Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
PBS
Sep 21, 2015

Chunjee posted:

:geno:: I found this username/password combo in plaintext logs
:downs:: Ok what do you want fixed?
:geno:: please remove that field or censor it. We don't allow usernames/passwords in logs
:downs:: but the Database team stores passwords in plaintext, I think
:geno:: seems unlikely, but please fix these logs
:downs:: I think the old legacy system stores them in plaintext too
:rant:: fascinating, can you mask these logs now?
boss: mask the logs
:downs:: ok

How do you troubleshoot user issues or audit actions without storing the usernames?

Adbot
ADBOT LOVES YOU

PBS
Sep 21, 2015

Ghostlight posted:

I think the issue is more with the password part.

Yeah, fair point but why say "we don't allow usernames/passwords in logs" instead of just "we don't allow passwords in logs"?

Sounds like a perfect opportunity for malicious compliance. "What? You want to know who accessed XYZ? Sorry, I don't have any record of who did that. Three months ago you asked me to remove usernames from the logs."

PBS
Sep 21, 2015

Arquinsiel posted:

While I instantly assumed that "usernames/passwords" means that there's a direct mapping in the logs I can see why that'd confuse someone who doesn't already understand the shorthand.

"usernames/passwords" is shorthand for passwords? One of us doesn't understand what shorthand means. (And I'm hoping it's not me)

PBS
Sep 21, 2015
Maybe I'm just missing something.

Is there a benefit to saying usernames/passwords, when just referring to passwords? Or does username/password denote a specific situation?

PBS
Sep 21, 2015

my cat is norris posted:

A plain text document containing only usernames isn't necessarily a huge security risk. It would provide a starting point for someone with malicious intent, perhaps especially so if those usernames are email addresses, but it's a forgivable offense if no other details are present.

Having usernames AND their corresponding passwords stored in plain text is a giant problem. You're basically handing someone the keys to the kingdom, at that point.

The post in question tells us that both usernames and passwords were stored in that plain text format, hence "usernames/passwords" -- a common enough shorthand. Maybe you've not run into that before? No need to feel dumb about it, anyway.

No, I haven't. I can't imagine a situation in which it'd be acceptable to log passwords, even if there's no obvious corresponding user id.

I can see user names both ways I guess, they have a lot of utility though IMO.

What would be the proper way to handle user attribution without logging user name? A separate unique id?

PBS fucked around with this message at 03:33 on Aug 16, 2018

PBS
Sep 21, 2015

Malek posted:

Served tomorrow...



Ha, hopefully they don't take that too seriously.

PBS
Sep 21, 2015
Our VDI infrastructure sucks, which is doubly bad because they just refreshed it.

It was fine for a little while, now it takes like a minute just to load a skype meeting.

PBS
Sep 21, 2015

Daylen Drazzi posted:

No one better open my pod...

He's starting to realize it's all a simulation, shut it down and make him more miserable in the new one!

PBS
Sep 21, 2015

chin up everything sucks posted:

I am so sorry that you live and work in Ohio. Especially in Dayton.

His job sounds cool at least.

I don't do much outside of work, a nice job alone would be fine with me.

PBS
Sep 21, 2015

Antioch posted:

One of the best parts of my new job is being able to fix things like this. SQL server running low on space? Prop it up with an extra 100gb, that's what the SAN is for.

Previous job that was a Change Request, which went to committee once a week, then went to a decision board, then a plan would be submitted, budget drawn and approved, cost centre negotiated, outage window planned (yes even for non outage changes *just in case*), then finally a change could be implemented. Followed by a post mortem, change control completion form, and a follow-up email from the change board manager.

When I left my old job, I had an open change for a certificate renewal. I had opened the change 3 months before expiry. When I left it was a week past expiry and hadn't hit budget yet.

I thought our change process was bad but it's not even close to that.

What industry?

PBS
Sep 21, 2015

GnarlyCharlie4u posted:

I hate phones. I hosed up and one day told like 20 users to come in to see me for help entering their new passwords on their phones so they could access their email. Not that I hadn't instructed them how to do it before; I even made a nice 30 second phone-friendly video and word doc and sent it to everyone to show them how but for whatever reason these people were too inept / lazy to do it themselves. Some have had tickets open for as long as 8-10 weeks.
Anywho, I had free cycles one day that week because I was just working on contract stuff so I knew I'd be glued to my desk.
Almost everyone came in and had their AD passwords reset (surprise they never use computers apparently) and entered on their phone's email client.

Cue 60 days later when I receive 20 voicemails from the same people saying they're coming in to have me 'fix their phone'.

FML what have I done??? :gonk:

Ha, that sucks. You can at least make it a little better by varying the day their passwords expire on.

PBS
Sep 21, 2015

suuma posted:

I just wonder who's going to take all the calls I normally do, now..

Lots of "well I don't know exactly what the role would look like yet" but :yotj:, maybe?

Probably you.

PBS
Sep 21, 2015

ChubbyThePhat posted:

The part that is confusing me is he thought up the monstrous solution that will cost money and time and break in 3 seconds, then proceeds to mention DHCP snooping which sounds like what he wanted all along?????

Trying to push them to do snooping?

"You can do this monstrous thing, or we could just do the simpler thing I previously asked for"

PBS
Sep 21, 2015

Arquinsiel posted:

Owned my first database today. Feels good.

What'd you do, drop all the tables?

PBS
Sep 21, 2015
My company first took away the ability to roll over, then a few years later implemented unlimited time off.

PBS
Sep 21, 2015

Karatela posted:

If it helps, I am dumber, as I still don't get it.

I'm probably ruining the joke or may be missing it myself, but DNS is usually port 53. So it's a mashup of route 66 and the standard dns port.

PBS
Sep 21, 2015

Jaded Burnout posted:

High speed train is £70 return, plus ~£5 tube, ~£8 train station parking, ~£2 fuel & maintenance, and an ~£8 central-London lunch. So that's, what, 90+?

They don't have a commuter's pass?

PBS
Sep 21, 2015

myron cope posted:

It's from an internal CA yeah. I do have the chain installed which is even weirder to me that it complains. It says "the website sent scrambled credentials that Google Chrome cannot process". This is one of the errors where they don't let you continue anyway, I just can't get to it.

Also, it's Footprints 12. It does seem really bad, but from the way people here talk about ticket systems they're all pretty much bad?

For security errors that chrome won't let you bypass normally, you can type thisisunsafe and it'll bypass. Don't ask why I need to know this.

Chrome changes the keyword from time to time, so if you're using it and it stops working one day you can just google for the new one.

PBS
Sep 21, 2015

Thanatosian posted:

I feel like HR is universally pretty terrible. Like, the place I work at now has the best HR I've ever worked with, and I would describe it as "meets expectations."

Yeah ours is pretty bad too. Our internal recruiters are so bad it's depressing to work with them.

PBS
Sep 21, 2015

nexxai posted:

You're starting to sound suspiciously like a user...

That's the great thing about working at a large company, everyone is a user to someone.

PBS
Sep 21, 2015

LethalGeek posted:

The only way to secure the network is to keep the users off it, they can't be trusted.

This is a fairly common attitude in the industry and it doesn't help anyone.

PBS
Sep 21, 2015

Gerdalti posted:

I don't know why, but wrapping the GPG calls in a function fixed it.
For those interested in this lovely lovely project:

code:
Your code

I have a few critiques on the code that may help you out.

code:
# File Browser Dialog
Add-Type -AssemblyName System.Windows.Forms
$FileBrowser = New-Object System.Windows.Forms.OpenFileDialog -Property @{ InitialDirectory = [Environment]::GetFolderPath('Desktop') }
$null = $FileBrowser.ShowDialog()
All fine.

code:
# Create output file name, and remove existing file with that name
$filename,$ext1 = $FileBrowser.FileName.split('.')
$hashfile = $filename+'.hash'
This assumes there's only one period in the filename, not a big deal really but could be a little confusing at some point.

code:
Remove-Item -Path $hashfile
I really shy away from deleting user's files without the user specifically and knowingly initiating that action. Not a huge deal but could potentially bite you.
You're going to get an error if there's not already a .hash file with that name present, this can be handled with a simple test.

code:
foreach($line in [System.IO.File]::ReadLines($FileBrowser.FileName))
{
       $line=$line.ToUpper()
       $hasher = New-Object -TypeName "System.Security.Cryptography.SHA256CryptoServiceProvider"
       $encoding = [System.Text.Encoding]::UTF8
       $hash = ($hasher.ComputeHash($encoding.GetBytes($line)) | % {
            "{0:X2}" -f $_
        }) -join ""
       echo $hash | Out-File -FilePath $hashfile -Append
}
I see a few improvement opportunities here, one of which is very significant.

First, there's no point in declaring $hasher and $encoding more than once. This will incur a performance penalty (though a fairly minor one), cut those and stick them above the for-loop.
Second, overall $hash is fine, but it is a little hard to read and a bit slow.
Third, you don't need to echo $hash to append it. You can pipe it directly.
Lastly, every single run of the for-loop you're having to open your file to append the hash. This will totally cripple your script from a performance perspective.

There are a few easy ways to handle that last point and the best method really depends on your environment and the files you're working with. You could add a test inside the loop to dump once an array reaches a certain size (I'd use this method if the files are larger than 10k/20k lines). If the lists are shorter you can just write it all to an array and dump it to a file at the very end.

Here are some of the things I mentioned implemented,

code:
<#
    Powershell to hash email strings to SHA256
    This Will accept any file as input 
    *** format must be single email address per line ***
    Email addresses are converted to uppercase before hashing
#>

# File Browser Dialog
Add-Type -AssemblyName System.Windows.Forms
$FileBrowser = New-Object System.Windows.Forms.OpenFileDialog -Property @{ InitialDirectory = [Environment]::GetFolderPath('Desktop') }
$null = $FileBrowser.ShowDialog()
# Create output file name, and remove existing file with that name
$filename,$ext1 = $FileBrowser.FileName.split('.')
$hashfile = $filename+'.hash'

if (Test-Path -Path $hashfile) {
    Remove-Item -Path $hashfile
}

$hashList = New-Object System.Collections.Generic.List[System.String]
$hasher = [System.Security.Cryptography.HashAlgorithm]::Create('sha256')
$encoding = [System.Text.Encoding]::UTF8
$count = 0

#Hash each line, and add to hashList array
foreach($line in [System.IO.File]::ReadLines($FileBrowser.FileName))
{
       $line=$line.ToUpper()
       $hash = ($hasher.ComputeHash($encoding.GetBytes($line)))
       $hashString = [System.BitConverter]::ToString($hash).Replace('-','')
       $hashList.Add($hashString)
}


$hashList | Out-File -FilePath $hashfile -Append

####
#Cut out the GPG stuff, no comments there
###
With a list of 10000 email addresses it went from 3+ minutes to process down to less than 4 0.5 seconds just by implementing these changes.

This task would also be a good candidate for parallelization if you're looking at significantly larger lists.

PBS fucked around with this message at 17:28 on Apr 27, 2019

PBS
Sep 21, 2015

Gerdalti posted:

That's some great advice. I'm not very good with power shell, so I'll look at implementing those Monday morning.

I couldn't get a definitive answer on how large the files will be, but experience has me thinking 500000 to 1500000 rows isn't out of the question.

Thanks!

Made a few more edits. It'll now process 1.5m rows in ~80 seconds on my machine.

Also, can be done fairly simply (and significantly more quickly) via python.

Python 3.6
code:
from tkinter.filedialog import askopenfilename
import time
import hashlib
import os.path

filename = askopenfilename()
starttime = time.time()

split_filename = filename.split('.')
hash_filename = split_filename[0] + '.hash'

if os.path.isfile(hash_filename):
    os.remove(hash_filename)

with open(filename, 'r', encoding='utf-8') as email_list:

    with open(hash_filename, 'w', encoding='utf-8') as hash_list:

        for line in email_list:
            line = line.strip().upper().encode('utf-8')
            hash = hashlib.sha256(line).hexdigest()
            hash_list.write(hash + '\n')

endtime = time.time()
totaltime = endtime - starttime
print(f'Total Time: {totaltime} Seconds')


Total Time: 6.09424614906311 Seconds
Lines: 1,500,000

PBS fucked around with this message at 18:19 on Apr 27, 2019

PBS
Sep 21, 2015

Proteus Jones posted:

Yeah, Python is pretty much tailor made for this kind of stuff. But since they’re talking Powershell, I’m guessing Windows so they may not have/not be able to install Python.

Yeah, that's why I did the best I could in powershell first.

If you can get python on any machine of the same OS type you can also compile a python script into an executable, making it more portable.

PBS
Sep 21, 2015

Thanks Ants posted:

At first I was “huh, you go to prison for domain squatting?” but then carried on reading and it was just :aaa:

Amazing that anyone could be that stupid. Of course they could trace it back to him, the guy that had been harassing him for the name.

PBS
Sep 21, 2015

Thanks Ants posted:

“Here just transfer the domain into this account in my name with all my other domains”

Even if he hadn't when he eventually setup a service at that domain it'd likely have been traceable back to him too.

There's a lot of layers of stupid there.

PBS
Sep 21, 2015

Agrikk posted:

Sounds like a pretty major change

Wonder how that got though CAB.

PBS
Sep 21, 2015

xsf421 posted:

We were told by some devs last week that "logging didn't make it" into their newest prod build (that was throwing 500 errors to 20% of all traffic to their site).


I'm friends with the poor NOC dude they promoted to be the docker platform bitch, I keep sending him pictures of dumpster fires over teams and asking him how his platform is doing.

Doordash?

PBS
Sep 21, 2015

D. Ebdrup posted:

These mentions of Quick Assist has me thinking of Intels QuickAssist, the HBA and on-chip accellerators for compression, encryption, and hashing at up to 100Gbps, and I got very confused.

Do you work on their sales or marketing team?

PBS
Sep 21, 2015

GreenNight posted:

Can you send chat messages via PowerShell too? Then I can script my responses.

Probably, you can do it for Skype/Lync by loading some assemblies and creating a com object.

PBS
Sep 21, 2015
The place I worked at was like that too. Eventually the queue would just fill up with the old tickets that no one wanted to touch due to the risk of a bad review because the person'd waited so long.

Eventually it'd get so bad me and the only other coworker that cared would try to close out as many as possible.

I found out after I left that the way I was closing tickets cause a survey to never be fired off. I'd always wondered why I got so little feedback, but it was almost always good when I did get some so I guess it worked out.

PBS
Sep 21, 2015

Mustache Ride posted:

We had some piece of Intel cross our desk and our threat Intel guy shoved it into ThreatConnect to strip all the IOCs out. Some douchnozzle put "cmd.exe" launched as part of an execution indicator in the report, and my lovely script pulled it down from TC and added it to the Bit9 block list automatically.

Most of the 25k employees around the world took the day off that day.

We had something similar happen, included servers too.

PBS
Sep 21, 2015

AlexDeGruven posted:

A senior VP posted:

We don't need to right-size because we're thin-provisioning

Our CEO said this once, but it sounded better then.

PBS
Sep 21, 2015

potato of destiny posted:

apparently a couple of people did changes 'without adequately communicating the impact to our end users' so guess what everyone gets to spend the next three loving weeks doing

One three week long CAB meeting?

PBS
Sep 21, 2015

ConfusedUs posted:

Ditto. Teams is miles better than Skype for Business, which was our previous iteration.

Teams isn't perfect (my biggest gripe is how it has to load chat history when you scroll up), but it's certainly sufficient for my day to day use. The best thing I can say about it is that it rarely gets in the way, other than the chat history thing. It does what it needs to do when I need it to do it.

Apparently our Mac users hate it though. I guess the Mac client is far more troublesome.

All the mac stuff for microsoft's office suite sucks. The outlook client has significantly less functionality than the windows client. SfB is janky in general, randomly locks up, and will sometimes consume all ram and swap space on my mac when I join large meetings.

PBS
Sep 21, 2015

Spring Heeled Jack posted:

An security alert came in letting us know of a user email sign-in from a suspicious IP (we're on the east coast, the IP was from the west coast). We've reviewing everything and check with the user and it turns out someone fibbed about a sick day and took a little extended vacation. Normally we wouldn't give a poo poo but it triggered a security event in our system so now we have to write it up and explain what happened.

Why wouldn't that be a simple "confirmed it was user"?

PBS
Sep 21, 2015

Spring Heeled Jack posted:

Because we have an incident reporting system that subsequently gets reviewed in manager meetings by my boss' boss to make it sound important.

That sounds hosed up

PBS
Sep 21, 2015

D. Ebdrup posted:

Someone needs to invent etherjacking for wifi, so that IoT devices can be subjected to it.

Microwave?

PBS
Sep 21, 2015

Shut up Meg posted:

Ah GPG: simple software to perform a simple task that is impossible to explain the concept of, with controls and setup/configuration that no one can use.

Symantec's PGP offering has integrated fairly well with outlook/exchange in our org, the end user doesn't even have to think about it as long as they're on windows. If they're not on windows it sucks to be them. (By them I mean me)

Adbot
ADBOT LOVES YOU

PBS
Sep 21, 2015

kensei posted:

My boss gave his notice on the 30th. They called and offered me his job on the 31st.

:yotj:

I may be in a similar situation soon, except I don't really want his job and I'm not sure I even want to stay if he leaves.

  • 1
  • 2
  • 3
  • 4
  • 5