Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›366 »

geonetix: Mar 6, 2011

Yeah tried that but now I'm explaining what an Evangelist is

# ? Jul 4, 2016 14:46

Adbot: ADBOT LOVES YOU

# ? Jun 6, 2024 12:42

gonadic io: Feb 16, 2011; >>=

geonetix posted:

Yeah tried that but now I'm explaining what an Evangelist is .

Um. Please tell me that you're not in a native English speaking country.

# ? Jul 4, 2016 15:02

Trabisnikof: Dec 24, 2005

gonadic io posted:

Um. Please tell me that you're not in a native English speaking country.

Most people don't consider evangelist a job outside the ministry

# ? Jul 4, 2016 15:08

A Man With A Plan: Mar 29, 2010; Fallen Rib

Security auditor maybe? Unless that's already a defined role in your org

# ? Jul 4, 2016 15:13

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

geonetix posted:

How would you call somebody in an organisation that does code review and educates their colleagues?

Just poking around, but I'm having so much trouble coming up with a proper function name for such a person. "Idiot" does not suffice

wizardsecurity engineer

# ? Jul 4, 2016 15:18

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://twitter.com/CthulhuSec/status/749952937493925888

# ? Jul 4, 2016 15:21

BattleMaster: Aug 14, 2000

good thing R'lyeh didn't sign an extradition treaty

# ? Jul 4, 2016 15:31

Pile Of Garbage: May 28, 2007

a sensible decision. get em now whilst the litigation is good!

# ? Jul 4, 2016 15:38

ahmeni: May 1, 2005; It's one continuous form where hardware and software function in perfect unison, creating a new generation of iPhone that's better by any measure.; Grimey Drawer

geonetix posted:

How would you call somebody in an organisation that does code review and educates their colleagues?

Just poking around, but I'm having so much trouble coming up with a proper function name for such a person. "Idiot" does not suffice

it sounds a bit dumb but Security Delivery Engineer is the right combo of words that lets you sneak in and help coding teams without being That Guy From Security Who Fucks Deliverables

# ? Jul 4, 2016 15:45

Wild EEPROM: Jul 29, 2011; oh, my, god. Becky, look at her bitrate.

security club promoter

# ? Jul 4, 2016 16:38

Pile Of Garbage: May 28, 2007

lol it's me! literally because holy gently caress it isn't that hard to secure IIS and your app for fucks sake yes i'm going to casually namedrop your project to secops for the glory of pissing all over others.

# ? Jul 4, 2016 16:42

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

geonetix posted:

How would you call somebody in an organisation that does code review and educates their colleagues?

Just poking around, but I'm having so much trouble coming up with a proper function name for such a person. "Idiot" does not suffice

"Director of No", to match my average historical experience

# ? Jul 4, 2016 16:44

fritz: Jul 26, 2003

BattleMaster posted:

good thing R'lyeh didn't sign an extradition treaty

not dead which eternal lie
but warrant servers will always try

# ? Jul 4, 2016 16:44

Midjack: Dec 24, 2007

geonetix posted:

How would you call somebody in an organisation that does code review and educates their colleagues?

Just poking around, but I'm having so much trouble coming up with a proper function name for such a person. "Idiot" does not suffice

"top of the layoff list" is how that seems to work

# ? Jul 4, 2016 16:48

Bhodi: Dec 9, 2007; Oh, it's just a cat.; Pillbug

geonetix posted:

How would you call somebody in an organisation that does code review and educates their colleagues?

Just poking around, but I'm having so much trouble coming up with a proper function name for such a person. "Idiot" does not suffice

dreamsmasher

# ? Jul 4, 2016 16:50

geonetix: Mar 6, 2011

Trabisnikof posted:

Most people don't consider evangelist a job outside the ministry

Truth. Also we're Dutch so.

A Man With A Plan posted:

Security auditor maybe? Unless that's already a defined role in your org

We have internal auditor and it seems to attract the wrong people.

ahmeni posted:

it sounds a bit dumb but Security Delivery Engineer is the right combo of words that lets you sneak in and help coding teams without being That Guy From Security Who Fucks Deliverables

Heh. We went with Software Security Engineer. But it's a bit of a mixup anyway.

Thanks everybody!

