These are the crazy people in your security neighborhood – Part 2 Private Pyle

When you have been around the IT/Security space as long as I have you run into to a lot of whacky people. After a while you begin sorting and classifying them into nice convenient stereotypes. Over the next few weeks I will post my own stereotypes that I have discovered. Hope you get a laugh and figure out where you fit in. The Professional Conclusion is what to do if you are another security professional, the Vendor Conclusion is how you should deal with them if you are trying to sell them something.

Private Pyle started out in some backwater town in eastern Oklahoma before he joined the military to get the heck out of there.

private pyle

Once in the military someone figured out that this dude could add and plug in cables and they put him in the IT group. There he plugged in routers in places like Dubai and Kuwait. If it was in 2016, I’d bet he’d also have plugged in his a 3D printer like Dremel (check Dremel 3d40 review).

One time he saw a Pix firewall and that landed on his resume. He then gets sucked into AFCERT at some point and proceeds to write approximately 9000 proceed and policy manuals. Kicks out of .mil land and finds out that TS clearance he has is worth $$$$$ with all the private .gov contractors out there. Usually then will embed themselves into the belly of a contracting firm and never leave. Every once in a while the smart ones escape and end up in the private sector. Once they do they are generally mellow and easy going. They love building stuff. Got a firewall with extra blinky lights? Sold! IDS with a neural network learning computer? He will take 12! Got services? Unless you are part of the military industrial complex, you have the chips stacked against you.

Professional Conclusion: Typically laid back and mellow. Most are pretty sedate. Think Al Gore but they might actually know what TCP/IP is.

Vendor Conclusion: See above, blinky lights, outrageous promises sold!

Part 3 – The Techno Weenie

Source Mentioned: https://www.3dtechvalley.com

Free Dr. Pepper Overloads Site, Exposes Captcha Key

I love Dr. Pepper. So when then announced they where giving it away for free I was all over it.

Sadly though the site was not up to the task and was continually failing in new and wonderful ways. Everything from Service Unavailable to this piece of code poo:

Start ‘, gmdate(”F j, Y, g:i:s a T”, $start_time), ‘
Now ‘, gmdate(”F j, Y, g:i:s a T”, time()), ‘
End ‘, gmdate(”F j, Y, g:i:s a T”, $end_time), ‘
Time From Start ‘, $g_nTimeToStart, ‘ (H:’,$g_nHoursFromStart,’ M:’,$g_nMinutesFromStart,’ S:’,$g_nSecondsFromStart,’)’, ‘
Time Until End ‘, $g_nTimeToEnd, ‘ (H:’,$g_nHoursToEnd,’ M:’,$g_nMinutesToEnd,’ S:’,$g_nSecondsToEnd,’)’, $g_bSwitch? ‘
SWITCH
‘:’
NO SWITCH
‘; exit(); } require_once(’recaptchalib.php’); include “account/process_user.php”; // Get a key from http://recaptcha.net/api/getkey $publickey = “6Lcp6AMAAAAAACdUl5_X5cbuQLzgWMMRHlb3MbwV”; $privatekey = “6Lcp6AMAAAAAAGR1pjoXN2dLHg9sVIKmBR-XXXX”; ?>

Hey cool a private key (I changed it above)! It looks like to goes to ReCaptcha so I hop on over to the ReCaptcha site to find out how bad this is. I found this;

Signing up for a reCAPTCHA Key

In order to use reCAPTCHA, you need a public/private API key pair. This key pair helps to prevent an attack where somebody hosts a reCAPTCHA on their website, collects answers from their visitors and submits the answers to your site. You can sign up for a key on the reCAPTCHA Administration Portal.

So if you where paying attention you can now crack Dr. Peppers ReCaptcha all day long. This is not the end of the world but I am sure some spammer somewhere is already on in and doing something not good.

This is a great example of the type of things missed when you are only looking one piece of the app. sec. problem.  This could have been prevented with an egress filter of some sort or better load a failure testing in QA. It looks like the folks at Dr Pepper are doing neither.

And I never did get my free Dr. Pepper!!