Security Fuckup Megathread - v13.69 - plugins may violate privacy

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »

Pile Of Garbage: May 28, 2007

ok cool but do are you denying that when present IME poses a significant threat of compromise and can provide persistence to malware in its default state? if you arent then prove otherwise or gently caress off i guess? no one has time for bs semantics

# ? May 2, 2017 18:35

Adbot: ADBOT LOVES YOU

# ? Jun 8, 2024 07:14

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

i'm denying that ime is active in systems where both components are not present, which is what bangersinmyknickers claimed

# ? May 2, 2017 18:42

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

infernal machines posted:

i'm denying that ime is active in systems where both components are not present, which is what bangersinmyknickers claimed

because it looks like you're saying that ime is inactive even when the operation system sees that the devices exist

# ? May 2, 2017 18:44

Pile Of Garbage: May 28, 2007

infernal machines posted:

i'm denying that ime is active in systems where both components are not present, which is what bangersinmyknickers claimed

ok cool good luck proving a negative.

someone post something interesting to clear the air pls? all ive got is apparently krebs has found a SaaS outfit which is accidentally exposing their customer list via their sitemap:

https://twitter.com/briankrebs/status/859430935711887360

Pile Of Garbage fucked around with this message at 18:48 on May 2, 2017

# ? May 2, 2017 18:46

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

anthonypants posted:

because it looks like you're saying that ime is inactive even when the operation system sees that the devices exist

because the OS says those devices exist even when the CPU does not support IME. how is this not coming across? the claim you guys are making is that if either (but not both) of the two components required for a functional IME are present, then it's exploitable. i've not seen any evidence of that and none of the linked sources appear to suggest that.

but yes, this is surprisingly tedious. if an exploit comes out i'll test it on the i3 box and reply with my findings

infernal machines fucked around with this message at 19:05 on May 2, 2017

# ? May 2, 2017 18:50

AARP LARPer: Feb 19, 2005; THE DARK SIDE OF SCIENCE BREEDS A WEAPON OF WAR; Buglord

removed. sorry, I think it turned out to be a joke?

AARP LARPer fucked around with this message at 19:44 on May 2, 2017

# ? May 2, 2017 19:05

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

no way.

# ? May 2, 2017 19:06

Pile Of Garbage: May 28, 2007

dont doxx me and my employer.

e: lol now my post makes zero sense because war dogs edited theirs!

Pile Of Garbage fucked around with this message at 19:54 on May 2, 2017

# ? May 2, 2017 19:06

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

infernal machines you might just want to stop before you're too far back for you to catch up

# ? May 2, 2017 19:50

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Migishu posted:

infernal machines you might just want to stop before you're too far back for you to catch up

okay, if anyone comes up with proof that IME is active and exploitable when only one of the two required components is present, please post it. i'll apologize unreservedly

# ? May 2, 2017 19:52

Pile Of Garbage: May 28, 2007

RIP infernal machines, thought of IME and died

# ? May 2, 2017 19:55

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

infernal machines posted:

okay, if anyone comes up with proof that IME is active and exploitable when only one of the two required components is present, please post it. i'll apologize unreservedly

you went from "sure it's supported on cpus but it's NOT supported on motherboards" to "ok it's supported on motherboards but that DOESN'T mean it's supported by the cpu"

# ? May 2, 2017 20:14

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

anthonypants posted:

you went from "sure it's supported on cpus but it's NOT supported on motherboards" to "ok it's supported on motherboards but that DOESN'T mean it's supported by the cpu"

yeah, there are both. there are two scenarios where one but not both of the required components for IME may be present. the original claim was that this was irrelevant and it was exploitable regardless.

a bunch of people here posted screenshots of device manager on boards that do support it. there are boards that do not support IME and don't have that device. you can still install an i5 or an i7 that has vPro support in them.

likewise you can install a celeron, pentium, or i3 that does not support vpro in one of those boards they took the screen shots from. in either case, IME should not be active because it requires both chipset and cpu support.

this is not difficult

# ? May 2, 2017 20:25

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

like, i really don't get what's so contentious about this.

IME is used as a differentiating feature on both platform and CPU skus. some don't have it and you can mix and match those components, but according to intel you need both for it to work. if the ones that don't have it actually do, and it's exploitable then fine, but i'd like to see someone demonstrate that.

