Security Fuckup Megathread - v11.4 - who u gonna snitch to pussy bitch fuck u

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v11.4 - who u gonna snitch to pussy bitch fuck u

«‹›26 »

Shame Boy: Mar 2, 2010

spankmeister posted:

So the French network TV5Monde got hacked by IS, 11 channels down.

http://edition.cnn.com/2015/04/09/europe/french-tv-network-attack-recovery/index.html

I wonder how exactly because IS hasn't really been that sophisticated up until this point.

They're actually fairly sophisticated from what I understand, and when they're not genocidin' people they're actively trying to keep the infrastructure of the lands they claimed up and running because their entire persona revolves around them being the one true "legitimate" state where all the Muslims have to go by law and life will be fun and happy and great (if you're not one of the people they kill). The reason why we haven't really seen them attacking the west much at all is more to do with their goals - they're not Al Qaeda, they're not trying to attack the "far" enemies. Their main goal right now is to claim land to make themselves more legitimate, and wait for America to come try to kick their asses, at which point they believe it's prophesied that they will win and that particular battle will start down the countdown clock to the apocalypse.

The Atlantic did a pretty great write-up on the whole thing here.

# ¿ Apr 9, 2015 17:51

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 09:32

Shame Boy: Mar 2, 2010

Munkeymon posted:

hahahaha he has a .computer domain

hopefully someday http://nadim.dipshit will work

hmmm... is funy.computer worth $40...

# ¿ Apr 9, 2015 17:55

Shame Boy: Mar 2, 2010

Nintendo Kid posted:

From CSI: Cyber S1E5 �Crowd Sourced�. Supposedly, this is the source code of a web site that interfaces with a bomb� and more specifically, a �dead man�s switch� that immediately detonates the bomb if any of the code is modified.

i'm the "checkif" operator

# ¿ Apr 10, 2015 13:49

Shame Boy: Mar 2, 2010

also i'm the random syntax highlighting that makes no goddamn sense

# ¿ Apr 10, 2015 13:49

Shame Boy: Mar 2, 2010

Carbon dioxide posted:

So, Facebook felt it was necessary to "correct" some Belgian security report which showed that Facebook sucks.

https://newsroom.fb.com/news/h/setting-the-record-straight-on-a-belgian-academic-report/

It's quite funny, really, lots of weaseling.
Misleadingly?
Ah. It was not their intention that the 'bug' would be found. They're fixing it so the 'bug' can't be found by outside researchers any more.
Additionally, they say nothing about tracking non-Facebook users using other methods, without cookies. Such as IP-based tracking, which certainly happens.
Fact: they'll randomly opt you back in without telling you whenever they update their systems.

This Richard Allan figure would make a very good politician.

if you define "tracking" to be "following an animal through the woods using instinct and careful observation of the environment around you" then no Facebook doesn't do any tracking :smug:

# ¿ Apr 10, 2015 13:53

Shame Boy: Mar 2, 2010

Wheany posted:

it's probably a screenshot of an editor with syntax highlighting for .sh files, but since the syntax makes no sense, neither does the highlighting

idk half of it seems like it's trying to syntax highlight sh/bash but a bunch of it seems like they added it after the fact to emphasize the "bomb" parts, and other parts just make no sense at all.

# ¿ Apr 10, 2015 16:57

Shame Boy: Mar 2, 2010

FCKGW posted:

http://www.fbi.gov/birmingham/press-releases/2015/ua-student-charged-with-unauthorized-access-to-university-computer

40 replies out of 60 emails is an amazing response for a phishing email.

tbf it sounds like a well-tailored phishing email rather than the sent-to-millions "hi i am from facebawk ur account has been hacked!!!! plz click here and answer some questions!" ones

# ¿ Apr 10, 2015 17:55

Shame Boy: Mar 2, 2010

Carbon dioxide posted:

Back in my high school, it was fine to play browser games or do whatever on the library computers, as long as there weren't any kids waiting to use the computers for actual school work. They usually didn't even mind if you hacked it somewhat, because that allowed the IT guy to see where he could improve the system security.

I got detention once, for subverting their block on chat protocols. I think I managed to log in to MSN Messenger or somesuch. I got detention because chatting from the school computers was absolutely banned. They said the reason was that online communities are full of rapists and the school didn't want any possibility of being held responsible if someone meets their future rapist online.

my school had a bizarre rule that chatting was banned but remote desktop / vnc was grey area don't ask don't tell sorta stuff so they'd kick you off if you tried to go to like, meebo, but if you remoted into your home computer and chatted that way it was fine.

# ¿ Apr 10, 2015 18:14

Shame Boy: Mar 2, 2010

atomicthumbs posted:

Bedlam DL3

see also: this recent berkeley event

quote:

You know what? They were right - the company�s email system did NOT deal with this gracefully.

Why? Well, you've got to know a bit more about how Exchange works internally.

nah "it's exchange" is pretty much enough of an answer.

# ¿ Apr 11, 2015 12:18

Shame Boy: Mar 2, 2010

~Coxy posted:

"compose a new email" is only naughty when you do it in palemoon

because for some reason "open in new window" links make the spawned process appear as firefox.exe

which is blocked by name

at my company we had a barracuda content filter on everything which was mandated by one of our clients, not our choice. i say "had" because the CEO got annoyed with it blocking his "sites" and had IT completely bypass it so now it's just sitting there powered on to keep up appearances but it literally has no ethernet cables goin' to it at all.

# ¿ Apr 13, 2015 15:41

Shame Boy: Mar 2, 2010

Let's say that, hypothetically, my work network has been running an open, unrestricted SOCKS4 proxy exposed to the greater internet (and also our private network, so theoretically you could proxy into the private network if you knew the IP you were going to) for like a year now that we just noticed and fixed. Approximately how hosed do you think we should consider everything? Is this one of those "set fire to the office and start again down the street"-level things?

# ¿ Apr 14, 2015 21:09

Shame Boy: Mar 2, 2010

Truga posted:

If someone abused it, you'd probably know after a year. Chances are people found it, laughed at it and posted about it on an internet forum, then went on with their lives.

You should set your network security guy on fire, though.

I can't set fire to him, he's been here way longer than I have and is best buds with the CEO. This is the same company that was running Tomcat 5 with the default password on ALL of the production servers for eight loving years before someone (me!) found it and freaked out. There were like 20+ servlets on each server that had been installed by bots and basically functioned as "allow executing whatever as root" services.

Yes I'm looking for a new job.

# ¿ Apr 14, 2015 21:41

Shame Boy: Mar 2, 2010

Shaggar posted:

tomcat doesn't have a default password for specifically that reason so they must have set up a password probably using the default example pw from apache.org which is probably like tomcat/tomcat.

well it was "admin/admin" so if it wasn't the default it certainly wasn't set up right in any case.

ultramiraculous posted:

cheese-cube,

seriously this whole thing sounds like a complete poo poo show. you have prod servers running unknown code and a proxy into your network.

burn all of it down before you're found to be in possession of child snuff porn and running a tor node for isis.

the prod servers running unknown code were nuked and replaced with entirely new poo poo without transferring a single thing between the old and new stuff just to be sure. the proxy into our network is fun and new though.

# ¿ Apr 14, 2015 22:04

Shame Boy: Mar 2, 2010

herp derp can't edit

# ¿ Apr 14, 2015 22:04

Shame Boy: Mar 2, 2010

computer toucher posted:

Does this actually work?

i just tried it and it didn't work, and we're poo poo about updating our servers. Microsoft might have force-updated it though.

EDIT: I got this:

code:

$ nc [redacted] 80
GET / HTTP/1.1
Host: [redacted] 
Range: bytes=18-18446744073709551615


HTTP/1.1 416 Requested Range Not Satisfiable
Content-Type: text/html
Last-Modified: Wed, 15 Apr 2015 13:34:07 GMT
Accept-Ranges: bytes
ETag: "9cc6e4d88077d01:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 13:41:54 GMT
Content-Length: 362
Content-Range: bytes */0

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Requested Range Not Satisfiable</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Requested Range Not Satisfiable</h2>
<hr><p>HTTP Error 416. The requested range is not satisfiable.</p>
</BODY></HTML>

Shame Boy fucked around with this message at 14:43 on Apr 15, 2015

# ¿ Apr 15, 2015 14:37

Shame Boy: Mar 2, 2010

anthonypants posted:

why does it have to be telnet and not like, netcat or wget or something

because they're a windows user and they don't have any actually useful programs on windows

# ¿ Apr 15, 2015 14:43

Shame Boy: Mar 2, 2010

anthonypants posted:

according to this tweet if you do this
code:
curl -v -H "Range: bytes=234234-28768768" "http://host/a.png" -o a.png
and it returns HTTP 416 = vuln, and HTTP 20X = not

does a.png actually have to exist? because I'm getting 404.

EDIT: tried it with a file I knew to exist and it returned 416 woo

# ¿ Apr 15, 2015 14:59

Shame Boy: Mar 2, 2010

anthonypants posted:

it looks like you got a 416 on the telnet one too

yeah but that was before i realized 416 was what we were looking for. security guy is patching it right now anyway, but it's the same security guy that allowed

graph posted:

r o f l

so we'll see...

# ¿ Apr 15, 2015 15:30

Shame Boy: Mar 2, 2010

Mido posted:

my car has the option of being 100% keyless

i used it as such and it was cool

eventually the battery died

i replaced it

died like a week later

took key out of fob and stopped caring and use my keys like a normal person and things are just fine

my car just has a START button rather than a hole for keys, the only way to start it if the fob battery dies is to rub the fob against the START button for a few seconds while it does some powerless RFID poo poo.

# ¿ Apr 17, 2015 02:56

Shame Boy: Mar 2, 2010

Mido posted:

i don't live in the future until I have to say the product of the day out loud to authenticate

"McDonalds McGriddle" * car beeps *

wasn't that legit something Sony patented, like you have to stand up and go "I LOVE EATING AT ARBYS" to play your videogame or whatever?

# ¿ Apr 17, 2015 06:16

Shame Boy: Mar 2, 2010

Billiton sounds like the name of a snooty butler

# ¿ Apr 17, 2015 15:13

Shame Boy: Mar 2, 2010

Chris Knight posted:

dev tittys

# ¿ Apr 17, 2015 18:00

Shame Boy: Mar 2, 2010

re: keyfob chat, i wear faggy gay girljeans sometimes that are so tight that removing my keys from my pocket is a legitimate challenge and my car not requiring me to do so is awesome.

check your cargo pants privilege :colbert:

# ¿ Apr 20, 2015 17:28

Shame Boy: Mar 2, 2010

Shaggar posted:

just touch the door handle and it will automatically unlock if the fobs in ur pocket.

yes that's the feature I'm saying is awesome. i thought the whole problem is that people could use POWER AMPLIFIERS (tm) to make it so you can touch the door while the keys are still in your house.

# ¿ Apr 20, 2015 17:43

Shame Boy: Mar 2, 2010

Bonfire Lit posted:

I'd hope that the car would do challenge-response instead of just accepting any old replay, especially since it's the one initiating the conversation unlike the old push-button fobs

from what I understand the car just has this counter in it and the keyfob has a counter and as long as the counters produce something within +- 200 counts of each other it's fine with it.

# ¿ Apr 20, 2015 18:16

Shame Boy: Mar 2, 2010

spankmeister posted:

hai guise how do i intercepted ssl?

asking for a friend

nice av/post combo

# ¿ Apr 21, 2015 16:45

Shame Boy: Mar 2, 2010

Optimus_Rhyme posted:

We guarantee our attribution is accurate as we paid for the more expensive MaxMinds GeoIP database

i lol'd irl

# ¿ Apr 22, 2015 14:24

Shame Boy: Mar 2, 2010

Jabor posted:

there was also one case where the mitm proxy wasn't actually validating certs itself, so when it was installed anyone could pull off a dumb-as-rocks self-signed mitm attack against you. but yeah, not using per-client keys is the most common fuckup.

e: also, there's no reason for the proxy to actually trust certificates generated with the proxy key. there's no use case in which real servers would be presenting one of those certificates to the proxy.

it was validating certs actually, but when a cert showed as invalid it would just rename the name to "<site>-invalid.com" or something like that. That's fine for the common name, but it completely ignored SAN's, so you could just make a SAN of "*.google.com" or whatever and it wouldn't touch it and your browser would just go "lol k looks legit to me"

# ¿ Apr 22, 2015 15:00

Shame Boy: Mar 2, 2010

Daman posted:

https://www.youtube.com/watch?v=lgEI4Ldo1i4

# ¿ Apr 23, 2015 01:26

Shame Boy: Mar 2, 2010

Aleksei Vasiliev posted:

Criminals won't pause before popping and unlocking.

*groan*

# ¿ Apr 23, 2015 15:45

Shame Boy: Mar 2, 2010

Perplx posted:

https://vimeo.com/10281433

it's been like 5+ years since that came out and every time it's posted i still have to watch the whole thing and giggle like an idiot the whole time.

# ¿ Apr 24, 2015 04:59

Shame Boy: Mar 2, 2010

https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html

quote:

The source code contains a logical flaw related to user PIN (aka PW1) verification that allows an attacker with local host privileges and/or physical proximity (NFC) to perform security operations without knowledge of the user�s PIN code.

...

The flaw is mitigated by the fact that an attacker would typically require some abilities that would enable the attack even without the logical flaw.

In particular, any attacker with access to the local host must be assumed to be able to learn the user�s PIN code, simply by intercepting communication with the OpenPGP card hardware or through key logging.

dammit yubikey you're the only hsm-y/smartcard thing I can afford do a better job

# ¿ Apr 24, 2015 18:44

Shame Boy: Mar 2, 2010

Rufus Ping posted:

openpgp card + usb smartcard reader is �35 http://shop.kernelconcepts.de/

(you can use it with ssh-agent to store ssh keys too)

doesn't seem to do NFC the way the yubikey does. they have ones with MiFARE but it just seems to be a separate chip stapled on. gotta have NFC for my poo poo phone for reasons.

# ¿ Apr 24, 2015 23:14

Shame Boy: Mar 2, 2010

Munkeymon posted:

why'd they station it so low? less radiation hazard for the occupants?

That (it's under the magnetic field and also beneath the Van Allen belts), plus less lifting like SIGSEGV said, plus if it's in the thin-but-still-there part of the atmosphere space junk only sticks around for like, a few months before re-entry compared to hundreds of thousands of years.

# ¿ May 1, 2015 17:59

Shame Boy: Mar 2, 2010

idk about that weird linux router thing but I heard that Netflix had some kind of breakthrough with their setup and that's why they're switching: http://arstechnica.com/security/2015/04/16/it-wasnt-easy-but-netflix-will-soon-use-https-to-secure-video-streams/

also I met Weev waaay back in like 2005 and can confirm he's a genuinely awful person.

# ¿ May 6, 2015 05:39

Shame Boy: Mar 2, 2010

Twenty-Seven posted:

all messaging programs are the worst

lync client is, indeed, loving garbo. for some reason a few different silos teams in my company are using slack or hipchat, and those are both surprisingly lovely too for how hyped they are. slack is probably the least offensive of these but i'd heard so much hype about it i thought it was going to shoot rainbows into my eyeballs.

skype is a nonstop abomination. google hangouts is pretty bad i wish they'd make an actual native client for it with fuckin tabs which they never will because they're trying so hard to make chromeos a thing still for some reason so it has to run as a gimpy chrome extension

even imessage sucks, it's constantly loving up group chats if someone goes abroad and plugs a sim card with a different phone number into their phone everything shits the bed.

in conclusion im mad

i unironically use Pidgin for everything (except IRC) because my friends are spread out across like 8 different protocols and gently caress if I'm gonna run the entire massive abortion that is the Steam client all the time just to chat to my bros.

not IRC though cuz it sucks at IRC noticably more than it sucks in general, idk why

# ¿ May 8, 2015 04:20

Shame Boy: Mar 2, 2010

Snapchat A Titty posted:

probably more likely than not

humanity is a pox on the world

We're the only species to figure out how to completely eliminate horrible diseases like smallpox, outright leave the planet and grace a literal other world thanks to our own ingenuity and determination, and also to decide that that poo poo was boring and expensive so let's just invest our money in murder robots and dragon dildos instead.

# ¿ May 9, 2015 02:51

Shame Boy: Mar 2, 2010

JumpinJackFlash posted:

lol if you think that guy is going to jail.

he's going to retire to a luxurious dacha outside of Moscow.

I mean he was already the super-rich son of an oligarch he probably stole this billion just for shits and giggles.

# ¿ May 9, 2015 05:38

Shame Boy: Mar 2, 2010

Daman posted:

weev is managing to troll this thread without having an account. drat

hi security buds did you hear about the jellyfish windows GPU rootkit that isn't a loving rootkit?

https://github.com/x0r1/WIN_JELLY

it's trending on reddit so I'm sure there's going to be a bunch of articles about how amazing this ROOTKIT is

what it actually does: shows you can use cuda to store data temporarily across reboots in GPU mem.

what it doesn't: have a way to prevent that memory from being overwritten, actually execute anything from that memory without a nongpu component, do things a rootkit does

oh yeah like that rootkit where you'd freeze ram with freon and put it in another computer and root around in it looking for keys.

root.

# ¿ May 10, 2015 11:05

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 09:32

Shame Boy: Mar 2, 2010

OSI bean dip posted:

https://www.unitedstatescourts.org/federal/cand/284981/1-0.html

lenovo is facing a lawsuit

of course, what will happen is that you'll end up with a $25 credit towards some poo poo security product in the end

Please accept a free year of Kroll identity monitoring at NO CHARGE!!!

# ¿ May 11, 2015 18:05

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v11.4 - who u gonna snitch to pussy bitch fuck u

«‹›26 »