Cocoa Crispies posted:

traditional banks can’t make a person-to-person payment system safe and I’m saying that as someone who bought a shmoocon ticket in a dark alley in Berlin

quote:

Hoover's security question to her friend was: "Who is my favourite Beatle?" The fraudster would have had a one in four chance of getting it right — John, Paul, George or Ringo. In a test of RBC's Interac system, Go Public was given four chances to answer the security question correctly. 

Ur Getting Fatter posted:

Some hot key swapping going on in that dark alley

Cisco Router Bug Has Massive Global Implications posted:

Now, researchers are disclosing a remote attack that would potentially allow a hacker to take over any 1001-X router, and compromise all the data and commands that flow through it.

And it only gets worse from there.

To compromise the routers, researchers from the security firm Red Balloon exploited two vulnerabilities. The first is a bug in Cisco’s IOS operating system—not to be confused with Apple's iOS—which would allow a hacker to remotely obtain root access to the devices. This is a bad vulnerability, but not unusual, especially for routers. It can also be fixed relatively easily through a software patch.

The second vulnerability, though, is much more sinister. Once the researchers gain root access, they can bypass the router's most fundamental security protection. Known as the Trust Anchor, this Cisco security feature has been implemented in almost all of the company’s enterprise devices since 2013. The fact that the researchers have demonstrated a way to bypass it in one device indicates that it may be possible, with device-specific modifications, to defeat the Trust Anchor on hundreds of millions of Cisco units around the world. That includes everything from enterprise routers to network switches to firewalls.

D. Ebdrup posted:

So far as I can tell, this also means that firmware runtime attestation is completely impossible, so you cannot know if the firmware that's on the system messes with any future firmware, unless you JTAG the system and push the firmware to it in a way that the firmware runtime cannot know about.

And the best part is, that basically no vendor has a solution for this particular problem if they ever get hit by it - the closest work is described in my last post in the video titled Securing Bare Metal Hardware at Scale, and that was a year ago and I haven't heard much news about it yet.

And since the trust root is apparently in the FGPA, we're truly hosed.

quote:

They discovered that when Cisco’s secure boot detected a breach of trust in a system, it would wait 100 seconds—a pause programmed by Cisco engineers, perhaps to buy enough time to deploy a repair update in case of a malfunction—and then physically kill the power on the device. The researchers realized that by modifying the part of the bitstream that controlled this kill switch, they could override it. The device would then boot normally, even though secure boot accurately detected a breach.

quote:

They also broke two of their routers during the process of physically manipulating and soldering on the boards to look for the reset pin.

flakeloaf posted:

https://www.cbc.ca/news/business/rbc-customer-out-of-pocket-after-e-transfer-fraud-1.5128114




a good part of my job is spent standing at the front of teh room telling people not to do basically any of the things in this article

Winkle-Daddy posted:

doesn't sound terrible to fix:


Sounds like this bit of logic just needs to be thought through again...but as they didn't release the specifics yet, it's hard to say ¯\_(ツ)_/¯

e: lmaorf

Jabor posted:

my read of that is that the code that decides what to do when secure boot can't verify the firmware can itself be modified, so all you need to do is modify it to just boot anyway.

Soricidus posted:

lol whatsapp owned by a goddamn buffer overflow like its 1999 again

redleader posted:

yeah but c and c++ are real good, see

CVE-2019-11815 posted:

The Linux Kernel is prone to a race-condition vulnerability.

An attacker can exploit this issue to cause denial of service and execute arbitrary code.

Linux kernel versions prior to 5.0.8 are vulnerable.

Plank Walker posted:

favorite beatle is secure as hell, just pick ringo

Wiggly Wayne DDS posted:

been a while since the last pre-auth rdp rce

The Electronaut posted:

Looks like the Lenovo leaked CVEs have been released.

flakeloaf posted:

BES

Wiggly Wayne DDS posted:

been a while since the last pre-auth rdp rce

quote:

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.

infernal machines posted:

Number19 posted:

CVSS3 Base 9.8 score, pre-authentication, wormable attack against RDP:


https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

lol

Number19 posted:

CVSS3 Base 9.8 score, pre-authentication, wormable attack against RDP:


https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

lol

quote:

Enable Network Level Authentication (NLA) on systems running supported editions of Windows 7, Windows Server 2008, and Windows Server 2008 R2
You can enable Network Level Authentication to block unauthenticated attackers from exploiting this vulnerability. With NLA turned on, an attacker would first need to authenticate to Remote Desktop Services using a valid account on the target system before the attacker could exploit the vulnerability.

Shaggar posted:

NLA is enabled on 7, 2008, and 2008 r2 by default isn't it?

BangersInMyKnickers posted:

yeah but it will also accept legacy RDP. I think you need to screw with GPOs to make it not accept them

Number19 posted:

you do have to force NLA-only mode via gpo/registry. i have that set but patched it anyways because why not

haveblue posted:

what are the odds that you don't type in the name of your favorite beatle but pick it from a dropdown

Lain Iwakura posted:

https://twitter.com/business/status/1128294423585071104?s=20

bloomberg is a reputable publication that should report on security more often because it does a good job at that

quote:

It works on all operating systems, including Apple’s iOS, Google’s Android, and Microsoft’s rarely used mobile version of Windows.