Dex posted:

his application isn't involved in this part of the chain, it's all rsa securid and their client software. i'd suggest reading their docs if you're curious about the how and why of it

sarehu posted:

So the Apple thing is basically that on the iPhone 5C they're getting ordered to provide a signed firmware that'll let unlimited passcode attempts (or just reveal the password, or whatever). And this is something which would be technically impossible on later models. Right?

MrMoo posted:

There is a pretty awful Cisco appliance that has a SSL portal that works like this.

quote:

Google and Red Hat have linked up to deliver a patch for a serious bug in the GNU C Library, or glibc, which is widely used in Linux applications, distributions and devices.

Anyone running a Linux server is likely to need to install the jointly-developed patch that fixes a critical flaw in the getaddrinfo function in glibc.

The vulnerability had until recently gone unnoticed but was actually introduced in version 2.9 of the open-source library, which was released in May 2008.

Google has detailed that the bug is a stack buffer overflow flaw in the function, which can be remotely exploited by causing a machine to run a DNS lookup and delivering a response in the form of UDP or TCP packets that exceed 2,048 bytes.

Google engineers said any software using getaddrinfo, "May be exploited with attacker-controlled domain names, attacker-controlled DNS servers, or through a man-in-the-middle attack".

Like previous open-source bugs, this one also affects a wide range of Linux distributions, software and devices.

"Pretty much any Linux system uses glibc, and getaddrinfo is typically used to resolve IP addresses. Which means Linux servers as well as workstations, are vulnerable unless it runs an old version of glibc (pre 2.9)," noted Johannes Ullrich, CTO of the SANS Internet Storm Center.

Ullrich initially believed Android devices are probably also affected by the bug. However, security researcher Kenn White has since pointed out Google opted for the glibc alternative Bionic C software for Android.

White also said there is a possibility that CentOS, Oracle, and Amazon Linux may be vulnerable to the glibc vulnerability.

Although Google engineers discovered the flaw independently, when they began assessing it they discovered the issue had been previously reported to glibc's maintainers and that engineers at Red Hat were also investigating the issue.

The two companies collaborated on the development and testing of the patch that was released on Tuesday.

Red Hat has confirmed that affected products include multiple versions of RHEL server, workstation and desktop products.

Google has developed exploit code for the flaw but is not making that software publicly available. However, it has published a proof of concept that can be used to test if systems are vulnerable.

"When code crashes unexpectedly, it can be a sign of something much more significant than it appears; ignore crashes at your peril," Google's engineers said.

They also noted that while remote code execution is possible, it would still require bypassing exploit mitigations such as address-space layout randomization.

John McAfee posted:

I will, for free, decrypt the information on the San Bernardino iPhone with my team. We will primarily use social engineering and it will take us three weeks. If you accept my offer, then you will not need to ask Apple to place a backdoor in their product, which will be the beginning of the end of America.

If you doubt my credentials, Google "Cybersecurity legend" and see whose name is the only name that appears in the first ten out of over a quarter of a million results.

TheQat posted:

http://www.ibtimes.co.uk/john-mcafee-i-can-hack-san-bernardino-iphone-fbi-apple-backdoor-like-giving-our-enemies-1544651

TheQat posted:

http://www.ibtimes.co.uk/john-mcafee-i-can-hack-san-bernardino-iphone-fbi-apple-backdoor-like-giving-our-enemies-1544651

TheQat posted:

http://www.ibtimes.co.uk/john-mcafee-i-can-hack-san-bernardino-iphone-fbi-apple-backdoor-like-giving-our-enemies-1544651

deep impact on vhs posted:

can confirm that it's awful, we have one in place where i work now.

i hate it.

EVIR Gibson posted:

I found a Cisco device where, without any creds on the login page, could run commands on the server, as root, through the password field.

I use it for a demonstration (while not mentioning the product or model) of why you sanitization is a thing when dealing with user input.

Same box also allowed me to change a password without knowing the previous password by making sure the pass auth response was changed a "false" to "true" (easy to do with Burp Suite) to submit back to the server.

In summary, it is like saying I give the guy that checks my previous password garbage and he tells me to gently caress off. I step to the next guy in the process who asks me what the previous guy said about me and I tell him the other guy just loved me.

"Everything checks out, your password is changed."

ming-the-mazdaless posted:

A year ago, I did a Proof of Concept for insider threat detection in a hospital group.
By creating a user behaviour index, I was able to identify a few misuse events, that pointed to a potential auth issue.

After playing around a bit, I found the following:
billing system
patient management for ICU, Pre/post natal, Surgical and Ward
Dispensary
Practitioner management

I was able to add myself as a medical practitioner, prescribe medication, assign patients to my roster, order a transfer and ultimately kidnap children from their hospitals by co-opting their ambulance service.

None of the above had any form of authentication in place.
All of the above are hosted in a lovely server farm in a consumer isp.


As of yesterday, nothing had been done to resolve this clusterfuck. What is everyone's opinion on the matter? Full public disclosure?

ming-the-mazdaless posted:

A year ago, I did a Proof of Concept for insider threat detection in a hospital group.
By creating a user behaviour index, I was able to identify a few misuse events, that pointed to a potential auth issue.

After playing around a bit, I found the following:
billing system
patient management for ICU, Pre/post natal, Surgical and Ward
Dispensary
Practitioner management

I was able to add myself as a medical practitioner, prescribe medication, assign patients to my roster, order a transfer and ultimately kidnap children from their hospitals by co-opting their ambulance service.

None of the above had any form of authentication in place.
All of the above are hosted in a lovely server farm in a consumer isp.


As of yesterday, nothing had been done to resolve this clusterfuck. What is everyone's opinion on the matter? Full public disclosure?

ming-the-mazdaless posted:

A year ago, I did a Proof of Concept for insider threat detection in a hospital group.
By creating a user behaviour index, I was able to identify a few misuse events, that pointed to a potential auth issue.

After playing around a bit, I found the following:
billing system
patient management for ICU, Pre/post natal, Surgical and Ward
Dispensary
Practitioner management

I was able to add myself as a medical practitioner, prescribe medication, assign patients to my roster, order a transfer and ultimately kidnap children from their hospitals by co-opting their ambulance service.

None of the above had any form of authentication in place.
All of the above are hosted in a lovely server farm in a consumer isp.


As of yesterday, nothing had been done to resolve this clusterfuck. What is everyone's opinion on the matter? Full public disclosure?

Loving Africa Chaps posted:

As a doctor i'd be super interested in seeing that though. Hospital IT is insanely bad. At my hospital no one can connect to the staff wifi so all the consultants connect their laptops to the open guest wifi to send emails about patients to one another.

OSI bean dip posted:

Talk to a lawyer; health care is one of those things that could get you sued to all hell. Are you American? Did you do this as an individual or are you working for a firm that was hired to do the PoC? Do you have any NDAs with them?

As much as health care organizations need reform, full public disclosure may work very much against your favour.

Sharktopus posted:

do you think that patient safety will be increased more by you politely asking the hospital to spend resources, or by forcing them to fix these very real problems?

EVIR Gibson posted:

So here's a random tool I always use when scoping out a target; Bing.

Stop laughing.

But really, Bing has a feature no other search engine out there has including Google. It gives the user the ability to search for domains by IP.

Why is this useful? It gives possible ways to get into the target domain via another vulnerable domain.

So the sequence of events that have to happen is

1) The target site is fully patched
2) The target site is on a shared-host with a site (it could be a firewall rule giving the sites the same IP remember), let's call it the side-target, that is not fully patched (Wordpress, Drupal are super good targets)
3) The side-target installation has a path traversal issue or the ability to run remote commands via the site
4) If there is no virtualization or weak very sandboxing.
5) Compromising the side-target can allow for access to the host all the sites are served on including your target


Bing lets you get a bit of Shodan functionality for free.

Type the following to Bing search for where SA is hosted at.

code:

ip:104.25.246.12

Now admire how many gambling site and dentists sites are hosted on the same IP as Senor Lowtax

Rufus Ping posted:

That's cloudflare you idiot

Rufus Ping posted:

That's cloudflare you idiot

EVIR Gibson posted:

private github account on the same ip

If you do not understand this, sorry!

Dex posted:

you clearly know what shodan is, so why not just use it?

Subjunctive posted:

I do not understand this.

Rufus Ping posted:

I think he's suggesting someone might have an exposed e.g. GitLab installation running on their production servers and if it were vulnerable in some way then an attacker could pivot once inside

AxillaHallux posted:

Dex posted:

i encrypt my end, and you encrypt your end, back and forth forever

))<>((

Subjunctive posted:

https://letsencrypt.org/