Security Fuckup Megathread - v13.69 - plugins may violate privacy

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »

Partycat: Oct 25, 2004

mab at least allows for accounting for network devices, so it's not a total free for all.

Pushing the security effort line has a ton more buy in today in light of today's attacks but people still are highly resistant to extra effort. Especially for internal vectors, when they don't understand that doesn't necessarily mean literally a hacker disguising himself and coming on board or into a facility.

Expensive lessons have to be learned first I guess.

# ? Jun 18, 2017 14:20

Adbot: ADBOT LOVES YOU

# ? Jun 3, 2024 10:30

Blockade: Oct 22, 2008

Partycat posted:

Pushing the security effort line has a ton more buy in today in light of today's attacks...

What attacks?

# ? Jun 18, 2017 16:23

Lutha Mahtin: Oct 10, 2010; Your brokebrain sin is absolved...go and shitpost no more!

goddamnedtwisto posted:

was his problem "i think my girlfriend is deleting all my emails because people keep telling me they've sent me something and i've never received it"?

nah he claims his ex has hacked dozens of voip phones (i assume like vonage?) over the past couple years. reading it again, i still think the guy is just not very smart, but i change my mind to say there might be some mental illness too. the level 3 reply is pretty funny though, they say "uh, we're trying to figure out your report, can you explain how we fit into the story here?" :lol:

# ? Jun 18, 2017 17:38

Wiggly Wayne DDS: Sep 11, 2010

amazing: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/T6emeoE-lCU

Private key corresponding to public key in trusted Cisco certificate embedded in executable posted:

Hi all,

Last weekend, in an attempt to get Sky's NOW TV video player (for Mac) to work on my machine, I noticed that one of the Cisco executables contains a private key that is associated with the public key in a trusted certificate for a cisco.com <http://cisco.com/> sub domain (drmlocal.cisco.com <http://drmlocal.cisco.com/>). This certificate is used in a local WebSocket server, presumably to allow secure Sky/NOW TV origins to communicate with the video player on the users' local machines.

I read the Baseline Requirements document (version 1.4.5, section 4.9.1.1), but I wasn't entirely sure whether this is considered a key compromise. I asked Hanno B�ck on Twitter (https://twitter.com/koenrh/status/873869275529957376 <https://twitter.com/koenrh/status/873869275529957376>), and he advised me to post the matter to this mailing list.

The executable containing the private key is named 'CiscoVideoGuardMonitor', and is shipped as part of the NOW TV video player. In case you are interested, the installer can be found at https://web.static.nowtv.com/watch/NowTVPlayerInstaller.pkg <https://web.static.nowtv.com/watch/NowTVPlayerInstaller.pkg> (SHA-256: 56feeef4c3d141562900f9f0339b120d4db07ae2777cc73a31e3b830022241e6). I would recommend to run this installer in a virtual machine, because it drops files all over the place, and installs a few launch items (agents/daemons). The executable 'CiscoVideoGuardMonitor' can be found at '$HOME/Library/Cisco/VideoGuardPlayer/VideoGuardMonitor/VideoGuardMonitor.bundle/Contents/MacOS/CiscoVideoGuardMonitor'.

Certificate details:

Serial number: 66170CE2EC8B7D88B4E2EB732E738FE3A67CF672
DNS names: drmlocal.cisco.com <http://drmlocal.cisco.com/>
Issued by: HydrantID SSL ICA G2

Leaf certificate + HydrantID intermediate:
https://gist.github.com/koenrh/bf2a7eee03c9100be37d30b92760f5ab#file-certificates-pem <https://gist.github.com/koenrh/bf2a7eee03c9100be37d30b92760f5ab#file-certificates-pem>

As proof, I have published a verification message in a GitHub Gist, and signed the message using the compromised private key. See: https://gist.github.com/koenrh/bf2a7eee03c9100be37d30b92760f5ab#file-message-txt <https://gist.github.com/koenrh/bf2a7eee03c9100be37d30b92760f5ab#file-message-txt> (verify using: 'openssl dgst -sha256 -verify public-key.pem -signature message.txt.sig message.txt')

If this is indeed considered a key compromise, where do I go from here, and what are the recommended steps to take? Do I need to contact the subscriber (Cisco), and ask them to send a revocation request for this certificate to the issuer? Or do I need to notify the issuer (HydrantID), and ask them to revoke this certificate?

Thanks.

Best regards,
Koen Rouwhorst

# ? Jun 18, 2017 18:30

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

that revocation fight is going to be so good

# ? Jun 18, 2017 21:44

NFX: Jun 2, 2008; Fun Shoe

I'm the responsible disclosure advised by at hanno

# ? Jun 19, 2017 14:58

necrotic: Aug 2, 2005; I owe my brother big time for this!

Another password manager enters the fold. This one has a node process that replaces username and password in the requests instead of entering them directly into the form.

Also it's a node project

https://github.com/HainaLi/horcrux_password_manager

# ? Jun 19, 2017 15:19

AggressivelyStupid: Jan 9, 2012

Let's Play/Walkthrough

For the sake of this walkthrough, we assume you are a paranoid user who does not trust any one keystore with your credentials. You decide to spread your secrets across three keystores (at least two are required to use Horcrux) across three distinct datacenter regions in Amazon Web Services (AWS). You then plan to make a Facebook account with Horcrux and successfully login.

:thunk:

# ? Jun 19, 2017 15:22

Bhodi: Dec 9, 2007; Oh, it's just a cat.; Pillbug

Xposting from the opsec thread because this one was pretty big... the RNC hired an analytics firm who doesn't security and left a unpassworded S3 db full of 198 million people's personal info https://www.upguard.com/breaches/the-rnc-files

https://www.upguard.com/breaches/the-rnc-files posted:

In what is the largest known data exposure of its kind, UpGuard�s Cyber Risk Team can now confirm that unsecured databases containing the sensitive personal details of over 198 million American voters was left exposed to the internet by a firm working on behalf of the Republican National Committee (RNC) in their efforts to elect Donald Trump. The data, which was stored in a publicly accessible cloud server owned by Republican data firm Deep Root Analytics, included 1.1 terabytes of entirely unsecured personal information compiled by DRA and at least two other Republican contractors, TargetPoint Consulting, Inc. and Data Trust. In total, the personal information of potentially near all of America�s 200 million registered voters was exposed, including names, dates of birth, home addresses, phone numbers, and voter registration details, as well as data described as �modeled� voter ethnicities and religions.

it's also full of a bunch of subreddits like "InfertilityBabies" and a bunch of pokemon-related ones from the article's screenshot :lol:

BIG DATA

# ? Jun 19, 2017 15:27

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

necrotic posted:

Another password manager enters the fold. This one has a node process that replaces username and password in the requests instead of entering them directly into the form.

Also it's a node project

https://github.com/HainaLi/horcrux_password_manager

What is the worst that can happen? I am sure it has the highest quality code.

# ? Jun 19, 2017 15:27

AggressivelyStupid: Jan 9, 2012

Lain Iwakura posted:

What is the worst that can happen? I am sure it has the highest quality code.

JavaScript code:


     // unique salt?
     const key = crypto.pbkdf2Sync(auth, '0945jv209j252x5', 100000, 512, 'sha512');

     console.log("Super secret auth key is: " + key.toString('hex') + "\n"); // '3745e48...aa39b34'

i'm the unique salt?

# ? Jun 19, 2017 15:31

flakeloaf: Feb 26, 2003; Still better than android clock

Bhodi posted:

Xposting from the opsec thread because this one was pretty big... the RNC hired an analytics firm who doesn't security and left a unpassworded S3 db full of 198 million people's personal info https://www.upguard.com/breaches/the-rnc-files

it's also full of a bunch of subreddits like "InfertilityBabies" and a bunch of pokemon-related ones from the article's screenshot

BIG DATA

not much what's upguard with you

# ? Jun 19, 2017 15:32

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

AggressivelyStupid posted:

JavaScript code:

     // unique salt?
     const key = crypto.pbkdf2Sync(auth, '0945jv209j252x5', 100000, 512, 'sha512');

     console.log("Super secret auth key is: " + key.toString('hex') + "\n"); // '3745e48...aa39b34'

i'm the unique salt?

Minor issue. It's Node!

# ? Jun 19, 2017 15:36

leper khan: Dec 28, 2010; Honest to god thinks Half Life 2 is a bad game. But at least he likes Monster Hunter.

Bhodi posted:

Xposting from the opsec thread because this one was pretty big... the RNC hired an analytics firm who doesn't security and left a unpassworded S3 db full of 198 million people's personal info https://www.upguard.com/breaches/the-rnc-files

it's also full of a bunch of subreddits like "InfertilityBabies" and a bunch of pokemon-related ones from the article's screenshot

BIG DATA

Now I have a reason to be smug about not voting/registering. :smug:

# ? Jun 19, 2017 15:45

cinci zoo sniper: Mar 15, 2013

leper khan posted:

Now I have a reason to be smug about not voting/registering.

no you are a loving idiot

# ? Jun 19, 2017 16:19

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Please do not derail this thread

# ? Jun 19, 2017 16:25

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Bhodi posted:

Xposting from the opsec thread because this one was pretty big... the RNC hired an analytics firm who doesn't security and left a unpassworded S3 db full of 198 million people's personal info https://www.upguard.com/breaches/the-rnc-files

it's also full of a bunch of subreddits like "InfertilityBabies" and a bunch of pokemon-related ones from the article's screenshot

BIG DATA

thank you docevil...wherever you are...

# ? Jun 19, 2017 16:29

Zil: Jun 4, 2011; Satanically Summoned Citrus

AggressivelyStupid posted:

Let's Play/Walkthrough

For the sake of this walkthrough, we assume you are a paranoid user who does not trust any one keystore with your credentials. You decide to spread your secrets across three keystores (at least two are required to use Horcrux) across three distinct datacenter regions in Amazon Web Services (AWS). You then plan to make a Facebook account with Horcrux and successfully login.

well at least we know they will have an easy time coming up with the name for the exploit public release. thinking basilisk fang

# ? Jun 19, 2017 17:05

flakeloaf: Feb 26, 2003; Still better than android clock

Zil posted:

well at least we know they will have an easy time coming up with the name for the exploit public release. thinking basilisk fang

unlocket

# ? Jun 19, 2017 17:13

duTrieux.: Oct 9, 2003

leper khan posted:

Now I have a reason to be smug about not voting/registering.

i've taken to mentally classifying people who intentionally didn't vote as soft trump supporters

# ? Jun 19, 2017 17:49

Janitor Prime: Jan 22, 2004; PC LOAD LETTER

What da fuck does that mean; Fun Shoe

duTrieux. posted:

i've taken to mentally classifying people who intentionally didn't vote as soft trump supporters

You do realize that national votes in non swing states literally don't matter

# ? Jun 19, 2017 18:02

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Janitor Prime posted:

You do realize that national votes in non swing states literally don't matter

It's a good thing that people only vote for the president, and not any other form of elected official then.

Your vote in swing states doesn't matter either since the results have a margin of hundreds of people at a minimum too, so just don't ever vote.

# ? Jun 19, 2017 18:09

FAT32 SHAMER: Aug 16, 2012

Janitor Prime posted:

You do realize that national votes in non swing states literally don't matter

Michigan was a swing state? :thunk:

# ? Jun 19, 2017 18:42

RISCy Business: Jun 17, 2015; bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork; Fun Shoe

FAT32 SHAMER posted:

Michigan was a swing state?

it is when the democratic party goes all marie antoinette on it

loving retards

# ? Jun 19, 2017 18:44

Midjack: Dec 24, 2007

oh god shut the gently caress up and take it to the politics thread or dnd or loving anywhere else

# ? Jun 19, 2017 19:24

suffix: Jul 27, 2013; Wheeee!

necrotic posted:

Another password manager enters the fold. This one has a node process that replaces username and password in the requests instead of entering them directly into the form.

