Security Fuckup Megathread - v13.69 - plugins may violate privacy

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »

Powerful Two-Hander: Mar 10, 2004; Mods please change my name to "Tooter Skeleton" TIA.

Instant Grat posted:

is it a big faux pas to use lastpass or am i just "suboptimal" for sticking w/ that

security fuckup megathread: a big faux pass

# ? May 14, 2017 19:35

Adbot: ADBOT LOVES YOU

# ? May 18, 2024 18:40

mod saas: May 4, 2004; Grimey Drawer

re:keep rear end, is there an acceptable version for macos?

# ? May 14, 2017 19:56

spankmeister: Jun 15, 2008

Meat Beat Agent posted:

tbc was right

15 years ago maybe

# ? May 14, 2017 20:00

angry_keebler: Jul 16, 2006; In His presence the mountains quake and the hills melt away; the earth trembles and its people are destroyed. Who can stand before His fierce anger?

surebet posted:

imagining for a moment that they wouldn't get wrecked, if the requested payment was over paypal, i'm sure the conversion rate would be significantly higher. maybe they should try with amazon giftcards or something

the problem is amazon will work with investigators to see what account had gc code xxxx applied and to what address any purchases made by that account have been sent

the best bet would be to just steal somebody's identity to make a paypal account and cash out to bitcoin or w/e, then the poor schlub with the bank account would have to explain why a paypal in his name was being used for cool crimes

# ? May 14, 2017 20:04

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

mod saas posted:

re:keep rear end, is there an acceptable version for macos?

macpass

# ? May 14, 2017 20:14

duTrieux.: Oct 9, 2003

mod saas posted:

re:keep rear end, is there an acceptable version for macos?

...you aren't running windows in a vm?

# ? May 14, 2017 21:15

Shame Boy: Mar 2, 2010

OSI bean dip posted:

macpass

seconded, it actually looks good! :unsmith:

# ? May 14, 2017 21:56

Shame Boy: Mar 2, 2010

my favorite media player is whatever's on the computer played at a reasonable volume

# ? May 14, 2017 21:57

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

ErIog posted:

1password not having Linux support is killing me right now and I think I'm going to just bite the bullet and switch back to Keepass like I was using 9 years ago.

1password works fine under wine

# ? May 14, 2017 22:02

Shifty Pony: Dec 28, 2004; Up ta somethin'

angry_keebler posted:

the problem is amazon will work with investigators to see what account had gc code xxxx applied and to what address any purchases made by that account have been sent

the best bet would be to just steal somebody's identity to make a paypal account and cash out to bitcoin or w/e, then the poor schlub with the bank account would have to explain why a paypal in his name was being used for cool crimes

nah you get people to reship or money mule into bitcoin or western union via spam or Craigslist job listings. you don't need to steal account credentials when people will gladly do the dirty work for you if you promise them money for little effort.

but these ransomware programs are being sold to script kiddies who are unwilling or unable to pull that much coordination off.

# ? May 14, 2017 22:30

Jewel: May 2, 2009

Oh, I didn't see this posted here even though it's 8hrs old, maybe I just missed it though.

https://twitter.com/TalBeerySec/status/863741929401585664

# ? May 14, 2017 22:35

Shame Boy: Mar 2, 2010

am i correct in reading that as some loving OS/2 to NT compatibility thing

windows :allears:

# ? May 14, 2017 22:38

spankmeister: Jun 15, 2008

Neat

# ? May 14, 2017 22:42

pseudorandom name: May 6, 2007

ate all the Oreos posted:

am i correct in reading that as some loving OS/2 to NT compatibility thing

windows

It may just be parts of the protocol are still encoded using OS/2 data types & values while not actually being OS/2 compatible, but, yeah, probably.

# ? May 14, 2017 22:58

mod saas: May 4, 2004; Grimey Drawer

duTrieux. posted:

...you aren't running windows in a vm?

dude i'm just excited to get someone's second hand mac i don't know the rules yet

i wanted to integrate with my existing win10/anroid setup

# ? May 15, 2017 00:54

fins: May 31, 2011; Floss Finder

finally.. 2017: the year of linux on the desktop

# ? May 15, 2017 02:02

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

ate all the Oreos posted:

am i correct in reading that as some loving OS/2 to NT compatibility thing

windows

There are a lot of references to OS/2 in NT due to its development history. It doesn't necessarily mean it is a backwards compatibility situation here.

I don't even think SMB or RPC existed in OS/2 itself.

# ? May 15, 2017 02:13

FCKGW: May 21, 2006

I finally moved away from Lastpass to Dashlane and it seems pretty good. I tried 1password but keep running into a bunch of little annoyances, especially on PC.

# ? May 15, 2017 02:23

fishmech: Jul 16, 2006; by VideoGames; Salad Prong

OSI bean dip posted:

There are a lot of references to OS/2 in NT due to its development history. It doesn't necessarily mean it is a backwards compatibility situation here.

I don't even think SMB or RPC existed in OS/2 itself.

SMB was developed at IBM initially, and was in OS/2 from version 2.0 onwards. that would mean it was in os/2 about 6 months sooner than it showed up in the first Windows for Workgroups.

# ? May 15, 2017 03:09

Proteus Jones: Feb 28, 2013

# ? May 15, 2017 04:22

Midjack: Dec 24, 2007

flosofl posted:

lol

# ? May 15, 2017 04:39

Mr.Radar: Nov 5, 2005; You guys aren't going to believe this, but that guy is our games teacher.

fins posted:

finally.. 2017: the year of linux on the desktop

https://twitter.com/hackerfantastic/status/863359375787925505

# ? May 15, 2017 04:46

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

https://twitter.com/maldr0id/status/863838938477338625 lol https://archive.fo/izWrH

# ? May 15, 2017 05:43

Kuvo: Oct 27, 2008; Blame it on the misfortune of your bark!; Fun Shoe

anthonypants posted:

https://twitter.com/maldr0id/status/863838938477338625 lol https://archive.fo/izWrH

lol

# ? May 15, 2017 06:42

incoherent: Apr 24, 2004; 01010100011010000111001
00110100101101100011011
000110010101110010

I appreciate namecheap being the a part of the vanguard of preventing global worm apocalyptics.

# ? May 15, 2017 06:48

jre: Sep 2, 2011; To the cloud ?

anthonypants posted:

https://twitter.com/maldr0id/status/863838938477338625 lol https://archive.fo/izWrH

Lmao

# ? May 15, 2017 07:50

Truga: May 4, 2014; Lipstick Apathy

fishmech posted:

what? the last couple versions from aol and the latest version (5.666) from the Dutch people who bought it out when AOL gave up all run fine.

are you trying to run some dodgy version from 2002 or something

unironically thanks for this, I didn't know there was a new version released in 2014. i gave up on winamp before that.

# ? May 15, 2017 08:40

Wiggly Wayne DDS: Sep 11, 2010

https://oded.ninja/2017/05/14/amt-n-ken-hack/

quote:

The bug was fairly simple. Instead of this:

code:

int main () {
  string realpass = "secret";
  string userpass = "user-secret";
  int equal = strncmp(realpass.c_str(),userpass.c_str(),realpass.size());
  if (equal == 0) {
     printf ("'%s' equals to '%s'", realpass.c_str(), userpass.c_str());
  }
  return equal * equal; // make sure it's positive
}

The code was compiled like this:

code:

int main () {
  string realpass = "secret";
  string userpass = "user-secret";
  int equal = strncmp(realpass.c_str(), userpass.c_str(), userpass.size());
  if (equal == 0) {
     printf ("'%s' equals to '%s'", realpass.c_str(), userpass.c_str());
  }
  return equal * equal; // make sure it's positive
}

# ? May 15, 2017 11:26

Jewel: May 2, 2009

i didn't see this part lmao

https://twitter.com/internetofshit/status/864079949287878656

# ? May 15, 2017 12:43

Truga: May 4, 2014; Lipstick Apathy

well, we know what the attack vector was now

# ? May 15, 2017 12:48

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

mod saas posted:

re:keep rear end, is there an acceptable version for macos?

I use MacPass which doesn't completely blow buuuuuut I dunno how good the PRNG and the generated passwords are

# ? May 15, 2017 13:51

vodkat: Jun 30, 2012; cannot legally be sold as vodka

More wannacry lols

https://twitter.com/tarah/status/863848105023643648

https://twitter.com/hackerfantastic/status/863833239475171329

# ? May 15, 2017 14:32

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Wiggly Wayne DDS posted:

https://oded.ninja/2017/05/14/amt-n-ken-hack/

Would be much better if this guy didn't jump to "it must be a nation state attack to opaquely modify the compilers everyone uses to replace this one specific string" from the get go.

# ? May 15, 2017 14:45

Shame Boy: Mar 2, 2010

vodkat posted:

More wannacry lols

https://twitter.com/tarah/status/863848105023643648

https://twitter.com/hackerfantastic/status/863833239475171329

oh well if rainbow dash avatar tried to hack it and couldn't it must be a lost cause

# ? May 15, 2017 15:22

cinci zoo sniper: Mar 15, 2013

ate all the Oreos posted:

oh well if rainbow dash avatar tried to hack it and couldn't it must be a lost cause

which pony is on your avatar btw

# ? May 15, 2017 15:35

fins: May 31, 2011; Floss Finder

http://illmatics.com/carhacking.html

papers and tools from the jeep cherokee hack. interesting read.

quote:

The �rmTrack� method contains a command injection vulnerably that will allow an attacker that can call the D-Bus method to run arbitrary shell commands by specifying a file name containing a shell meta- character. (There are others methods with similar vulnerabilities as well). Our suspicions were correct, as command injection is quite typical when dealing with user input from supposed trusted sources.
However, the command injection is not necessary because the �NavTrailService� service actually provides an �execute� method which is designed to execute arbitrary shell commands! Hey, it�s a feature, not a bug!

# ? May 15, 2017 15:49

Shame Boy: Mar 2, 2010

cinci zoo sniper posted:

which pony is on your avatar btw

it's a horrifying dead-eyed version of applejack called spookyjack:

https://www.youtube.com/watch?v=CaKS4zK7Hu4

i haven't seen any of the pony show because i'm not a child but i think this pony homunculus is wonderfully horrible :v:

# ? May 15, 2017 15:54

Chalks: Sep 30, 2009

ate all the Oreos posted:

it's a horrifying dead-eyed version of applejack called spookyjack:

Every time I see it I think it's a tropical fish.

# ? May 15, 2017 15:55

Tiny Bug Child: Sep 11, 2004; Avoid Symmetry, Allow Complexity, Introduce Terror

spankmeister posted:

15 years ago maybe

if there's a better one out there please by all means tell me what it is. esp if it works on macs cause winamp doesn't work on my work laptop

# ? May 15, 2017 16:07

Adbot: ADBOT LOVES YOU

# ? May 18, 2024 18:40

flakeloaf: Feb 26, 2003; Still better than android clock

I thought it was some wide-eyed yellow bird

# ? May 15, 2017 16:16

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »