Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Dr. Arbitrary
Mar 15, 2006

Bleak Gremlin
Just be glad it isn't some forced acronym.
V.E.N.O.M.
Virtualization Escape in Native QEMU Onboard Microdisk

Adbot
ADBOT LOVES YOU

deimos
Nov 30, 2006

Forget it man this bat is whack, it's got poobrain!

KoRMaK posted:

I like it. Like how I like when NASA and other science places make up cool acronyms and work backwards.

I always wondered if there was a way to jump out of the VM, is this the first time this has been discovered?

quote:

Most VM escape vulnerabilities discovered in the past were only exploitable in non-default configurations or in configurations that wouldn’t be used in secured environments. Other VM escape vulnerabilities only applied to a single virtualization platform, or didn’t directly allow for arbitrary code execution.

CVE-2007-1744 – Directory traversal vulnerability in shared folders feature
CVE-2008-0923 – Path traversal vulnerability in VMware’s shared folders implementation
CVE-2009-1244 – Cloudburst (VMware virtual video adapter vulnerability)
CVE-2012-0217 – 64-bit PV guest privilege escalation vulnerability
CVE-2014-0983 – Oracle VirtualBox 3D acceleration multiple memory corruption vulnerabilities
VENOM (CVE-2015-3456) is unique in that it applies to a wide array of virtualization platforms, works on default configurations, and allows for direct arbitrary code execution.

Thanks Ants
May 21, 2004

#essereFerrari


evol262 posted:

So glad this is finally public.

Said it before, but it bears repeating. Who else is sick of every CVE needing some catchy name since heartbleed?

*raises hand*

evol262
Nov 30, 2010
#!/usr/bin/perl

KoRMaK posted:

I like it. Like how I like when NASA and other science places make up cool acronyms and work backwards.

I always wondered if there was a way to jump out of the VM, is this the first time this has been discovered?

There have been a bunch in the past. Xen has a lot, Hyper-V has a few, VMware has a few. VMware had a very, very similar exploit (VMSA-2012-0009) a few years ago, for example.

But it's kind of sampling bias. Xen has a lot, comparatively, because it's the oldest open-source hypervisor. VMware and Microsoft can quietly patch vulnerabilities they're paying bounties on without announcing, which is an option that we don't get in the open source world.

spankmeister
Jun 15, 2008






Yeah, i work in ~infosec~ and it's annoying as gently caress.

vanity slug
Jul 20, 2010

CVE-2015-3456 is easy to remember too. I mean, come on, 3456.

Lord Dudeguy
Sep 17, 2006
[Insert good English here]

GreenBuckanneer posted:

Once people figure out how to implement DFSR on their servers, SMBs wont need cloud backup services anymore...

DFSR plus deduplication on Server 2012 R2 is so :swoon:

Drunk Nerds
Jan 25, 2011

Just close your eyes
Fun Shoe
While I'm not in IT, I am an editor, and this funny one came in the other day that I think fits here, as it was a ticket:

"Issue: Unsubcribe me
Comment: I added myself to a list to see any responses to my comment, and now I get three emails every time a comment comes in.
User: bot@spamjam.com"

A spambot that sprayed its dumb ad in our comments section was complaining that we send him too much automated email.

I did nothing. My boss was fine with that.

Knormal
Nov 11, 2001

hihifellow posted:

Lockout: that's set way too drat low and they should have enabled the self-help questions. If it's good enough for a bank, it's good enough here.

Cert: the tools are obtuse and require a usb PXE key but yes it can be done.
Believe me, I agree on the lockout count, but unfortunately we're the only division at my place that really uses laptops so I can't get anyone else to support me. I suggested 20 attempts in a meeting and literally got laughed at because they thought that was too unsecure, even though like someone else said should be concerned about brute-force attacks, not bad typing. Our policy people really don't function in the real world.

OwlFancier
Aug 22, 2013

Siochain posted:

I thought I was the only person who did this anymore.
loving works a treat, but I'll have to look into the USB stick.

I miss the little slidey bits on the side of floppy discs.

I wish I could buy a USB stick with a physical write block. I know it's impossible but I still wish I could.

m.hache
Dec 1, 2004


Fun Shoe

OwlFancier posted:

I miss the little slidey bits on the side of floppy discs.

I wish I could buy a USB stick with a physical write block. I know it's impossible but I still wish I could.

http://i.imgur.com/004zjvS.gifv

Guy Axlerod
Dec 29, 2008

Ahem.

evol262
Nov 30, 2010
#!/usr/bin/perl

MO was awesome

Guy Axlerod
Dec 29, 2008

evol262 posted:

MO was awesome

I only ever saw an CD/MO combo drive once, it connected to a Parallel port! Didn't have any MO media though.

However, pictured above is a CD caddy.

Lightning Jim
Nov 18, 2006

Just a mad weather-ologist :science:

evol262 posted:

MO was awesome

Geez, the only time I've ever dealt with MO was at the local library as a kid and I didn't even really know what I was handling.

But I did get to have a home system with 5 1/2" floppies.

dennyk
Jan 2, 2005

Cheese-Buyer's Remorse
Back in high school I stored my digital media projects on a flopticle for a couple of semesters and on an MO disc after that. We had all sorts of interesting tech in our labs there. I spent quite a bit of time working on a Centris 650 that had a slide scanner in the drive bay. We also had a NeXTstation, and the video production guys had a sweet Amiga rig with all kinds of fun accessories. One summer we put in a whole lab of brand new 5000-series PowerMacs (which almost electrocuted some elementary school kids who were doing a weeklong summer program there; they were the first ones to use the new lab and it turns out that plugging a few dozen PowerMacs into a series of daisy-chained power strips all plugged into one outlet and then powering them all on at once is a Bad Idea, unless your goal is to see how big of an electrical arc you can create. :science: ).

We also had a few PC labs, including an AutoCAD lab. Got to play with some fun stuff back then.

Edit: I had (well, have) a Commodore 64 with a 1541, so I was using 5.25" disks since I was like six, but my first PC was all fancy and had a 3.5" drive AND a CD-ROM. :toot: I had to get another 4MB of RAM for it so I could play my Interplay Lord of the Rings game and NASCAR Racing, though (and make special boot disks for 'em as well; spent ages messing with the boot config files and emm386...).

dennyk fucked around with this message at 22:56 on May 13, 2015

Thanks Ants
May 21, 2004

#essereFerrari


evol262 posted:

MO was awesome

That and the DVD-RAM spec that Panasonic pushed where the discs came in caddies and had an awesome pattern on the data layer.

sfwarlock
Aug 11, 2007
So you know that wall of legal employee notices that no one ever reads? Someone printed up an extra one and stuck it up there at some point, and it just now got noticed. It reads:

quote:

There have been numerous requests over the last few months for (mumble) Inc to institute a gym membership reimbursement program. After extensive consideration, the company has decided not to implement such a program at the present time.
We feel (mumble) employees get enough exercise beating around the bush, bending regulations, chewing the fat, climbing the walls, dodging responsibility, ducking the boss, fishing for compliments, flying off the handle, grasping at straws, jumping to conclusions, passing the buck, pulling strings, pushing their luck, running in circles, stretching the truth, throwing their weight around, and wading through paperwork.
This policy may be reconsidered in the future, but don't hold your breath (unless swimming through bullshit). Thank you for your continued excellent work.

There's now a ticket for IT to try to figure out who printed it. My comment was "Two steps. First we eliminate everyone who doesn't use Oxford commas, then from everyone left, we figure out who'd be anal enough to alphabetize that list."

The Muffinlord
Mar 3, 2007

newbid stupie?
I'd be inclined to tell them it was untraceable.

Malachite_Dragon
Mar 31, 2010

Weaving Merry Christmas magic
I can't help but read that paragraph in George Carlin's voice. That's fantastic.

Agrikk
Oct 17, 2003

Take care with that! We have not fully ascertained its function, and the ticking is accelerating.

Dr. Arbitrary posted:

Just be glad it isn't some forced acronym.
V.E.N.O.M.
Virtualization Escape in Native QEMU Onboard Microdisk

Back in the day I watched a cartoon called M.A.S.K. and they fought a group called V.E.N.O.M. and we always wondered what venom stood for. One afternoon we were pontificating about it, tossing random words around and my dad tossed one out:

Vampires Eating Nuts On Michael (My brother is named Michael).

This was in the mid 80's so that story is about thirty years old, but still, every time I see the word venom I think of nut-eating vampires.

Also: I was later in an engineering project team tasked with building a better mouse trap for a drafting project, so we called ourselves Vicious Engineers Neatly Obliterating Mice.

Why do I remember stuff like this? This poo poo never leaves my head and

</coolstory>

Dr. Arbitrary
Mar 15, 2006

Bleak Gremlin

Dr. Arbitrary posted:

Just be glad it isn't some forced acronym.
V.E.N.O.M.
Virtualization Escape in Native QEMU Onboard Microdisk

Virtualized Environment Neglected Operations Manipulation
http://venom.crowdstrike.com/

Ugh

Che Delilas
Nov 23, 2009
FREE TIBET WEED

sfwarlock posted:

There's now a ticket for IT to try to figure out who printed it. My comment was "Two steps. First we eliminate everyone who doesn't use Oxford commas, then from everyone left, we figure out who'd be anal enough to alphabetize that list."

Close the ticket with, "Logs point to someone with a sense of humor, further detail unavailable."

Alliterate Addict
Jul 10, 2012

dreaming of that face again

it's bright and blue and shimmering

grinning wide and comforting me with it's three warm and wild eyes

Che Delilas posted:

Close the ticket with, "Logs point to someone with a sense of humor, further detail unavailable."

"Since this is not one of the items issued by the company, we are forced to assume that a user brought one in from outside of work and as such we have no asset tag to trace against. Recommendation: bag checks at the door to prevent any more external humor from being brought in."

chin up everything sucks
Jan 29, 2012

sfwarlock posted:

There's now a ticket for IT to try to figure out who printed it. My comment was "Two steps. First we eliminate everyone who doesn't use Oxford commas, then from everyone left, we figure out who'd be anal enough to alphabetize that list."

I'm fairly certain that entire thing is a quote from a comedian. I swear I've heard it before.

Fil5000
Jun 23, 2003

HOLD ON GUYS I'M POSTING ABOUT INTERNET ROBOTS

Agrikk posted:

Back in the day I watched a cartoon called M.A.S.K. and they fought a group called V.E.N.O.M. and we always wondered what venom stood for. One afternoon we were pontificating about it, tossing random words around and my dad tossed one out:

Vampires Eating Nuts On Michael (My brother is named Michael).

This was in the mid 80's so that story is about thirty years old, but still, every time I see the word venom I think of nut-eating vampires.

Also: I was later in an engineering project team tasked with building a better mouse trap for a drafting project, so we called ourselves Vicious Engineers Neatly Obliterating Mice.

Why do I remember stuff like this? This poo poo never leaves my head and

</coolstory>

I *think* that VENOM stood for Vicious Evil Network of Mayhem, despite that being clearly a stupid name for anything.

Verizian
Dec 18, 2004
The spiky one.
^I thought is was Viscous Evil Network, blah blah because saturday morning cartoon villains were always a bit thick.

As for the notice board, can't you kick that over to security with a suggestion to install more CCTV cameras? Also print out the sketch of the thief from this clip and suggest him as a suspect.
https://www.youtube.com/watch?v=uaQ-uawJQ-M

MJP
Jun 17, 2007

Are you looking at me Senpai?

Grimey Drawer
A ticket didn't come in...

... because I've been logging every instance of someone coming up to me and asking me to do anything as part of the Powers that Be figuring out if they can replace the terminated desktop guy with someone junior or with a little more experience.

This morning, after having to go back and forth to perform desktop support poo poo twice before 8:30 AM, I decided that if my boss was too busy to go over the data, I would do so for him.

Apologies for the wall o' text, but this is why I'm giving very real YotJ consideration if they don't immediately start hiring, despite me trying to keep my cool and wait it out until the end of the month. This email is about to go to my boss:

quote:

Since 4/28, as requested, I've collected statistics on any situation where anyone in %company% asks me to handle something. This excludes interactions that are solely completed within Zendesk, vendor interactions, sysadmin tasks, etc. - basically, anything that would have otherwise been handled by %formerhelpdeskguy%.

It is worth note that anything which a helpdesk tech would have to escalate came in universally through a ticket - I had zero walk-ups that related to major outages, complex issues, etc. The exception here is %boss% interacting with me to perform tasks that would be related to my normal work as a sysadmin. Barring unique cases, these tasks would not be easily completed by a helpdesk analyst without some explanation and/or training.

I've broken everything down thus far into actionable data as such:

As of the writing of this email, there were 70 non-ticket interactions: walk-ups, calls, IMs, questions at the coffee machine, etc.

24 of these were not related to actual IT issues - moving boxes, questions about mobile devices, %companyname% processes/procedures, etc.

46 of these were related to actual IT issues.

All percentages are rounded down to the nearest full percentage point.

Of the 46 IT issues that were non-ticket interactions:
-27 never had a ticket opened at all (58% of all non-ticket interactions)
-4 had tickets opened in advance with someone interacting asking for expedited service/questions related to the ticket (8%)
-15 had tickets opened after the fact (32%)
-42 were completed without a ticket being open beforehand (91%)

Of the 24 non-specific interactions:
-10 were %boss% requesting me to perform a task that could not have been done by a normal helpdesk person (41% of all non-specific interactions)
-14 were not %boss% and could have been handled by a normal helpdesk analyst (58%)
-0 had tickets opened (100%)

Of all interactions:
-51 had no ticket opened at any point in time by anyone involved (72%)
-60 could have been handled at a helpdesk level (85%)
-10 were related to sysadmin experience/requirements (14%)

I'll refrain from commentary other than citing this article (based on actual psychological tests in peer-reviewed journals, sources cited within the article) that states the damages done by multi-tasking to this degree, doubly so where it's an interruption to perform a required task (such as a helpdesk request which must be resolved for a user to continue working): https://www.psychologytoday.com/blog/brain-wise/201209/the-true-cost-multi-tasking

I hope it at least gets the point across without sounding opinionated but after schlepping a whiteboard I'm starting to think it's time for me to grow a loving backbone.

spog
Aug 7, 2004

It's your own bloody fault.

MJP posted:

A ticket didn't come in...

... because I've been logging every instance of someone coming up to me and asking me to do anything as part of the Powers that Be figuring out if they can replace the terminated desktop guy with someone junior or with a little more experience.

This morning, after having to go back and forth to perform desktop support poo poo twice before 8:30 AM, I decided that if my boss was too busy to go over the data, I would do so for him.

Apologies for the wall o' text, but this is why I'm giving very real YotJ consideration if they don't immediately start hiring, despite me trying to keep my cool and wait it out until the end of the month. This email is about to go to my boss:


I hope it at least gets the point across without sounding opinionated but after schlepping a whiteboard I'm starting to think it's time for me to grow a loving backbone.

Needs some piecharts

Fil5000
Jun 23, 2003

HOLD ON GUYS I'M POSTING ABOUT INTERNET ROBOTS

spog posted:

Needs some piecharts

Ideally an area chart with the queries received by type over time.

MJP
Jun 17, 2007

Are you looking at me Senpai?

Grimey Drawer
Oh wow holy poo poo charts in Excel have CHANGED since I last had to do 'em.

Wizard of the Deep
Sep 25, 2005

Another productive workday

MJP posted:

A ticket didn't come in...

... because I've been logging every instance of someone coming up to me and asking me to do anything as part of the Powers that Be figuring out if they can replace the terminated desktop guy with someone junior or with a little more experience.

They will not hire someone until they absolutely have to. YotJ yourself now, before you find yourself at the bottom of the well.

MJP
Jun 17, 2007

Are you looking at me Senpai?

Grimey Drawer
I talked to my boss about it, mentioning morale issues. He asked for the report and stats I'd compiled. Same with the HR lady.

Both of them were only OK with terming the helpdesk guy if they could immediately re-hire.

Given the CFO, I'm thinking that nothing will change his mind - and the HR lady is leaving on Monday for a vacation until the end of the month.

To hell with the bottom of the well - my hands are on the rope and I'm pulling upward. My resume's been floated, it's time to get my cover letter reworked and my search on in earnest. gently caress the well, I won't be that goon.

totalnewbie
Nov 13, 2005

I was born and raised in China, lived in Japan, and now hold a US passport.

I am wrong in every way, all the damn time.

Ask me about my tattoos.
I've posted about our ridiculous IT department before and this email just came in from them:

quote:

IT needs your assistance in maintaining IP availability (Network connectivity). We are requesting that when you are in the office and your laptop is docked you turn your wireless off – You can do this by the wireless switch located on either side of your laptop or some models have the switch located on the top above the keyboard. When docked and wireless is on you are consuming (2) IP addresses which can and has resulted in connectivity issues due to no IP availability.

[insert three pictures of the wireless switch on various laptops]


We have at most 200 people in the office. DHCP lease is for 4 days or so. At this point, all I am anymore is just confused at what it is they actually do over there.

Edit: I forgot to add, this was after an email yesterday telling people not to download windows updates because it was bringing the network to a crawl and included instructions on how to turn off windows updates. We're also all required to attend mandatory computer security training because of recent crypto* infections. These guys :allears:

totalnewbie fucked around with this message at 15:51 on May 14, 2015

nexxai
Jul 17, 2002

quack quack bjork
Fun Shoe

MJP posted:

gently caress the well, I won't be that goon.
You put together a statistical look at every IT interaction you've had in the past 2 weeks, citing a psychology journal. You're a little bit that goon.

MJP
Jun 17, 2007

Are you looking at me Senpai?

Grimey Drawer

nexxai posted:

You put together a statistical look at every IT interaction you've had in the past 2 weeks, citing a psychology journal. You're a little bit that goon.

To be fair, I just googled "multitasking problems article" and made sure it had scholarly sources.

I deny no gooniness - I have moved from lurking to posting, after all - but I won't be in the well if I can avoid it.

Also I was asked to record the interactions. I brought this statistical situation up to my boss yesterday and he said he had about five or six projects but he'd try to take a look at the stats. Five or six projects usually means he won't have the chance, so I figured I'd do some quick basic number crunching. Also, these interactions are anything that didn't come through a ticket, which means people aren't doing what we asked and management supported, so yeah, there's that too.

MJP fucked around with this message at 15:38 on May 14, 2015

nexxai
Jul 17, 2002

quack quack bjork
Fun Shoe

MJP posted:

goony stuff
I was kidding dude. You don't need to try and prove my point for me.

Inspector_666
Oct 7, 2003

benny with the good hair

totalnewbie posted:

I've posted about our ridiculous IT department before and this email just came in from them:


We have at most 200 people in the office. DHCP lease is for 4 days or so. At this point, all I am anymore is just confused at what it is they actually do over there.

I dunno, that's not too out of hand on its own. But if I recall correctly, you have other stories about your IT department being completely incompetent at networking, which I guess explains why they don't just switch the LAN over to a /23 or something.

MJP
Jun 17, 2007

Are you looking at me Senpai?

Grimey Drawer

nexxai posted:

I was kidding dude. You don't need to try and prove my point for me.

why is it that my neck feels hairier all of a sudden and I'm checking out the EVE Online threads

Adbot
ADBOT LOVES YOU

BaseballPCHiker
Jan 16, 2006

MJP posted:

I talked to my boss about it, mentioning morale issues. He asked for the report and stats I'd compiled. Same with the HR lady.

Both of them were only OK with terming the helpdesk guy if they could immediately re-hire.

Given the CFO, I'm thinking that nothing will change his mind - and the HR lady is leaving on Monday for a vacation until the end of the month.

To hell with the bottom of the well - my hands are on the rope and I'm pulling upward. My resume's been floated, it's time to get my cover letter reworked and my search on in earnest. gently caress the well, I won't be that goon.

It's amazing how C-level execs think they can just start cutting jobs in IT without any negative issues popping up. Sure in your case nothing has happened because you've been able to step up in the short term and keep things running. Now inevitably you're getting burned out and tired of doing things that aren't your job so you'll leave. Meaning they will have to spend time and money hiring a replacement who will take a while to get up to speed, and then if he's any good he'll jump ship too. All of this work will get dumped on your boss or someone else in the department which will cause them to leave or become less productive. Next thing you know the whole IT department is over worked and stressing out and not doing their best work anymore. By the time it get's to this point the CFO will have already bragged about how much money he saved this company and used it as an opportunity to jump ship elsewhere for more money. Now the company has no trust in IT and has to either hire a whole new department from scratch or pay more expensive consultant types to come in, do work studies, and make fancy graphs to show what the company needs to do.

  • Locked thread