Also it's a node project

https://github.com/HainaLi/horcrux_password_manager

quote:

iancarroll 4 hours ago [-]

I am pretty sure the code is reusing IVs for AES-CTR[0] (i.e. the encryption is worthless), because it doesn't specify an IV and Node seems to derive the IV from the key.[1] This seems like a massive footgun in Node.
I don't think their scheme results in different keys for each site, but I could be wrong.
[0] https://github.com/HainaLi/horcrux_password_manager/blob/master/utils.js#L20
[1] https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password

lol wtf node that's like the wrongest possible thing to do
literally full compromise built into the api

# ? Jun 19, 2017 19:51

duTrieux.: Oct 9, 2003

Janitor Prime posted:

You do realize that national votes in non swing states literally don't matter

i live in california, i'm very well aware of this.

it changes nothing unless you've given yourself wholly over to cynicism.

# ? Jun 19, 2017 20:03

duTrieux.: Oct 9, 2003

Midjack posted:

oh god shut the gently caress up and take it to the politics thread or dnd or loving anywhere else

i'm sorry, but everything is political. it's a bummer, i know.

# ? Jun 19, 2017 20:04

Wiggly Wayne DDS: Sep 11, 2010

post better. there's no end to sec fucks and other threads for your dumb arguments

return of the stack clash: http://www.openwall.com/lists/oss-security/2017/06/19/1

# ? Jun 19, 2017 20:42

RISCy Business: Jun 17, 2015; bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork; Fun Shoe

duTrieux. posted:

i live in california, i'm very well aware of this.

it changes nothing unless you've given yourself wholly over to cynicism.

dehumanize yourself and face to voter apathy

# ? Jun 19, 2017 20:42

graph: Nov 22, 2006; aaag peanuts

Midjack posted:

oh god shut the gently caress up and take it to the politics thread or dnd or loving anywhere else

agreed

# ? Jun 19, 2017 22:34

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

duTrieux. posted:

i'm sorry, but everything is political. it's a bummer, i know.

don't post in this thread again, idiot

# ? Jun 19, 2017 23:40

My Linux Rig: Mar 27, 2010; Can't post for 6 years!

Midjack posted:

oh god shut the gently caress up and take it to the politics thread or dnd or loving anywhere else

seriously. don't we have enough of this poo poo pushed into our faces everyday

# ? Jun 19, 2017 23:54

aardvaard: Mar 4, 2013; you belong in the bog of eternal stench

it's hard to have something pushed in your face when you're a ghost.

# ? Jun 20, 2017 07:02

FAT32 SHAMER: Aug 16, 2012

# ? Jun 20, 2017 15:44

duTrieux.: Oct 9, 2003

Lain Iwakura posted:

don't post in this thread again, idiot

you didn't say my true name backwards

# ? Jun 20, 2017 17:50

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

duTrieux. posted:

you didn't say my true name backwards

he said it forwards

# ? Jun 20, 2017 18:31

Wiggly Wayne DDS: Sep 11, 2010

unrar may have missed a few vulnerabilities reported to them https://bugs.chromium.org/p/project-zero/issues/detail?id=1278 and https://bugs.chromium.org/p/project-zero/issues/detail?id=1286

# ? Jun 20, 2017 18:51

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Wiggly Wayne DDS posted:

unrar may have missed a few vulnerabilities reported to them https://bugs.chromium.org/p/project-zero/issues/detail?id=1278 and https://bugs.chromium.org/p/project-zero/issues/detail?id=1286

your dest is a pos

# ? Jun 20, 2017 18:55

Adbot: ADBOT LOVES YOU

# ? Jun 3, 2024 10:30

Midjack: Dec 24, 2007

Wiggly Wayne DDS posted:

unrar may have missed a few vulnerabilities reported to them https://bugs.chromium.org/p/project-zero/issues/detail?id=1278 and https://bugs.chromium.org/p/project-zero/issues/detail?id=1286

raro

# ? Jun 20, 2017 19:08

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›216 »