Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
computer toucher
Jan 8, 2012


what am I looking at?

nm, apparently this: http://www.theguardian.com/technology/2015/jan/06/personal-details-moonpig-exposed-security-bug

e2: heh I skipped a whole page.

that'll do, moonpig, that'll do.

computer toucher fucked around with this message at 20:27 on Jan 6, 2015

Adbot
ADBOT LOVES YOU

EMILY BLUNTS
Jan 1, 2005

remember when netflix made the quixter thing and then didnt check if the account was owned by someone constantly talking about weed?? link here is sort of the same thing

prefect
Sep 11, 2001

No one, Woodhouse.
No one.




Dead Man’s Band
Surprisingly, the MoonPig flaw is not the first hole Price has found in a British greetings-card website. In October 2013, he disclosed a vulnerability in Funky Pigeon’s website which let an attacker take over a user’s account and gain access to personal data. That flaw was fixed within a week.


what is wrong with british web site names?

Alereon
Feb 6, 2004

Dehumanize yourself and face to Trumpshed
College Slice
I think sticking two random words together is a better way to get a company name than to take another random word and drop half the vowels.

pagancow
Jan 15, 2001

Video Stymie

Active666 posted:

Talk on the boarding passes gently caress up that was talked a while back...
https://www.youtube.com/watch?v=_ySZOTl7Vls

fix your audio if you're going to do a talk

Peanut and the Gang
Aug 24, 2009

by exmarx

pagancow posted:

fix your audio if you're going to do a talk

Hello. How's everyone doing today? Having a great time at this conference!

syscall girl
Nov 7, 2009

by FactsAreUseless
Fun Shoe

prefect posted:

Surprisingly, the MoonPig flaw is not the first hole Price has found in a British greetings-card website. In October 2013, he disclosed a vulnerability in Funky Pigeon’s website which let an attacker take over a user’s account and gain access to personal data. That flaw was fixed within a week.


what is wrong with british web site names?

http://youtu.be/NixkgB_glUc

Bloody
Mar 3, 2013

prefect posted:

what is wrong with british web site names?

they are all generated by that image hosting website

EMILY BLUNTS
Jan 1, 2005

Alereon posted:

I think sticking two random words together is a better way to get a company name than to take another random word and drop half the vowels.

there is a UK company called Boxed Ice. their product/service is called Server Density. the email notification system is called Robot Llama.

minato
Jun 7, 2004

cutty cain't hang, say 7-up.
Taco Defender
A British compiler tools company once considered naming their new product "Spiny Norman's Pajama Party".

Shaggar
Apr 26, 2006
that makes as much sense as any other british name for a thing

Sniep
Mar 28, 2004

All I needed was that fatty blunt...



King of Breakfast
put the chips in your slappy ham

Erwin
Feb 17, 2006

there's a british actor named benedict cumberbatch

Qtotonibudinibudet
Nov 7, 2011



Omich poluyobok, skazhi ty narkoman? ya prosto tozhe gde to tam zhivu, mogli by vmeste uyobyvat' narkotiki
goddamnit microsoft why can't you write a goddamn useful or at least complete ipsec stack.

this tunnel isnt coming up because the microsoft vpn server is specifying its own IP as the only thing in its protected network. it does this because there is literally nowhere in the configuration wizard to configure what the local protected networks should be.

i mean i know the ipsec rfcs are a clusterfuck but you'd think theyd implement basic gateway to gateway functionality like every other vendor on the planet.

why shaggar why.

anthonypants
May 6, 2007

by Nyc_Tattoo
Dinosaur Gum
our ids server at work apparently had ssh open to the world and we didn't notice until someone failed a bunch of logon attempts lol

Shaggar
Apr 26, 2006

IPvSH6T posted:

goddamnit microsoft why can't you write a goddamn useful or at least complete ipsec stack.

this tunnel isnt coming up because the microsoft vpn server is specifying its own IP as the only thing in its protected network. it does this because there is literally nowhere in the configuration wizard to configure what the local protected networks should be.

i mean i know the ipsec rfcs are a clusterfuck but you'd think theyd implement basic gateway to gateway functionality like every other vendor on the planet.

why shaggar why.

i haven't used the remote access stuff in forever but i seem to remember it being pretty robust. you may need to get past the wizard to get to more advanced options

infernal machines
Oct 11, 2012

we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Shaggar posted:

that makes as much sense as any other british name for a thing

it's a monty python reference.

in fact all those names are probably nerdbait references to some obscure bbc comedy series that stopped airing a generation before anyone involved in the company was born

Tayter Swift
Nov 18, 2002

Pillbug

infernal machines posted:

it's a monty python reference.

in fact all those names are probably nerdbait references to some obscure bbc comedy series that stopped airing a generation before anyone involved in the company was born

I had the ethelthefrog.net domain name for a decade so I can relate

Qtotonibudinibudet
Nov 7, 2011



Omich poluyobok, skazhi ty narkoman? ya prosto tozhe gde to tam zhivu, mogli by vmeste uyobyvat' narkotiki

Shaggar posted:

i haven't used the remote access stuff in forever but i seem to remember it being pretty robust. you may need to get past the wizard to get to more advanced options

good thing technet says how to do that.

oh wait it just says use the wizard. kill me now.

anthonypants posted:

our ids server at work apparently had ssh open to the world and we didn't notice until someone failed a bunch of logon attempts lol

eh my vps has ssh open to the world who cares. literally just endless attempts to log into root, which is impossible:
journalctl -u sshd | grep "Failed password for root" | wc -l
256103

infernal machines
Oct 11, 2012

we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

IPvSH6T posted:

good thing technet says how to do that.

oh wait it just says use the wizard. kill me now.

ms lesson #1 don't use the wizard for anything as it will invariably use the most nonsensical options by default and changing them after the fact will break poo poo

ms lesson #2 if you don't use the wizard your poo poo will probably break in an unexpected way during an update or integration with another product because everything assumes you used the wizard and just sets things accordingly

jre
Sep 2, 2011

To the cloud ?



anthonypants posted:

our ids server at work apparently had ssh open to the world and we didn't notice until someone failed a bunch of logon attempts lol

:stonk: :ironicat:

a cyberpunk goose
May 21, 2007

infernal machines posted:

ms lesson #1 don't use the wizard for anything as it will invariably use the most nonsensical options by default and changing them after the fact will break poo poo

ms lesson #2 if you don't use the wizard your poo poo will probably break in an unexpected way during an update or integration with another product because everything assumes you used the wizard and just sets things accordingly

this


except the opposite

a cyberpunk goose
May 21, 2007

if the wizard won't do it then pay someone else to do it

lesson 1: don't be that someone else

infernal machines
Oct 11, 2012

we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Mido posted:

if the wizard won't do it then pay someone else to do it

lesson 1: don't be that someone else

i am that someone else

otherwise, yes your analysis is correct

Jewel
May 2, 2009

alternatively pay an actual wizard to do it

a cyberpunk goose
May 21, 2007

Jewel posted:

alternatively pay an actual wizard to do it

kkk window admins to be specific

Captain Foo
May 11, 2004

we vibin'
we slidin'
we breathin'
we dyin'

Mido posted:

kkk window admins to be specific

grand windows dragon

anthonypants
May 6, 2007

by Nyc_Tattoo
Dinosaur Gum

infernal machines posted:

ms lesson #1 don't use the wizard for anything as it will invariably use the most nonsensical options by default and changing them after the fact will break poo poo

ms lesson #2 if you don't use the wizard your poo poo will probably break in an unexpected way during an update or integration with another product because everything assumes you used the wizard and just sets things accordingly
https://www.youtube.com/watch?v=QRJ0EB_r9DY

akadajet
Sep 14, 2003


ya... this kind of humor is lost of me

infernal machines
Oct 11, 2012

we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

this video roughly conveys how incredibly unpleasant the process of configuring ms software is

probably not in the way intended, but just by being really gratingly unpleasant throughout

Bloody
Mar 3, 2013

Captain Foo posted:

grand windows dragon

Mods rename Shaggar this

computer toucher
Jan 8, 2012

Erwin posted:

there's a british actor named benedict cumberbatch

that's a Salad Fingers side character name right there.

influx.
Dec 16, 2007

Nice pants!

Erwin posted:

there's a british actor named benedict cumberbatch

he cant say penguins

https://www.youtube.com/watch?v=-GnLDJAgrws

Lain Iwakura
Aug 5, 2004

The body exists only to verify one's own existence.

Taco Defender
so i decided to feed a fresh install of windows to virustotal via a script and see what the the results are

quote:

MD5: ad61f7afe913b2642650504df283aa63
Path(s):
./winsxs/wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7/dnscacheugc.exe
Detection details:
AegisLab - W32.Expiro

MD5: fcf5c8bb9afd8d15b324b702f9b186b7
Path(s):
./System32/ieetwcollector.exe
./winsxs/amd64_microsoft-windows-ie-ieetwcollector_31bf3856ad364e35_11.2.9600.17239_none_a584352617c3f1bb/ieetwcollector.exe
Detection details:
AegisLab - Win64.Expiro

MD5: bb88d7bf8b6d3fad2459a6e70105228a
Path(s):
./winsxs/amd64_microsoft-windows-g..ebuild-search-index_31bf3856ad364e35_6.1.7601.17610_none_1d10224d57ce5c5e/rebuildSearchIndex.exe
Detection details:
AegisLab - Win64.Expiro

MD5: e3406f3104957c4967826e7c06ff77fd
Path(s):
./Installer/{236BB7C4-4419-42FD-0409-1E257A25E34D}/NewShortcut1_236BB7C4441942FD04091E257A25E34D.exe
Detection details:
TheHacker - W32/Leave.gu

MD5: ea6eadf6314e43783ba8eee79f93f73c
Path(s):
./winsxs/wow64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7600.16385_none_352647b674b9e378/sidebar.exe
Detection details:
ByteHero - Trojan.Win32.Heur.098

MD5: 46b8be4f4ba4d853c6825956d98021e2
Path(s):
./winsxs/amd64_microsoft-windows-fsutil_31bf3856ad364e35_6.1.7601.21680_none_2ac406171fe62477/fsutil.exe
Detection details:
AegisLab - Win64.Expiro

MD5: bfd3178735d97c858ffa467f8199700c
Path(s):
./SoftwareDistribution/Download/e0e3274808cbc64c021ffcb005720a65/amd64_microsoft-windows-ie-ieetwcollector_31bf3856ad364e35_11.2.9600.17126_none_a58e492017bc6f90/ieetwcollector.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 19340d1fba1a2a3c96f1a2c84a9ec415
Path(s):
./System32/Speech/SpeechUX/SpeechUXTutorial.exe
./winsxs/amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7600.16385_none_77fee1b2657da663/SpeechUXTutorial.exe
./winsxs/amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd/SpeechUXTutorial.exe
Detection details:
Bkav - HW64.packed.8090

MD5: 8daacebf0e55cfb82b01fc450576be5a
Path(s):
./System32/IME/IMEJP10/imjpuexc.exe
./winsxs/amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_696354579779eadf/imjpuexc.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 2830c1fca1da002a498eca5dbb0679ae
Path(s):
./winsxs/amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7/showmount.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 6e570050e6cf5d6f6dc1c1eef9bb3949
Path(s):
./System32/DriverStore/FileRepository/c7118908.inf_amd64_neutral_8dc4ff304e4afff6/B117547/atiapfxx.exe
Detection details:
Bkav - W32.Clod5f7.Trojan.f044

MD5: e78910d78ca05c06ed6455d401999402
Path(s):
./winsxs/amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7600.20904_none_a0117c29336d4534/prevhost.exe
Detection details:
Bkav - HW64.packed.84DC

MD5: 2bf84985de59544a0460bb33f804da3a
Path(s):
./SysWOW64/ReAgentc.exe
./winsxs/x86_microsoft-windows-winre-recoverytools_31bf3856ad364e35_6.1.7601.17514_none_d7553e5fcf6b6373/ReAgentc.exe
Detection details:
AegisLab - W32.Virut

MD5: 37c7c89b03f9d39629eda545a1645d68
Path(s):
./SoftwareDistribution/Download/9b1fd27f7aca994956425ec72072da60/amd64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.18539_none_735ca6b7203d6b5a/tzupd.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 04ff24d66412fc1072f8d0b7cb83bcf5
Path(s):
./winsxs/wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_6.1.7601.22252_none_b6b33b7d8557de1f/mstsc.exe
Detection details:
AegisLab - W32.Expiro

MD5: 334c44bf74df6af20a45a4477d995dbc
Path(s):
./Installer/{B74D4E10-1033-0000-0000-000000000001}/AdobeBridge_B74D4E10103300000000000000000001_1.exe
./Installer/{B74D4E10-1033-0000-0000-000000000001}/BridgeCommonShortcut_B74D4E101033000000000001_1.exe
Detection details:
TheHacker - W32/Leave.gu

MD5: bc3beeeeb1ada8687738d057ceed6f1c
Path(s):
./winsxs/amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d/appcmd.exe
Detection details:
AegisLab - Win64.Expiro

MD5: db4ffb795611eb2d8ab55d5fc047ce32
Path(s):
./winsxs/amd64_microsoft-windows-g..ewowregisteredowner_31bf3856ad364e35_6.1.7601.17671_none_e3b3f68bbb72a87b/UpdateWowRegisteredOwner.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 3afa03119583647136c49b80dad38f19
Path(s):
./winsxs/amd64_microsoft-windows-ie-ieetwcollector_31bf3856ad364e35_11.2.9600.16428_none_a56da9e617d4f97e/ieetwcollector.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 2145f324edfed2498adef6a0e2290ec2
Path(s):
./winsxs/x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419/PDMSetup.exe
Detection details:
AegisLab - W32.Virut

MD5: 1a42ea6484e6e1a773c2fd09e976e774
Path(s):
./winsxs/amd64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.17514_none_736d5be520319b24/tzupd.exe
./winsxs/amd64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.22156_none_73cd994e396e053e/tzupd.exe
./winsxs/amd64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.22508_none_7405b1163943a0d3/tzupd.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 199d8ecb6748b2b866cba52a8d092034
Path(s):
./winsxs/x86_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_6.1.7601.17514_none_f71e39745cb0f950/RMActivate_ssp_isv.exe
Detection details:
AegisLab - W32.Expiro

MD5: a3a132cbe48af0324466469f2caae8a2
Path(s):
./winsxs/amd64_microsoft-windows-ie-ieetwcollector_31bf3856ad364e35_11.2.9600.17041_none_a59b8b8817b20628/ieetwcollector.exe
Detection details:
AegisLab - Win64.Expiro

MD5: a236b1646e96ab06be0f8d592b6d9a0d
Path(s):
./System32/OxpsConverter.exe
./winsxs/amd64_oxpsconverter_31bf3856ad364e35_6.1.7601.17933_none_0804e1f7c5c64bf1/OxpsConverter.exe
Detection details:
K7GW - Trojan ( 700001171 )

MD5: b2120b16b3e221b4d3342e87867a5163
Path(s):
./winsxs/x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7601.17514_none_71c62979c253e895/RMActivate_ssp.exe
Detection details:
AegisLab - W32.Expiro

MD5: d5a8dbf87c5e9ab71075a7ff16c1e719
Path(s):
./winsxs/amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_672ce6c3de2cb17f/PkgMgr.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 4e1073b674746eea0b2ea0f4775ea6a4
Path(s):
./winsxs/amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_7df14b591094e7ec/TsUsbRedirectionGroupPolicyControl.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 25c460925c98446a96eedd3029e3e246
Path(s):
./winsxs/amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7601.21663_none_a1b5f77730c54248/prevhost.exe
Detection details:
Bkav - HW64.packed.E463

MD5: 5b96f9bebf4de1722b9d4646305222dc
Path(s):
./winsxs/x86_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_6.1.7601.22530_none_ebc92b07671d5e00/RMActivate_isv.exe
Detection details:
AegisLab - W32.Virut

MD5: 916cec665a9879deb15bbdd943b7350b
Path(s):
./SoftwareDistribution/Download/a1c89802275d7f027da0a0bd82ca400b/amd64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.18588_none_732596d12066ddb8/tzupd.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 9c64d5c8a624f506c87e7a4a8682a322
Path(s):
./winsxs/amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7600.16762_none_9f44fd5c1a821d3b/prevhost.exe
Detection details:
Bkav - HW64.packed.A128

MD5: e01d2ac63453534db8ad1ea97dee9c3a
Path(s):
./SysWOW64/RMActivate_isv.exe
./winsxs/x86_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_6.1.7601.18332_none_eb418cea4dfdf3bd/RMActivate_isv.exe
Detection details:
AegisLab - W32.Virut

MD5: dc0b0581268858f95766139a394426e7
Path(s):
./winsxs/amd64_microsoft-windows-g..validatefntcache-03_31bf3856ad364e35_6.1.7601.17888_none_a6ac762931614073/invalidateFntcache.exe
Detection details:
AegisLab - Win64.Expiro

MD5: f642e79073c719e0bf2f500b84236944
Path(s):
./Installer/{E9787678-1033-0000-8E67-000000000001}/AppLanuchShortcut_E9787678103300008E67000000000001_1.exe
./Installer/{E9787678-1033-0000-8E67-000000000001}/ProgramMenuShortcut_E9787678103300008E670000000001_1.exe
Detection details:
TheHacker - W32/Leave.gu

MD5: 725d0cd0bc104b47b1975319712e280b
Path(s):
./winsxs/amd64_microsoft-windows-g..validatefntcache-02_31bf3856ad364e35_6.1.7601.17621_none_a6f11fcb312ed12d/invalidateFntcache.exe
Detection details:
AegisLab - Win64.Expiro

MD5: 3cced287ec7df84cec633a9a4e03dd62
Path(s):
./winsxs/amd64_microsoft-windows-g..ebuild-search-index_31bf3856ad364e35_6.1.7601.21720_none_1d8eef2c70f41819/rebuildSearchIndex.exe
Detection details:
AegisLab - Win64.Expiro

MD5: a45092e6f09f68118b27e31bc0b2c014
Path(s):
./winsxs/amd64_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.5.7601.17514_none_af500e3c7fc49bc4/wuapp.exe
Detection details:
AegisLab - Win64.Expiro

da fuq is up with aegislab

BangersInMyKnickers
Nov 3, 2004

I have a thing for courageous dongles

Where'd your install media come from?

Lain Iwakura
Aug 5, 2004

The body exists only to verify one's own existence.

Taco Defender

BangersInMyKnickers posted:

Where'd your install media come from?

an msdn iso

BangersInMyKnickers
Nov 3, 2004

I have a thing for courageous dongles

ultimate media? there's a bunch of 3rd party crap bundled in there from drivers that could be triggering it. SP0 Win7 pro media had a UPS driver in it with a virus and even MS was distributing it through Windows Update for a while until I reported it. Stranger things have happened. If its in the SxS folder it is likely inactive.

That or something somehow tampered with your media or your machine, but it would be odd for it to only mess with SxS and none of the live files

Munkeymon
Aug 14, 2003

Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.



BangersInMyKnickers posted:

ultimate media? there's a bunch of 3rd party crap bundled in there from drivers that could be triggering it. SP0 Win7 pro media had a UPS driver in it with a virus and even MS was distributing it through Windows Update for a while until I reported it. Stranger things have happened. If its in the SxS folder it is likely inactive.

I was gonna say something along the lines of 'this goes all the way to the top' but goddamn it almost does :stare:

quote:

That or something somehow tampered with your media or your machine, but it would be odd for it to only mess with SxS and none of the live files

or virus detection databases are full of false positives and OSI just reverse engineered the white list they use to avoid quarantining stock system files

Lain Iwakura
Aug 5, 2004

The body exists only to verify one's own existence.

Taco Defender

BangersInMyKnickers posted:

ultimate media? there's a bunch of 3rd party crap bundled in there from drivers that could be triggering it. SP0 Win7 pro media had a UPS driver in it with a virus and even MS was distributing it through Windows Update for a while until I reported it. Stranger things have happened. If its in the SxS folder it is likely inactive.

That or something somehow tampered with your media or your machine, but it would be odd for it to only mess with SxS and none of the live files

msdn windows 7 enterprise media downloaded from msdn itself :)

Adbot
ADBOT LOVES YOU

Lain Iwakura
Aug 5, 2004

The body exists only to verify one's own existence.

Taco Defender

Munkeymon posted:

or virus detection databases are full of false positives and OSI just reverse engineered the white list they use to avoid quarantining stock system files

that is what i am wondering

  • Locked thread