Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›366 »

Powerful Two-Hander: Mar 10, 2004; Mods please change my name to "Tooter Skeleton" TIA.

oh cool i lost my last.fm password, now i don't have to bother reclaiming it

DreddyMatt posted:

A friend of mine was trying to get planning permission to renovate a flat he'd bought in the historical centre of a city. he spent 6+ months trying to get his paperwork sorted out. eventually he grew tired of that game, spoke to a politician friend of his and got his paperwork a week later

i only got some stuff that i was waiting for my local council to do done because i wrote a formal complaint to my local councillor who had an axe to grind and he went nuclear on them and emailed the head of their entire legal department to prioritise my case.

just threatening a formal complaint works for public services as well because complaints gently caress up their statistics #firstworldhacks

# ? Sep 7, 2016 18:06

Adbot: ADBOT LOVES YOU

# ? Jun 6, 2024 22:05

Bhodi: Dec 9, 2007; Oh, it's just a cat.; Pillbug

Midjack posted:

federal it, checks out

yep, 100℅ shitshow and of course jeff is still there and in fact got promoted twice since the start of it

# ? Sep 7, 2016 18:07

Shaggar: Apr 26, 2006

Bhodi posted:

Anyone else read the OPM report? It's dry but you should check out chapter 5

jeff (IT director and all around scumbag) is told he has malware by cylance, goes "poo poo this could be bad, let's get a second opinion and also make it a blind test and not tell them we know anything", then brings in cytech who goes "Uh so we found malware on what you said was a quarantined network but it kind of looks like a non-quarantined active production network and our CEO says to give you some free services because these are literally the systems his clearance information sit on" then jeff decided to try and cover it up, misled a select committee about cytech's role in discovery and instructed staff to wipe all the cytech servers that had logs and forensic images and ship them back even while an investigation was in progress spawned from the NYT leak story and the committee hearing

the government should not be allowed to keep records with any sensitive data

# ? Sep 7, 2016 18:37

burning swine: May 26, 2004

YeOldeButchere posted:

how's the security for this sort of rfid biometric data storage anyway?

i'll be honest, i'm asking half out of curiosity, and half because i expect it to be terrible and hilarious

terrible and hilarious, in almost every case. One-way transformations of biometric data exist, work, are cryptographically secure just like a hash, but nearly nobody is using them. I worked for a startup just out of college that offered this exact service, and naturally, it flopped because none of our potential customers (including government) could be made to understand why they need to be doing things that way.

YeOldeButchere posted:

no one has adequately solved the fingerprint revocation problem either, as far as i know

In fact that problem has been solved, the transformed biotokens can be revoked and new (but different) ones generated from the same finger/iris/whatever.

I wrote my master's thesis on this poo poo, I could yak about it for hours. I made a giant post about biometrics in one of the previous secfuck threads, but it was like a year ago and I don't know how to find it

# ? Sep 7, 2016 20:58

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Cowboy Mark posted:

A vendor pitched this 1million bit encryption thingy to us:

http://www.cubeitz.com/next-level-security/

1 million bits :smug:

# ? Sep 7, 2016 21:33

burning swine: May 26, 2004

oh hey it was actually pretty easy to find

quote:

When stored digitally, fingerprints are nearly _always_ stored as a simple series of minutiae points which are just sets of 3 numbers: x/y coordinates and 'theta', which represents the angle, e.g. which direction that particular feature is facing. Some new systems include a fourth value for curvature' but almost nobody is using this.

Visualized, a minutiae field on top of a fingerprint looks like this:

In the world of digital biometrics, storing an actual image of the fingerprint is tantamount to storing a password in plain text. It's a stupid babby mistake that absolutely nobody should be making. The flashing fingerprints on computer screens you see on CSI are total bunk.

Nearly all matching is based loosely around an ancient algorithm called "Bozorth" which iterates each individual minutia point in both candidate fingerprints, compares distance and angle to all nearby points, and arrives at a cumulative distance score. Here's what it looks like for one minutia point on 2 fingerprints:

It has to be done this way because fingerprints differ significantly from one impression to the next, even when they are the same finger. Skin stretches, people get scratches or cuts, people age, etc. For 1:1 (e.g. 'verification') Matching accuracy is very good. For 1:N (e.g. identification') it can be pretty accurate, but still depends on the quality and size of the fingerprint DB. False positives are definitely possible. As mentioned before, the threshold for a distance score that qualifies as a match is basically just an arbitrary confidence level which was predetermined statistically.

Naturally the biggest concern is storing these strings of minutia securely, because they contain enough data for an attacker to reconstruct a fingerprint just from the minutia. There are some very good systems out there that can perform essentially a one-way transformation on the data, like a hash, but still retaining the ability to perform 'fuzzy' matching with new samples that are not 100% identical. I wrote my master's thesis in CS on the subject. The stuff works, but nobody is using it because so far there's no demand anywhere that biometrics be handled securely, and there probably never will be. I was working for a biometrics security startup at the time which was trying to market one of these solutions, and we predictably failed and went out of business.

Anyway that's my fingerprint derail hope you liked it

To elaborate slightly on storage: remember that you need to store a thing of some sort which you can compare new fingerprints against (the process is actually identical for fingerprint, iris, face, etc). This original impression is called the 'gallery' entry, and new impressions are called 'probes'. When someone claiming to be joe schmoe asks to be verified by the biometric system, he puts his finger down and the scanner creates a new impression to compare against the stored gallery entry.

When it comes down to the storage of this gallery entry, there's 4 approaches:

1. Use a cool algorithm like the one I worked on which can give a yes/no response without actually storing any of the original fingerprint minutiae or any data that can be used to recover said data. There are multiple libraries for doing this. Analogy: Hashed+salted password. ISO has a standard that describes this: ISO-24745
2. Store raw minutiae points with reversible encryption and some kind of certificate system. This is better than nothing, but still exposes biometric data to possible recovery because the crypto is reversible. Analogy: reversibly encrypted passwords. EU's BSI TR-03110 falls into this category.
3. Store raw minutiae triplets without encryption, because it's just like, numbers, man. The problem here is that minutiae can be trivially used to reconstruct a facsimile of the original fingerprint. Analogy: ROT13'd passwords
4. Store a literal loving picture of your user's fingerprint, because you're an idiot. This still happens alarmingly often. As recently as last year HTC got caught storing bitmaps of their users fingerprints in user-accessible space on their android phones. Analogy: Plaintext passwords, hand written by a drooling idiot

The vaaaaast majority of biometric systems out there now are doing either #2 or #3, and #4 isn't exactly rare either. Naturally, nobody is ever willing to talk about the security of their backend, ever. Part of my thesis was comparison to existing systems that claim to do the same or a similar thing, which lead to this, my favorite passage:

quote:

I was able to locate only one other example of currently deployable web-enabled biometric authentication: A software development kit called �Bio-Plugin��, created by a company called M2Sys. Bio-Plugin provides te ability to authenticate users against a remote server through a web interface designed to be incorporated into existing web services, and is compatible only with biometric scanners produced by M2Sys. Notably, these devices are not limited to fingerprint biometrics.

As the necessary information pertaining to security and privacy was not forthcoming in the publically available marketing materials on the M2Sys website, I initiated direct contact with the company. Through numerous conversations with M2Sys representatives, I attempted to learn the details of the biometric record storage and verification system employed by Bio-Plugin but was ultimately unsuccessful. Representatives of the company were able to provide only a high-level description of the workings of the system. It was made clear that during matching, probe records are collected on the client, and transmitted in some fashion to a remote server for matching and identity verification. M2Sys�s representatives repeatedly stressed that raw images of fingerprints (or other supported biometrics) are never transmitted or stored, but were unable to provide any further details regarding the nature of the biometric templates used or the communication protocols used to transfer them. Responding to an inquiry regarding ISO-24745 ([26], a standard defining security and privacy considerations for biometric systems - see section 5), a representative of M2Sys indicated that Bio-Plugin was not compliant with the standard. This author was directed eventually to [27], a whitepaper that briefly describes the template creation process employed by M2Sys. In this paper, an author of dubious authority makes the claim that it would be �nearly impossible� to recreate the original biometric image using the stored template, but does not elaborate on this reasoning. No mention of the revocability of these templates is present, nor was I able to make such a determination through repeated correspondence with representatives of M2Sys.

In the absence of the transparency necessary to make an educated decision regarding the security and privacy properties of the Bio-Plugin software, and considering the extreme consequences of compromised biometric features, and the increased likelihood of such an incident in a web-enabled system, I am forced to conclude that Bio-Plugin software cannot be assumed to be safe, secure, or private until sufficient evidence to the contrary is made available.

# ? Sep 7, 2016 21:34

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

lol I bet they're generating 4,000 aes256 keys and chaining it all together

# ? Sep 7, 2016 21:36

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

I don't even what to think about the cpu time it would take to transmit 125kB of keys over DH

# ? Sep 7, 2016 21:38

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://twitter.com/AsherLangton/status/773622483576467456

# ? Sep 7, 2016 21:43

hobbesmaster: Jan 28, 2008

OSI bean dip posted:

https://twitter.com/AsherLangton/status/773622483576467456

jesus.

loving.

christ.

# ? Sep 7, 2016 21:44

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://twitter.com/AsherLangton/status/773622636865662977

https://twitter.com/AsherLangton/status/773622962888904704

and i have already downloaded their app

# ? Sep 7, 2016 21:45

Kuvo: Oct 27, 2008; Blame it on the misfortune of your bark!; Fun Shoe

OSI bean dip posted:

https://twitter.com/AsherLangton/status/773622483576467456

OSI bean dip posted:

https://twitter.com/AsherLangton/status/773622636865662977

https://twitter.com/AsherLangton/status/773622962888904704

and i have already downloaded their app

# ? Sep 7, 2016 21:48

burning swine: May 26, 2004

lmfao that 'security through obscurity' bit

# ? Sep 7, 2016 21:48

Thanks Ants: May 21, 2004; #essereFerrari

Er guys I think it's legit, just see this watertight presentation

https://www.youtube.com/watch?v=ISYyB3cTR3k

# ? Sep 7, 2016 21:53

Panty Saluter: Jan 17, 2004; Making learning fun!

OSI bean dip posted:

https://twitter.com/AsherLangton/status/773622636865662977

https://twitter.com/AsherLangton/status/773622962888904704

and i have already downloaded their app

# ? Sep 7, 2016 21:53

Phone: Jul 30, 2005; 親子丼をほしい。

i got a word salad bingo!

# ? Sep 7, 2016 21:54

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

OSI bean dip posted:

https://twitter.com/AsherLangton/status/773622483576467456

# ? Sep 7, 2016 22:29

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

COACHS SPORT BAR posted:

oh hey it was actually pretty easy to find

To elaborate slightly on storage: remember that you need to store a thing of some sort which you can compare new fingerprints against (the process is actually identical for fingerprint, iris, face, etc). This original impression is called the 'gallery' entry, and new impressions are called 'probes'. When someone claiming to be joe schmoe asks to be verified by the biometric system, he puts his finger down and the scanner creates a new impression to compare against the stored gallery entry.

When it comes down to the storage of this gallery entry, there's 4 approaches:

1. Use a cool algorithm like the one I worked on which can give a yes/no response without actually storing any of the original fingerprint minutiae or any data that can be used to recover said data. There are multiple libraries for doing this. Analogy: Hashed+salted password. ISO has a standard that describes this: ISO-24745
2. Store raw minutiae points with reversible encryption and some kind of certificate system. This is better than nothing, but still exposes biometric data to possible recovery because the crypto is reversible. Analogy: reversibly encrypted passwords. EU's BSI TR-03110 falls into this category.
3. Store raw minutiae triplets without encryption, because it's just like, numbers, man. The problem here is that minutiae can be trivially used to reconstruct a facsimile of the original fingerprint. Analogy: ROT13'd passwords
4. Store a literal loving picture of your user's fingerprint, because you're an idiot. This still happens alarmingly often. As recently as last year HTC got caught storing bitmaps of their users fingerprints in user-accessible space on their android phones. Analogy: Plaintext passwords, hand written by a drooling idiot

The vaaaaast majority of biometric systems out there now are doing either #2 or #3, and #4 isn't exactly rare either. Naturally, nobody is ever willing to talk about the security of their backend, ever. Part of my thesis was comparison to existing systems that claim to do the same or a similar thing, which lead to this, my favorite passage:

also this is a kickin' rad post

# ? Sep 7, 2016 22:29

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

it's written in realbasic

# ? Sep 7, 2016 22:35

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

OSI bean dip posted:

it's written in realbasic

lmbo

# ? Sep 7, 2016 22:39

Thanks Ants: May 21, 2004; #essereFerrari

Snapchat A Titty posted:

lmbo

# ? Sep 7, 2016 22:43

Shame Boy: Mar 2, 2010

OSI bean dip posted:

it's written in realbasic

is it byte-level compiled on the server at the lowest possible place and heavily encrypted though

# ? Sep 7, 2016 22:43

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://twitter.com/afreak/status/773641837626007552

# ? Sep 7, 2016 23:00

Thanks Ants: May 21, 2004; #essereFerrari

tell me that the server connection happens in plaintext

# ? Sep 7, 2016 23:03

Winkle-Daddy: Mar 10, 2007

OSI bean dip posted:

https://twitter.com/afreak/status/773641837626007552

set phasers to pwn

# ? Sep 7, 2016 23:09

Shame Boy: Mar 2, 2010

OSI bean dip posted:

https://twitter.com/afreak/status/773641837626007552

is that an animated scrolly number border around the edge i see

this thing is amazing

e: oh it's just your console and the thing has a weird borderless window I guess?

# ? Sep 7, 2016 23:10

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

everything is plaintext http

# ? Sep 7, 2016 23:10

Shame Boy: Mar 2, 2010

OSI bean dip posted:

everything is plaintext http

# ? Sep 7, 2016 23:12

FlapYoJacks: Feb 12, 2009

OSI bean dip posted:

everything is plaintext http

Security Fuckup Megathread - v12.1.4 - everything is plaintext http

# ? Sep 7, 2016 23:15

mod saas: May 4, 2004; Grimey Drawer

OSI bean dip posted:

it's written in realbasic

i will not be convinced that this is anything other than realplayer + visual basic

# ? Sep 7, 2016 23:15

Thanks Ants: May 21, 2004; #essereFerrari

OSI bean dip posted:

everything is plaintext http

# ? Sep 7, 2016 23:16

surebet: Jan 10, 2013; ａｖａｔａｒ
ｓｐｅｃｉａｌｉｓｔ

YeOldeButchere posted:

no one has adequately solved the fingerprint revocation problem either, as far as i know

pshaw, sure they did

# ? Sep 7, 2016 23:18

McGlockenshire: Dec 16, 2005; GOLLOCKS!

OSI bean dip posted:

everything is plaintext http

well I was going to quote the old version of this post where you said they were making it hard to debug things and I was going to snark that maybe they were good at at least one thing but welp

# ? Sep 7, 2016 23:18

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Parallel Paraplegic posted:

is that an animated scrolly number border around the edge i see

this thing is amazing

e: oh it's just your console and the thing has a weird borderless window I guess?

that's the plaintext for the latest bletchley boffins challenge

# ? Sep 7, 2016 23:26

Thanks Ants: May 21, 2004; #essereFerrari

anthonypants posted:

that's the plaintext for the latest bletchley boffins challenge

the challenge text was generated by this product, OSI kept it quiet for a few weeks and now is dropping clues in this thread

# ? Sep 7, 2016 23:28

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

McGlockenshire posted:

well I was going to quote the old version of this post where you said they were making it hard to debug things and I was going to snark that maybe they were good at at least one thing but welp

there are some headaches in RE'n this poo poo but we're still figuring out things

i've already tested the crypto out that said

# ? Sep 7, 2016 23:28

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Parallel Paraplegic posted:

is that an animated scrolly number border around the edge i see

this thing is amazing

e: oh it's just your console and the thing has a weird borderless window I guess?

i have it open in bin ninja

# ? Sep 7, 2016 23:30

qntm: Jun 17, 2009

dear security thread, I am going to bletchley park on friday, anything in particular I should look out for

# ? Sep 7, 2016 23:38

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

qntm posted:

dear security thread, I am going to bletchley park on friday, anything in particular I should look out for

take photos

# ? Sep 7, 2016 23:41

Adbot: ADBOT LOVES YOU

# ? Jun 6, 2024 22:05

burning swine: May 26, 2004

lol but their awful promo video said the million-bit key was downloaded via a 4096-bit encrypted connection

anthonypants posted:

that's the plaintext for the latest bletchley boffins challenge

qntm posted:

dear security thread, I am going to bletchley park on friday, anything in particular I should look out for

pick me up a boffin

# ? Sep 7, 2016 23:42

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›366 »