Security Fuckup Megathread - v13.69 - plugins may violate privacy

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »

dpkg chopra: Jun 9, 2007; Fast Food Fight; Grimey Drawer

Volmarias posted:

Well, that's easy to solve, just have one of them click on a phishing email and all of their emails will be encrypted.

ransomware: still more secure than symantec products

# ? Mar 3, 2017 20:51

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 19:49

flakeloaf: Feb 26, 2003; Still better than android clock

using a flagship product actually called sep11

# ? Mar 3, 2017 21:25

Powerful Two-Hander: Mar 10, 2004; Mods please change my name to "Tooter Skeleton" TIA.

flakeloaf posted:

using a flagship product actually called sep11

clever marketing i guess because you'll never forget it

# ? Mar 3, 2017 22:00

Doom Mathematic: Sep 2, 2008

Powerful Two-Hander posted:

permanently secure, foreverally encrypted and fully loving it

"You'll be pleased to hear that I installed Cryptolocker on all of our Windows machines."

"You mean BitLocker?"

"Huh?"

# ? Mar 3, 2017 22:02

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Powerful Two-Hander posted:

clever marketing i guess because you'll never forget it

JFC

# ? Mar 3, 2017 22:04

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

Powerful Two-Hander posted:

clever marketing i guess because you'll never forget it

Volmarias posted:

JFC

flakeloaf posted:

using a flagship product actually called sep11

is that loving why its called that?

# ? Mar 3, 2017 22:08

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Powaqoatse posted:

is that loving why its called that?

symantec endpoint protection 11

# ? Mar 3, 2017 22:10

Kuvo: Oct 27, 2008; Blame it on the misfortune of your bark!; Fun Shoe

this probably goes here

https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-authorities.html?smid=tw-nytimes&smtyp=cur

quote:

SAN FRANCISCO � Uber has for years engaged in a worldwide program to deceive the authorities in markets where its low-cost ride-hailing service was being resisted by law enforcement or, in some instances, had been outright banned.

quote:

Uber�s use of Greyball was recorded on video in late 2014, when Erich England, a code enforcement inspector in Portland, Ore., tried to hail an Uber car downtown as part of a sting operation against the company.

At the time, Uber had just started its ride-hailing service in Portland without seeking permission from the city, which later declared the service illegal. To build a case against the company, officers like Mr. England posed as riders, opening the Uber app to hail a car and watching as miniature vehicles on the screen made their way toward the potential fares.

But unknown to Mr. England and other authorities, some of the digital cars they saw in the app did not represent actual vehicles. And the Uber drivers they were able to hail also quickly canceled. That was because Uber had tagged Mr. England and his colleagues � essentially Greyballing them as city officials � based on data collected from the app and in other ways. The company then served up a fake version of the app populated with ghost cars, to evade capture.

# ? Mar 3, 2017 22:12

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

anthonypants posted:

symantec endpoint protection 11

erp sorry

# ? Mar 3, 2017 22:14

Shaggar: Apr 26, 2006

Kuvo posted:

this probably goes here

https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-authorities.html?smid=tw-nytimes&smtyp=cur

that rules

# ? Mar 3, 2017 22:15

flakeloaf: Feb 26, 2003; Still better than android clock

anthonypants posted:

symantec endpoint protection 11

it's like a hip hop yakkety sax anti-virus system

# ? Mar 3, 2017 22:24

Thanks Ants: May 21, 2004; #essereFerrari

Powerful Two-Hander posted:

clever marketing i guess because you'll never forget it

# ? Mar 3, 2017 22:59

SwampDonkey: Oct 13, 2006; by Smythe
(and can't post for 4 years!)

In keeping with the topic of ransomware:

https://twitter.com/BNONews/status/837786577669586946

# ? Mar 3, 2017 23:09

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

apseudonym posted:

I would break TZ for this shirt

you'd break TZ for the fun of it

# ? Mar 3, 2017 23:49

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Kuvo posted:

this probably goes here

https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-authorities.html?smid=tw-nytimes&smtyp=cur

Yow.

# ? Mar 4, 2017 04:12

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

quote:

SwampDonkey posted:
In keeping with the topic of ransomware:

https://twitter.com/BNONews/status/837786577669586946

� CNN

�Wikipedia

# ? Mar 4, 2017 04:18

Midjack: Dec 24, 2007

Kuvo posted:

this probably goes here

https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-authorities.html?smid=tw-nytimes&smtyp=cur

i intensely dislike uber and their ilk for a variety of reasons but that's still pretty great

# ? Mar 4, 2017 04:51

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

"you have to say if you're a cop", but instead we figure it out based on us spying on you

# ? Mar 4, 2017 05:02

Proteus Jones: Feb 28, 2013

Jabor posted:

"you have to say if you're a cop", but instead we figure it out based on us spying on you

I'm absolutely convinced the police themselves are the root of this bit of truthiness.

# ? Mar 4, 2017 05:13

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

Jabor posted:

"you have to say if you're a cop", but instead we figure it out based on us spying on you

lmbo

pre:

Welcome to...
           _   _                  ____        _
          | | | | ____ _   _     /  __\ ____ | |_
          \ `-� // ,. \ | | |    | / _ / ,. \|  _|
           `, .� | L| | |_| |    | \_||| L| || |_
 ____  _    |_|  \____/\__,_|    \____/\____/\___|        _ TM
|  _ \(_) ___  ___ ____ _,__ _,__  ___  ___ | |_  ___  __| |
| | \ \ |/ __|/  _| ,. \ ,. \ ,. \/ _ \/  _||  _|/ _ \/ _` |
| |_/ / |\__ \| (_| L| I || | || |  __/| (_ | |_ | __/ (_| |
|____/|_||___/\___^____/_||_|_||_|\___|\___/\___|\___|\__,_|

                        Backup Server
                   [Admined by � Carth� �]

   We have all the latest in Warez & Mp3z. Mac of course.
                 Come & Look, You'll Like it

By  clicking the  "Agree"  button, you agree to all of the
following conditions and rules:

  � I am not  in any way affiliated with any government or
    law-enforcement agency. That includes me not reporting
    this server to any of those.

  � This server is strictly for  backup purposes. By down-
    loading, I agree to that I have ownership of a license
    to the files. If I do not own a license, the files are
    considered  for  evaluation  purposes,  and should  be
    deleted  within 24 hours.  I am aware that if I choose
    not to do so, I violate applicaple copyright laws.

  � As this is a backup server, I may back my own files up
    here.  The admin is in no way responsible for what the
    users  choose to upload.  To his knowledge, all  users
    here own a license to the software they backup to this
    server.  The requests  here are  not  necessarily  the
    requests of the admin,  but can as well be requests of
    the members who wants a backup of the files they own.

  � As  this  server does not have unlimited bandwidth,  I
    will  have to queue my transfers.  An exception is up-
    loads,  which can  be at  the same  time as downloads.
    Several  connections  from  the  same  IP  may  not be
    established.

  � Downloading without uploading ("Leeching") is not good
    netiquette. If I have no requests to upload, I am per-
    mitted to upload something i like, though. Accounts to
    other  servers  will be  accepted as  a substitute for
    uploading.

  � Posting  unimportant news ("Spamming")  or saying  the
    same  thing in the chat over and over ("Flooding") are
    neither examples of good netiquette.  Therefore,  this
    is not allowed at all on this server.

  � I have read the agreement.  If I did not read it, I am
    without rights on this server.  Also, if I violate the
    agreement  in  any  way,  I loose  the rights  on this
    server.
                             ____              _    _
                            /  __\  __ _ ____ I |_ | |  TM
                        _   | /    / _` | ,. \I  _|| |_    _
                       (_)  | \___| (_| | `� /I |  | ,.`, (_)
                            \____/ \__,_|_|\_\\__\ |_||_|

Agreement v. 2.1

# ? Mar 4, 2017 05:24

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

loving hell late 90s me was kindof an rear end in a top hat

# ? Mar 4, 2017 05:25

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

I loose the rights

# ? Mar 4, 2017 05:49

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

infernal machines posted:

I loose the rights

pls dont flood or spam

# ? Mar 4, 2017 06:08

Phone: Jul 30, 2005; 親子丼をほしい。

Kuvo posted:

this probably goes here

https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-authorities.html?smid=tw-nytimes&smtyp=cur

whoa whoa whoa whoa

uber doing something to skirt the law?

# ? Mar 4, 2017 06:21

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

zen buddhism for the new millenium:

if you see a travis kalanick on your road, kill him.

# ? Mar 4, 2017 06:45

Carbon dioxide: Oct 9, 2012

So this is new http://blog.talosintelligence.com/2017/03/dnsmessenger.html

# ? Mar 4, 2017 11:23

A Man With A Plan: Mar 29, 2010; Fallen Rib

welp

Trump Inherits a Secret Cyberwar Against North Korean Missiles https://nyti.ms/2lHz4E9

# ? Mar 4, 2017 16:19

Thanks Ants: May 21, 2004; #essereFerrari

he's got giuliani and his son or whoever it was so everything will be fine

# ? Mar 4, 2017 16:41

ynohtna: Feb 16, 2007; backwoods compatible; Illegal Hen

no need to worry, we have it on good authority that "It won't happen!"

# ? Mar 4, 2017 16:51

Dex: May 26, 2006; Quintuple x!!!

Would not escrow again.

VERY MISLEADING!

fake nukes

# ? Mar 4, 2017 17:29

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Dex posted:

fake nukes

# ? Mar 4, 2017 19:12

Carbon dioxide: Oct 9, 2012

some app sales page posted:

Privacy is a priority to us: We think twice about what data we store and all data is stored cloud-free in Germany, protected by German privacy laws.

# ? Mar 4, 2017 19:59

Shame Boy: Mar 2, 2010

lol good, I lust for cloud death

# ? Mar 4, 2017 21:17

Midjack: Dec 24, 2007

cloud2butt remains a pro plugin

# ? Mar 4, 2017 21:22

Carbon dioxide: Oct 9, 2012

# ? Mar 4, 2017 23:21

Syncopated: Oct 21, 2010

Carbon dioxide posted:

i lolled

# ? Mar 4, 2017 23:55

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://np.reddit.com/r/homeautomation/comments/5xa0h1/ring_pro_doorbell_calling_china/deh3gsz/

Some Internet of poo poo consumer posted:

So recently installed a ring doorbell and found some interesting network traffic.

At random intervals, it seems to be sending a UDP/1 packet to 106.13.0.0 (China). All other traffic goes to AWS.

Anyone have any thoughts to iot devices calling back to China?

'Matt' at the Internet of poo poo company posted:

Hi I'm the VP of Security at Ring and I thought it might be helpful to give you all some background on what you are seeing.

Occasionally at the end of live call or motion, we will lose connectivity. Rather than abandoning the entire call, we send the last few audio packets that are corrupted anyway to a non-routable address on a protocol no one uses. The right way to do that is to use a virtual interface or the loopback to discard the packets. The choice to send it to somewhere across the world and let the ISP deal with blocking is a poor design choice that the teams on working on addressing ASAP.

From a risk/disclosure perspective, it's relatively benign but like the everyone else, when my team first saw it in the wild we had similar concerns.

i will circle back when we have updated firmware.

-Matt

Someone calling out Matt on this bullshit posted:

This is ridiculous. You are trolling, right? Let's pretend you were even going to do this ridiculous technical implementation and you didn't have an explicit loopback. Why can't you just drop? Why would you pick some random address (not even RFC1918)? Why not just send it to the IP address of the Ring device itself? Or how about the default gateway? Why not 127.0.0.1 and maybe it makes it out to be blocked by an egress filter but at least it doesn't get to a routable public network.

The state of IoT security is already poor - and this is is what Ring does to deal with "end of call" packets? Come on.

Later edit:

Sorry Matt, but I am going to have to pull your response apart a bit more here.

This is what the traffic looks like (from /u/sp0di):
code:
 10:06:12.263764 6c:0b:84:f9:df:fc > 90:6c:ac:84:51:9e, ethertype IPv4 (0x0800), length 214: (tos 0x0, ttl 64, id 6080, offset 0, flags [DF], proto UDP (17), length 200)
    10.23.1.125.51506 > 106.13.0.0.1: [udp sum ok] UDP, length 172

 13:10:22.224408 6c:0b:84:f9:df:fc > 90:6c:ac:84:51:9e, ethertype IPv4 (0x0800), length 214: (tos 0x0, ttl 64, id 5547, offset 0, flags [DF], proto UDP (17), length 200)
    10.23.1.125.51506 > 106.13.0.0.1: [udp sum ok] UDP, length 172
You state....

quote:
Occasionally at the end of live call or motion, we will lose connectivity. Rather than abandoning the entire call, we send the last few audio packets that are corrupted anyway to a non-routable address on a protocol no one uses.