# ? Jul 4, 2016 17:24

Rothon: Jan 4, 2012

quote:

StartCom always try hard to provide best free SSL certificate service for worldwide customers, this is why we have released the StartEncrypt, but due to the time tight and lack strict test before release, there are many bugs in the current version of StartEncrypt, so we decide to stop this version and start to work for new version that based on ACME protocol, we think this is a best choice for more security and more transparency. Very thanks to all valuable feedback, we appreciate all help to improve our products.

https://www.startssl.com/NewsDetails?date=20160606&acme

# ? Jul 4, 2016 17:34

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

I want to clone Eddy Nigg so I can beat him soundly with a copy of himself

# ? Jul 4, 2016 17:42

Star War Sex Parrot: Oct 2, 2003

kalstrams posted:

now i can blame you for touching poop *cartoonishly laughs into hidden nsa microphone*

thanks

did you not read the article to go along with that github repo a few days ago?

http://bits-please.blogspot.com/2016/06/extracting-qualcomms-keymaster-keys.html

# ? Jul 4, 2016 17:54

fins: May 31, 2011; Floss Finder

https://github.com/Cr4sh/ThinkPwn

quote:

This code exploits 0day privileges escalation vulnerability (or backdoor?) in SystemSmmRuntimeRt UEFI driver (GUID is 7C79AC8C-5E6C-4E3D-BA6F-C260EE7C172E) of Lenovo firmware. Vulnerability is present in all of the ThinkPad series laptops, the oldest one that I have checked is X220 and the neweset one is T450s (with latest firmware versions available at this moment). Running of arbitrary System Management Mode code allows attacker to disable flash write protection and infect platform firmware, disable Secure Boot, bypass Virtual Secure Mode (Credential Guard, etc.) on Windows 10 Enterprise and do others evil things.

...

quote:

Vulnerable code of SystemSmmRuntimeRt UEFI driver was copy-pasted by Lenovo from Intel reference code for 8-series chipsets

Lenovo, not the bastion of security that we want, but the one we truly deserve.

# ? Jul 4, 2016 17:59

cinci zoo sniper: Mar 15, 2013

Star War Sex Parrot posted:

did you not read the article to go along with that github repo a few days ago?

http://bits-please.blogspot.com/2016/06/extracting-qualcomms-keymaster-keys.html

i did read a different article on it, slightly less involved

# ? Jul 4, 2016 19:20

jre: Sep 2, 2011; To the cloud ?

geonetix posted:

How would you call somebody in an organisation that does code review and educates their colleagues?

Dr No

# ? Jul 4, 2016 19:48

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

cylance and sophos are having a fist fight

https://blog.cylance.com/sophos-yet-so-far

quote:

This conversation has gone on long enough and wastes everyone's time. We don't game tests and never will. We strongly urge customers to test any solutions on their own systems and networks. It is the only truly independent and �real world� metric that ever matters.

Ryan Permeh
Cylance Chief Scientist and Founder

https://blogs.sophos.com/2016/06/29/thoughts-on-comparative-testing/

quote:

For months, Cylance has sought to dazzle audiences with its �Unbelievable� demonstration, staging well-choreographed battles against other IT security vendors, including Sophos. The exhibition ends with Cylance delivering near-perfect scores while everyone else (predictably) shows lackluster results. Yet when the playing field is leveled, and Cylance�s product comes under real scrutiny, the company cries foul, puts the fear of lawsuits into the minds of its partners, and accuses others of �smoke and mirrors� tactics.

At a recent Cylance presentation during an industry event in Las Vegas, one Sophos customer (from Chicago) in the audience asked to see how the Sophos product was configured for Cylance�s �Unbelievable� demo. On reviewing the settings, the customer discovered that key (and default) protection settings had been disabled. When the customer insisted that Cylance enable the proper default configuration and re-run the test, Sophos beat Cylance. The same behavior has been reported by multiple other vendors, including the disabling of everything other than hash lookups � an unfair test to say the least.

After seeing these demos and hearing numerous similar stories, we instructed our technical team to evaluate the Cylance claims so that we could test their validity. We focused on making the comparison fair, factual, and balanced using default and vendor-recommended settings. Sophos didn�t cherry pick or manipulate malware for the test.

Upon completing the testing, Sophos posted a video on YouTube outlining the results and showing real screen captures of the side-by-side testing. In fact, we deliberately went out of our way to be as transparent as possible.

After seeing the video online, Cylance contacted the reseller who provided access to the CylancePROTECT product, citing license compliance concerns and threatening �retribution� if the reseller involved did not demand that Sophos withdraw the video immediately; this left the reseller in fear of a lawsuit.

Given the importance of our partner relationships, at the request of the reseller and as a courtesy to them we chose to take down the video while we consider the best vehicle to provide the market with fair comparisons of Sophos� and Cylance�s products. Again, to be very clear: the only reason we elected to take the video down was because the reseller was concerned about threats and pressure from Cylance, not because we believed the video was somehow inaccurate. If Cylance was to agree to stop pressuring or threatening the reseller, we�d be happy to re-post the video for all to see. In the meantime, if you�d like to hear the facts behind the video, just reach out to a Sophos partner or a Sophos sales representative.

Cylance itself has acquired access to many other vendors� products, including Sophos, and has been using them in its own competitive testing in public demos, in violation of end user licenses. In fact, Cylance just renewed its licenses for Sophos products through one of our partners. When Cylance acquires our software we don�t threaten the reseller. Note that despite our efforts, to date, Cylance has been unwilling to allow us to license its products.

If you aspire to be a channel friendly IT security vendor, it�s not a good idea to bully your partners. Sophos is arguably the most channel-centric security vendor, as evidenced by sweeping the security-related CRN ARC awards for two consecutive years and counting. And we certainly didn�t get there by intimidating our partners.

As with any industry, IT security vendors sometimes make aggressive claims about what their products can do, and compare them to competitive products. Sometimes they are accurate and independently verifiable, sometimes less so. At Sophos, we have a long history of steadfastly adhering to one of our core company values � authenticity. It�s one of the key reasons we have built a base of more than 200,000 customers and over 20,000 reselling partners, and enjoy one of the highest customer satisfaction and renewal rates in the industry.

Sophos has not been contacted directly by Cylance to refute the results of our test. In the interest of fair play, we would welcome constructive conversation with Cylance to discuss our testing method and configurations used. If Cylance believes the configuration settings were somehow incorrect, we would be happy to reconfigure and rerun the test.

Cylance could also help the market assess the effectiveness of its product by participating in industry third-party tests. Cylance remains absent from virtually all public independent third-party tests (e.g., AV-TEST, AV Comparatives, SE Labs, NSS Labs, etc.). The one exception we are aware of was in December, 2015, when Cylance competed in AV-TEST�s independent analysis. Those test results were as follows:

On protection against certain types of malware, Cylance scored 5.5 out of 6. Sophos scored a perfect 6 out of 6
On performance Cylance scored 4 out of 6. Cylance had the second worst performance of all 11 vendors in the test. Sophos scored 5 out of 6 on the same test
And on the usability test, Cylance again scored 4 out of 6 with an alarming 26 false positives (the entire group average was 3, Sophos had 1). Sophos scored a 5.5 out of 6 on the test.
More recently (June, 2016), Sophos asked a reputable third-party tester, MRG Effitas, to run an independent comparative test using live, in-the-wild samples representing zero-day malware. This test used malware that was minutes old, not days or weeks old, and that hadn�t yet circulated widely, if at all. The results: Sophos blocked 97 percent while CylancePROTECT blocked 91 percent.

We believe that customers should be wary of vendors who fail to participate in public tests because there is no way to hold them publicly accountable for their marketing claims.

Despite Cylance�s claims to the contrary, our industry has evolved significantly over the years. The days of just using hashes as the primary mechanism for blocking malware have long since passed. Any leader in this industry has stayed current by successfully adapting to the threats at hand and continuously innovating. Industry leaders do not rely on one piece of technology but an ever-evolving set for complete protection.

Effective cybersecurity solutions are needed now more than ever. At Sophos that�s our passion. And as a representative of Sophos, it�s nice to be part of an organization that acts in good faith and values innovation, truth, and authenticity.

UPDATE: I mentioned an event in Chicago, but have corrected to clarify that the event was in Las Vegas and the customer was from Chicago.

# ? Jul 4, 2016 22:50

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

make that more of a slap fight

# ? Jul 4, 2016 22:53

Jewel: May 2, 2009

hey but look at this shitshow

:shittypop:

http://www.theregister.co.uk/2016/07/03/mri_software_bugs_could_upend_years_of_research/?mt=1467666616578

quote:

MRI software bugs could upend years of research

In this paper at PNAS, they write: �the most common software packages for fMRI analysis (SPM, FSL, AFNI) can result in false-positive rates of up to 70%. These results question the validity of some 40,000 fMRI studies and may have a large impact on the interpretation of neuroimaging results.�

...

That's not a gentle nudge that some results might be overstated: it's more like making a bonfire of thousands of scientific papers.

# ? Jul 4, 2016 22:53

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

OSI bean dip posted:

cylance and sophos are having a fist fight

https://blog.cylance.com/sophos-yet-so-far

https://blogs.sophos.com/2016/06/29/thoughts-on-comparative-testing/

lol

# ? Jul 4, 2016 23:00

spankmeister: Jun 15, 2008

My moneys on sophos because cylance are math nerds

# ? Jul 4, 2016 23:15

Graff: May 10, 2012

Jewel posted:

hey but look at this shitshow

http://www.theregister.co.uk/2016/07/03/mri_software_bugs_could_upend_years_of_research/?mt=1467666616578

lol

# ? Jul 4, 2016 23:33

Graff: May 10, 2012

Graff posted:

lol

verging on megalol

# ? Jul 4, 2016 23:36

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Jewel posted:

hey but look at this shitshow

http://www.theregister.co.uk/2016/07/03/mri_software_bugs_could_upend_years_of_research/?mt=1467666616578

but literally not figuratively to people this affects.

# ? Jul 4, 2016 23:40

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

geonetix posted:

How would you call somebody in an organisation that does code review and educates their colleagues?

Just poking around, but I'm having so much trouble coming up with a proper function name for such a person. "Idiot" does not suffice

Principal engineer. If your senior engineers aren't doing code reviews and mentoring junior engineers, :dogout:

immediately and don't look back.

# ? Jul 4, 2016 23:41

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://www.wired.com/2016/06/symantecs-woes-expose-antivirus-software-security-gaps/

quote:

Wysopal suggests security researchers may overlook security software because they�re too close to the problem. Many in this line of work are employed by other security firms, he says, �and they�re not going to attack their own. Maybe it doesn�t look good for a Symantec researcher to be publishing a flaw in McAfee.�

i have to keep my mouth shut about certain things i come across because i am affected by dumb ndas both past and present =/

# ? Jul 4, 2016 23:46

ahmeni: May 1, 2005; It's one continuous form where hardware and software function in perfect unison, creating a new generation of iPhone that's better by any measure.; Grimey Drawer

cheese-cube posted:

lol it's me! literally because holy gently caress it isn't that hard to secure IIS and your app for fucks sake yes i'm going to casually namedrop your project to secops for the glory of pissing all over others.

lol at security as gatekeepers instead of an integrated process in software development and deployment

# ? Jul 5, 2016 00:43

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

ahmeni posted:

lol at security as gatekeepers instead of an integrated process in software development and deployment

Lol at security as having any decision making power whatsoever in most software development and deployment.

:negative:

# ? Jul 5, 2016 01:04

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Volmarias posted:

Lol at security as having any decision making power whatsoever in most software development and deployment.

you gotta get in at the requirements stage. that does mean stating clear criteria for security characteristics though, which can be a more rigorous framing than security professionals usually undertake

# ? Jul 5, 2016 01:33

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

Subjunctive posted:

you gotta get in at the requirements stage. that does mean stating clear criteria for security characteristics though, which can be a more rigorous framing than security professionals usually undertake

# ? Jul 5, 2016 02:07

Tankakern: Jul 25, 2007

hm has anyone posted this yet? new vpn thingie

https://www.wireguard.io/

actually looks awesome, but what do i know

# ? Jul 5, 2016 15:05

Shame Boy: Mar 2, 2010

Tankakern posted:

hm has anyone posted this yet? new vpn thingie

https://www.wireguard.io/

actually looks awesome, but what do i know

i think someone posted it, if not i somehow got linked it in the last week or so

it seems like it was competently made but it's obviously super untested

# ? Jul 5, 2016 15:10

Perplx: Jun 26, 2004; Best viewed on Orgasma Plasma; Lipstick Apathy

yes it was mentioned a few pages back

ask me about making an 8 node full mesh network using openvpn

# ? Jul 5, 2016 15:13

Adbot: ADBOT LOVES YOU

# ? Jun 6, 2024 12:42

Shame Boy: Mar 2, 2010

Perplx posted:

yes it was mentioned a few pages back

ask me about making an 8 node full mesh network using openvpn

ok i will, cuz i tried once and failed

# ? Jul 5, 2016 15:47

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›366 »