« first day (910 days earlier)      last day (2824 days later) » 
01:00 - 20:0020:00 - 00:00

8:01 PM
@Iszi Here we go, what's wrong with JS now?
 
@Simon I really don't know what sparked that comment. I was just amused by the visualization. Seriously, it could be interesting.
 
@Iszi All I wanna say is that I won't be the guinea pig.
 
@TildalWave well, it is called honeynet...
@Simon on the server???
 
@AviD nvm, I've rewritten the whole meta post to say about the DEF CON qualifiers instead ;)
1
Q: DEF CON CTF 2013 qualifiers (15th to 17th of June 2013, midnight to midnight UTF)

TildalWaveDEF CON CTF 2013 qualifiers will start on Saturday, 15th of June 2013 at 00:00 hours UTC, and will last 48 hours until Sunday, 17th of June at 00:00 hours UTC (so midnight to midnight throughout the weekend). The login page is here and we'll post login details in the IT Security's CTF Team chat r...

 
@AviD Nah, I was reacting to the dude's quote.
 
8:15 PM
 
@Adnan Hey, following up on our discussion on security.stackexchange.com/questions/37321/… -- what do you thinking I'm missing?
 
@AviD I don't think so. We have all kinds of certs and stuff I don't understand. If you get an email from boss@company.com we know it's really from boss@company.com
Though we don't have ways to verify anotherBoss@differentcompany.com
 
@Adnan yes, but how do you know you know?
 
@AviD Well, that's for our sysadmin to know. All I know is that you cannot do that, I don't know how it's done. I know that we're issued certificates and we must install them on our computers.
it's probably related to that
 
The one CAS server I have auth access to is... fairly noncompliant.
 
8:22 PM
@phyzome In basic terms and in broad lines, I want you to explain to me how you think it's possible.
@AviD Actually, one of the projects I was working on needed some error reporting functionality. I thought I'd set from: myproj-error@company.com
and the emails weren't delivered
 
@phyzome CAS?
@phyzome and hello and welcome, btw.
 
then I get an email from the sysadmin telling me that there's an API to which I need to authenticate, and after that I can send the emails from the code by sending them to the API.
 
Central Authentication Service
Thanks.
 
@phyzome ah.
 
@phyzome Because the only way I think it could have been done is by watching the URL of the hidden frame to know the ticket value. Is that what you're thinking about?
 
8:26 PM
@Adnan Briefly, the CAS 1.0 spec (can't speak for more recent stuff) doesn't specify anything about restricting who it will authenticate a user to.
No, the attack I'm envisioning doesn't involve anything sneaky like that. The attacker just says "hey I'm a client, gimme that ticket" and the CAS server does so.
 
@phyzome How would the attacker do that? He doesn't have the cookie.
 
CAS clients never have the cookie.
The user-agent does, and always presents it to the CAS server.
The point is, the service URL is unrestricted, according to the spec. Anyone who can send the browser to a URL can ask for a ticket to be sent to an arbitrary server.
 
@phyzome Okay! I think now I get it
 
Whitelisting the domains a service URL can use would solve it, but is maybe a bit less elegant (and is annoying for client development). I was asking about other mechanisms for preserving CAS-user anonymity on the public web.
 
@phyzome It seems I'm the one who misunderstood your question. Apologies
 
8:30 PM
No worries.
 
@phyzome Okay, so let me see. Tell me If I'm right
@phyzome but just before that. In your attack, how would the attacker get hold of the ticket?
Actually, no need to.
The hidden frame would just point to cas/auth?service=evil.example.com.
 
Right.
They specify a service URL on their own domain. The ticket comes in on the querystring, and the server nabs it, validates it, and then does nefarious things with the information.
 
@phyzome So it'd be the same if I send you that link by email (I'd use a shortening service to "hide" it).
 
Yeah.
 
@phyzome Yup, this will definitely expose the username. Hmmm.. interesting
 
8:36 PM
Alternatively, the page the service URL leads to has JS that nabs the ticket from its own document.location, asks the server via AJAX to validate the ticket (can't be done from JS-land), and then says "Hello, alice@cas.example.net!"
There's a similar attack in OAuth, but with actually-dire consequences.
The reason I was going on about frames is that that allows the attack to be 1) invisible, and 2) iterated over a list of possible CAS servers.
 
@phyzome Yup, I've just tested it on my little server using the bare link (no frames), but I think it'd work just the same with a frame.
 
You can also wreak minor havoc with /logout because the CAS spec says it needs to respond to GET, but that's true of most sites on the internet. :-P
 
@phyzome Now I must head home. I'll ping you tomorrow to let you know what I think. Also, now that the conversation is here, others can see it and contribute.
 
9:01 PM
6
A: Why is blog spam always written so badly?

Eric LippertThe spammers are automatically generating new comments by taking existing comments and running them through a thesaurus program that replaces words with synonyms or related parts of speech. The result is a sentence which makes sense, but has word choices that no native speaker would ever make: ...

where does this guy get all of his sockpuppets from?
I honestly liked @Adnan's comment a lot more than this answer... "oh look I've got some unformatted hypertext, it must be how all of the spam bots work" :))
 
@AJHenderson How is anti-spam NOT security?
 
9:21 PM
It feels good to be home.
 
OK that's getting ridiculous - the guy got 10 upvotes in 40 minutes for a half-baked answer, and at the same time nothing much else changed in the thread ... except I believe @Gilles upvoted two comments there under the question and maybe the question itself.
 
@TildalWave Don't you understand what's happening? Spam bots upvoted him.
 
@Simon we call it sockpuppeting, but yeah the question is only now on the SuperCollider high enough for me to think OK so most people upvote top rated question and they're done with how much they'd like to understand things discussed... I'm not upset because of lack of votes on my or @AJHenderson's post mind you, but his answer simply doesn't answer the question that's the most worrying thing about it
 
@TildalWave that guy is an SO demigod, he has no end of people who'll upvote anything by him
it's like having an answer from Jeff Atwood
and at least he isn't as wrong as Jeff
 
It's like having a comment from Jon Skeet
 
9:31 PM
@Gilles well ... up his bottom then, he's another Jeff Atwood trolling on Sec.SE then
 
@TildalWave only one
 
@Gilles I suspect my "borderline on-topic" comment?
 
@TildalWave yes
 
@TildalWave I see, I wasn't aware of that term.
 
though I disagree with borderline
 
9:33 PM
@Gilles makes sense... so what happened in those 40 minutes is @Adnan got 1 upvote on his comment and the guy got 10 upvotes on his answer
not counting me and you
 
Do people really follow high rep people to upvote them? Also, he's a C#/VB dude, he probably doesn't know anything about security, mouhahaha.
 
@Gilles yup I get that too :) I guess I was under influence of the VTC on the question and engaged my diplomatic mode :)
@Simon No... he doesn't even know much about programming, please check my comment under his post (the second half)
what the bleep would be challenging about reverse "engineering" a bleeping SCRIPT???
 
@TildalWave I think I'd disagree that he doesn't know much about programming, given that he writes languages, compilers, and static analyzers for a living. ;-) (I've followed his blog for a number of years.)
 
@Simon I'm a computer scientist (programming language theory and formal methods) turned embedded programmer, what do I know about security or unix?
 
@Xander OK, maybe... tho I wouldn't like to comment how much I've benefited from his work, might be overly personally opinionated of me ;) Still, that what he said is a major burp and I wouldn't let him touch my WAF rules, let alone write code for it
 
9:40 PM
@Gilles Je faisais une blague sur le monde de Microsoft qui est loin d'être sécuritaire, tout simplement.
I shouldn't speak another language in here, right? Oops.
 
if you start speaking French then soon we'll be getting Finnish and Hebrew and whatnot
there are people at MS who understand security
 
Hence why I just posted that.
 
they are even involved in product design nowadays
I'm amazed that nobody's fully rooted the Surface yet
and even the first jailbreak took months
 
I guess the demand isn't as big as Android/iOS
@TildalWave he reached 13 upvotes now. It must be quite easy to get rep on any section when you're popular on SO.
 
@TildalWave Awwwh! I missed the rep-train!
@Simon Mitä??!
@Simon ماذا؟
@Simon Что?
 
9:51 PM
@Adnan Please, please, please add some answer there. And all others should too. I don't care if you repeat already made points, didn't bother the top answerer at all.
 
@Adnan Si senior.
 
@TildalWave No, I'm not gonna. If I add answer, it'll feed the rep-train even more.
 
@Adnan oh shoot I forgot about the SuperCollider ratings
 
@TildalWave If you had the highest upvoted answer, I'd happily feed the train for you.
But I don't care for that guy
 
@Adnan Hän oli yksinkertaisesti pilailla Microsoft-ympäristössä on kaukana turvallinen
 
9:54 PM
@Simon You realize that you've just made an overly apologetic reply in French? Isn't that slightly redundant? :))
 
@TildalWave that French sentence isn't apologetic
Rekel je samo šalil o okolju Microsoft pa daleč od varnih
 
@Gilles hahahaha well your Slovenian is even worse than my French :P
 
@Gilles Well, here's something interesting about Finnish. "Hän" means both he and she. You just have to watch a Finnish person speaking a newly-learned English. Pricesless!
 
@TildalWave Yeah, it was more or less apologetic. But still, I get what you're saying, pfft. :)
 
@Simon it's just a joke ... and a cliché one at that ;)
 
10:00 PM
@Tildal What the hell is wrong with that question?! It's not suitable for Sec.SE and the the current top answer is borderline shitty
 
@TildalWave I know, I can always attempt to defend myself by saying I was born in Canada, which makes me Canadian (what a revelation, right?). However, people then proceed to laugh at our army :(
 
@Adnan I think it's OK here, because it describes spam filter avoidance techniques (or other things that I thought I've helped cover to what @AJ already said anyway)... but yes, the top answer didn't bring absolutely nothing new to the table, merely reiterated one of previous points (@AJ's that had 3 upvotes at the time)
@Simon You have an army? Who's in it? Michael Moore? :))) :P
oh shit he's American, honestly didn't know that... ok, how about .... hmmm ... who's Canadian that isn't enrolled to DMZ already?
(teasing, don't answer :P)
 
@TildalWave Big bear and little bear?
 
@Gilles enrolled in DMZ ;)
 
@TildalWave Yeah they have an army.
 
10:09 PM
LOL, here we go. I find those pics so damn funny.
 
@Xander OT... how about I say you're right in the comment to that 1 upvote answer and we agree to delete both our comments? I think I was too upset and started seeing things that aren't there, your "marketing" comment actually explains it perfectly
 
@Simon I couldn't help it. :-D
@TildalWave Works for me! :-)
 
This is my favorite one, oh lord.
 
@Simon Yeah, that's awesome. Some of the best ones are for the Navy though.
@Simon And for the "not making fun of Canada but still funny" genre this is my favorite.
 
@Xander Boom, headshot :D
My reply to this would be that's because we're nice to everyone, we even apologize when someone else bumps into us! hehe
 
10:19 PM
Ok, time for me to go since it's appears it's better than 50/50 that my power is about to go out.
See y'all later.
 
See ya!
 
10:38 PM
I think you could've made both your points already in the answer and avoid me picking your brains, but one point still seems to be avoiding you: none of the sample spam messages OP posted actually endorse any products, or are otherwise promoting any other cause. And we can see such baffling messages all over the Internet in blogs, forums, you name it. Now, why do you think this is so, and again - how does your answer actually answer the question? You're partially explaining the strange grammar used, but didn't touch the purpose of such spam messages, not in the slightest bit. — TildalWave 12 secs ago
 
@TildalWave Great reply.
 
@Simon yeah well... it's a sloppy answer, I simply hate it being upvoted so much, because I know what that means - it means most programmers rather hear reasoning supporting their already existing code, than write new code supporting reason better. Which is a shame and we'll be seeing more spam, and there won't be anything they can do about it (while I'm spam free for years and my code obviously sucks LOL).
 
@TildalWave Nobody likes to revise their code, unfortunately.
 
10:56 PM
@Simon Dunno, I'd disagree. It's probably true for some developer groups, but certainly not for the open source community (which e.g. MS obviously isn't)
 
@TildalWave You have a valid point.
@TildalWave What time is it for you right now?
 
@Simon 1 am
 
@TildalWave So it is true, you are nocturnal, hehehe
 
@Simon yup... and btw, the spam saga continues.... he edited his answer to now try and change the point of the question and explaining it's an old trick in the comments. I had to reply, of course :)
From the question: "I ask because when I first saw it, I thought perhaps they were being genuine but inarticulate." Now, do you honestly think OP would omit such obviously important detail? Please, you're now editing your answer to make of the question what it isn't. There's no talk of links anywhere in the question, and we see such posts all over the Internet, and a lot of them don't have any links anywhere. I would accept an addendum explaining it might be some sort of probing, confirmation of bypassing registration checks, CAPTCHAs, e.t.c., but this is becoming slightly silly now. — TildalWave 1 min ago
 
@TildalWave At least it seems that he's not getting upvoted constantly now.
 
11:15 PM
@Simon prolly run out of sockpuppets... have you seen his comment on the question? He's so full of himself I wouldn't put it past him he created multiple accounts to upvote himself even. I mean, why would anyone follow him to a website he's never posted before, and 10 of them in under 40 minutes? The question wasn't on the SuperCollider yet then for anyone to easily notice it. And we all know what direction fish stinks from, don't we?
 
@TildalWave Do you really think he'd do a such thing? If so, he's really sad..
 
@Gilles while annoying, spam isn't really a threat directly as long as it is handled. It certainly makes less overhead for administration if you can fight it, but it isn't a compromise of a system or a breach
I think anti-spam falls more under system administration than security
 
11:42 PM
Sup everybody :D
 
01:00 - 20:0020:00 - 00:00

« first day (910 days earlier)      last day (2824 days later) »