This is not a non-routable address (106.13.0.0). This is 106.12.0.0/15 owned by Baidu.
code:
    % Information related to '106.12.0.0 - 106.13.255.255'

    inetnum:        106.12.0.0 - 106.13.255.255

    netname:        Baidu

    descr:          Beijing Baidu Netcom Science and Technology Co., Ltd.

    descr:          Baidu Plaza, No.10, Shangdi 10th street,

    descr:          Haidian District Beijing,100080
UDP is a protocol no one uses? Do you mean port 1 (tcpmux)? What exactly happened to your end point (the other host) and why aren't packets just continuing to be sent there, even if they are disregarded on that side?

quote:
"we send the last few audio packets that are corrupted anyway to a non-routable address on a protocol no one uses"

and

quote:
"The choice to send it to somewhere across the world and let the ISP deal with blocking is a poor design choice"
are mutually exclusive statements.

How does a non-routable address make "somewhere across the world" so an "ISP [can] deal with blocking"?

Edit #2

It has now been confirmed by two users that Ring is using a fixed source port, destination, and destination port. This means that Ring is effectively poking a UDP NAT hole that would allow return traffic to traverse the NAT gateway and reach the Ring.

Protocol: UDP

Static source port: 51506

Static destination: 106.13.0.0

Static destination port: 1

In a very theoretical scenario, let's say this transmits periodically (which it does), then this would keep open a NAT translation on your edge router and many common NAT devices will use the same OUTSIDE source port if it isn't already in in use for translation.

Traffic sourced from 106.13.0.0:1 and destined for yourip:51506 would reach the Ring device. Let's now pretend the Ring has a backdoored firmware that is simply waiting for a UDP packet to show up and provide an IP for the next command and control channel. In theory, it would only require 2^32 packets to hit every host on the Internet. You can now simply spray every host with one packet and wait to see who shows up.

I'm going to assume this isn't a backdoored firmware, but it very easily could be and the attack vector looks plausible.

Matt, I think you need to provide a little more information. This isn't adding up.

# ? Mar 5, 2017 01:05

Shame Boy: Mar 2, 2010

# ? Mar 5, 2017 01:13

Truga: May 4, 2014; Lipstick Apathy

the s in iot stands for security

# ? Mar 5, 2017 01:17

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 19:49

atomicthumbs: Dec 26, 2010; We're in the business of extending man's senses.

OSI bean dip posted:

https://np.reddit.com/r/homeautomation/comments/5xa0h1/ring_pro_doorbell_calling_china/deh3gsz/

This is not a non-routable address (106.13.0.0). This is 106.12.0.0/15 owned by Baidu.
code:
    % Information related to '106.12.0.0 - 106.13.255.255'

    inetnum:        106.12.0.0 - 106.13.255.255

    netname:        Baidu

    descr:          Beijing Baidu Netcom Science and Technology Co., Ltd.

    descr:          Baidu Plaza, No.10, Shangdi 10th street,

    descr:          Haidian District Beijing,100080
UDP is a protocol no one uses? Do you mean port 1 (tcpmux)? What exactly happened to your end point (the other host) and why aren't packets just continuing to be sent there, even if they are disregarded on that side?

and

are mutually exclusive statements.

How does a non-routable address make "somewhere across the world" so an "ISP [can] deal with blocking"?

Edit #2

It has now been confirmed by two users that Ring is using a fixed source port, destination, and destination port. This means that Ring is effectively poking a UDP NAT hole that would allow return traffic to traverse the NAT gateway and reach the Ring.

Protocol: UDP

Static source port: 51506

Static destination: 106.13.0.0

Static destination port: 1

In a very theoretical scenario, let's say this transmits periodically (which it does), then this would keep open a NAT translation on your edge router and many common NAT devices will use the same OUTSIDE source port if it isn't already in in use for translation.

Traffic sourced from 106.13.0.0:1 and destined for yourip:51506 would reach the Ring device. Let's now pretend the Ring has a backdoored firmware that is simply waiting for a UDP packet to show up and provide an IP for the next command and control channel. In theory, it would only require 2^32 packets to hit every host on the Internet. You can now simply spray every host with one packet and wait to see who shows up.

I'm going to assume this isn't a backdoored firmware, but it very easily could be and the attack vector looks plausible.

Matt, I think you need to provide a little more information. This isn't adding up.

[/quote]

Holy poo poo

# ? Mar 5, 2017 01:22

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »