Security Fuckup Megathread - v13.69 - plugins may violate privacy

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »

haveblue: Aug 15, 2005; Toilet Rascal

grandfather's exe

# ? Apr 26, 2017 17:44

Adbot: ADBOT LOVES YOU

# ? May 21, 2024 02:13

burning swine: May 26, 2004

Number19 posted:

have some more atlassian fuckups while we're at it: https://confluence.atlassian.com/doc/confluence-security-advisory-2017-04-19-887071137.html

lol atlassian

My company switched to hipchat a while ago, and I noticed that whenever someone sends a picture (which is frequently a screenshot of something proprietary, or at least not meant for disclosure), it ends up hosted on an s3 instance with absolutely no authentication. URL is something like s3.amazonaws.com/uploads.hipchat.com/[comany's unique ID]/[some other id]/[upload.png]

I'd been meaning to do some prodding and see if [some other id] is predictable, maybe I should take that off the back burner

# ? Apr 26, 2017 17:47

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

haveblue posted:

grandfather's exe

I've only changed the language twice and the OS three times

# ? Apr 26, 2017 17:48

Wheany: Mar 17, 2006; Spinya^{ha^{ha^haha}ha}ha_{ha_{ha_haha}ha}ha!; Doctor Rope

infernal machines posted:

mainframe of theseus

I get this reference

haveblue posted:

grandfather's exe

I get this reference

# ? Apr 26, 2017 18:14

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

COACHS SPORT BAR posted:

NICE!

lol atlassian

My company switched to hipchat a while ago, and I noticed that whenever someone sends a picture (which is frequently a screenshot of something proprietary, or at least not meant for disclosure), it ends up hosted on an s3 instance with absolutely no authentication. URL is something like s3.amazonaws.com/uploads.hipchat.com/[comany's unique ID]/[some other id]/[upload.png]

I'd been meaning to do some prodding and see if [some other id] is predictable, maybe I should take that off the back burner

just stick a UUID in there and it's basically as good as authentication over https.

# ? Apr 26, 2017 18:17

necrotic: Aug 2, 2005; I owe my brother big time for this!

COACHS SPORT BAR posted:

NICE!

lol atlassian

My company switched to hipchat a while ago, and I noticed that whenever someone sends a picture (which is frequently a screenshot of something proprietary, or at least not meant for disclosure), it ends up hosted on an s3 instance with absolutely no authentication. URL is something like s3.amazonaws.com/uploads.hipchat.com/[comany's unique ID]/[some other id]/[upload.png]

I'd been meaning to do some prodding and see if [some other id] is predictable, maybe I should take that off the back burner

I found slack had this same issue and it blew my mind. I _think_ its since been fixed? e: yeah totally has

# ? Apr 26, 2017 18:26

burning swine: May 26, 2004

Subjunctive posted:

just stick a UUID in there and it's basically as good as authentication over https.

It's waaaaaay too short to be a UUID

e: just compiled a list of all the urls sent to me. It's more or less on par with an imgur identifier. Meh, not as interesting as I had hoped

burning swine fucked around with this message at 19:07 on Apr 26, 2017

# ? Apr 26, 2017 18:57

darthbob88: Oct 13, 2011; YOSPOS

Wheany posted:

I get this reference

I get this reference

I got these references long ago, and though they have changed over the years they are the same references.

# ? Apr 26, 2017 19:52

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

quote:

14:26:20 warrshrike | I need some help from you geniuses
14:27:25 warrshrike | So I had this idea for a side project
14:27:56 warrshrike | I'm thinking if a nearly totally safe messenger service is possible
14:28:14 warrshrike | Here is my rationale for it
14:29:12 warrshrike | recently, many end to end services have been known to be insecure to certain 3 letter agencies as well as criminals
14:29:27 warrshrike | this is almost always due to the OS running the sw getting breached
14:29:44 warrshrike | rather than the encryption or key app getting compromised
14:30:34 warrshrike | so what we cut the OS out of it? Make a messenger which runs directly on bare metal (say an opensource linux board) ala unikernel style

# ? Apr 26, 2017 19:52

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

OSI bean dip posted:

so like an eeprom that contains your messages, sounds cool

# ? Apr 26, 2017 20:00

burning swine: May 26, 2004

Good writeup on the security dumpster fire that is SugarCRM:

http://karmainsecurity.com/tales-of-sugarcrm-security-horrors

# ? Apr 26, 2017 20:06

Shaggar: Apr 26, 2006

the sugarcrm "API" is basically sql injection.

