Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›366 »

Kuvo: Oct 27, 2008; Blame it on the misfortune of your bark!; Fun Shoe

Panty Saluter posted:

https://twitter.com/DetroitQSpider/status/750339961627566080

Remembering 192.168.1.1 is haaaaaaaaaard, so i use a public domain

daft punk railroad posted:

i need tp-link for my security hole

# ? Jul 5, 2016 20:45

Adbot: ADBOT LOVES YOU

# ? Jun 3, 2024 17:19

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

lmbo apple supremacy

# ? Jul 5, 2016 20:53

ultramiraculous: Nov 12, 2003; "No..."; Grimey Drawer

Parallel Paraplegic posted:

Literally me cuz they dropped support for the galaxy Nexus way early and I still have one at home

I mean I don't use it but I have one

i'm not sure how that counts? i mean i have a g1 in a closet somewhere running like froyo, but i don't number it among my many failures.

# ? Jul 5, 2016 21:28

Crust First: May 1, 2013; Wrong lads.

has anyone posted this password generator kickstarter yet? they've got a demo site!

# ? Jul 5, 2016 22:08

burning swine: May 26, 2004

Crust First posted:

has anyone posted this password generator kickstarter yet? they've got a demo site!

quote:

I got the idea because my dad was always forgetting his passwords and

okaaay

code:

var letters = "qwertyuiopasdfghjklzxcvbnm0123456789";
var symbols = "!@#$%^&*()-_+=";
var upperCases = "QWERTYUIOPASDFGHJKLZXCVBNM";

off to a good start

code:

function generatePassword(charSet, masterKey, seed) {
	var generator = masterKey + seed;
	var builder = "";

	var passwordSize = 8 + Math.abs(generator.charCodeAt(0) % 4);
	for (var i = 0; i < passwordSize; i++) {
		var first = Math.abs((i - 30) % generator.length);
		var second = Math.abs((8 - i * i / 2 - 5) % generator.length);
		var index = Math.abs((generator.charCodeAt(first) * generator.charCodeAt(second)) % charSet.length);
		builder += charSet.charAt(index);
	}
	return builder;
}

level of entropy: :ins:

# ? Jul 5, 2016 22:37

burning swine: May 26, 2004

my kickstarter: for only $500 i will send an email to everyone I know telling them to use mypasswordFacebook on facebook

# ? Jul 5, 2016 22:42

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://twitter.com/afreak/status/750446597670973440

i wonder if i can get him to walk into a trap

# ? Jul 5, 2016 22:50

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

like i get that he warns people that the passwords should not be used but at least make the demo show some level of competance

# ? Jul 5, 2016 22:51

spankmeister: Jun 15, 2008

OSI bean dip posted:

https://twitter.com/afreak/status/750446597670973440

i wonder if i can get him to walk into a trap

Do you find that this approach of asking loaded questions works?

# ? Jul 5, 2016 22:56

burning swine: May 26, 2004

spankmeister posted:

Do you find that this approach of asking loaded questions works?

if the goal is to goad the target into revealing further incompetence, then historically yes, it tends to work

# ? Jul 5, 2016 22:58

spankmeister: Jun 15, 2008

COACHS SPORT BAR posted:

if the goal is to goad the target into revealing further incompetence, then historically yes, it tends to work

woosh

# ? Jul 5, 2016 22:59

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Looks like it's working right here

# ? Jul 5, 2016 23:02

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://github.com/vedi0boy/seeed/commits/master

all those commits

# ? Jul 5, 2016 23:09

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

COACHS SPORT BAR posted:

if the goal is to goad the target into revealing further incompetence, then historically yes, it tends to work

OSI bean dip posted:

https://github.com/vedi0boy/seeed/commits/master

all those commits

Seeed's code is for viewing purposes only. It is open-source to build trust with it's users, not to give the code away. If you would like to use code that is used for Seeed, please send me an e-mail to vedioboy07-at-gmail-dot-com. Thank you

# ? Jul 5, 2016 23:10

Wiggly Wayne DDS: Sep 11, 2010

couldn't even be bothered to use letsencrypt

# ? Jul 5, 2016 23:13

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Wiggly Wayne DDS posted:

couldn't even be bothered to use letsencrypt

seems like startcom might be more his scene

# ? Jul 5, 2016 23:16

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Subjunctive posted:

seems like startcom might be more his scene

no. comodo's 90-day eval cert

# ? Jul 5, 2016 23:38

FlapYoJacks: Feb 12, 2009

I'm the code.js file.

# ? Jul 5, 2016 23:44

DrPossum: May 15, 2004; i am not a surgeon

COACHS SPORT BAR posted:

okaaay

code:

var letters = "qwertyuiopasdfghjklzxcvbnm0123456789";
var symbols = "!@#$%^&*()-_+=";
var upperCases = "QWERTYUIOPASDFGHJKLZXCVBNM";

off to a good start

code:

function generatePassword(charSet, masterKey, seed) {
	var generator = masterKey + seed;
	var builder = "";

	var passwordSize = 8 + Math.abs(generator.charCodeAt(0) % 4);
	for (var i = 0; i < passwordSize; i++) {
		var first = Math.abs((i - 30) % generator.length);
		var second = Math.abs((8 - i * i / 2 - 5) % generator.length);
		var index = Math.abs((generator.charCodeAt(first) * generator.charCodeAt(second)) % charSet.length);
		builder += charSet.charAt(index);
	}
	return builder;
}

level of entropy: :ins:

today i learned javascript apparently allows mod ops on floating point numbers

# ? Jul 6, 2016 00:02

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

DrPossum posted:

today i learned javascript apparently allows mod ops on floating point numbers

so does C, it just calls it `fmod`. no reason it couldn't have overloaded the way it overloads `+` and such (like Java does)

# ? Jul 6, 2016 00:07

fritz: Jul 26, 2003

DrPossum posted:

today i learned javascript apparently allows mod ops on floating point numbers

what other kind of numbers does javascript have

also floating point mod is perfectly fine for reducing thigns ot (-pi, pi)

# ? Jul 6, 2016 00:33

cinci zoo sniper: Mar 15, 2013

e: java != javascript

e2: hmm so javascript has just double float with inf/nan?

cinci zoo sniper fucked around with this message at 00:48 on Jul 6, 2016

# ? Jul 6, 2016 00:46

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

kalstrams posted:

e: java != javascript

e2: hmm so javascript has just double float with inf/nan?

+inf, -inf, +0, -0, NaN

# ? Jul 6, 2016 00:54

DrPossum: May 15, 2004; i am not a surgeon

i clearly know fuckall about javascript math, but when I see

code:

var second = Math.abs((8 - i * i / 2 - 5) % generator.length);
var index = Math.abs((generator.charCodeAt(first) * generator.charCodeAt(second)) % charSet.length);
builder += charSet.charAt(index);

i guess i'm just too locked into my past experience when I think second is an integer

from the pics thread

https://twitter.com/raganwald/status/750019151561797632

# ? Jul 6, 2016 01:02

ultramiraculous: Nov 12, 2003; "No..."; Grimey Drawer

kalstrams posted:

e2: hmm so javascript has just double float with inf/nan?

duh. what other fancy number types could you possibly need?!?

# ? Jul 6, 2016 01:06

DrPossum: May 15, 2004; i am not a surgeon

ultramiraculous posted:

duh. what other fancy number types could you possibly need?!?

the nonfancy number types that literally every digital computer from the dawn of time understands. not exclusively floating point which my playstation couldn't do. anyways, sorry for the programming chat derail. i hope someone else learned something

# ? Jul 6, 2016 01:13

ultramiraculous: Nov 12, 2003; "No..."; Grimey Drawer

i didn't learn anything, that's for sure

# ? Jul 6, 2016 01:17

cinci zoo sniper: Mar 15, 2013

Subjunctive posted:

+inf, -inf, +0, -0, NaN

oic, though im not sure what good is to have explicit -0 and +0 if +0 === -0. i mean, i get the division sign think for +- inf, but i imagine that could probably have been done in some different way too. anyways, terrible programming thread is for me showing blazing incompetence, rather than secfuc.

speaking of secfucks, here's something hopefully not yet discussed, a keylogger reverse engineered to an extent it's author got an e-mail

# ? Jul 6, 2016 01:19

Deep Dish Fuckfest: Sep 6, 2006; Advanced
Computer Touching; Toilet Rascal

DrPossum posted:

the nonfancy number types that literally every digital computer from the dawn of time understands.

i too long for binary coded decimal support in javascript

# ? Jul 6, 2016 01:27

nexous: Jan 14, 2003; I just want to be pure

kalstrams posted:

speaking of secfucks, here's something hopefully not yet discussed, a keylogger reverse engineered to an extent it's author got an e-mail

Neat. I wrote the email server being used by the attacker. Welp that's my contribution to this thread.

# ? Jul 6, 2016 01:33

Stabby McDamage: Dec 11, 2005; Doctor Rope

kalstrams posted:

oic, though im not sure what good is to have explicit -0 and +0 if +0 === -0. i mean, i get the division sign think for +- inf, but i imagine that could probably have been done in some different way too. anyways, terrible programming thread is for me showing blazing incompetence, rather than secfuc.

speaking of secfucks, here's something hopefully not yet discussed, a keylogger reverse engineered to an extent it's author got an e-mail

It has to do with how floats are represented. Integers elegantly have one representation per value. Floats are comparatively ugly: they're base-two scientific notation, so they have a sign field, a mantissa field, and an exponent field. As a natural consequence, you can represent +0 and -0. +inf, -inf, and NaN are special case interpretations of certain representations.

I have no doubt that floating point weirdness has hosed many a sec over the years.

# ? Jul 6, 2016 02:42

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Stabby McDamage posted:

It has to do with how floats are represented. Integers elegantly have one representation per value. Floats are comparatively ugly: they're base-two scientific notation, so they have a sign field, a mantissa field, and an exponent field. As a natural consequence, you can represent +0 and -0. +inf, -inf, and NaN are special case interpretations of certain representations.

I have no doubt that floating point weirdness has hosed many a sec over the years.

Fire anyone who says floats are for currency

# ? Jul 6, 2016 03:07

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

do you guys remember trillian https://www.trillian.im/help/trillian-blog-and-forums-security-incident/

# ? Jul 6, 2016 03:40

Segmentation Fault: Jun 7, 2012

anthonypants posted:

do you guys remember trillian https://www.trillian.im/help/trillian-blog-and-forums-security-incident/

this sec fuckup really whips the llama's rear end

# ? Jul 6, 2016 03:42

Pile Of Garbage: May 28, 2007

just been catching up on the thread, lolling at the tplinklogin.net thing however it's not as big a deal as you'd think as it's just being squatted by these dinguses: http://www.trellian.com/

# ? Jul 6, 2016 03:48

Panty Saluter: Jan 17, 2004; Making learning fun!

anthonypants posted:

do you guys remember trillian https://www.trillian.im/help/trillian-blog-and-forums-security-incident/

2003 up in hurr

# ? Jul 6, 2016 04:10

JewKiller 3000: Nov 28, 2006; by Lowtax

holy poo poo trillian still exists?

# ? Jul 6, 2016 05:48

ErIog: Jul 11, 2001

Anyone happen to know if any mail-credential-stealing Mac viruses are going around right now?

Somebody here had their credentials compromised and their account was sending out lots of spam. Now I'm fairly certain the dude just got his creds stolen legit since he uses the same weak password everywhere for everything. Yet, my boss claims that the last spam email sent out of the account was AFTER I did a password reset.

There are some attack surfaces I can find on the machine due to old rear end software, but it all seems really unlikely.

It's Canadian Pharmacy spam, by the way.

edit: There's very few attack vectors on the machine. If it's a virus it's real new or real targeted. My boss is still having me write it up as a virus infection though because the work on his end to look at the logs to rule out a brute force password attack(it was real real weak originally and pretty weak after the password change) is too much so instead I get to obsessively document the entire software stack and pretend there was an attack vector that's legit.

The thing I hate the most is that it is theoretically possible this is some kind of malware due to the browser history in question and Flip4Mac + WMV being involved, but my heart tells me nothing of the sort happened.

On the one hand, if I had mail server access I could end this charade real quick. On the other hand I would become the mail server admin at that point, and my boss seems to want to do that for some weird kinky reason.

ErIog fucked around with this message at 15:04 on Jul 6, 2016

# ? Jul 6, 2016 07:32

qntm: Jun 17, 2009

COACHS SPORT BAR posted:

code:

function generatePassword(charSet, masterKey, seed) {
	var generator = masterKey + seed;
	var builder = "";

	var passwordSize = 8 + Math.abs(generator.charCodeAt(0) % 4);
	for (var i = 0; i < passwordSize; i++) {
		var first = Math.abs((i - 30) % generator.length);
		var second = Math.abs((8 - i * i / 2 - 5) % generator.length);
		var index = Math.abs((generator.charCodeAt(first) * generator.charCodeAt(second)) % charSet.length);
		builder += charSet.charAt(index);
	}
	return builder;
}

I like the 8 - i * i / 2 - 5

# ? Jul 6, 2016 13:10

Adbot: ADBOT LOVES YOU

# ? Jun 3, 2024 17:19

ate shit on live tv: Feb 15, 2004; by Azathoth

COACHS SPORT BAR posted:

if the goal is to goad the target into revealing further incompetence, then historically yes, it tends to work

A powerful self-own.

Is TP-Link widely deployed? I'd never heard of it.

# ? Jul 6, 2016 16:18

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›366 »