The DMZ

AviD

00:01

anyway, I'll try it tomorrow.

D3C4FF

@AviD Do you have HT enabled or anything fun like that?

AviD

@D3C4FF HT, sure

TBT, no

wait, what do you mean "fun"? Do you shut HT off?

D3C4FF

Yeah, if you shut HT off watch your temps drop :P

AviD

sure, and performance. Right?

though right now I'm not worried about the temps...

D3C4FF

00:24

@AviD Well, the point is you can find good stable voltages/settings, and reduce power draw, then whenyou see how high you go, you can re-enabled HT, it shouldn't cause any instability but power+heat will be up, so you'll need to cool it adequately

AviD

@D3C4FF hmm interesting. I guess that would make sense for extremeOC, though probably not so much for my high-not-extreme OC...

definitely not for my moderate OC.

though I'm thinking of setting up the turbo boost on top of the x43...

if I have the headroom, might as well, right? it wont push it if its too hot.

thats assuming my chip is still alive and well...

D3C4FF

00:44

@AviD I usually leave 'turbo boost' disabled personally

just incase it suddenly bumping the multi does something strange...

AviD

sure, with high overclocks you dont have spare headroom, but perhaps with the lower speeds, it might make sense...

whatever, not doing anything till I see the chip works right...

Scott Pack

Well. This does not bode well. It was starting to feel somewhat warm in the house, so I went to turn on the AC. It appears as though the compressor isn't kicking on.

Xander

01:25

@ScottPack. Ugh. Ours went out last summer. Not fun. At least you're catching it early, before the heat of the summer.

Scott Pack

02:31

No. Doubt. Our bedrooms are built into the roofline. The south facing unshaded roofline. I don't see how they managed pre-AC.

The annoying thing is that it was working yesterday. I really hope it's a relay or capacitor. I'm not sure I can stomach a new compressor.

Stack Exchange

04:20

If you can manage to choose u and v such that u = v = x, then the answer is just (1/2)x^2, which is easy to remember. Oh, and add a '+C' or you'll get yelled at.

TildalWave

04:57

@AviD with turbo you're enabling it to clock individual cores higher when others are not in use, meaning you'd be getting a lot of heat on a really small space... that's tough to cool down, so it's suggested that you disable turbo. Also, it's a bit sporadic since it's only tested for nominal speeds and I believe that the multipliers it uses can make it really unstable. I would advice against it.

@AviD Another thing to consider is also that the mobo is faulty. I wouldn't bet against it, since you had strange problems since the start (better stability at higher OC)

But I highly doubt that you permanently damaged your CPU, not with the OC you were doing (unless the heatsink isn't properly attached to it... then all is possible)

Anyway, I was actually dreaming of that mocking that I was on the receiving end of after giving my opinion on compiled code vs. interpreted languages security. Thought of another case for the former, if anyone is interested in pulling down my pants again and giving me some from behind... just tell me when to drop the soap :)) :P

Terry Chia

@TildalWave @Adnan.

TildalWave

@TerryChia ouch buthurt! :)))

D3C4FF

05:32

<blink><marquee>Does this really work?</marquee></blink>

Sadly no

TildalWave

Bloody hell I can't get to any reviews on SO... even got one of those glad that you're paying attention tests doh!

D3C4FF

@TildalWave I can't get any votes on SU -_-

TildalWave

@D3C4FF Why not? It's dead? Or you're the victim of the usual hit and run questions?

D3C4FF

@TildalWave Not sure, couple of hit and runs, no-one wants to upvote my questions either? shrugs

Terry Chia

@D3C4FF It's SU.

TildalWave

05:45

@D3C4FF added my +1 on that Synergy question because it's good and valid... but I can't go through others any faster not to trip over the serial voting check

At 1335 on both Sec.SE and SO now... made one edit here, waiting for the accept... need another on SO

Terry Chia

@TildalWave Approved, you need 1 more.

TildalWave

@TerryChia hmm I see no change in rep... and I made one more with ample change (added tons to formatting and links)

D3C4FF

@TildalWave Whats the 'serial voting' check?

TildalWave

@D3C4FF If for example I went on your profile page and opened your questions/answers from there to vote on them, the system would detect serial upvoting and reverse them. It's also doing other checks to prevent it, but the ones from profile page as a referral are the most obvious ones. I.e. if you vote on mostly a single individual's posts, or vote too fast without taking the time to actually read it... stuff like that

D3C4FF

@TildalWave Interesting, makes sense!

Terry Chia

05:57

@TildalWave You need 2 people to approve a suggested edit.

TildalWave

@TerryChia oh cheers! didn't know that... so each time I edit I bug either two high ranking users or a mod? wheeey there's more perks to it than I initially thought hehe

I want my two 1337s now... but then 3000 here I come :)

success!: stackexchange.com/users/2211833/tildalwave?tab=accounts

2

D3C4FF

06:18

Awesome! :D

TildalWave

06:30

@D3C4FF yo is this DNS spam.looptech.com.au familiar to you? had it in my access logs with referrer from my profile here... I was thinking, who do I know in Oz that would put spam in their DNS name... thought of you 1st LOL

TildalWave

06:42

@D3C4FF BTW... Remove the overflow:hidden; from Styles_System1.css, line 259 ;) Some of the contents on the main page are hidden under another DIV... either that, or change the style for the table after it to width: 581px;... someone messed it up there :P

1

A: Organization like OWASP for network security?

If you're looking for the equivalent of OWASP for network security then I'd suggest that testing methodologies like OSSTMM or PTES (although PTES is still rather incomplete), are a good place to look for information. However as you say both of those will have a very large amount of information i...

@RoryMcCune PTES would be less incomplete if they didn't crop their diagrams like this one LOL

Rory McCune

@TildalWave FWIW I think PTES is dead as a dodo these days the last substantive updates to it were last year. shame really it was quite a good idea..

TildalWave

@RoryMcCune Shame indeed. I still find it useful tho, especially for the diagrams and nice explanations to them. Organizing things around is with PT more of a challenge than the tests themselves sometimes are IMO

when I say organizing... I mean also reporting on findings obviously. That's where PTES comes quite handy with nearly copy/paste-able structure that then just needs actual test results... I wasn't involved with many pentests tho, so it's just my impression really

not many pentesters here tho... I expect most were consumed by UK and Germany :)

@RoryMcCune Out of curiosity, how many different versions do you include in your reports? I've only glimpsed through reports for management and mostly worked on the ones for devs, but the differences were huge

Rory McCune

07:13

@TildalWave well we typically pass out one report with a management section at the beginning (short and high-level) and then a detail section in the middle (goes into what was tested and found) and then a "slides" section at the back which just summarizes each of the vulns found...

so it can be a bit repetitious but then things like Dradis can help automate some of it..

TildalWave

@RoryMcCune You do follow-ups as standard? Or that depends on the client? I imagine it's suggested and probably a standard practice with bigger customers, but what about the smaller dev teams? If you even do those?

Rory McCune

@TildalWave TBH we very rarely get asked to do follow-ups which is a shame. I did one the other week where I did a workshop on web app security and talked through the findings for the devs

but that was the first one I've done in over a year.

TildalWave

07:56

1

A: What is the difference between Exploit and Payload?

I prepared an easier to read version of the diagram (I believe). It's following same basic principles the @D3C4FF's excelent answer does. I was tempted to go with his analogy first, but I thought it wouldn't be appropriate due to recent events and for the current global political climate. The t...

I've added a bit more description why I think it's a suitable analogy. Obviously some didn't get it... I honestly hope it's not simply a case of them using too reflective displays LOL

@RoryMcCune That's a shame yup. What's the general feedback you get for your VAs? Are your clients overwhelmed by your reports, or they actually knew what to expect, or even gave suggestions?

@RoryMcCune There's probably some consulting going on even before they sign the contract,... I guess what I'm asking is if you negotiate to what detail you should go, or you have packages and then decide on pricing and timeframe terms based on project complexity? Or a bit of both?

Rory McCune

09:33

@TildalWave VAs are weird. In a lot of cases I think people are having them done purely for compliance purposes, so we'll see the exact same findings repeatedly

@TildalWave well I don't see a lot of the pre-sales stuff all the time, but a lot of it is trying to find out why they want the test as much as what they're looking to cover. Ideally people want the test to improve their security, so that's the best case as you can give guidance on fixing stuff. Other times it's contractual/compliance and then it can become a point of getting as much done as possible within their budget which tends to be fixed.

TildalWave

09:46

@RoryMcCune I glimpsed through your webpage and have a few suggestions. You mentioned now compliance testing, so maybe it wouldn't be a bad idea to include what certification compliance testing you offer (maybe references too). And maybe in the stuff section also what certification they have? I only went there curious about what you said BTW, I'm not a certification freak or spying on you :P You've already shared the contents of your car's booth with the rest of the world anyway LOL

Rory McCune

@TildalWave heh, no worries, all that stuff is as public as the contents of my car boot :) Most of the stuff we do at the moment is 3rd party (we work for other testing companies) so references are a little tricky, although we've had a couple recently. good point though I should put compliancy content up there to help with search traffic.

TildalWave

@RoryMcCune Watching that why pentesting must die video now, the title caught my attention LOL ;)

Rory McCune

@TildalWave well ya know attention seeking sounding titles are good for getting people into presentations :)

TildalWave

10:05

@RoryMcCune some good points there at the yes but can I crash it? about what PT actually is, possibly the simplest explanation I've ever heard (minus the accent LOL)

Antony Vennard

10:20

HI!

Rory McCune

@TildalWave yeah I do tend to sound overly scottish when speaking...

TildalWave

@RoryMcCune neah I don't have problems understanding... just teasing ;) BTW... that brownish liquid you're drinking... could that be the source of your accent? :P

Looks like a posh single malt

3/4 pint daily allowance for married with children LOL

Rory McCune

@TildalWave heh unfortunately nothing so nice. at a guess it'll be coffee or diet coke :)

TildalWave

Rory Alsop

Heh - posh single malt

Rory McCune

10:28

@TildalWave ahh club mate :)

Club-Mate

Club-Mate () is a caffeinated carbonated mate-extract beverage made by the Loscher Brewery (Brauerei Loscher) near Münchsteinach, Germany, which originated in 1924. Club-Mate has a relatively high caffeine content (20 mg per 100 ml), low sugar content (50 g/kg), and low calories (20 per 100 ml of beverage), compared to other beverages such as cola and other energy drinks. Club-Mate is available in 0.33 and 0.5 litre bottles. History Geola Beverages of Dietenhofen, Germany originally formulated and marketed Club-Mate under the name Sekt-Bronte. The drink was only known regionally unti...

TildalWave

@RoryMcCune hehe yup just wiki-ed too

Rory Alsop

@rorym had fun last night. I now have an enlightened sticker on my guitar, and after the gig I popped off 8 portals on my way home

Rory McCune

@RoryAlsop w00 I'm still waiting for any of the portals round here to get approved...

BTW did you hear that we have a smurf in the DMZ

Rory Alsop

Wonder if both of us submitting the same portals will speed anything up. Who is the smurf?

Rory McCune

@RoryAlsop its @lynks . I was trying to persuade him to see the errors of his ways last night...

not sure on the portals. I have a feeling they're swamped but still it would be nice to see some progress from them...

Adnan

10:55

@TildalWave Is that you?

@TerryChia Well, somebody has to do it.

TildalWave

@Adnan no it's @RoryMC

Adnan

@TildalWave Get out of here!

TildalWave

@Adnan c'mon you've never watched any of his presentations?

@Adnan blip.tv/bsideslondon/rory-mccune-pen-testing-must-die-5410173

Adnan

@TildalWave Jesus! The way that sounds!

@RoryMcCune @RoryAlsop What's with you security guys?! Do you ever get old? Should I start pen. testing to throttle my aging process?

Rory McCune

@Adnan well it's either the security or the good scots diet :)

TildalWave

11:01

@Adnan they're Scots they'll put it down to good genes and cultural background

Ah yeah LOL ... 2 seconds too late

Adnan

@RoryMcCune So what do you eat? What do you drink? Beside the blood of babies

Rory Alsop

@Adnan Haggis and Irn-Bru

TildalWave

@Adnan shiiit that made me nearly choke to death in laughter.. .where the f* do you get these? LOL @ blood of babies

Adnan

@RoryAlsop Jesus Christ! I shouldn't have Googled Haggist! What the hell is that?!

TildalWave

@Adnan haggis *)

Adnan

11:05

@TildalWave Well, it's a universally proven facts that Rorys are into Metal music, and we all know that head bangers worship Satan and drink babies' blood.

How do explain the everlasting youth then?

TildalWave

@Adnan not blood of virgins?

Adnan

@TildalWave Looks like something my ex's mom would cook.

@TildalWave You see, I'm not too keen to the "blood of virgins" thing. It sounds so.. ummm.. I can't explain it.

TildalWave

@Adnan rare?

Adnan

You know which girls are the best?

Lebanese girls.

@TildalWave This is actually very interesting. More answers on SO, yet the same rep and less badges.

TildalWave

@Adnan hit and run questions ;)

Adnan

11:10

@TildalWave and Lebanese girls.

TildalWave

@Adnan I get this distinct feeling I'm supposed to ask why?

Antony Vennard

I get the impression people vote less on SO.

Adnan

@TildalWave You just can't resist their majestic presence.

Terry Chia

@AntonyVennard Nono. You just have not found the really stupid, reptrain type questions.

TildalWave

6806

A: Why is processing a sorted array faster than an unsorted array?

You are the victim of branch prediction fail. What is Branch Prediction? Consider a railroad junction: Image by Mecanismo, from Wikimedia Commons: http://commons.wikimedia.org/wiki/File:Entroncamento_do_Transpraia.JPG Now for the sake of argument, suppose this is back in the 1800s - before...

like this?

Antony Vennard

11:12

@TerryChia possibly. It could also be that there is much more content, so the chances of a Q reptraining are low. But there was some research done into voting in tags and I think haskell came out as the tag to be in for votes/answer.

Terry Chia

@TildalWave Nah, that answer actually looks quite good.

Adnan

@TildalWave @TerryChia This contributes to my theory; "An answer that begins with a picture will have a high number of votes"

TildalWave

@TerryChia well it is, but not THAT much better than most with 5 up votes are

Terry Chia

There was a really stupid one on the supercollider a few months ago. Can't remember the title.

Adnan

Case and point.

TildalWave

11:14

@Adnan ~~why don't you ever do this with answers of others?~~ :P never mind

Terry Chia

@Adnan You are missing some freehand circles in those pictures.

Adnan

@TildalWave It's called shameless self-plugging.

3

No dirty thoughts @TerryChia and @AviD

Terry Chia

@Adnan With a cactus?

I think the cactus thing deserves a spot on the meme question.

Adnan

@TerryChia Usually, with a cactus dipped in vodka, at night. But you can use whatever makes you comfortable.

TildalWave

@Adnan so you actually ordered some of those items @ScottPack suggested you get off Amazon?

Terry Chia

11:16

9 hours till the CTF starts FYI.

I'll be sleeping at that time but those that are awake can and should go ahead and start. :)

Link and account details are pinned in the other chat room.

TildalWave

@TerryChia we'll need you later to collect the prize ;)

Adnan

@TerryChia Actually, the original cactus incident is attributed to the user DiH

TildalWave

1445

Q: How can I get query string values?

Is there a plugin-less way of retrieving query string values via jQuery (or without)? If so, how, and if not what plugin do you recommend?

@TerryChia this one seems to fit the description well enough

Antony Vennard

@TerryChia I'll be awake and (possibly) awake enough to do the CTF. Will start and post what I'm doing in the room.

TildalWave

@Adnan Dunno for @RoryMcCune (tho possibly because he associates with @RoryAlsop), but @RoryAlsop looks young because he's so old that his appearances run into the integer overflow (the - sign only shows in the mirror reflection, though).

7

Adnan

11:32

I can't say this enough, man, I love Cryptocat

Rory Alsop

11:45

@TildalWave hahahahaha

Haggis - it's like a sausage, only better. You can use it in place of mince to make haggis lasagne, or as a topping for haggis pizza. You can have it for breakfast, lunch, (and/or) dinner

TildalWave

@RoryAlsop That pizza looks Scottish for more reasons than just being a haggis version of pizza Bolognese LOL the crust is wiiiiideeeee and no cheese on it! You probably don't get many Italian tourists, huh? :)))

Rory Alsop

@TildalWave nah, that's just a pic I found online. The ones you get in Asda are filled to the brim :-)

TildalWave

@RoryAlsop just teasing ;) I make one mean pizza tho, if you're ever down our woods, you're invited ;)

Rory Alsop

@TildalWave definitely - I am a massive pizza fan. Generally where other bands would drink/take drugs etc between soundcheck and playing - we go find a good Italian restaurant :-)

Terry Chia

3

Rory Alsop

11:59

hahahaha

nice @Terry

Polynomial

12:13

Hard Mode

Scott Pack

Haggis in the morning, haggis in the evening, haggis at suppertime. When you've got some haggis you can have haggis at any time!

Polynomial

Haggis in the bedroom.

Scott Pack

@Terry I can do you a better image when I get on a computer.

@RoryA avalanchepizza.net/menu

Rory Alsop

@Polynomial ew

Terry Chia

@ScottPack The first thought that popped into my head - Llama Pizza.

Rory Alsop

12:16

@TerryChia and fuzzy alpaca pizza

Polynomial

@RoryAlsop What? Nothing turns a lady on more than shredded animal organs!

Rory Alsop

@Polynomial .... o...kayyyyy

Terry Chia

@RoryAlsop That surprises me coming from a Scot.

Rory Alsop

@TerryChia my dating technique never included the Lady Gaga technique...

Terry Chia

@RoryAlsop Whatever happened to her? She seems to have dropped out of the news recently.

Scott Pack

12:22

@TerryChia flickr.com/photos/29233640@N07/8036039000

Rory Alsop

@TerryChia dunno - I only ever liked a couple of things about her - edible clothing, and her stage craft. I'm not really that into pop music (cos I'm a fogey)

Scott Pack

2

Terry Chia

@ScottPack heh.

@RoryAlsop I'm not really into pop music either, and I'm the opposite of a fogey.

Scott Pack

@TerryChia If John could get his hands on some he just might. He doesn't like to do odd things for the purpose of being odd, but he does try to do things unusual that taste yummy.

Oh, the systems guys in here should probably look at this.

major.io/2013/04/19/reprint-stop-disabling-selinux

Terry Chia

@ScottPack nice.

I do agree that troubleshooting selinux errors can be a major frustration.

Scott Pack

12:28

@TerryChia Yeah, he pretty much summed up my feelings in his first post.

@TerryChia It's more about retraining your debugging process.

$THING doesn't seem to be working, is $THING running? Yes. Does $THINGS logs list any obvious failures? No. Are there any denies in /var/log/audit/audit.log?

Terry Chia

I really need to look deeper into selinux. Ugh, another thing on my very long todo list.

Scott Pack

A few months ago an update to Fedora 18 ended up breaking the security contexts on /etc/hostname.

Simply by changing my debugging process to allow for selinux it took me about 30 minutes to diagnose and fix.

It was as simple as issuing a restorecon, so the fix took seconds, but the debugging wasn't that much harder.

Rory Alsop

@ScottPack I hated trying to to it before I really understood restorecon

Scott Pack

@RoryAlsop The policies, these days, are pretty spot on. But yeah, between the policies being good and restorecon to fix issues...there's 90% of the problem solved right there.

Terry Chia

12:56

@RoryAlsop @ScottPack How much data does Ingress use? I'm probably gonna play it with my phone tethered to my tablet but I don't want to burst my data cap.

Scott Pack

It's pretty continuous but not terrible. It'll depend quite a bit on how much you play.

My data usage, since I got my invite, has been about 50MB for the Ingress app

That's been since about March 26th

Terry Chia

@ScottPack Ahh, that's very manageable.

Battery is probably gonna be my main hurdle.

Scott Pack

Quite right. The other day I had Ingress running for about 45 minutes and burned through 60% of my battery.

Rory Alsop

@TerryChia The max I managed in one month was 1.5Gb, and that was using the IITC browser a lot. Get one of the battery packs I mentioned - 12000mAh is a lot!

Scott Pack

@RoryAlsop Is this on your Desire?

I've only got the stock 1230mAh. The GPS on this thing is very nearly a short to ground.

Rory Alsop

13:16

@ScottPack have an S3

the battery pack is an external one from amazon - give two usb slots at 1 and 2 amp

Scott Pack

@RoryAlsop When did you upgrade?

Terry Chia

A floating Sheldon appears.

Rory Alsop

@ScottPack January time, ish

Scott Pack

Ah. My contract is up in October, I figure I'll be upgrading then.

Rory Alsop

@ScottPack The S3 is awesomely robust, comes with the tools to easily use alternate builds, excellent battery life and a really good gps

my mate just got the htc 1 and it seems almost as good

Travis

13:31

What's up @ScottPack. I got Snort working pretty well and also remembered now to use -D to see what was going on. Had some rule errors.

Scott Pack

@Travis That happens sometimes. If you're including a signature that doesn't parse then snortd crashes on startup. Pretty lame if you ask me.

I would rather it throw an error message, skip that one, and continue on.

I've come into work with several dozen alarms because Sourcefire fucked up a rule.

Terry Chia

@ScottPack See, now you need to rewrite snort.

Scott Pack

That should happen less frequently now. They used to use a different versioning scheme internally than externally.

Travis

@ScottPack Yep! Just moves right along and spawns the process though. At least output something lol. I'm trying to refine one particular alert. It comes up when Adobe tries to run an update and I've found the rule but I'm not sure if I can do an exception

Scott Pack

Just recently they converged the version numbers so they'll match up.

So you want to ignore that signature for a specific host

Travis

13:34

No, because adobe is using akamai. Basically I need the payload signature to ignore Adobe or something like that

Crap..didn't mean to hit enter

Scott Pack

That's...trickier. Whitelisting a signature for a host is built in

You're wanting to modify the signature.

Rory Alsop

@Travis - you can edit and delete your recent chat posts

Scott Pack

It's...odd.

So, whenever snort processes a packet it processes it against every signature that would make sense for that packet.

It internally builds out an array of all of the alerts that fire.

Then it logs the first alert that fired.

Travis

@RoryAlsop Thanks!

Terry Chia

0

Q: Is changing the default port more secure?

A lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports. My question is this, though, if the port is changed to a random port, yes an attacker knows it's open, but do they know what service is ...

firewalls ports

Definitely a dupe of something.

I remember arguing about it with someone on here.

Travis

13:37

@ScottPack So would it be a rule or something else?

Scott Pack

Technically, there is some prioritization, but not much. Largely it was one of those decisions that was designed in for future proofing, but wasn't ever really fully utilized.

@Travis The best think you could do is rewrite the signature that's firing and tweak it so it doesn't fire on your use case.

Terry Chia

Ah, found it.

Scott Pack

@TerryChia I'm gonna say this

23

Q: Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? Edit: I should also mention that I am using iptables rules to limit brute forcing attacks, only 5 l...

authentication attacks linux attack-prevention ssh

Terry Chia

@ScottPack yep, found that one and vtc-ed.

Scott Pack

The one you posted is a more general case, but the answers are the same

Good. I got a kick ass answer on that one. :)

Travis

13:39

@TerryChia My answer would be not really. Whatcha think?

Terry Chia

@Travis My viewpoint is that it is indeed just obscuring the target and won't deter any semi-determined attacker.

Scott Pack

@Travis It depends on your use case.

@Travis I'd say go read the answers on the one I posted and see what you think.

Terry Chia

A few people around here brought up a decent point that it cuts down on the automated bruteforce type attacks you find on the internet and can help to somewhat reduce the noise on your logs.

So, weigh that against having your users remember an obscure port number.

Travis

@ScottPack It's a very vague rule. Just looks for content of PE|00 00| saying that a portable EXE file was detected. Not smart enough yet to come up with a solution on how to block everything but adobe

Will the signatures work chronologically like if I do a pass first for the adobe and alert for the current sig?

@ScottPack: Good info in that SSH port article. Very relevant for sure. I can't upvote until I get 15 rep on there though :(

Scott Pack

@Travis It might be worthwhile to just disable, then. Or, perhaps, not not fire an alert on akamai boxes.

@Travis Not really.

So, the reason snortd takes so long to start is that it's processing all of the signatures and building out a big state table/decision tree like data structure.

So the order in which the rules are processed depends more on how they're constructed.

Iszi

13:49

@ScottPack Holy crap, that's ridiculously large for a simple "humor" image. Even if it were serious, it's still vastly larger-than-life!

Scott Pack

Some types of signatures are prioritized.

Travis

Just disable it for now. It only triggered for Adobe anyway

Scott Pack

For instance, a suppression rule is such that the signature will still be processed, but it won't produce an alert.

Rule tuning is a bitch.

Travis

Yep! I wrote a shell script (instead of using oinkmaster) that will pull and process rule files from Emerging Threats and Bleedingsnort.

Adnan

@TerryChia God damn it! You should have a normal avatar. For a second I thought that was you.

@TerryChia Looking nice with your guitar, eh? facebook.com/terry.chia.73

Terry Chia

13:53

@Adnan Sadly, I'm not that old.

Adnan

@TerryChia Which leaves us with young Chia Terry facebook.com/chia.terry.3

Terry Chia

@Adnan Closer.. but no. ;)

Why are you stalking me?

Scott Pack

@Travis All the cool kids used PulledPork these days.

Adnan

@TerryChia If I were stalking you, you wouldn't know. Mwahahahaha!

@ScottPack I'm thinking of ways to sexualize that term "PulledPork". I couldn't come up with any.

Scott Pack

@Adnan That would be sacrilege.

Travis

13:57

@ScottPack I've got that too.

Rory Alsop

@Adnan I think @Polynomial mentioned shredded meat products earlier...

Travis

@Adnan Want to pull on my pork?

Scott Pack

@TerryChia I think I found your facebook

@Travis At a certain point with children and mariaige all you can hope is that someone will.

Travis

One day

Scott Pack

@Travis PulledPork will pull down the newer SharedObject rules, oinkmaster can't process those. You can also use regexes in your PP config to modify a signatures when you update. So you actually can locally modify a shipped rule and still update.

Tinned_Tuna

14:01

I never knew that SecureID was based on PKCS#1 v1.5!

this is entirely new information!

Rory Alsop

hmmmm - not sure this is really needed. What do you guys think?

0

Q: Area 51 Security Review Proposal

Stack Overflow has Code Review. UX is about to have Design Review. So what do we need? Security Review. Someone needs to start a proposal to make such a site happen.

discussion

Polynomial

@RoryAlsop the legal issues are potentially crippling for such a site

Rory Alsop

ayup

Terry Chia

@Polynomial This.

Polynomial

surely someone could do something malicious and claim it was an authorised test

Rory Alsop

14:02

I figured rather than weigh in heavy handed as a mod, I'd wait until you guys had had a go :-)

Scott Pack

@TerryChia Oh yeah, this is definitely your facebook. I see all your shitty bands.

Terry Chia

Go write that on the discussion page.

Travis

@ScottPack I'm guessing I need to really read the documentation in depth of PulledPork. I have it just doing the VRT rules

Terry Chia

@ScottPack Stalker. ><

Scott Pack

@TerryChia Meh, I'm bored. My kid's been sick the past couple of days. So I'm sitting at home drinking coffee watching Sesame Street.

Watching Grover explain paleontologist is funny.

2

@Travis It's better in some ways, worse in others.

Travis

14:04

@ScottPack I'm using Barnyard2/Snorby to view alerts. How do you handle non-translated SID's that aren't located in the SID map for barnyard?

Scott Pack

@Travis Pullpork will generate a new sidmap as part of it's update process.

Travis

Yep, my script that does that using the script in the contrib folder of snort. Just doesn't seem like it is getting it for all (like that adobe one)

Scott Pack

@Travis That's definitely a problem I have. I'm pulling in a few dozen rules that we've written in-house or from groups/mailing lists I'm on.

Adnan

@RoryAlsop Not a good idea, I'll even say it's a bad idea.

Rory Alsop

@Adnan agreed

Scott Pack

14:07

I see it as useless fragmentation

Not a very compelling argument either. "SO has Code Review so clearly sec.se needs Security Review."

Adnan

Code Review is usually about small pieces of code and general ideas.

Reviewing the security model of company, for example, is a whole different story.

You can't really make judgement based on a 10-line question.

Scott Pack

@TerryChia I like Ben and Jerry's too.

Polynomial

0

Q: Serious issues around Security Review

Proposal: Security Review As far as I can tell, this proposal essentially amounts to asking StackExchange citizens to perform a penetration test on live sites. I can see several serious issues with this: It may be difficult to verify that the OP is: The actual owner or representative of the ...

technology

Travis

What's the security review?

Polynomial

it's an Area51 proposal

Travis

14:19

Oh

@ScottPack Oddly I just grepped my SID map file and the one that isn't translated is in there...

Scott Pack

@Travis You may need to restart barnyard

@Travis It only reads the sid.map on startup.

Also, if Snorby is doing any kind of internal tracking, it may have already created an internal entry for that signature ID and mapped it back to the invalid name.

Travis

@ScottPack Maybe. I did restart barnyard. I'll do it again just to see.

Scott Pack

We're run into the latter problem with our SIEM. It creates a new log message record in it's own signature database every time it sees a new kind of log message, but it's keyed off the SID (for snort) and the message field doesn't get updated.

So what I ended up doing was configuring my snort puppet module to restart barnyard if the rules get updated.

Travis

14:35

You and puppet :)

Scott Pack

Travis

I just kill -9 the process and execute my rc.local file to start it all

If I could remember about 10 years ago I might know how to search and auto kill the process and run then restart snort/barnyard :)(

Or just not be lazy and Google it

Scott Pack

What distro?

Travis

14:55

ubuntu 12.04

Scott Pack

Freaking upstart

probably service barnyard2 restart

Xander

15:37

@ThomasPornin He is promoting his own product.

linkedin.com/in/andrewthompsonparasoft

(In reference to this answer)

0

A: Are there any free static analysis tools for C# / .NET code

Not Free, bu the best static analysis tool for C# on the market is Parasoft's dotTest http://www.parasoft.com/jsp/products/dottest.jsp

Rory McCune

@Xander I did wonder, especially as I didn't really think the parasoft tool was security focused...

Thomas Pornin

@RoryMcCune Given the presentation of the answer, and the fact that the Sec.SE account was all new, it was quite probable.

Rory McCune

@ThomasPornin true true

Terry Chia

I just finished watching Swordfish. Amusing how hollywood thinks hacking is like.

Polynomial

It's a particularly poor example :P

the film is poor, that is. not the example.

Terry Chia

15:51

@Polynomial Well, I was bored so I figured I'll check out what hollywood is smoking.

Polynomial

some crazy shit, clearly.

Scott Pack

Go back and watch The Net.

Terry Chia

@Polynomial Have you been answering much questions this month? Or is that 1.5k latent rep?

I have been quite active this month and I'm still 300 short of you.

Polynomial

latent mainly.

I had a couple of active days

Terry Chia

Damn, you are getting as bad as The Bear now.

Terry Chia

16:09

@RoryMcCune @AviD arstechnica.com/gadgets/2013/04/…

Rory Alsop

16:30

@Terry, no that is exactly how we do pen testing. We all have TVRs and Halle Berrys

3

Terry Chia

@RoryAlsop Damn, I want a Halle Berry.

Scott Pack

@TerryChia How else do you think we get motivated?

David

17:02

morning

AJ Henderson

17:12

I'm sure it will be seen pretty soon, but I was able to confirm security.stackexchange.com/questions/25031/… as self promotion from a PR article with his contact info

Xander

@AJHenderson I flagged it as well. chat.stackexchange.com/transcript/message/9057539#9057539

AJ Henderson

@Polynomial Yes, weren't there naked women in it. Hackers never see boobs

completely unrealistic

it was also my biggest problem with the movie hackers, they were otherwise spot on

Rory Alsop

@AJHenderson and @Xander - thanks. Binned!

Jeff Ferland

@AJHenderson I wanted to be a real hacker :(

Travis

17:30

@AJHenderson It's amusing really to watch it again after growing up and realizing that whitehats don't fly through the cyberspaces of their own computer systems with high speed VR glasses.

Thomas Pornin

18:13

@RoryAlsop Did you convert an answer to comments yesterday, on that question ?

5

Q: Is it appropriate to use haveged as a source of entropy on virtual machines?

While looking for solutions to entropy pool depletion on virtual machines, I came across an interesting project called haveged, which is based on the HAVEGE algorithm (HArdware Volatile Entropy Gathering and Expansion). It makes a pretty fantastic claim. HAVEGE is a random number generator th...

linux virtualization

Because the answerer did it again.

TildalWave

18:58

@ThomasPornin Maybe it was one of those random things? :) "It is not due to timer drift, but the aggregation of the asynchronous behaviors in a modern processor" doesn't read as true random to me. If the RNG is determined by fluctuation in code execution time, then what happens to it when you run two or more of these in parallel? Is f(1->N)[0,1] mod N = RND? Maybe I'm missing something, but I'm not so sure it maintains the randomness with high N.

Thomas Pornin

@TildalWave Well, there is randomness, and there is unpredictability.

Apparently, the RNG feeds itself on the exact timing of some operations which may take a variable time depending on "a lot of factors"

mostly cache misses, TLB misses, and branch prediction

If several such entropy harvesters run in parallel, it is likely that the values they obtain will not be independent of each other.

In particular, if the attacker can run some code of his own on the machine, and the processor uses hyperthreading, then the attacker can more or less obtain the same kind of value as the entropy harvester

i.e. the harvester will indeed obtain values which are more or less random (in a physical sense) but the attacker will get the same, which means that the attacker can still "predict" them (a posteriori prediction, which still counts as an attack if the attacker does not get to see the PRNG output)

it seems that the HAVEGE designers are not completely aware of the difference between randomness and unpredictability, the latter being crucial to security (e.g. if you use the PRNG to generate a RSA key)

TildalWave

19:13

@ThomasPornin That was my initial thoughts when I was reading that reply. I didn't delve deeper into it, because... well it's Friday evening LOL... but what you describe seems exactly to be the problem with it. But not just that it isn't random (i.e. it is unpredictable, but not random), I fear that the resolution of the function isn't infinite either, meaning you can overload it to return predictable results. How random it is, when it depends on execution time, but you can control this? It isn't.

@ThomasPornin Still, I'm not sure what you meant with answerer did it again? You gather it should be converted to a comment again? Or were you just surprised that his earlier answer was converted? (I didn't see it before this alleged conversion to a comment, but seems rather strange to me - never seen it before on a post that at least attempts on answering the question)

Thomas Pornin

@TildalWave The guy first post an answer, which consisted of comments on the other two answers. Some mod converted the answer into comments (mods can do that). Apparently, he was not happy with the conversion, and reposted an answer. I wanted to make the mod (supposedly @Rory the Old) aware of it, so as he should decide whether this requires mod action again.

On that specific subject, I don't have a definite answer. Answers-which-should-be-comments are bad answers, but I am quite happy with leaving bad answers just be bad answers, without any mod action to erase them.

TildalWave

@ThomasPornin Oh then it was justified. This latter post seems OK to me, albeit a bit strange to explain the difference between HAVAGE and havaged, say that he's working on havaged, then only deal with how HAVAGE works internally. But it is in a form of an answer, maybe just the first comment in it isn't really needed. (I'll just edit it to remove the first paragraph and a few typos, then we'll see what mods will think of it)

Thomas Pornin

19:29

@TildalWave When you do edits, non-mod reviewers (e.g. me) can handle it, too

TildalWave

@ThomasPornin yes, if I get things correctly, two are needed to approve edits then... I'll re-read it as well to check for errors/typos ... shouldn't take a minute ;)

Thomas Pornin

@TildalWave Yes... it is a bit weird, though: my edits don't need approval, but I cannot approve the edit of someone else all by my own.

Editing without needing approval from reviewers is granted when you get 2k reputation; it is not a very exclusive power.

TildalWave

@ThomasPornin Oh darn, I just realized I'll get +2 rep on the edit, if it's approved. That means I won't have 1337 rep any more :(

Thomas Pornin

@TildalWave Then just work a bit to 13337, then.

TildalWave

@ThomasPornin It's not a race when you can't win it, so that might take a while ;) And it's a CTF night

Rory Alsop

19:39

@ThomasP - it looks like his previous answer was split up into a range of comments. I'm not sure how to do that - quite a useful tool.
Re the answer, I think @Tildal's edit sounds the way to go. Probably not mod needed

Thomas Pornin

@RoryAlsop While you are there, could you have a look at the site stats ? It seems to me that this week has been especially slow.

TildalWave

@ThomasPornin anyway, my next rep target is at 7017 ... the roof, the roof, the roof is on fire ;))

Transcript for