# ? Apr 26, 2017 20:08

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

COACHS SPORT BAR posted:

Good writeup on the security dumpster fire that is SugarCRM:

http://karmainsecurity.com/tales-of-sugarcrm-security-horrors

quote:

SugarCRM is a pretty popular Customer Relationship Management (CRM) application written in PHP code. It was born in 2004 as an open source project hosted on SourceForge, a development repository for free software.

article just ends right there

# ? Apr 26, 2017 20:16

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Loaded fine for me

quote:

SugarCRM is a pretty popular Customer Relationship Management (CRM) application written in PHP code. It was born in 2004 as an open source project hosted on SourceForge, a development repository for free software. By June of the same year, the rapid success of the project allowed the original developers to found SugarCRM Inc. and raise $2 million in venture capital. A month later, on July 3, Sugar Open Source version 1.0 was released. In October 200 .........

Etc

# ? Apr 26, 2017 20:19

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

Volmarias posted:

Loaded fine for me

Etc

whoosh

# ? Apr 26, 2017 20:24

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

i get joaks

# ? Apr 26, 2017 20:26

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Cocoa Crispies posted:

article just ends right there

lol

# ? Apr 26, 2017 20:26

fishmech: Jul 16, 2006; by VideoGames; Salad Prong

Volmarias posted:

I've only changed the language twice and the OS three times

Only registered members can see post attachments!

# ? Apr 26, 2017 20:33

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

OSI bean dip posted:

lol what the heck

# ? Apr 26, 2017 20:39

rafikki: Mar 8, 2008; I see what you did there. (It's pretty easy, since ducks have a field of vision spanning 340 degrees.)

~SMcD

https://arstechnica.com/information-technology/2017/04/picture-this-senate-staffers-id-cards-have-photo-of-smart-chip-no-security/

quote:

Moreover, in contrast to the executive branch's widespread adoption of PIV cards with a smart chip, most Senate staff ID cards have a photo of a chip printed on them, rather than a real chip.

# ? Apr 26, 2017 21:06

dpkg chopra: Jun 9, 2007; Fast Food Fight; Grimey Drawer

rafikki posted:

https://arstechnica.com/information-technology/2017/04/picture-this-senate-staffers-id-cards-have-photo-of-smart-chip-no-security/

if those chip pictures prove themselves to be brave and secure, one day they will become real chips

# ? Apr 26, 2017 21:16

A Pinball Wizard: Mar 23, 2005; I know every trick, no freak's gonna beat my hands; College Slice

rafikki posted:

https://arstechnica.com/information-technology/2017/04/picture-this-senate-staffers-id-cards-have-photo-of-smart-chip-no-security/

my brain automatically converted piv to penis in vagina

# ? Apr 26, 2017 21:23

cinci zoo sniper: Mar 15, 2013

are planeforce have bug bounty program now

# ? Apr 26, 2017 21:25

Phone: Jul 30, 2005; 親子丼をほしい。

A Pinball Wizard posted:

my brain automatically converted piv to penis in vagina

computer fucker.

# ? Apr 26, 2017 21:36

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

pinball in wizard

# ? Apr 26, 2017 22:00

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

http://www.antbleed.com/

quote:

Antbleed is a backdoor introduced by Bitmain into the firmware of their bitcoin mining hardware Antminer.

The firmware checks-in with a central service randomly every 1 to 11 minutes. Each check-in transmits the Antminer serial number, MAC address and IP address. Bitmain can use this check-in data to cross check against customer sales and delivery records making it personally identifiable. The remote service can then return "false" which will stop the miner from mining.

quote:

At worst, this firmware backdoor allows Bitmain to shut off a large section of the global hashrate (estimated to be at up to 70% of all mining equipment). It can also be used to directly target specific machines or customers. Standard inbound firewall rules will not protect against this because the Antminer makes outbound connections.

Even without Bitmain being malicious, the API is unauthenticated and would allow any MITM, DNS or domain hijack to shutdown Antminers globally. Additionally the domain in question DNS is hosted by Cloudflare making it trivially subjected to government orders and state control.

# ? Apr 26, 2017 22:39

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

OSI bean dip posted:

http://www.antbleed.com/

https://twitter.com/SDLerner/status/857339715577663489
https://twitter.com/petertoddbtc/status/857341376245182464

# ? Apr 26, 2017 22:40

fishmech: Jul 16, 2006; by VideoGames; Salad Prong

anthonypants posted:

https://twitter.com/SDLerner/status/857339715577663489
https://twitter.com/petertoddbtc/status/857341376245182464

someone should do the last bit

# ? Apr 26, 2017 22:42

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

fishmech posted:

someone should do the last bit

# ? Apr 26, 2017 22:43

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

fishmech posted:

someone should do the last bit

yeah i agree unironically but afaik i need an antmain miner first

# ? Apr 26, 2017 22:43

MononcQc: May 29, 2007

this is actually good for bitcoin because

# ? Apr 26, 2017 22:43

spankmeister: Jun 15, 2008; Can't post for 11 hours!

I lust for bitcoin death

# ? Apr 26, 2017 22:57

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

fishmech posted:

someone should do the last bit

# ? Apr 26, 2017 23:09

mod saas: May 4, 2004; Grimey Drawer

fishmech posted:

someone should do the last bit

quote:

The last bit was mined for the first time, half in jest, on April 20, 2140, at a time when humanity first stepped into the light.

# ? Apr 26, 2017 23:23

Carbon dioxide: Oct 9, 2012

With the way bitcoins work, the amount of bitcoins mined per period of time cannot change, I think.

So if you were to kill a majority of bitcoin miners, those who are left over would suddenly get way more bitcoins way faster.

# ? Apr 26, 2017 23:27

Mr. Nice!: Oct 13, 2005; c-spam cannot afford

Carbon dioxide posted:

With the way bitcoins work, the amount of bitcoins mined per period of time cannot change, I think.

So if you were to kill a majority of bitcoin miners, those who are left over would suddenly get way more bitcoins way faster.

the difficulty would balance out so that the speed would end up around the same (average 10 minutes iirc) after a short burst period, but the thing is they would lock out anyone not using the best asics if they shut off all the antminers outside of the chinese pools.

they can effectively lock out the entire rest of the bitcoin network and they only way to prevent it is to somehow patch and repair the firmware and hope there isn't more hidden backdoors or develop and deploy a par competitor with the current antminers.

china has the entire bitcoin protocol by the balls with this.

# ? Apr 26, 2017 23:33

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Cocoa Crispies posted:

whoosh

... gently caress :cripes:

# ? Apr 26, 2017 23:34

vOv: Feb 8, 2014

Carbon dioxide posted:

With the way bitcoins work, the amount of bitcoins mined per period of time cannot change, I think.

So if you were to kill a majority of bitcoin miners, those who are left over would suddenly get way more bitcoins way faster.

the difficulty adjustment isn't instant but i don't remember how often it happens, i want to say twice a month or something g

# ? Apr 26, 2017 23:38

fishmech: Jul 16, 2006; by VideoGames; Salad Prong

Mr. Nice! posted:

the difficulty would balance out so that the speed would end up around the same (average 10 minutes iirc) after a short burst period, but the thing is they would lock out anyone not using the best asics if they shut off all the antminers outside of the chinese pools.

the difficulty can only change every so often (as it stands, once every 14 days if things are in good working order, as it's every 2016 blocks), and can only change up to a certain amount each time.

it could take months easily for bitcoin to adjust back to consistent 10ish minute blocks again if 70% of the mining power was immediately wiped out and stayed wiped out.

# ? Apr 26, 2017 23:39

Adbot: ADBOT LOVES YOU

# ? May 21, 2024 02:13

Gobbeldygook: May 13, 2009; Hates Native American people and tries to justify their genocides.

Put this racist on ignore immediately!

vOv posted:

the difficulty adjustment isn't instant but i don't remember how often it happens, i want to say twice a month or something g

it's adjusted every 2016 blocks, so every ~two weeks. next adjustment is 32 blocks away.

# ? Apr 26, 2017 23:43

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »