Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
PBS
Sep 21, 2015

Jabor posted:

Validity being too long absolutely affects certs issued before September. The thing happening in September is that the maximum validity period is getting shorter.

According to digicert,

quote:

Any certificates issued before Sept. 1, 2020 will still be valid, regardless of the validity period (up to 825 days). Certificates that are not publicly trusted can still be recognized, up to a maximum validity of 825 days. -- https://www.digicert.com/blog/position-on-1-year-certificates/

And I'm talking about 2 year certs.

Edit: They're actually 3 year certs, which makes the inconsistency even more puzzling. Most people aren't getting the error (talking thousands of employees), but a few do.

PBS fucked around with this message at 18:45 on Aug 3, 2020

Adbot
ADBOT LOVES YOU

Arsenic Lupin
Apr 12, 2012

This particularly rapid💨 unintelligible 😖patter💁 isn't generally heard🧏‍♂️, and if it is🤔, it doesn't matter💁.


evil_bunnY posted:

That's the thing, your monitor isn't a company-wide available asset. Write down your loving password if you must.

I originally read this as "your mother", which tbf is also true. At least of my mother, don't know about yours.

wolrah
May 8, 2006
what?

PBS posted:

According to digicert,


And I'm talking about 2 year certs.

Edit: They're actually 3 year certs, which makes the inconsistency even more puzzling. Most people aren't getting the error (talking thousands of employees), but a few do.
When exactly were they issued versus when they expire?

The limit was 39 months from April 2015 until March 2018, which at least Chrome interprets as the longest possible 39 months including a leap year and two 31 day months for 1188 total days, then it switched to 825 days after that.

This means there's around a 10 month period between the evening of May 3, 2017 and the end of February 2018 where a cert could have been issued at or above 3 years and still be valid. If it's actually 3 years and not maxing out the allowed range that earliest date moves forward to seven months starting August 3, 2017.

Interestingly as a result of the changing maximum validity periods there are two gaps in time for which there are no currently valid certificates. 10 year certificates were grandfathered in if they were issued before the effective date of the CA/B Forum requirements on July 1, 2012. This means any issued between this time on August 4, 2010 and then are still valid, but there's a nearly five year gap after that because all of the 60 month era certs have already expired (the last of them in March 2020) along with three quarters of the 39 month era. The 825 day certs have also started expiring as of June 3 so we have another gap there that's currently two months wide and growing.

edit: If it's a public-facing service you can try feeding it to Qualys' checker, just make sure to check the "do not show results on boards" box if this is something you'd rather not have exposed to the bots of the world https://www.ssllabs.com/ssltest/

whose tuggin
Nov 6, 2009

by Hand Knit
Remember when Dennis Ritchie, Bob Morris (author of Unix crypt utility) and a future stats professor at Berkeley stumbled across an attack against the Hagelin m-209 cipher machines used by the US military, and the NSA approached them and asked them not to publish it?
https://www.bell-labs.com/usr/dmr/www/crypt.html

Remember when it was revealed in 2020 that the entire Hagelin corporation was controlled by the CIA?
https://en.wikipedia.org/wiki/Crypto_AG#Compromised_machines
https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/

The NSA even personally wrote manuals for Hagelin cipher machines

Computer Serf
May 14, 2005
Buglord

trashy owl posted:

If you're looking for Free, you might want to look into Security Onion.

I tried security onion but it takes up 30 gigs of RAM, it seems cool to impress management with. Their "open source" repo just compiles a disk image. Is there any sort of tool that'd make it easy to turn the disk image into a set of install scripts like ansible or just pulling the bins and config files? It would be nice to remove a bunch of the things on there so it runs on a cheaper server.

Looks like Prometheus + Grafana is another popular option but it doesn't do IPS blocking and alerting?

Mainly I'm just looking for something to put on cheap <2GB servers that'll try to block malicious traffic and alert if there's weird activity or if it gets :owned: (file hashes? something like tripwire)

duck monster
Dec 15, 2004

Klyith posted:

If I was on the jury I'd say not guilty to wire fraud, on the grounds that bitcoins have no value.

On the other hand if it was a sex offender trial......

"Objection Your honor! The fact my client owns a bitcoin account does not establish guilt of sexual assault against minors!"

"Your honor, But does it not establish that he might be a libertarian"

"Objection overruled"

But yeah, I half suspect Bitcoin might be the best thing that ever happened to law enforcement. Its like the criminals of the worlds randomly decided that the best way to hide their money was to publish their ledgers in the newspaper, but with the names scrubbed out and replaced with their telephone numbers.

CyberPingu
Sep 15, 2013


If you're not striving to improve, you'll end up going backwards.
https://www.msn.com/en-gb/money/tec...U?ocid=msedgntp

quote:


After the user has inserted the Stealth device into their mouth, it would scan their pre-stored palate biometrics to check that it belongs to them.
Then, in order to unlock particular devices, a "one-time sense code" would be sent to the user – a process that requires internet signal or wifi – and they must perform a certain pre-defined, intentional sensory gesture with the tongue in response to the code, like pressing or sliding.



:wtc:

evilhacker
Feb 27, 2011

Computer Serf posted:

I tried security onion but it takes up 30 gigs of RAM, it seems cool to impress management with. Their "open source" repo just compiles a disk image. Is there any sort of tool that'd make it easy to turn the disk image into a set of install scripts like ansible or just pulling the bins and config files? It would be nice to remove a bunch of the things on there so it runs on a cheaper server.

Looks like Prometheus + Grafana is another popular option but it doesn't do IPS blocking and alerting?

Mainly I'm just looking for something to put on cheap <2GB servers that'll try to block malicious traffic and alert if there's weird activity or if it gets :owned: (file hashes? something like tripwire)

Take a look at Suricata and Zeek for malicious traffic detection and blocking. Your best bet for weird activity detection would be a good auditd config and centralized, off system log collection.

Quaint Quail Quilt
Jun 19, 2006


Ask me about that time I told people mixing bleach and vinegar is okay
There was another infosec thread with tips for a layman, does anyone have that handy? I can't seem to find it, it may have went dead..

It had a good op about using windows defender (only) for AV and turned me onto 1password.

Garrand
Dec 28, 2012

Rhino, you did this to me!

Quaint Quail Quilt posted:

There was another infosec thread with tips for a layman, does anyone have that handy? I can't seem to find it, it may have went dead..

It had a good op about using windows defender (only) for AV and turned me onto 1password.

Your Operating System has Poor Operational Security?

Quaint Quail Quilt
Jun 19, 2006


Ask me about that time I told people mixing bleach and vinegar is okay
Thank you, I had it bookmarked even.
It must not have had any posts lately.

Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...
:wink:


:wmwink:

PBS
Sep 21, 2015

wolrah posted:

When exactly were they issued versus when they expire?

The limit was 39 months from April 2015 until March 2018, which at least Chrome interprets as the longest possible 39 months including a leap year and two 31 day months for 1188 total days, then it switched to 825 days after that.

This means there's around a 10 month period between the evening of May 3, 2017 and the end of February 2018 where a cert could have been issued at or above 3 years and still be valid. If it's actually 3 years and not maxing out the allowed range that earliest date moves forward to seven months starting August 3, 2017.

Interestingly as a result of the changing maximum validity periods there are two gaps in time for which there are no currently valid certificates. 10 year certificates were grandfathered in if they were issued before the effective date of the CA/B Forum requirements on July 1, 2012. This means any issued between this time on August 4, 2010 and then are still valid, but there's a nearly five year gap after that because all of the 60 month era certs have already expired (the last of them in March 2020) along with three quarters of the 39 month era. The 825 day certs have also started expiring as of June 3 so we have another gap there that's currently two months wide and growing.

edit: If it's a public-facing service you can try feeding it to Qualys' checker, just make sure to check the "do not show results on boards" box if this is something you'd rather not have exposed to the bots of the world https://www.ssllabs.com/ssltest/

It was issued on June 1st 2019 and is valid for 1096 days.

wolrah
May 8, 2006
what?

PBS posted:

It was issued on June 1st 2019 and is valid for 1096 days.
If that's a public certificate that shouldn't have even been issued, much less having it work for any remotely modern browsers.

It's not clear to me whether or not private certificates using locally trusted roots are held to the same standards, some reports indicate yes but others say they're more of a free-for-all.

Computer Serf
May 14, 2005
Buglord

evilhacker posted:

Take a look at Suricata and Zeek for malicious traffic detection and blocking. Your best bet for weird activity detection would be a good auditd config and centralized, off system log collection.

thank you evilhacker :yaycloud:

PBS
Sep 21, 2015

wolrah posted:

If that's a public certificate that shouldn't have even been issued, much less having it work for any remotely modern browsers.

It's not clear to me whether or not private certificates using locally trusted roots are held to the same standards, some reports indicate yes but others say they're more of a free-for-all.

Yeah, it's private.

CyberPingu
Sep 15, 2013


If you're not striving to improve, you'll end up going backwards.
https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/

Sickening
Jul 16, 2007

Black summer was the best summer.
https://thehackernews.com/2020/08/teamviewer-password-hacking.html

:laffo: Teamviewer sucks if you haven't figured it out.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
What's a more secure way to access a home computer running Windows 10 from a not-home location?

Sickening
Jul 16, 2007

Black summer was the best summer.

Ynglaur posted:

What's a more secure way to access a home computer running Windows 10 from a not-home location?

Vpn is about it. If you can't vpn, you are just going to have to accept some risk with a 3rd party remote desktop service or open ports.

Subjunctive
Sep 12, 2006

✨sparkle and shine✨

Pop Tailscale on there and your phone or laptop or whatever and you’re off to the races.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Maybe time for me to buy a Pi and learn to install Wireguard on Docker or something.

Internet Explorer
Jun 1, 2005





Ynglaur posted:

What's a more secure way to access a home computer running Windows 10 from a not-home location?

Chrome Remote Desktop seems pretty good.

BlankSystemDaemon
Mar 13, 2009



Internet Explorer posted:

Chrome Remote Desktop seems pretty good.
Chrome really is turning into an OS, isn't it.

beuges
Jul 4, 2005
fluffy bunny butterfly broomstick
What's the thread's opinion of ZeroTier?

Combat Pretzel
Jun 23, 2004

No, seriously... what kurds?!
Zerotier creates a virtual layer 1 network. If you need it, why not. Tailscale is probably the better solution, because it uses Wireguard to create a layer 3 network.

Both use a lot more battery on my phone than plain Wireguard, tho.

I'm currently running a Wireguard endpoint within docker on my Raspberry Pi with Home Assistant.

Powered Descent
Jul 13, 2008

We haven't had that spirit here since 1969.

Sickening posted:

Vpn is about it. If you can't vpn, you are just going to have to accept some risk with a 3rd party remote desktop service or open ports.

Ynglaur posted:

Maybe time for me to buy a Pi and learn to install Wireguard on Docker or something.

A proper VPN is best, but for a simple use case like one person phoning home for an RDP session, an ssh tunnel is plenty secure and (in my opinion) it's a lot easier to set up. Heck, I think you can even run openssh-server directly in WSL, and not even need a separate Linux box to accept the incoming ssh connection.

The Fool
Oct 16, 2003


Wireguard isn't quite enterprise ready as far as I know.

evil_bunnY
Apr 2, 2003

Subjunctive posted:

Pop Tailscale on there and your phone or laptop or whatever and you’re off to the races.

https://rnorth.org/tailscale-docker/ at home and go

Internet Explorer
Jun 1, 2005





D. Ebdrup posted:

Chrome really is turning into an OS, isn't it.

wait until I tell you about Chrome OS

RFC2324
Jun 7, 2012

http 418

Powered Descent posted:

A proper VPN is best, but for a simple use case like one person phoning home for an RDP session, an ssh tunnel is plenty secure and (in my opinion) it's a lot easier to set up. Heck, I think you can even run openssh-server directly in WSL, and not even need a separate Linux box to accept the incoming ssh connection.

Windows has an ssh server built in. I forget how to use it, but its there and has been for a couple years

CommieGIR
Aug 22, 2006

The blue glow is a feature, not a bug


Pillbug

RFC2324 posted:

Windows has an ssh server built in. I forget how to use it, but its there and has been for a couple years

Its under Apps -> Optional Features -> Add A Feature

https://virtualizationreview.com/ar...0the%20service.

CLAM DOWN
Feb 13, 2007




https://twitter.com/caetuscap/status/1293205995083177985

e: lmao https://nypost.com/2020/08/11/john-mcafee-apparently-arrested-for-wearing-thong-instead-of-face-mask/

some kinda jackal
Feb 25, 2003

 
 
Can't be forced to eat your dick if you're in custody

Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...

2020 is really just bringing that "is it real or machine generated" vibe to the news, rising towards a crescendo as the year goes on.

chin up everything sucks
Jan 29, 2012

Volmarias posted:

2020 is really just bringing that "is it real or machine generated" vibe to the news, rising towards a crescendo as the year goes on.

The world is a simulation and we just found the bug that causes a Dwarf Fortress style tantrum spiral. Everything is spinning out of control in hilariously bad ways that shouldn't be possible.

Fame Douglas
Nov 20, 2013

by Fluffdaddy

All this article does is highlight how terrible journalism is these days: Clicking on the tweets, they clearly state that he was denied entry into Germany for not wearing a face mask and then apparently got into a physical fight with the police denying him entry. Which ended with McAfee in German jail.

Darchangel
Feb 12, 2009

Tell him about the blower!


At this point, a kaiju attack would not be surprising.

PuErhTeabag
Sep 2, 2018
My friend is redoing a website for a local business and found this homebuilt "crypto" gem written by a different local web developer in 2007. Luckily it didn't protect anything important, but still.


code:
function submitentry(){
password = document.password1.password2.value.toLowerCase()
username = document.password1.username2.value.toLowerCase()
passcode = 1
usercode = 1
for(i = 0; i < password.length; i++) {
passcode *= password.charCodeAt(i);
}
for(x = 0; x < username.length; x++) {
usercode *= username.charCodeAt(x);
}

if((usercode==censored&&passcode==censored)||(usercode==censored&&passcode==censored))
{
window.location=username+".html"}

else{
alert("password/username combination wrong")}
}

I'm censoring the numbers present just to be paranoid, but they are roughly 3.0e13 for the usernames and passwords (although one of the passwords is only about 1.4e10). Having 6 primes in the 97-122 range (lower case ascii) makes it reallllly easy to figure out most of the letters by factoring, especially when three of those primes are a, e, and m.

Oh, and this was just published in the source of the webpage,.

Adbot
ADBOT LOVES YOU

Cup Runneth Over
Aug 8, 2009

She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate


That's a cool CTF exercise for you to point potential interns towards.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply