Tavern on the Meta

user2284570

00:30

Hello, I’ve background in searching vulnerabilities for well known internet companies like Github (you see my profile on bounty.github.com) and Google purchase order № 434622 and № 423269.

Some months ago, I started studying security issues on stack exchange since they launched a bug bounty program on hackerone… In some cases, I approached near completion for reporting to the stack exchange staff recently.

user2284570

00:43

And today, I learned Pickpocketing isn’t limited to pedestrians, and can also happens at high speeds. I learned you can pickpocket someone (someone being myself) while driving a motorcycle if you drive without wearing a motorcycle helmet (I can remember the face of the thief)…

Journeyman Geek

0_0

user202362

user2284570

As result, my tablet was stolen and on it, an unencrypted ꜱᴅ card containing all my mostly ready work on stackexchange security… Which means important data landed on the wrong hands.

user202362

you know what I see? - stockholm symptom

Journeyman Geek

Assuming they know what to do with it.

Also, you do have backups, right?

user2284570

00:49

I am concerned to what can happen to stack exchanges users.

user315433

What's the worst that can happen? A loss of imaginary brownie points.

user315433

And that's pretty far fetched.

user2284570

@Desire unsandboxed ʀᴄᴇ ?

Journeyman Geek

cause a pickpocket's likely to not be technical outside 'wipe the device and resell'

user202362

if you force a baby mammal to be next to you, then you feed and care for it for a period of time, eventually it will display a strong sense of stockholm symptom & becoming your pet

user315433

00:51

Overall, it's all far fetched. Someone hacks SE and turns it into a malware-serving site.

user315433

I'd worry about getting personal stuff erased from that tablet, if you have remote wipe.

user315433

And leave it for other users to worry about their own security.

user2284570

@JourneymanGeek everything is detailed… By the way, he must have seen he was stealing a Samsung galaxy tab while taking it… He must have stolen it for data since Samsung devices like this have their samsung accounts tied to the serial number (you can’t register it under an other account unless the owner remove the device serial number from it device list)

Journeyman Geek

He must have seen someone with a device that was grabbable.

ɥʇǝS

@user2284570 you think he knows that? xD

Journeyman Geek

00:57

I suspect you also overestimate your importance, and the average intelligence of the average snatch thief.

user202362

@user2284570 are you a troll?

user202362

who stores all the sensitive information on a SD card in a tablet?

user202362

secondly, unless you are targeted, thinking about the probability of your tablet stolen by a highend hacker who is also a decent at pickpocketing

user2284570

@Desire : far fetched, just follow the pocs. He must at least knows someone with sufficient knowledge for unlocking the device…

@Telkitty no I’m not web.archive.org/web/20160503035035/https://bounty.github.com bounty.github.com/researchers/ytrezq.html

user202362

that's P(hacker) x P(thief) ... less than 1% probably

user202362

01:01

@user2284570 how does that prove that you are not a troll

Journeyman Geek

@user2284570 also. you do have backups, right?

user2284570

@Telkitty : of course, I wasn’t specifically targeted… I think he just did this in order to see what kind of interesting data on devices he can get by stealing… like banking details…

Journeyman Geek

@user2284570 or to just resell a tablet.

That's a thing

user202362

@user2284570 you don't need to worry about that, your bank probably implements 2 tier authentication for sensitive transactions

Journeyman Geek

and/or change your password

user2284570

01:08

@Telkitty yes, through the Google authenticator android app. I’m locked out for changing my password until bank opening next morning… But that’s unlikely he can bypass Samsung knox in one night in order to unlock… So I think it isn’t a problem…

On the contrary, the ꜱᴅ card just needs to be inserted into a computer…

@JourneymanGeek : unlikely with those devices… As long as I don’t remove the tablet from my Samsung account, it will get located as soon as the tablet gets connected to internet (though Samsung own’s portal)… Even with all the data erased since it’s the serial number which is used… He may be young and beardless, but not that stupid…

Journeyman Geek

20 mins ago, by Journeyman Geek

I suspect you also overestimate your importance, and the average intelligence of the average snatch thief.

See the second half ;p

Or the average fence I suppose

No one's gonna go "OH MY GOD, ITS A SAMSUNG! NO WAY I'M GOING TO BE ABLE TO RESELL THAT! I KNOW, I'LL SELL THE CONVENIENTLY UNENCRYPTED VULNS ON THE SD CARD TO THE RUSSIANS!"

user2284570

@JourneymanGeek : I don’t think this is the first galaxy tab he stole…

Journeyman Geek

@user2284570 Citation Needed

You're thinking like an ivory tower security guy. Think like someone on the streets.

Quite often the most dangerous things are the simplest. Like a UPS plugged into itself.

user2284570

01:23

@JourneymanGeek he needs experience for pickpocketing successfully… Even more for doing this while running without getting an accident…

Journeyman Geek

but he probably dosen't care if its a galazy tab, ipad or chinese self destructive piece of garbage.

user2284570

@JourneymanGeek : it was partially out of my pocket… and that’s the only thing he stole. I had the remark that I wasn’t carefull

user202362

Podcast #118 – What’s a Travel-Hacker, Anyway?

Journeyman Geek

> it was partially out of my pocket

user202362

like a thief hacker who travels to steal SD cards?

Journeyman Geek

01:25

helloooooo target of opportunity.

(also what kinda security guy walks around with a tablet full of unencrypted data? ._.)

user2284570

@JourneymanGeek If I would have encrypted it with my tablet, I wouldn’t be able to use it with my computer and vice versa…

user2284570

01:39

@Telkitty teenager who is currently experienced experienced in robbing things in general and might become a murderer later (which means he can leave his fingerprints)… because the local police lacks money and so prioritize action on murders (and because jail is sometimes the place to start using drugs).

Fingerprint analysis is mostly done in case of serious injuries… not for thieving a Mercedes (unless you’re related to the president liberation.fr/france/2007/01/30/…)… Theive just don’t need to use gloves

user315433

02:10

I think I'll try the life of a weekly commuter in the spring semester... the thought of 100% moving to Long Island is unbearable.

user310756

12 hours old, how amazing is that?

user310756

@Telkitty allo!!

user202362

02:18

@YvetteColomb omg, amazing!

user315433

> you'll stop people in their tracks with your new widened physical make-up

user315433

Yeah, getting around fat people on a sidewalk. :/

Journeyman Geek

03:36

→ 7 messages moved to Chimney

\o/

Catija

@JourneymanGeek Um... can you get rid of mine, too? It looks weird now.

Journeyman Geek

→ 1 message moved to Chimney

@Catija done

Catija

HA HA HA HA HA

Journeyman Geek

→ 5 messages moved to Chimney

I probably shouldn't be throwing those there but shrug

who's looking, right? ;p

Catija

It's smokey related.

redhand

04:58

Magisch

06:10

@JourneymanGeek gz

Journeyman Geek

@Magisch bz?

;p

TheLittleNaruto

Good job @JourneymanGeek

SmokeDetector

06:44

[ SmokeDetector | MS ] Manually reported answer (batch report: post 1 out of 2): Export iTunes music library information (album, artist, track names) to CSV or spreadsheet format? by Angela71 on apple.SE

[ SmokeDetector | MS ] Manually reported answer (batch report: post 2 out of 2): How can I copy a Playlist from one iTunes library to another? by Angela71 on apple.SE

SmokeDetector

06:56

[ SmokeDetector | MS ] Mostly dots in answer: Однажды и т.д. by user187575 on rus.SE

user310756

@Telkitty the pics I promised. It was great to see you today!!! Look forward to seeing you again soon xoxoxox

user310756

user202362

<3 @Yvette

user202362

07:04

💖

user310756

Those I took yesterday - I got there quite late @Telkitty

user202362

nice :)

user310756

@Telkitty I love it!! The two best friends. Did you take any others?

user202362

07:07

better start posting solar panels and power tools before people start thinking we live on farms :p

Journeyman Geek

... you don't?

user310756

LOLOL

user202362

@YvetteColomb I took similar ones, better not spam here

user310756

@JourneymanGeek no I rent that land - agistment. It's 12 minutes from my home. I will show you where my home is

user310756

@Telkitty text them to me!

Journeyman Geek

07:09

ah ;p

user310756

I live on the next ridge over - I drive around on a third perpendicular ridge to get home

TheLittleNaruto

What is this ?

Oh

Those arrows are really helpful to understand

user310756

@TheLittleNaruto Telkitty and I live near each other and catch up regularly. I keep horses close by and we hang out there with my horses and the owners chicken

user310756

We are thinking of getting some chooks together and keeping them at the horses

user310756

07:11

@TheLittleNaruto joking right?

TheLittleNaruto

Woah! That's awesome

user202362

@Yvette & I were talking about start a rescue chicken sanctuary with rescued baby chickens ... (how to make things sound better than it actually is :p)

TheLittleNaruto

@YvetteColomb smart gal

user310756

@TheLittleNaruto would you believe I draft maps for NASA??

TheLittleNaruto

I never rode a horse

user310756

07:12

really??

TheLittleNaruto

@YvetteColomb No I wouldn't. That would be too much for my belief

user310756

I first rode when I was 4 and fell in love instantly. Life long. My old girl Penny smells like the first horse I learnt to ride on

TheLittleNaruto

@YvetteColomb Yes.

@YvetteColomb Is it hard to control 'em ?

user202362

not if you have apples or carrots, no

TheLittleNaruto

It's not like I never got chance, but I always get scared.

user310756

07:14

@TheLittleNaruto not if you're experienced

user310756

I have lost my nerve a lot these days. Most people do as they get older, we don't bounce so well

TheLittleNaruto

You guys are lucky living in a place like that

horses, nature

@YvetteColomb How old are you if I may ask ? ^^

user310756

@TheLittleNaruto we live in the largest city in the country.

user310756

@TheLittleNaruto 50

TheLittleNaruto

@YvetteColomb I see

user310756

07:16

It cost $200 per week just to rent the land alone for the horses. We're lucky there's still some places that have land.

user310756

Hay and feed is also expensive in the city 1.5 - 2 times more than in the country areas.

user202362

the one in the picture is Penny or Cleo? @Yvet

Journeyman Geek

ow

user310756

Cleo

TheLittleNaruto

Well you're a developer.

money doesn't matter

user310756

07:17

@TheLittleNaruto Exactly

user310756

well it does - cos I only work remotely and don't want to work full time :)

Journeyman Geek

@TheLittleNaruto citation needed

user310756

@Telkitty Cleo's hair is like yours, Penny's is like mine

user202362

:D

user310756

LOL

user310756

07:18

One mroe pic

TheLittleNaruto

@JourneymanGeek :)

user310756

Penny with her fly mask

TheLittleNaruto

Here in marriage ceremony, bridegroom needs to ride a horse in order to go to the place where marriage ritual will take place.

@YvetteColomb

rene

!!/coffee

SmokeDetector

07:26

@rene brews coffee for @rene

user202362

yeah you can get married over the internet in a game too

user202362

ride a e-donkey (not e-mule)

user202362

then live happily ever after in a e-mansion, eating e-food - all very technologically advanced

rene

... e-divorce ... sounds awesome

TheLittleNaruto

07:48

Lol

!!/coffee

SmokeDetector

@TheLittleNaruto brews coffee for @TheLittleNaruto

TheLittleNaruto

@rene add tea command too

kicks @redhand out of universe

redhand

one simply can't click me

Journeyman Geek

@redhand clicks on @redhand

Derpy

@TheLittleNaruto you need some "ginseng that really sings" tea bag.

Journeyman Geek

08:05

@Derpy really really sings?

and what ~~does the fox say~~ does the ginseng sing?

Derpy

08:23

@JourneymanGeek seems oddly similar to "Whistle Glouglou"

user310756

@TheLittleNaruto nice romantic

Sinister

@TheLittleNaruto It's there already.

!!/tea

SmokeDetector

@Sinister brews a cup of lemon tea for @Sinister

user310756

!!/vodka

user310756

hahahaha

Sinister

08:32

@YvetteColomb Hands a glass of Vodka for @YvetteColomb

lol

user310756

@Sinister thanks!! :D

user310756

I'm studying so alcamohol is the last thing I can drink O>O

user310756

I can drink cyber alcamohol

user202362

:'(

user310756

lol

user310756

08:40

hm goes to charcoal to talk to the guys about this

Journeyman Geek

;p

rene

@YvetteColomb hand down the bottle. I'm done with the water ...

user310756

08:58

@rene Sure!! :D

user310756

I wish we could all have a big meet up. That would be awesome

TheLittleNaruto

09:19

@Derpy lol

@YvetteColomb XD

@Sinister I see, Thanks

Magisch

09:32

finally done catching up with flagging

tfw 105 pending custom mod flags

Success

hhh... when they killed the color on the review icon... I wish they bring it back, otherwise there's really no indicator of pending review even on smaller sites >_<

oh wait, it should lit even now?

Sinister

@Success I feel the same. There's no indication of pending posts. It's never becoming red on beta sites.

TheLittleNaruto

09:59

@Telkitty gives cake to @Telkitty that she had cooked 7 days back

XD

rene

10:25

> Or it might be a cached value from the future, where the cache defies the linear concept of time.

Journeyman Geek

0_0

user202362