# ? May 2, 2017 20:30

FAT32 SHAMER: Aug 16, 2012

Infernal Machine Engine

infernal machine's enigma

idk that's all i got

# ? May 2, 2017 20:33

Dylan16807: May 12, 2010

infernal machines posted:

yeah, there are both. there are two scenarios where one but not both of the required components for IME may be present. the original claim was that this was irrelevant and it was exploitable regardless.

a bunch of people here posted screenshots of device manager on boards that do support it. there are boards that do not support IME and don't have that device. you can still install an i5 or an i7 that has vPro support in them.

likewise you can install a celeron, pentium, or i3 that does not support vpro in one of those boards they took the screen shots from. in either case, IME should not be active because it requires both chipset and cpu support.

this is not difficult

the issue is that going by what other people are saying the board support is very common

which would imply that a hell of a lot of consumer systems with i5 and i7 processors are vulnerable, maybe even most of them, not the relative rarity you're making it out to be

# ? May 2, 2017 20:57

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

i'll concede that point, i've sold plenty of systems without it, but it appears to be included on many q/x/z series chipset boards, especially in the enthusiast range. it looks like the management engine device is present even in cases where they don't actually support amt as well

e: looks like the ME pci device component was made a standard part of the intel chipset in 2015, previously it was optional

i'm curious how intel defines "Intel-based consumer PCs" now

Also whoa hey:

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr posted:

Determine if you have an Intel� AMT, Intel� SBA, or Intel� ISM capable system: https://communities.intel.com/docs/DOC-5693. If you determine that you do not have an Intel� AMT, Intel� SBA, or Intel� ISM capable system then no further action is required.

https://communities.intel.com/docs/DOC-5693 posted:
Look for the Intel Management Engine Interface driver. Look in the Windows* Device Manager for the Intel ME device. (Note that some PCs may have the Intel ME and Intel MEI driver, but they are not Intel vPro Technology PCs, so this method is not always reliable.)

infernal machines fucked around with this message at 21:22 on May 2, 2017

# ? May 2, 2017 21:00

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Dex posted:

https://twitter.com/gavinandresen/status/859164795655917568

# ? May 2, 2017 21:34

Dex: May 26, 2006; Quintuple x!!!

Would not escrow again.

VERY MISLEADING!

worth posting the actual site here too http://www.randomsanity.org/

quote:

How it Works
Get an array of 64 bytes from whatever source of cryptographically-secure randomness you are using
Encode them as hex, and make a REST query to the randomsanity service
The service will return �true� if it those bytes look random and nobody else has submitted the same stream of bytes; otherwise it will return �false�.

i definitely trust a http website written by a bitcoin man to verify my crypto has enough crypto in it

# ? May 2, 2017 21:46

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

how to bytes "look random"

what does random look like?

# ? May 2, 2017 21:52

Meat Beat Agent: Aug 5, 2007; felonious assault with a sproinging boner

bytes presumably "look random" by just meeting some minimum amount of entropy, which is fairly trivial to determine

# ? May 2, 2017 21:56

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

_{_{this is a joke}}

# ? May 2, 2017 21:59

Meat Beat Agent: Aug 5, 2007; felonious assault with a sproinging boner

monkey chease

# ? May 2, 2017 21:59

Zamujasa: Oct 27, 2010; Bread Liar

Meat Beat Agent posted:

bytes presumably "look random" by just meeting some minimum amount of entropy, which is fairly trivial to determine

quote:

The service will return �true� if it those bytes look random and nobody else has submitted the same stream of bytes; otherwise it will return �false�.

quote:

// Best-effort "have we ever seen this array of bytes before?"

"best effort" :haw:

ah well maybe it can do a basic entropy tes--

quote:

$ curl https://rest.randomsanity.org/v1/q/A55AA55AA55AA55AA55AA55AA55AA55AA55A
true

the fun part is that you can't reliably link any examples because anybody trying to test the same observation will see "false" :downs:

# ? May 2, 2017 22:09

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

i am literally angry laughing over here

# ? May 2, 2017 22:22

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Zamujasa posted:

the fun part is that you can't reliably link any examples because anybody trying to test the same observation will see "false"

see? it's just getting more secure every time you use it

# ? May 2, 2017 22:36

Dex: May 26, 2006; Quintuple x!!!

Would not escrow again.

