The Infosec Thread: Yes, time to move off LastPass

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off LastPass

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

OSI bean dip posted:

Not particularly special in terms of its capabilities, but it has been floating about for a while it appears. Here's some links to look at:

https://www.virustotal.com/en/ip-address/130.0.237.22/information/
https://www.symantec.com/security_response/writeup.jsp?docid=2014-121211-5404-99&tabid=2

I can't share the report directly as it's tied to my work account, but I can share excerpts:

It should be noted that it has probably been picked up in the wild by an AV vendor well before this report came out (as per my previous links) but iSIGHT is the first team to figure out what is going on here.

This is precisely why our credit data does not hit our internal systems at retail locations, it (somewhat) traverses the same network, segmented via VLAN to the router and goes straight out to the credit processor. We USED to handle credit reconciliation, but decided to get out of the extreme PCI hell (and legal liability) and pay a 3rd party to assume the risk. basically you swipe a card on the verifone, it's segmented on say VLAN 3 which nothing else lives on, and that heads from switch to router and off to credit processor, our hands are (mostly) wiped clean of all those shenanigans.

# ¿ Nov 25, 2015 00:46

Adbot: ADBOT LOVES YOU

# ¿ Apr 25, 2024 15:14

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Someone got a little butthurt, thanks for the title infosec, you made my day

# ¿ May 6, 2016 00:24

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

22 Eargesplitten posted:

Can't the government track through TOR pretty easily if they decide it's an act of E-TERRORISM?

I think TOR changed their connection methods/algorithms which I believe was the issue? Eventually the gov't figured it out, whatever the vulnerability was, and could track people given a little bit of time of that person being connected. I could be talking out of my rear end though and perhaps TOR did nothing to resolve the problem and everyone jumped to some new platform.

# ¿ May 18, 2016 00:26

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

evil_bunnY posted:

And they're more likely to suffer repercussions from that than the actual leak.

Honestly, I'm surprised they are even doing something about it.

# ¿ Mar 14, 2018 23:23

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

22 Eargesplitten posted:

What�s a good on-site password manager (preferably capable of storing extra information related to the accounts) that allows multiple log-in accounts? Access logging would be a nice feature too.

My company stores admin account information for servers that contain extremely valuable client data on Sharepoint. I�m not sure whether that is better or worse than it sounds to me, but it doesn�t sound good. That�s potentially millions in fines, even more from legal fees and damages from lawsuits and a destroyed reputation if someone gets on the Sharepoint and takes the credentials.

Granted you need an account that can access the servers hosting the VMs, but still.

My old company used AuthAnvil, I think it's relatively cheap, they also have a 2FA offering.

# ¿ May 14, 2019 17:17

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

The scammers like to impersonate your local prefix, I just stopped answering calls that contain mine, but I've also literally never seen this prefix used anywhere so it hasn't been an issue for me.

# ¿ Oct 16, 2019 18:25

Adbot: ADBOT LOVES YOU

# ¿ Apr 25, 2024 15:14

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

We use zerotier, I do not have to admin it at all, but it seems to work just fine from what I can tell. Our architect evaluated quite a few products prior to implementing which was at least 2 years ago, maybe more and chose it so must not be too bad to deal with.

I just use it so I can connect to a TS without using a VPN; I believe we are still at the free tier level.

# ¿ Jul 24, 2020 22:35

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off LastPass