DEF CON CTF 2013 qualifiers will start on Saturday, 15th of June 2013 at 00:00 hours UTC, and will last 48 hours until Sunday, 17th of June at 00:00 hours UTC (so midnight to midnight throughout the weekend). The login page is here and we'll post login details in the IT Security's CTF Team chat r...
@AviD I don't think so. We have all kinds of certs and stuff I don't understand. If you get an email from boss@company.com we know it's really from boss@company.com
Though we don't have ways to verify anotherBoss@differentcompany.com
@AviD Well, that's for our sysadmin to know. All I know is that you cannot do that, I don't know how it's done. I know that we're issued certificates and we must install them on our computers.
then I get an email from the sysadmin telling me that there's an API to which I need to authenticate, and after that I can send the emails from the code by sending them to the API.
@phyzome Because the only way I think it could have been done is by watching the URL of the hidden frame to know the ticket value. Is that what you're thinking about?
@Adnan Briefly, the CAS 1.0 spec (can't speak for more recent stuff) doesn't specify anything about restricting who it will authenticate a user to.
No, the attack I'm envisioning doesn't involve anything sneaky like that. The attacker just says "hey I'm a client, gimme that ticket" and the CAS server does so.
The user-agent does, and always presents it to the CAS server.
The point is, the service URL is unrestricted, according to the spec. Anyone who can send the browser to a URL can ask for a ticket to be sent to an arbitrary server.
Whitelisting the domains a service URL can use would solve it, but is maybe a bit less elegant (and is annoying for client development). I was asking about other mechanisms for preserving CAS-user anonymity on the public web.
They specify a service URL on their own domain. The ticket comes in on the querystring, and the server nabs it, validates it, and then does nefarious things with the information.
Alternatively, the page the service URL leads to has JS that nabs the ticket from its own document.location, asks the server via AJAX to validate the ticket (can't be done from JS-land), and then says "Hello, alice@cas.example.net!"
There's a similar attack in OAuth, but with actually-dire consequences.
The reason I was going on about frames is that that allows the attack to be 1) invisible, and 2) iterated over a list of possible CAS servers.
@phyzome Now I must head home. I'll ping you tomorrow to let you know what I think. Also, now that the conversation is here, others can see it and contribute.
The spammers are automatically generating new comments by taking existing comments and running them through a thesaurus program that replaces words with synonyms or related parts of speech. The result is a sentence which makes sense, but has word choices that no native speaker would ever make:
...
where does this guy get all of his sockpuppets from?
I honestly liked @Adnan's comment a lot more than this answer... "oh look I've got some unformatted hypertext, it must be how all of the spam bots work" :))
OK that's getting ridiculous - the guy got 10 upvotes in 40 minutes for a half-baked answer, and at the same time nothing much else changed in the thread ... except I believe @Gilles upvoted two comments there under the question and maybe the question itself.
@Simon we call it sockpuppeting, but yeah the question is only now on the SuperCollider high enough for me to think OK so most people upvote top rated question and they're done with how much they'd like to understand things discussed... I'm not upset because of lack of votes on my or @AJHenderson's post mind you, but his answer simply doesn't answer the question that's the most worrying thing about it
@TildalWave I think I'd disagree that he doesn't know much about programming, given that he writes languages, compilers, and static analyzers for a living. ;-) (I've followed his blog for a number of years.)
@Xander OK, maybe... tho I wouldn't like to comment how much I've benefited from his work, might be overly personally opinionated of me ;) Still, that what he said is a major burp and I wouldn't let him touch my WAF rules, let alone write code for it
@Adnan Please, please, please add some answer there. And all others should too. I don't care if you repeat already made points, didn't bother the top answerer at all.
@Gilles Well, here's something interesting about Finnish. "Hän" means both he and she. You just have to watch a Finnish person speaking a newly-learned English. Pricesless!
@TildalWave I know, I can always attempt to defend myself by saying I was born in Canada, which makes me Canadian (what a revelation, right?). However, people then proceed to laugh at our army :(
@Adnan I think it's OK here, because it describes spam filter avoidance techniques (or other things that I thought I've helped cover to what @AJ already said anyway)... but yes, the top answer didn't bring absolutely nothing new to the table, merely reiterated one of previous points (@AJ's that had 3 upvotes at the time)
@Simon You have an army? Who's in it? Michael Moore? :))) :P
oh shit he's American, honestly didn't know that... ok, how about .... hmmm ... who's Canadian that isn't enrolled to DMZ already?
@Xander OT... how about I say you're right in the comment to that 1 upvote answer and we agree to delete both our comments? I think I was too upset and started seeing things that aren't there, your "marketing" comment actually explains it perfectly
I think you could've made both your points already in the answer and avoid me picking your brains, but one point still seems to be avoiding you: none of the sample spam messages OP posted actually endorse any products, or are otherwise promoting any other cause. And we can see such baffling messages all over the Internet in blogs, forums, you name it. Now, why do you think this is so, and again - how does your answer actually answer the question? You're partially explaining the strange grammar used, but didn't touch the purpose of such spam messages, not in the slightest bit. — TildalWave12 secs ago
@Simon yeah well... it's a sloppy answer, I simply hate it being upvoted so much, because I know what that means - it means most programmers rather hear reasoning supporting their already existing code, than write new code supporting reason better. Which is a shame and we'll be seeing more spam, and there won't be anything they can do about it (while I'm spam free for years and my code obviously sucks LOL).
@Simon Dunno, I'd disagree. It's probably true for some developer groups, but certainly not for the open source community (which e.g. MS obviously isn't)
@Simon yup... and btw, the spam saga continues.... he edited his answer to now try and change the point of the question and explaining it's an old trick in the comments. I had to reply, of course :)
From the question: "I ask because when I first saw it, I thought perhaps they were being genuine but inarticulate." Now, do you honestly think OP would omit such obviously important detail? Please, you're now editing your answer to make of the question what it isn't. There's no talk of links anywhere in the question, and we see such posts all over the Internet, and a lot of them don't have any links anywhere. I would accept an addendum explaining it might be some sort of probing, confirmation of bypassing registration checks, CAPTCHAs, e.t.c., but this is becoming slightly silly now. — TildalWave1 min ago
@Simon prolly run out of sockpuppets... have you seen his comment on the question? He's so full of himself I wouldn't put it past him he created multiple accounts to upvote himself even. I mean, why would anyone follow him to a website he's never posted before, and 10 of them in under 40 minutes? The question wasn't on the SuperCollider yet then for anyone to easily notice it. And we all know what direction fish stinks from, don't we?
@Gilles while annoying, spam isn't really a threat directly as long as it is handled. It certainly makes less overhead for administration if you can fight it, but it isn't a compromise of a system or a breach
I think anti-spam falls more under system administration than security
The spammers are automatically generating new comments by taking existing comments and running them through a thesaurus program that replaces words with synonyms or related parts of speech. The result is a sentence which makes sense, but has word choices that no native speaker would ever make:
...