VERY MISLEADING!

neat, they return a never-before-seen value as an X-Entropy header:

Python code:

# headers from a prev request
{'Content-Length': '5', 'Server': 'Google Frontend',
'X-Cloud-Trace-Context': 'ccf3f2e90310ec322c1e1fe27f59040e;o=1',
'Date': 'Tue, 02 May 2017 21:38:06 GMT', 'Content-Type': 'application/json',
'X-Entropy': 'f1ccd7df4bb7710e6e244b8a12e1d037329ba4234cba9a634abae9892604e324'}
>>> requests.get('http://rest.randomsanity.org/v1/q/{}'.format('f1ccd7df4bb7710e6e244b8a12e1d037329ba4234cba9a634abae9892604e324')).content
'true'

# ? May 2, 2017 22:39

CmdrRiker: Apr 8, 2016; You dismally untalented little creep!

Dex posted:

neat, they return a never-before-seen value as an X-Entropy header:

Python code:

# headers from a prev request
{'Content-Length': '5', 'Server': 'Google Frontend',
'X-Cloud-Trace-Context': 'ccf3f2e90310ec322c1e1fe27f59040e;o=1',
'Date': 'Tue, 02 May 2017 21:38:06 GMT', 'Content-Type': 'application/json',
'X-Entropy': 'f1ccd7df4bb7710e6e244b8a12e1d037329ba4234cba9a634abae9892604e324'}
>>> requests.get('http://rest.randomsanity.org/v1/q/{}'.format('f1ccd7df4bb7710e6e244b8a12e1d037329ba4234cba9a634abae9892604e324')).content
'true'

Incase you forgot what you sent and lose all hope of ever recovering your once in a lifetime and officially verified random string.

# ? May 2, 2017 23:03

Lutha Mahtin: Oct 10, 2010; Your brokebrain sin is absolved...go and shitpost no more!

lol i entered "Weedlord Bonerhitler" in hex and got true

# ? May 2, 2017 23:07

Maximum Leader: Dec 5, 2014

so is this dashlane thing any good?

# ? May 2, 2017 23:32

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

they have a whitepaper on their security model

https://www.dashlane.com/download/Dashlane-Security-Whitepaper-V2.8.pdf

evidently created in word

# ? May 2, 2017 23:36

ate shit on live tv: Feb 15, 2004; by Azathoth

Meat Beat Agent posted:

bytes presumably "look random" by just meeting some minimum amount of entropy, which is fairly trivial to determine

How do you determine "some minimum amount of entropy" in a byte stream that you do not know the source of?
Hint: You can't

# ? May 3, 2017 00:59

pseudorandom name: May 6, 2007

re: web site push notification chat from a couple days ago

I think they may be supercookies.

There's a unique per-subscription URL involved and a unique client-generated ECDH keypair.

# ? May 3, 2017 01:55

hobbesmaster: Jan 28, 2008

pseudorandom name posted:

re: web site push notification chat from a couple days ago

I think they may be supercookies.

are those ones you have to click ok to twice?

# ? May 3, 2017 01:58

Shame Boy: Mar 2, 2010

ate poo poo on live tv posted:

How do you determine "some minimum amount of entropy" in a byte stream that you do not know the source of?
Hint: You can't

code:

npm install --save string-entropy

# ? May 3, 2017 02:03

minivanmegafun: Jul 27, 2004

Dex posted:

worth posting the actual site here too http://www.randomsanity.org/

i definitely trust a http website written by a bitcoin man to verify my crypto has enough crypto in it

i really don't understand how the bitcoin protocol hasn't been completely destroyed yet with morons like this as core devs. it's got to be outright dumb luck.

# ? May 3, 2017 02:21

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

ate all the Oreos posted:

code:

npm install --save string-entropy

lol (the example looks familiar)

https://www.npmjs.com/package/string-entropy posted:

code:

Example

var entropy = require('string-entropy');
 
console.log(entropy('correct horse battery staple'));
// outputs  132

# ? May 3, 2017 02:24

JawnV6: Jul 4, 2004; So hot ...

"disable the ME" isn't a sensible phrase for a few years now, as tenuous as it was before that point

# ? May 3, 2017 02:25

fishmech: Jul 16, 2006; by VideoGames; Salad Prong

minivanmegafun posted:

i really don't understand how the bitcoin protocol hasn't been completely destroyed yet with morons like this as core devs. it's got to be outright dumb luck.

most of the really obvious problems with the protocol itself got fixed in the first few years before it got big.

now all of the problems left will never get fixed because miners will try to block it, but they're mostly things that don't break the protocol, just things that make bitcoin suck to use

# ? May 3, 2017 02:26

Adbot: ADBOT LOVES YOU

# ? Jun 8, 2024 07:14

VikingofRock: Aug 24, 2008

flakeloaf posted:

ME was a mistake

I'm sure your parents love you and are proud of you regardless of the circumstances of your birth

# ? May 3, 2017 02:27

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »