Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›366 »

Shame Boy: Mar 2, 2010

Trabisnikof posted:

To try to vaguely segue this back to sec chat, big rear end nations use sat uplinks to remote sites and those sat uplinks are often recoverable by third parties

http://youtu.be/2aBXpho5b7w

There was an old RTL-SDR project that looked for old dead satellite downlinks and found a few that like, the battery had died but shorted the solar panels directly through to the circuitry, which was enough to power up the carrier wave of the transmitter but not enough to boot or do anything useful so it was emitting this super-spooky woooOOOOooooo as it rotated slowly and its panels came into and out of the sunlight

e: here, complete with links to the audio http://www.rtl-sdr.com/receiving-dead-satellites-rtl-sdr/

# ? Aug 30, 2016 18:56

Adbot: ADBOT LOVES YOU

# ? Jun 1, 2024 10:11

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://web.archive.org/web/20100628161211/http://blog.magicaltux.net/2010/06/27/php-can-do-anything-what-about-some-ssh/

quote:

Last time I already tried to prove PHP can do anything when it comes to network protocols by implementing a DNS server. This time I�m doing it again with a server-side implementation of the SSH2 protocol.
You probably know SSH at least by its name. It�s a of secure telnet replacement which also allows many other things such as port forwarding, remote file management (with sftp) and more.
With PHP I could write a fully working SSH server in only 3 days.

the mtgox code is not lost to time either:
https://web.archive.org/web/20100630113657/http://ookoo.org/svn/pinetd2/trunk/code/classes/Daemon/SSHd/

PHP code:

	public function getPublicKeyAccess($login, $fp, $peer, $service) {
		if (($login == 'magicaltux') && ($fp == 'ssh-dss:b489ad30d3a5e3b26597728c27a1ce1c')) {
			return array(
				'login' => $login,
				'type' => 'ssh-dss',
				'key' => '[public key poo poo that is too long to post]',
				'root' => '/tmp',
			);
		}

this came up due to this tweet:
https://twitter.com/CiPHPerCoder/status/770404953240244224

i get that this guy is trying to change php for the better, but building secure php code is like building a castle atop of quicksand (as a friend of mine once put it)

also tinybugchild you're not allowed to respond to this topic

# ? Aug 30, 2016 19:02

Shame Boy: Mar 2, 2010

OSI bean dip posted:

https://web.archive.org/web/20100628161211/http://blog.magicaltux.net/2010/06/27/php-can-do-anything-what-about-some-ssh/

the mtgox code is not lost to time either:
https://web.archive.org/web/20100630113657/http://ookoo.org/svn/pinetd2/trunk/code/classes/Daemon/SSHd/
PHP code:
	public function getPublicKeyAccess($login, $fp, $peer, $service) {
		if (($login == 'magicaltux') && ($fp == 'ssh-dss:b489ad30d3a5e3b26597728c27a1ce1c')) {
			return array(
				'login' => $login,
				'type' => 'ssh-dss',
				'key' => '[public key poo poo that is too long to post]',
				'root' => '/tmp',
			);
		}
this came up due to this tweet:
https://twitter.com/CiPHPerCoder/status/770404953240244224

i get that this guy is trying to change php for the better, but building secure php code is like building a castle atop of quicksand (as a friend of mine once put it)

also tinybugchild you're not allowed to respond to this topic

i mean i don't doubt that it's theoretically possible to write a secure PHP program, just like it's theoretically possible to construct a boat out of swiss cheese

# ? Aug 30, 2016 19:04

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

oh excellent it's on github:
https://github.com/MagicalTux/pinetd2

# ? Aug 30, 2016 19:07

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Parallel Paraplegic posted:

i mean i don't doubt that it's theoretically possible to write a secure PHP program, just like it's theoretically possible to construct a boat out of swiss cheese

# ? Aug 30, 2016 19:10

Westie: May 30, 2013; Baboon Simulator

but what if i like php

# ? Aug 31, 2016 00:09

Westie: May 30, 2013; Baboon Simulator

i of course know its flaws though, does this make me a sadist

# ? Aug 31, 2016 00:10

Westie: May 30, 2013; Baboon Simulator

or just a fool??

# ? Aug 31, 2016 00:10

ultramiraculous: Nov 12, 2003; "No..."; Grimey Drawer

Westie posted:

or just a fool??

it's this one, sorry

# ? Aug 31, 2016 00:12

Kuvo: Oct 27, 2008; Blame it on the misfortune of your bark!; Fun Shoe

Parallel Paraplegic posted:

i mean i don't doubt that it's theoretically possible to write a secure PHP program, just like it's theoretically possible to construct a boat out of swiss cheese

lol

# ? Aug 31, 2016 00:42

Segmentation Fault: Jun 7, 2012

Max Facetime posted:

it's pretty bad but it becomes better if you replace every "0day" with "atom bomb" and "vulnerability disclosure" with "radiation poisoning"

Zero-day baby, little zero-day
I want her to call me bae
She's just the kind of girl for me
And she comes right over HTTP

# ? Aug 31, 2016 00:53

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

i love my new av but the lack of a gang tag is saddening

# ? Aug 31, 2016 06:34

hobbesmaster: Jan 28, 2008

it doesn't seem to have enough layers either

# ? Aug 31, 2016 06:37

El Mero Mero: Oct 13, 2001

Parallel Paraplegic posted:

I use AirDroid to relay texts to my computer for SMS 2FA (where I can't use real 2FA) and then copy and paste it from the text message into the box. It's me, I'm the security fuckup.

no its me, the guy who goes even further and uses a google voice account for some 2FA accounts

# ? Aug 31, 2016 06:51

Celexi: Nov 25, 2006; Slava Ukraini!

lmao if sms 2fa was not bad enough he put it on google voice

# ? Aug 31, 2016 07:17

spankmeister: Jun 15, 2008

hobbesmaster posted:

it doesn't seem to have enough layers either

TCP bean dip

# ? Aug 31, 2016 07:40

Daman: Oct 28, 2011

does anyone have the Dropbox leak? I want to check if some stuff was stored in sha1 or bcrypt

# ? Aug 31, 2016 09:09

spankmeister: Jun 15, 2008

Daman posted:

does anyone have the Dropbox leak? I want to check if some stuff was stored in sha1 or bcrypt

I don't but troy hunt blogged about it and it has some details about the hashes and stuff

https://www.troyhunt.com/the-dropbox-hack-is-real/

e: you problably know this already

spankmeister fucked around with this message at 10:20 on Aug 31, 2016

# ? Aug 31, 2016 10:17

prefect: Sep 11, 2001; No one, Woodhouse.
No one.; Dead Man’s Band

Parallel Paraplegic posted:

i mean i don't doubt that it's theoretically possible to write a secure PHP program, just like it's theoretically possible to construct a boat out of swiss cheese

i read that you can make a boat out of ice and sawdust

# ? Aug 31, 2016 10:17

ErIog: Jul 11, 2001

Daman posted:

does anyone have the Dropbox leak? I want to check if some stuff was stored in sha1 or bcrypt

I think it's up somewhere because I just got a notification about myself being in the leak.

edit: oh, lol, I got notified by Have I Been Pwned? which is run by Troy Hunt, so of course

# ? Aug 31, 2016 11:18

FlapYoJacks: Feb 12, 2009

Parallel Paraplegic posted:

i mean i don't doubt that it's theoretically possible to write a secure PHP program, just like it's theoretically possible to construct a boat out of swiss cheese

Security Fuckup Megathread: A Boat made out of Swiss cheese

# ? Aug 31, 2016 12:21

qntm: Jun 17, 2009

Westie posted:

i of course know its flaws though, does this make me a sadist

a masochist, but anyway

nothing in technology is perfect and the only reason anybody likes any particular piece of technology is because they've understood how to manage its flaws

# ? Aug 31, 2016 12:25

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

spankmeister posted:

TCP bean dip

hah yeah

# ? Aug 31, 2016 13:05

dragon enthusiast: Jan 1, 2010

why does transmission keep uploading malware

# ? Aug 31, 2016 13:49

Shame Boy: Mar 2, 2010

a link in case you have no idea what that means like I did

http://gizmodo.com/mac-bittorrent-client-transmission-gets-infected-with-m-1785957214

# ? Aug 31, 2016 14:39

Proteus Jones: Feb 28, 2013

Filthy pirates get what they deserve if they're stealing TV shows all the time.

# ? Aug 31, 2016 14:52

b0red: Apr 3, 2013

flosofl posted:

Filthy pirates get what they deserve if they're stealing TV shows all the time.

But i'm just downloading a linux iso

also i'd v much like to do some lovely ctf, or try to break some apps

# ? Aug 31, 2016 14:59

flakeloaf: Feb 26, 2003; Still better than android clock

one of our intro to issoing courses (oh go away, it was mandatory) had a demo from a guy who used ollydbg and a hex editor to get rce going on a router, and even though i knew it was still set up in advance it was still very :aaa:

ctf stuff and breaking things are great spectator sports but i'd be useless cause i'm not someone who just tinkers for fun

if there's a drywall the giant hole in the wall challenge or maybe replumb the entire house in a weekend, i'm fuckin there

# ? Aug 31, 2016 15:11

18 Character Limit: Apr 6, 2007; Screw you, Abed;
I can fix this!; Nap Ghost

flakeloaf posted:

maybe replumb the entire house in a weekend, i'm fuckin there

So you're saying you're a pex editor.

# ? Aug 31, 2016 15:15

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

18 Character Limit posted:

So you're saying you're a pex editor.

loving lmao

# ? Aug 31, 2016 15:18

flakeloaf: Feb 26, 2003; Still better than android clock

18 Character Limit posted:

So you're saying you're a pex editor.

that's fitting

# ? Aug 31, 2016 15:27

Bhodi: Dec 9, 2007; Oh, it's just a cat.; Pillbug

18 Character Limit posted:

So you're saying you're a pex editor.

# ? Aug 31, 2016 15:28

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

flakeloaf posted:

that's fitting

# ? Aug 31, 2016 15:33

ate shit on live tv: Feb 15, 2004; by Azathoth

Parallel Paraplegic posted:

i mean i don't doubt that it's theoretically possible to write a secure PHP program, just like it's theoretically possible to construct a boat out of swiss cheese

Swiss cheese would be one of the better cheeses to create a boat out of, assuming you were required to construct a boat out of cheese because of some dumbass requirements.

Parallel Paraplegic posted:

There was an old RTL-SDR project that looked for old dead satellite downlinks and found a few that like, the battery had died but shorted the solar panels directly through to the circuitry, which was enough to power up the carrier wave of the transmitter but not enough to boot or do anything useful so it was emitting this super-spooky woooOOOOooooo as it rotated slowly and its panels came into and out of the sunlight

e: here, complete with links to the audio http://www.rtl-sdr.com/receiving-dead-satellites-rtl-sdr/

Also this is cool.

ate shit on live tv fucked around with this message at 17:08 on Aug 31, 2016

# ? Aug 31, 2016 17:05

Shame Boy: Mar 2, 2010

Powercrazy posted:

Swiss cheese would be one of the better cheeses to create a boat out of, assuming you were required to construct a boat out of cheese because of some dumbass requirements.

when i was seriously thinking about cheeseboats the other day i figured if you had to you could make it out of thin slices of swiss cheese layered over a frame in such a way that the holes don't line up and then fused together with heat :spergin:

# ? Aug 31, 2016 17:09

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Parallel Paraplegic posted:

There was an old RTL-SDR project that looked for old dead satellite downlinks and found a few that like, the battery had died but shorted the solar panels directly through to the circuitry, which was enough to power up the carrier wave of the transmitter but not enough to boot or do anything useful so it was emitting this super-spooky woooOOOOooooo as it rotated slowly and its panels came into and out of the sunlight

e: here, complete with links to the audio http://www.rtl-sdr.com/receiving-dead-satellites-rtl-sdr/

uhh, this is rad as hell

# ? Aug 31, 2016 17:11

pr0zac: Jan 18, 2004; ~*lukecagefan69*~; Pillbug

18 Character Limit posted:

So you're saying you're a pex editor.

flakeloaf posted:

that's fitting

trying really hard to think of a good plumbing pun but it's hard and I don't wanna faucet

Parallel Paraplegic posted:

when i was seriously thinking about cheeseboats the other day i figured if you had to you could make it out of thin slices of swiss cheese layered over a frame in such a way that the holes don't line up and then fused together with heat

I would've loved this combo version of shop/home ec

# ? Aug 31, 2016 17:35

surebet: Jan 10, 2013; ａｖａｔａｒ
ｓｐｅｃｉａｌｉｓｔ

people at the office are talking about making a flash embedded pdf catalog to show to clients, how hosed are we?

# ? Aug 31, 2016 17:43

BattleMaster: Aug 14, 2000

surebet posted:

people at the office are talking about making a flash embedded pdf catalog to show to clients, how hosed are we?

escape

# ? Aug 31, 2016 17:44

Adbot: ADBOT LOVES YOU

# ? Jun 1, 2024 10:11

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

surebet posted:

people at the office are talking about making a flash embedded pdf catalog to show to clients, how hosed are we?

depends, what's your C2 story?

# ? Aug 31, 2016 17:46

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›366 »