasPornin rgr, looks like i have my definitions mixed

Thomas Pornin

Of course, if the attacker knows the sequence number (through prediction or observation), then he can do Evil Things, including killing the connection (with RST) but also hijacking the connection (which is in practice more evil).

Luc

@Luc But no star :( Everyone gets stars but me :(

Thomas Pornin

@Luc Ye shall not beg for stars. This is demeaning.

5

Terry Chia

13:14

@ThomasPornin @Luc See, he gets a star.

lynks

@ThomasPornin would it not put an end to all this (and to DDoS as it exists), if consumer ISPs just dropped egress packets with a forged source ip?

wait, scratch that wrt tcp sequence prediction

Thomas Pornin

@lynks It would not kill botnet-powered DDoS; at best, it would force zombies to use their own zombie IP.

Luc

@TerryChia life's so unfair

Thomas Pornin

It would prevent the easy forms of DDoS amplifications through open DNS resolvers, though.

Terry Chia

@ThomasPornin You know, if it were anyone else saying that, I'd have replied with "So's your face".

Thomas Pornin

13:16

@TerryChia Yeah, but I am me, and well aware of it.

lynks

@ThomasPornin which is significantly weaker is it not? I mean denyhosts could keep up with a medium botnet if source IPs could not be forged.

s/denyhosts/a relevant technology/

Thomas Pornin

@lynks I must add that a lot of botnet members are not home machines but hosting servers (dedicated or virtualized, it doesn't matter).

It is quite easier to DDoS a server when your botnet controls a few machines which are hosted in the same facility. Bandwidth will be much better, and there will probably be fewer controls.

lynks

@ThomasPornin heh yeah, two hosts on a gigabit switch can probably hurt eachother

Antony Vennard

@ThomasPornin Actually you (might) get around ingress/egress filtering that way too, and therefore be able to disguise the actual source by spoofing all your IP addresses.

I hadn't thought of that, but that'd actually be a really bad thing to be attacked by someone in the same datacenter :(

lynks

oh man this is out of date, reading the IMDB documentation, it contains install guides for Amiga, Acorn and DOS : /

"Several thousand movies and people are covered completely," hehe

Antony Vennard

13:30

Okay guys, I have a question: web security, I take it I should read and inwardly digest OSAWP as a starting point?

lynks

@AntonyVennard as with all types of security, IMHO the only way to really grasp stuff is to attack and defend, I would say write some php and pwn it.

but yeah, using OWASP for inspiration is certainly a good idea.

Antony Vennard

@lynks Yeah. I was thinking specifically of the OWASP vulnerable webapps, to try things out on.

lynks

there are loads of classes of attack that as a developer you (anyone) would just never think of, so vuln lists like OWASP are a great way to learn

@AntonyVennard one thing that really helped me in the early days was hackthissite.org

Antony Vennard

@lynks Yeah. I'm reasonably happy with OS-side stuff (C,C++,asm) but my web knowledge is currently letting me down, so learn I must :D

lynks

@AntonyVennard oh wow my profile still exists, thats potentially embarassing hackthissite.org/user/view/Lynks

Antony Vennard

13:36

@lynks Redirect loop apparently!

Terry Chia

Oh right, @lynks. CTF this sat?

lynks

@AntonyVennard odd, anyway I would say sign up and do the 'realistic' challenges. they will take you through everything in the OWASP top 10 and beyond. looks like I completed realistic 1-13 inclusive back in the day.

@TerryChia yeap, whats the plan?

Terry Chia

Friday for me actually. Not sure what day it is for you.

@lynks Just head on over to the CTF chatroom on the day. We'll see how it goes.

lynks

@TerryChia rgr

Terry Chia

> The CTF will begin on 2013-04-19 21:00 UTC and last for 48 hours.

And I hope we do better than last time.

lynks

13:39

@TerryChia yeah friday evening for me

@TerryChia im setting an alarm in my brand new phone right now :P

Rory Alsop

14:16

@Adnan - I'm going to take that as a compliment. I am a firm believer that growing old gracefully is for other people!

Adnan

@RoryAlsop Are you kidding me? No body saw that video and gave you more than 32, including me.

@RoryAlsop and yes, it's a compliment.

Lucas Kauffman

5

Antony Vennard

@LucasKauffman Oh. Dear.

Segfault. Go straight to core dump. Do not pass a signal handler. Do not gracefully exit..

TildalWave

@LucasKauffman good old mrs. peroxide ... reminds me of my chemistry teacher :)

@RoryAlsop You should! Because in two years time I shall too :P Kids these days! pffff

@Adnan actually... how old are you again? I can pull some old photos for my avatar too ya'know

Lucas Kauffman

14:37

@Adnan you mean 1932?

jokes jokes ^^

Terry Chia

@LucasKauffman Naw, 0032.

Lucas Kauffman

@TerryChia hex?

bad one, I know

Terry Chia

heh.

@RoryAlsop is OLD. The actual year is irrelevant.

Lucas Kauffman

@RoryAlsop take it is a compliment, you are considered to be wise, age and how you feel/look is different

Scott Pack

That's true, @RoryAlsop does seem much younger than he should be. Until you look at his sagging, leathery face.

lynks

14:42

its time to admit something: about half the time that a person leaves stackexchange chat, and their avatar slowly moves down the screen and fades out. it makes me jump because i think its a spider out of the corner of my eye.

Lucas Kauffman

@ScottPack That's not nice! but it is funny ^^

Scott Pack

@LucasKauffman If you can't be nice, be a hilariously lovable jerk!

2

Rory Alsop

15:20

Hahaha - Jerk

AviD

15:32

@LucasKauffman age is irrelevant. How old you are depends on how many kids you have.

Terry Chia

NUUUUUUH!

IT'S THE END OF THE WORLD!

2

Scott Pack

@AviD So you must be near retirement

AviD

@ScottPack you have NO idea.

@TerryChia ... and companies across the world recorded a productivity peak on 16/04 at 16:45UTC.

TildalWave

16:08

@AviD did someone just hit compress on this chat database, or why did it take so long to complete? :P

Tinned_Tuna

I just rescued a boxed copy of Mandrake Linux 8.2 ^.^

Scott Pack

Gods, why?

Tinned_Tuna

because I wanted to save it

I already have a boxed Red Hat 5.2 at home :-)

Terry Chia

@Tinned_Tuna Woah that's awesome. Should do what someone around here did with old Windows CDs.

I think it was @RoryMcCune?

Tinned_Tuna

Oh?

Terry Chia

16:22

Frame it up. :D

Tinned_Tuna

haha :-D

Now, more blogging.

Jeff Ferland

16:37

@ThomasPornin
>There is no "Internet crime". There is crime, and there are tools. The Law will not punish you more or less severely because you stole money with a method which involved Internet-connected machines, phone lines, paper or whatever.

Boy you missed the mark on that one!

Thomas Pornin

@JeffFerland Well, yeah, there are a few countries with weird laws. With 193+ countries in the world, it can be expected that on any subject one of them came up with a really creative law.

I would still maintain that in almost all countries, it is the theft of money which is the crime, not the usage of the Internet in pursuance of that goal.

Lucas Kauffman

16:55

I wonder what Kim Jong is up to today?

Thomas Pornin

Pyongyang, April 16 (KCNA) -- Kim Jong Un, first chairman of the National Defence Commission of the DPRK, Tuesday sent a message of greeting to Bashar Al-Assad, president of Syria.
The message extended warm congratulations to the president, government and people of Syria on the occasion of the 67th anniversary of Syria's independence, the significant national holiday of the Syrian people.
Expressing belief that the excellent bonds of friendship and cooperation between the two countries would grow stronger, the message wished the president and people of Syria success in their just struggle f…

Straight from the official Web site

Tinned_Tuna

How's this look : coderinaworldofcode.blogspot.co.uk/2013/04/…

Thomas Pornin

@Tinned_Tuna For your explanation about unpredictability, I often say it that way: you want worldwide uniqueness. Not only unique on your server, but also on all servers which happen to use the same code base. Using a server-local counter fails at that.

Random selection is just an easy way to get the uniqueness you are after, with high probability, and without having to bother with some worldwide allocation scheme.

Tinned_Tuna

@ThomasPornin thank you :-)

Thomas Pornin

You could also use the concatenation of the server DNS name (DNS is a worldwide allocation scheme) with a server-local counter. Randomness is easier and more robust, but this would work nonetheless.

Tinned_Tuna

17:09

@ThomasPornin doesn't that violate the obscurity principle?

i.e. if I knew a system was using that scheme, I could (before an exposure) calculate a wordlist tailored to one user

then on exposure, simply perform a lookup (assuming the user's password was in that wordlist)

Thomas Pornin

@Tinned_Tuna Well, you could, but the security property of salting would be maintained: to attack N hashed passwords, you have to pay N times the cost of attacking one password.

Predicting the salt value gives you the possibility to make the computational effort "in advance", but does not change the total cost for the attacker.

For it to make a difference, you have to imagine a scenario where the attacker can run powerful computers for weeks, but only has 30 seconds between actual hashed password theft, and password exploitation.

Tinned_Tuna

@ThomasPornin is it really hard to imagine an adversary having at most a day or two before discovery?

lynks

w00t ingres invite :)

Thomas Pornin

@Tinned_Tuna When I try to imagine that, I think about Tom Cruise and a system which release Pitbulls when somebody sneezes too loudly.

Tinned_Tuna

I suspect the LinkedIn dataset would not have been found if they didn't outright post it online.

TildalWave

17:24

0

A: What is the difference between Exploit and Payload?

According to @D3C4FF's answer, I figured out exploit and payload as explained in the figure below:

graph alert! :)

Can I? :)))

lynks

@TildalWave yes my child, run free.

i would have gone with the double payload thing though

TildalWave

LOL

lynks

or just put payload in like 4 times

TildalWave

17:40

this cleared up several points that have been confusing me for years, thanks. — lynks 3 mins ago

@lynks LOL what points did it clear?

AviD

@TildalWave It turns out gorillas like bananas.

@LucasKauffman Auditors vs Sysadmins

I know, I know, just wanted that pic up there :-)

Scott Pack

@TildalWave So....the vulnerability is a glory hole?

2

Tinned_Tuna

And the payload/exploit an exploding penis??

TildalWave

Tinned_Tuna

I'm going home.

Scott Pack

17:48

@Tinned_Tuna I think the payload is obvious.

AviD

@ScottPack from now on, I'm going to see security flaws as opportunities, not vulnerabilities.

5

TildalWave

@Tinned_Tuna ROFL :))))

AviD

@TildalWave love that one. Reminds me of my brother.

Scott Pack

@AviD Your brother is a jerk and smells like rotten fish?

AviD

@ScottPack other than the fish part, yes, very much so.

TildalWave

17:50

@AviD I double checked to which photo you were replying, just to be sure hehe

AviD

growing up I used to have to walk down the hallway sideways, to keep my back to the wall.

Scott Pack

Just like in prison, eh?

AviD

lol, lil bit.

lynks

for us it was always waiting for a lamp-post/other obstacle and giving a lateral shoulder barge just as we approach it. the victim's forward momentum will carry them into it every time.

AviD

12 year olds shouldnt need to know what a shank is.

@lynks parked cars work nicely too, when you / your victim is walking near the edge of the sidewalk. Loss of balance adds to the momentum and reduces the chance you will avoid it.

And good to know it wasnt just me :-)

lynks

17:59

@AviD ahh cars were way off limits to me, my dad used to be a rally driver so cars were always sacred

Transcript for