secfuck v18.51: who needs they entrussy revoked

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.51: who needs they entrussy revoked

«‹›975 »

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

are you a bad enough dude to sudo a command posted in the secfuck thread?

# ? Jun 20, 2019 04:24

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 16:51

Shame Boy: Mar 2, 2010

i went ahead and typed in the ls -lZ manually for the files that actually exist just in case there's some trick that would come over via a copy and paste, here you go:

code:

-rwx------. root root system_u:object_r:dosfs_t:s0     /boot/efi/EFI/centos/grubenv
lrwxrwxrwx. root root system_u:object_r:boot_t:s0      /boot/grub2/grubenv -> ../efi/EFI/centos/grubenv

# ? Jun 20, 2019 04:27

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

thanks!

# ? Jun 20, 2019 04:28

pseudorandom: Jun 16, 2010; Yam Slacker

Hed posted:

If you're gonna go that route, use Algo. I use ExpressVPN for your original purpose because I'm lazy and agreed, just trying to avoid snooping / open wifis

Dunno if the AWS stuff ends up cheaper, but I've used Algo on Azure, and Streisand on Digital Ocean.

Digitial Ocean is just $5 per month, so I see it as a much better option than commercial VPNs if you just want to prevent end-to-end snooping; if you're trying to be anonymous it's obviously a horrible idea.

When I first tried Algo about two years ago, for whatever reason, it didn't work on Digital Ocean. I'd connect, but after a short period of time like 10-30 minutes (I don't remember) I'd lose internet access. I'd still be connected to the server, but could no longer access internet. However, on Azure it worked fine, so I assume it was a DO issue that might be fixed.

Right now, I'm using Streisand because I couldn't get Algo to work on my phone, though there are some people who criticize it as being less secure because it has so many services, or something like that.

# ? Jun 20, 2019 06:23

evil_bunnY: Apr 2, 2003

Shame Boy posted:

i'm running centos, that counts right

code:

ls: cannot access /usr/sbin/grub2-set-bootflag: No such file or directory
ls: cannot access /boot/grub2/grubenv: Permission denied
ls: cannot access /boot/efi/EFI/fedora/grubenv: Permission denied

1/5 trolls

# ? Jun 20, 2019 07:17

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://twitter.com/mjg59/status/1141786872387010561?s=21

# ? Jun 20, 2019 21:16

BlankSystemDaemon: Mar 13, 2009

Lain Iwakura posted:

https://twitter.com/mjg59/status/1141786872387010561?s=21

This is nothing short of absolutely glorious levels of secfuck. It's almost so much glare that it blinds!

# ? Jun 20, 2019 21:55

pseudorandom name: May 6, 2007

there should be a new form of code golf that is just mercilessly publishing zero days

# ? Jun 20, 2019 22:34

spankmeister: Jun 15, 2008

pseudorandom name posted:

there should be a new form of code golf that is just mercilessly publishing zero days

It's known as Tavising

# ? Jun 20, 2019 22:40

pseudorandom name: May 6, 2007

Tavis waits 90 days

# ? Jun 20, 2019 22:40

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

Tavis0

# ? Jun 20, 2019 22:51

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Captain Foo posted:

Tavis0

# ? Jun 20, 2019 22:54

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

firefox owns macs

# ? Jun 20, 2019 23:12

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

there�s no way that�s still my Array.pop JIT path, right?

# ? Jun 20, 2019 23:52

Chris Knight: Jun 5, 2002; me @ ur posts; Fun Shoe

welp
https://twitter.com/citynews/status/1141774801226358785

# ? Jun 20, 2019 23:53

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Subjunctive posted:

there’s no way that’s still my Array.pop JIT path, right?

that's a helluva legacy

# ? Jun 20, 2019 23:54

flakeloaf: Feb 26, 2003; Still better than android clock

Chris Knight posted:

welp
https://twitter.com/citynews/status/1141774801226358785

hpwned

# ? Jun 20, 2019 23:55

BlankSystemDaemon: Mar 13, 2009

https://www.rcesecurity.com/2019/06/about-a-sucuri-rce-and-how-not-to-handle-bug-bounty-reports/ posted:

Sucuri is a self-proclaimed �most recommended website security service among web professionals� offering protection, monitoring and malware removal services. They ran a Bug Bounty program on HackerOne and also blogged about how important security reports are. While their program was still active, I�ve been hacking on them quite a lot which eventually ranked me #1 on their program.

By the end of 2017, I have found and reported an explicitly disabled SSL certificate validation in their server-side scanner, which could be used by an attacker with MiTM capabilities to execute arbitrary code on Sucuri�s customer systems.

The result: Sucuri provided me with an initial bounty of 250 USD for this issue (they added 500 USD later due to a misunderstanding on their side) - out of an announced 5000 USD max bounty, fixed the issue, closed my report as informative and went completely silent to apparently prevent the disclosure of this issue.

Every Sucuri customer who is using the server-side scanner and who installed it on their server before June 2018 should immediately upgrade the server-side scanner to the most recent version which fixes this vulnerability!

# ? Jun 21, 2019 08:58

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Chris Knight posted:

welp
https://twitter.com/citynews/status/1141774801226358785

I wonder when I will get a call from them offering credit checks for a year.

also I completely forgot about Sucuri but seem to recall them being clowns years ago

# ? Jun 21, 2019 11:00

redleader: Aug 18, 2005; Engage according to operational parameters

spankmeister posted:

It's known as Tavising

for it to be a legitimate sportlike activity, more than one person needs to be able to do it

# ? Jun 21, 2019 12:35

Shame Boy: Mar 2, 2010

Lain Iwakura posted:

I wonder when I will get a call from them offering credit checks for a year.

also I completely forgot about Sucuri but seem to recall them being clowns years ago

the end of the article does say they're offering free credit monitoring for a year so, yeah it's definitely coming lmao

# ? Jun 21, 2019 14:55

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

Lain Iwakura posted:

I wonder when I will get a call from them offering credit checks for a year.

also I completely forgot about Sucuri but seem to recall them being clowns years ago

We use them to monitor a few cloud-hosted WordPress things

# ? Jun 21, 2019 14:59

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

guess it's more like succuri now lel

# ? Jun 21, 2019 15:00

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

JPL got hacked by someone leaving a Raspberry Pi on the network.

# ? Jun 21, 2019 15:36

MononcQc: May 29, 2007

Lain Iwakura posted:

I wonder when I will get a call from them offering credit checks for a year.

https://www.desjardins.com/ca/personal-information/index.jsp

It's, hilariously enough, going to be with Equifax. I guess they have experience with massive data leaks. At least it's for 5 years?

# ? Jun 21, 2019 16:09

Michael Transactions: Nov 11, 2013

Chris Knight posted:

welp
https://twitter.com/citynews/status/1141774801226358785

Oh jesus. That is, quite a gently caress up. LMAO

# ? Jun 21, 2019 16:12

Squinky v2.0: Nov 16, 2006; Behind you! A three headed monkey!; College Slice

so that CBP hack was waaaay worse than initially reported

Hacked documents reveal sensitive details of expanding border surveillance

quote:

That assessment, however, woefully understates the number of sensitive documents that are now freely available on the Web � so much material, totaling hundreds of gigabytes, that The Washington Post required several days of computer time to capture it all.

The documents offer an unusually intimate glimpse of the machinery that U.S. officials depend on for the constant monitoring of legal immigration through the border. They also illuminate the government�s plans for expanding its use of license plate readers and facial-recognition cameras, including such details as how many cameras are focused on which traffic lanes at some of the busiest border crossings in the world.

The hoard of hacked documents includes detailed schematics, confidential agreements, equipment lists, budget spreadsheets, internal photos and hardware blueprints for security systems.

Among potentially sensitive government material are internal Department of Homeland Security handbooks, border surveillance diagrams and dozens of signed nondisclosure agreements between the subcontractor and government authorities, as well as companies such as Microsoft and the defense-contracting giant Northrop Grumman. Microsoft and Northrop Grumman did not respond to requests for comment.

The files also offer extensive detail on � and, in some cases, a literal road map to � equipment that has been installed at U.S. military bases and the United States� most highly trafficked border gateways.

there�s more too. whoever got in seems to have made off with essentially everything the contractor had. seems bad.

# ? Jun 21, 2019 16:57

Blinkz0rz: May 27, 2001; MY CONTEMPT FOR MY OWN EMPLOYEES IS ONLY MATCHED BY MY LOVE FOR TOM BRADY'S SWEATY MAGA BALLS

CommieGIR posted:

JPL got hacked by someone leaving a Raspberry Pi on the network.

story

https://www.forbes.com/sites/daveywinder/2019/06/20/confirmed-nasa-has-been-hacked/

# ? Jun 21, 2019 16:57

dpkg chopra: Jun 9, 2007; Fast Food Fight; Grimey Drawer

Blinkz0rz posted:

story

https://www.forbes.com/sites/daveywinder/2019/06/20/confirmed-nasa-has-been-hacked/

hopefully this won't result in delays or budget overruns to the james webb telescope

# ? Jun 21, 2019 17:06

Trabisnikof: Dec 24, 2005

bummer the oig doesnt say how they exploited the pi https://oig.nasa.gov/docs/IG-19-022.pdf

# ? Jun 21, 2019 17:09

Chris Knight: Jun 5, 2002; me @ ur posts; Fun Shoe

spb posted:

Oh jesus. That is, quite a gently caress up. LMAO

# ? Jun 21, 2019 17:12

DrPossum: May 15, 2004; i am not a surgeon

xkdon't

# ? Jun 21, 2019 22:19

susan b buffering: Nov 14, 2016

Squinky v2.0 posted:

so that CBP hack was waaaay worse than initially reported

Hacked documents reveal sensitive details of expanding border surveillance

there�s more too. whoever got in seems to have made off with essentially everything the contractor had. seems bad.

Lol this rules

# ? Jun 21, 2019 23:16

Carbon dioxide: Oct 9, 2012

https://www.tomshardware.com/news/nsa-contributes-low-level-stm-coreboot,39704.html

The NSA has started assigning developers to the Coreboot project, which is an open source alternative to Windows BIOS/UEFI firmware.

# ? Jun 22, 2019 12:40

Soricidus: Oct 21, 2010; freedom-hating statist shill

probably legit, like selinux. they come under enough scrutiny these days that they�d have a hard time sneaking any backdoors in without getting caught.

# ? Jun 22, 2019 12:43

BlankSystemDaemon: Mar 13, 2009

Presumably NSA could in theory write code to avoid static analysers (coverty, which coreboot uses), syzkaller (which they don't use yet), and sanitizers (like a-san, ub-san, et cetera - possibly in combination with syzkaller; again, something coreboot doesn't use yet)?

# ? Jun 22, 2019 13:34

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

They could also have the public facing team write good, well intentioned code and an internal team analyzing it for issues that can be exploited.

# ? Jun 22, 2019 13:36

Cybernetic Vermin: Apr 18, 2005

either way the nsa can no doubt get their primary work done by hacking on a higher level, and may be worried primarily about the black box nature of the preloaded uefi stuff loaded in locations outside nsa control.

# ? Jun 22, 2019 14:27

Soricidus: Oct 21, 2010; freedom-hating statist shill

i'm gonna go out on a limb here and guess that when the nsa attempts to introduce backdoors into code, they probably try not to put their name on the commits

# ? Jun 22, 2019 15:41

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 16:51

mystes: May 31, 2006

They presumably already have a backdoor in the Intel ME code, so I imagine this is just because they want a bios that's actually secure for their internal use.

# ? Jun 22, 2019 19:26

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.51: who needs they entrussy revoked

«‹›975 »