Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Rufus Ping
Dec 27, 2006





I'm a Friend of Rodney Nano


So how about that computer security eh,

join us on irc: irc.synirc.net #yossec
join us on reddit: https://reddit.com/r/netsec/

previous threads:
Security Fuckup Megathread - v17.1a - motherfuckers act like they forgot about jre (dec 2018-apr 2019)
Security Fuckup Megathread - v16.2 - /home/land/security/theatre (may-dec 2018)
Security Fuckup Megathread - v15.1 - Stop!!! I Kill You Researcher (jan-apr 2018)
Security Fuckup Megathread - v14.1 - Hello, is this a delivery order? (jun 2017-jan 2018)
Security Fuckup Megathread - v13.69 - plugins may violate privacy (jan-jun 2017)
Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door (apr 2016-jan 2017)
Security Fuckup Megathread - v11.4 - who u gonna snitch to pussy bitch gently caress u (apr 2015-apr 2016)
Security Fuckup Megathread - v10.1 (Hackers can turn your gas station into a bomb) (nov 2014-apr 2015)
Security Fuckup Megathread - v7.69 (stay safe security ghost) (aug-nov 2014)
Security Fuckup Megathread - v7.2 "BoringSFM" (jun-aug 2014)

these ones need archives:
Security Fuckup Megathread - v1.0.1g (apr-may 2014)
Security Fuckup Megathread - v0.9.8 - did this one even exist?
Security Fuckup Megathread - v69 (mar-apr 2014)
Security Fuckup Megathread - v1.2 (feb-mar 2014)
Security Fuckup Megathread - v1.1 - cant find this one, post the threadid if you got it
Security Fuckup Megathread - moved to admin forum; explanation here

Rufus Ping fucked around with this message at 02:19 on Sep 19, 2020

Adbot
ADBOT LOVES YOU

Volmarias
Dec 31, 2002

I'm sure I'll think of something.

I sure do like how they can manipulate the stack to their advantage

graph
Nov 22, 2006

aaag peanuts



these threads are gonna remain closed until shits sorted

graph
Nov 22, 2006

aaag peanuts



Celexi
Nov 25, 2006

tehehe



IS zone alarm still good?

Carbon dioxide
Oct 9, 2012



Celexi posted:

IS zone alarm still good?

zonealarm has never been good

Edit: Say, mods, now the shitstorm is over, could you edit a link to this thread in the last post of the old thread? Thanks.

Workaday Wizard
Oct 23, 2009

by Pragmatica


three weeks after moving to my new cybersecurity position and i still have no tasks and no privileges. i don't mind the money but i finished catching up with my shows and i'm bored of sitting at work doing nothing. i have a frosted glass door otherwise i would've brought my switch and did some gaming on company dime lol.

Workaday Wizard
Oct 23, 2009

by Pragmatica


any of you worked in non-operations infosec? i.e. dealing with risk analysis and policies and poo poo like that? how do you stay engaged?

geonetix
Mar 6, 2011




I do. It's just run of the mill grc work like you see everywhere, where everyone you speak to still assumes you're configuring firewalls and don't understand why loss of availability would be a risk worth addressing from a security perspective.

It's drat hard, nigh impossible to stay engaged.

geonetix
Mar 6, 2011




Oh and it never really gets any busier than what you're currently doing, for most commercial companies it really is basically a check-the-box-position.

Workaday Wizard
Oct 23, 2009

by Pragmatica


i guess i better start some side-projects then...

FungiCap
Jul 23, 2007

woof woof.


Shinku ABOOKEN posted:

any of you worked in non-operations infosec? i.e. dealing with risk analysis and policies and poo poo like that? how do you stay engaged?

I couldn't. Eventually, being surrounded by people who don't actually know how computers work but dictate policy for them starts to eat at your brain and you have to move on.

Blinkz0rz
May 27, 2001

MY CONTEMPT FOR MY OWN EMPLOYEES IS ONLY MATCHED BY MY LOVE FOR TOM BRADY'S SWEATY MAGA BALLS


Shinku ABOOKEN posted:

any of you worked in non-operations infosec? i.e. dealing with risk analysis and policies and poo poo like that? how do you stay engaged?

we have a team dedicated to it and it's telling that their hiring pool is "warm bodies that can use word and excel"

otoh i do security engineering which is a very different beast but also comes with similar engagement issues around picking and choosing meaningful work in a company where a lot of the security systems are already quite mature

geonetix
Mar 6, 2011




itís an incredibly tedious type of work and I wouldnít recommend it. it does involve talking to people that should work the policies and continuously wondering why they donít so itís not just office365 work, but it is a well paying joke of a job regardless

Rooney McNibnug
Sep 2, 2008

"Life always hopes. When a definite object cannot be outlined, the indomitable spirit of hope still impels the living mass to move toward something--something that shall somehow be better."


thank you, based mods

champagne posting
Apr 5, 2006

YOU ARE A BRAIN
IN A BUNKER


FungiCap posted:

I couldn't. Eventually, being surrounded by people who don't actually know how computers work but dictate policy for them starts to eat at your brain and you have to move on.

i ended up welcoming the brain worms.

I also argue as much as possible with my idiot coworkers who barely understand networked computers or virtual machines.

no your network connection wonít make the server install software faster thatís not how this works Turkish guy

no virtual machines are fine old Unix lady it doesnít matter whether the servers are real or virtual the brain worms are badly in your head

CmdrRiker
Apr 8, 2016

You dismally untalented little creep!

"Schadenboner" posted:

Is 9.9.9.9 good?

"The Fool" posted:

It's fine as long as you don't mind your dns being run by law enforcement.

I don't understand. Quad9 is too stringent with filtering?

SIGSEGV
Nov 4, 2010


telegram is the one run by cryptocurrency poop touchers and that has the "custom" hand rolled encryption, right? anyone cracked that one yet out of national actors yet?

url
Apr 23, 2007

internet gnuru


Rufus Ping posted:


Security Fuckup Megathread - moved to admin forum, must have done something really epic, dont remember what

I think reverse engineering a bot-net that installed a RAT from some infected p2p file, and then took screencaps of users who had it installed.
I 'think' that might have been the threshold for locking the thread - couldn't say for sure.

Rufus Ping
Dec 27, 2006





I'm a Friend of Rodney Nano


That was a diff thread and is goldmined

Volmarias
Dec 31, 2002

I'm sure I'll think of something.

Something something Nazis something mods

The Fool
Oct 16, 2003



CmdrRiker posted:

I don't understand. Quad9 is too stringent with filtering?

No, I mean literally founded by law enforcement.

One of the founding members of Quad9 is Global Cyber Alliance, two of the founding members of that organization are the City of London Police and the New York District Attorney.

To be honest, I like that organizations like that are behind a service that has the stated purpose of reducing cybercrime for everyone, it shows they are trying to be more proactive. But those two don't exactly have great track records for measured use of surveillance tools.

The Fool
Oct 16, 2003



SIGSEGV posted:

telegram is the one run by cryptocurrency poop touchers and that has the "custom" hand rolled encryption, right? anyone cracked that one yet out of national actors yet?

Also run by Russian nationals, so take that for what you will.

CmdrRiker
Apr 8, 2016

You dismally untalented little creep!

The Fool posted:

No, I mean literally founded by law enforcement.

One of the founding members of Quad9 is Global Cyber Alliance, two of the founding members of that organization are the City of London Police and the New York District Attorney.

To be honest, I like that organizations like that are behind a service that has the stated purpose of reducing cybercrime for everyone, it shows they are trying to be more proactive. But those two don't exactly have great track records for measured use of surveillance tools.

I respect your suspicion. At this point it definitely feels like the best option out of what is available. It's a nonprofit that doesn't allow itself (supposedly) to be managed by any entities other than itself, and would have to be held accountable were it to actually profit from user data. By comparison to other options it seems like a good place to start.

Rufus Ping
Dec 27, 2006





I'm a Friend of Rodney Nano


The Fool posted:

No, I mean literally founded by law enforcement.

One of the founding members of Quad9 is Global Cyber Alliance, two of the founding members of that organization are the City of London Police and the New York District Attorney.

To be honest, I like that organizations like that are behind a service that has the stated purpose of reducing cybercrime for everyone, it shows they are trying to be more proactive. But those two don't exactly have great track records for measured use of surveillance tools.

important to note that the city of london police are not the same as the metropolitan police who operate across greater london (although they too are complete bandits in their own right). the city of london police are the ones whose "intellectual property crime unit" strongarm web hosts and domain registries into deleting/handing over sites they claim are involved in IP infringement (primarily the sale of counterfeit luxury goods) without going through the courts. they are blatantly and shamelessly abusing their role, and the ignorance/goodwill/fear of the general public, to do the bidding of rolex, gucci, prada etc without any legal authority or oversight

Proteus Jones
Feb 28, 2013





Millions using 123456 as password, security study finds

quote:

For its first cyber-survey, the NCSC analysed public databases of breached accounts to see which words, phrases and strings people used.

Top of the list was 123456, appearing in more than 23 million passwords. The second-most popular string, 123456789, was not much harder to crack, while others in the top five included "qwerty", "password" and 1111111.

https://www.bbc.com/news/technology-47974583

SuppressdPuberty93
Nov 11, 2013


Uh oh. Looks like someone hosed up. LOL

Satellit3
Oct 21, 2008



Proteus Jones posted:

Millions using 123456 as password, security study finds


https://www.bbc.com/news/technology-47974583

how can they just reveal all my passwords on the news like that????

The Scientist
Nov 6, 2009



Ramrod XTreme

Someone or ones (definitely not Israel) is Doxxing Iranian Nationstate hackers and leaking their hacking tools: https://arstechnica.com/information-technology/2019/04/a-mystery-agent-is-doxing-irans-hackers-and-dumping-their-code/

https://arstechnica.com/information-technology/2019/04/a-mystery-agent-is-doxing-irans-hackers-and-dumping-their-code/

You can even go to the public telegram server and see it in real time ("Lab Dookhtegan") but be warned, they are posting images of dead bodies they claim are victims of the Iranian regime. :nms:

Rooney McNibnug
Sep 2, 2008

"Life always hopes. When a definite object cannot be outlined, the indomitable spirit of hope still impels the living mass to move toward something--something that shall somehow be better."


https://twitter.com/andrew___morris/status/1120297095108485120 interesting

Carbon dioxide
Oct 9, 2012



https://twitter.com/rosa/status/1119736583521853441

abigserve
Sep 13, 2009

this is a better avatar than what I had before



trying to get the bank ranges blacklisted and gently caress with everybodies payroll?

Wiggly Wayne DDS
Sep 11, 2010





abigserve posted:

trying to get the bank ranges blacklisted and gently caress with everybodies payroll?
or identify hosts that only whitelist bank ip ranges

url
Apr 23, 2007

internet gnuru


Rufus Ping posted:

That was a diff thread and is goldmined

my bad, i thought the time-frame was close to then

Stabby McDamage
Dec 11, 2005



Doctor Rope

Wiggly Wayne DDS posted:

or identify hosts that only whitelist bank ip ranges

If they spoof, then wouldn't they never see the replies and therefore not know who whitelists what?

Rufus Ping
Dec 27, 2006





I'm a Friend of Rodney Nano


Stabby McDamage posted:

If they spoof, then wouldn't they never see the replies and therefore not know who whitelists what?

in theory this isnt a dealbreaker (antirez's tcp idle scan) but yea i dont see how it would work here, or anywhere else for the past 20 years

reignofevil
Nov 7, 2008


Sometimes you gotta break the rules.


Proteus Jones posted:

Millions using 123456 as password, security study finds


https://www.bbc.com/news/technology-47974583

Six nine six nine still safe as houses

Winkle-Daddy
Mar 10, 2007


hell yeah, back to working on infosec software after a year and a half at Oracle getting my rear end kicked working on boring non-infosec trash! I missed poo poo posting with you guys.

power botton
Nov 2, 2011



are you even allowed to say you once worked at oracle if you leave

Adbot
ADBOT LOVES YOU

Winkle-Daddy
Mar 10, 2007


probably not tbh

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply