Security Fuckup Megathread - v14.1 - Hello, is this a delivery order? - The Something Awful Forums

Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

neutral milf hotel: Oct 9, 2001; by Fluffdaddy

plz rename thread Security Fuckup Megathread v15.0 - better upgrade ur libraries u stupid bitch

# ? Jun 29, 2017 04:17

Adbot: ADBOT LOVES YOU

# ? May 13, 2024 23:10

AARP LARPer: Feb 19, 2005; THE DARK SIDE OF SCIENCE BREEDS A WEAPON OF WAR; Buglord

JewKiller 3000 posted:

maybe the search engines, but you're not gonna get full text papers from the journals without paying, are you?

Yes, most of the time you'll get full access to full text html or PDFs for free. Everything under the sun? No. There are some publishers (IEEE comes to mind) that keep their poo poo walled off. There are also the occasional journals that embargo their materials for a month or so, but it's been a while since I've run across one of those.

# ? Jun 29, 2017 04:18

JewKiller 3000: Nov 28, 2006; by Lowtax

lol sounds like college libraries should cancel half their journal subscriptions and tell their students to get a public library card and go online. there, i've solved the university funding crisis

# ? Jun 29, 2017 04:19

Phone: Jul 30, 2005; 親子丼をほしい。

BeOSPOS posted:

plz rename thread Security Fuckup Megathread v15.0 - better upgrade ur libraries u stupid bitch

#include <libraries.h>

# ? Jun 29, 2017 04:20

JewKiller 3000: Nov 28, 2006; by Lowtax

the best thing about cs academia is you google the name of the paper and the first result is the main author's .edu website with a link to the "preprint" pdf. works EVERY time. ieee and acm suck rear end but NO BO DY cares because of this

also conferences matter more than journals, that helps

# ? Jun 29, 2017 04:26

AARP LARPer: Feb 19, 2005; THE DARK SIDE OF SCIENCE BREEDS A WEAPON OF WAR; Buglord

sorry everyone no more from me. i've got it all out of my system now and besides the darkest days are behind us which was when second life was going to usher in a golden age of virtual library service and holy gently caress things can only look up after that.

# ? Jun 29, 2017 04:28

JewKiller 3000: Nov 28, 2006; by Lowtax

i remember second life, i'm amazed that poo poo is still around. in the early days it was a true secfuck, the linden dollars were just starting to be traded for real money, yet the code was full of vulnerabilities. you could purchase private virtual properties, which would block everyone not invited from coming into them, but it was possible to clip through the border by sitting down on an object in the property. so you could drop in uninvited on some yiffy furs having e-sex. truly a golden age

# ? Jun 29, 2017 04:35

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

JewKiller 3000 posted:

the best thing about cs academia is

arxiv

# ? Jun 29, 2017 04:37

Sharktopus: Aug 9, 2006

Subjunctive posted:

arxiv

# ? Jun 29, 2017 05:15

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Lain Iwakura posted:

i'm so glad that this is the library thread. i totally misread the title when i clicked on it i guess

imho it was a pretty good troll to close the secfuck thread before it could get to page 219 and then replace it with a library thread

# ? Jun 29, 2017 05:34

Wiggly Wayne DDS: Sep 11, 2010

infernal machines posted:

a breathless and poorly written piece on the petya variant that hit recently

tl;dr: it's not really ransomware as it straight up overwrites the boot sector and subsequent blocks, there's no way to decrypt them because they weren't actually encrypted at all, presumably this is by design.

for some reason it ignores the existence of low level file recovery tools like testdisk and photorec, which will likely recover the file data regardless of mbr and mft damage

e: the implication being this is a state-level attack disguised to look like ransomware to generate a different narrative

yeah that's just copypasting where everyone's analysis has been going. we can't say malware has intentional flaws and political motivation though otherwise the :tinfoil:

:tinfoil:

comes out

# ? Jun 29, 2017 05:54

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

oops https://www.washingtonpost.com/news/the-switch/wp/2017/06/28/fedex-delivery-unit-hit-by-worldwide-cyberattack/

# ? Jun 29, 2017 06:55

pseudorandom name: May 6, 2007

does ExPetr actually rely on ETERNALBLUE or did the Russians just throw that in there to blame the NSA?

# ? Jun 29, 2017 07:15

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

pseudorandom name posted:

does ExPetr actually rely on ETERNALBLUE or did the Russians just throw that in there to blame the NSA?

it is allegedly one of the transmission vectors but it also uses psexec so

# ? Jun 29, 2017 07:17

Wiggly Wayne DDS: Sep 11, 2010

pseudorandom name posted:

does ExPetr actually rely on ETERNALBLUE or did the Russians just throw that in there to blame the NSA?

whoever the malware authors are use it but only for spreading internally - it isn't randomly scanning the internet. effectiveness is a higher design priority than little nods, but there is more than one variant hiding in this mess

# ? Jun 29, 2017 07:28

spankmeister: Jun 15, 2008

infernal machines posted:

a breathless and poorly written piece on the petya variant that hit recently

tl;dr: it's not really ransomware as it straight up overwrites the boot sector and subsequent blocks, there's no way to decrypt them because they weren't actually encrypted at all, presumably this is by design.

for some reason it ignores the existence of low level file recovery tools like testdisk and photorec, which will likely recover the file data regardless of mbr and mft damage

e: the implication being this is a state-level attack disguised to look like ransomware to generate a different narrative

Malware Tech refutes this:

https://www.malwaretech.com/2017/06/petya-ransomware-attack-whats-known.html

The fact remains that the installation ID is generated randomly though.

https://securelist.com/expetrpetyanotpetya-is-a-wiper-not-ransomware/78902/

I've looked at some samples today and the code does seem to support the theory, too early to tell though.

# ? Jun 29, 2017 11:54

Shifty Pony: Dec 28, 2004; Up ta somethin'

spankmeister posted:

Malware Tech refutes this:

https://www.malwaretech.com/2017/06/petya-ransomware-attack-whats-known.html

The fact remains that the installation ID is generated randomly though.

https://securelist.com/expetrpetyanotpetya-is-a-wiper-not-ransomware/78902/

I've looked at some samples today and the code does seem to support the theory, too early to tell though.

even if the installation ID wasn't just a random number and was actually generated in a way that would allow decryption, the whole decryption payment method stinks.

you have a well written customized piece of malware deployed in a sophisticated manner which combines multiple exploits and multiple payloads, and it relies on a single bitcoin address, the manual transcription of a huge installation ID which doesn't even avoid ambiguous characters, and email? there's a reason the ransomware industry standard procedure for payment is the creation of a per-machine bitcoin address with TOR being used to confirm payment and supply the decryption code automatically on payment.

whoever designed this thing didn't care about being paid. their goals were pretty clearly primarily to get credentials, to cause damage and disruption in Ukraine, or both.

# ? Jun 29, 2017 13:07

Wiggly Wayne DDS: Sep 11, 2010

the elephant in the room is that petya is ransomware already with a working payment chain, there was no need for these changes to exist

# ? Jun 29, 2017 13:16

spankmeister: Jun 15, 2008

I agree with both of you. To me it's abundantly clear what the purpose of this malware is.

# ? Jun 29, 2017 13:20

cinci zoo sniper: Mar 15, 2013

spankmeister posted:

I agree with both of you. To me it's abundantly clear what the purpose of this malware is.

pls share, ive been only halfassedly reading about petya

# ? Jun 29, 2017 13:47

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Another live fire exercise on Ukranian infrastructure, with a side of collateral damage, made to be plausibly connected to previous ransomware attacks?

# ? Jun 29, 2017 13:51

Shifty Pony: Dec 28, 2004; Up ta somethin'

this is a pretty good rundown of it with links to the posts of the various security researchers who found the issues:

https://medium.com/@thegrugq/pnyetya-yet-another-ransomware-outbreak-59afd1ee89d4

# ? Jun 29, 2017 13:54

cinci zoo sniper: Mar 15, 2013

infernal machines posted:

Another live fire exercise on Ukranian infrastructure, with a side of collateral damage, made to be plausibly connected to previous ransomware attacks?

that i kinda assumed it's russians just ukraining it away, i more thought some specific computer level macro objectives petya had that spankmeister may have implied

# ? Jun 29, 2017 14:13

spankmeister: Jun 15, 2008

cinci zoo sniper posted:

that i kinda assumed it's russians just ukraining it away, i more thought some specific computer level macro objectives petya had that spankmeister may have implied

The initial infection vector is from a Ukranian company that makes tax return software. This company was hacked and made to push a malicious update to its users. A lot of businesses and government in Ukraine and businesses that deal with Ukraine use this software because it's one of the few that's allowed for use by the government.

So that makes it clear that Ukraine was the target.

Now the malware itself looks like a variant of Petya, which is an existing ransomware family. This is a false flag, smoke and mirrors. Why? Because there is no way of getting your files decrypted. This is because it generates a unique "Installation ID" which you're supposed to send along with your bitcoin wallet address that you made the payment from to an email address. They use a single hardcoded bitcoin wallet for every infection. This method requires manual verification and is completely ludicrous for a malware that has such aggressive spreading methods. Modern ransomware uses a more sophisticated backend that generates a unique bitcoin wallet for each infection which allows payments to be automatically verified over a tor backend.

Stupid verification method aside, the installation ID is completely random. There is _no_ way to link this ID to a specific infection. The malware authors cannot determine which key it belongs to. So there is no chance of this ever working as a "legitimate" ransomware.

And like Wiggly Wayne DDS said, Petya was a perfectly functional ransomware, there was no reason to make the changes that they did.

# ? Jun 29, 2017 15:24

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

spankmeister posted:

And like Wiggly Wayne DDS said, Petya was a perfectly functional ransomware, there was no reason to make the changes that they did.

so wait was there a new legit ransomware attack this week or is petya older and just the non-ransomware targeted at ukraine is new?

# ? Jun 29, 2017 15:56

cinci zoo sniper: Mar 15, 2013

spankmeister posted:

The initial infection vector is from a Ukranian company that makes tax return software. This company was hacked and made to push a malicious update to its users. A lot of businesses and government in Ukraine and businesses that deal with Ukraine use this software because it's one of the few that's allowed for use by the government.

So that makes it clear that Ukraine was the target.

Now the malware itself looks like a variant of Petya, which is an existing ransomware family. This is a false flag, smoke and mirrors. Why? Because there is no way of getting your files decrypted. This is because it generates a unique "Installation ID" which you're supposed to send along with your bitcoin wallet address that you made the payment from to an email address. They use a single hardcoded bitcoin wallet for every infection. This method requires manual verification and is completely ludicrous for a malware that has such aggressive spreading methods. Modern ransomware uses a more sophisticated backend that generates a unique bitcoin wallet for each infection which allows payments to be automatically verified over a tor backend.

Stupid verification method aside, the installation ID is completely random. There is _no_ way to link this ID to a specific infection. The malware authors cannot determine which key it belongs to. So there is no chance of this ever working as a "legitimate" ransomware.

And like Wiggly Wayne DDS said, Petya was a perfectly functional ransomware, there was no reason to make the changes that they did.

:tipshat:

this is very interesting, and confusing

# ? Jun 29, 2017 16:09

ThePeavstenator: Dec 18, 2012; Establish the Buns

Well this morning certainly has been interesting.

I work at a large global company that makes lawn equipment and engines. Our manufacturing line computers were infected with ransomware last year and had to be shut down until hundreds of thousands of dollars were payed out.

I work in the equipment testing lab. The lab manager (who btw owns) and I are the people that maintain and develop software that handles all the test requests and test data, among other things.

I go into his office this morning and we notice that a folder in the network drive where all of our test data is stored had a bunch of [document in the folder filename].locky files. We immediately wrote a ticket, which immediately got escalated to the head of global network security. I then noticed that all the locky files were 0 bytes and I right clicked on the properties to see the owner. Every file was owned by the same guy and we work fairly closely with him so we messaged him right away. He tries being all coy saying he had no idea what we're talking about *wink*. Turns out they're all just empty and it was just a "prank".

Our IT sends out almost daily memos reminding people what to look for in a phishing attempt after we had production shut down last year. They were making GBS threads themselves this morning and wanted to speak with him right away. We told him this and his defense was "well I was just trying to check up on you guys, IT sends out phishing tests to employees all the time too!!"

tldr: A genius at work this morning decided to put a bunch of blank [filename].locky files on a network drive where all of our test data is stored as a "prank".

# ? Jun 29, 2017 16:57

cinci zoo sniper: Mar 15, 2013

ThePeavstenator posted:

Well this morning certainly has been interesting.

I work at a large global company that makes lawn equipment and engines. Our manufacturing line computers were infected with ransomware last year and had to be shut down until hundreds of thousands of dollars were payed out.

I work in the equipment testing lab. The lab manager (who btw owns) and I are the people that maintain and develop software that handles all the test requests and test data, among other things.

I go into his office this morning and we notice that a folder in the network drive where all of our test data is stored had a bunch of [document in the folder filename].locky files. We immediately wrote a ticket, which immediately got escalated to the head of global network security. I then noticed that all the locky files were 0 bytes and I right clicked on the properties to see the owner. Every file was owned by the same guy and we work fairly closely with him so we messaged him right away. He tries being all coy saying he had no idea what we're talking about *wink*. Turns out they're all just empty and it was just a "prank".

Our IT sends out almost daily memos reminding people what to look for in a phishing attempt after we had production shut down last year. They were making GBS threads themselves this morning and wanted to speak with him right away. We told him this and his defense was "well I was just trying to check up on you guys, IT sends out phishing tests to employees all the time too!!"

looks like he found a vuln in his employment status

# ? Jun 29, 2017 16:58

ThePeavstenator: Dec 18, 2012; Establish the Buns

cinci zoo sniper posted:

looks like he found a vuln in his employment status

I guess it should also be noted that he's not a computer toucher, he's an electrical technician, so I don't think he knew the level of reaction this was going to get.

# ? Jun 29, 2017 17:05

cinci zoo sniper: Mar 15, 2013

ThePeavstenator posted:

I guess it should also be noted that he's not a computer toucher, he's an electrical technician, so I don't think he knew the level of reaction this was going to get.

uhhhh

# ? Jun 29, 2017 17:07

AARP LARPer: Feb 19, 2005; THE DARK SIDE OF SCIENCE BREEDS A WEAPON OF WAR; Buglord

oh my god it was just a little prank about the company facing the possibility of another multi-million dollar loss -- why can't you guys take a joke???!!!

rip, electrical dude

# ? Jun 29, 2017 17:08

ThePeavstenator: Dec 18, 2012; Establish the Buns

cinci zoo sniper posted:

uhhhh

hey man I never said he was smart

# ? Jun 29, 2017 17:08

cinci zoo sniper: Mar 15, 2013

ThePeavstenator posted:

hey man I never said he was smart

not blaming you or anything, just didnt expect that it wasnt even a computer toucher. this is getting into windows xp screenshot wallpaper tier of pranks, only in the worst place at the worst time

# ? Jun 29, 2017 17:09

maskenfreiheit: Dec 30, 2004

ThePeavstenator posted:

Well this morning certainly has been interesting.

I work at a large global company that makes lawn equipment and engines. Our manufacturing line computers were infected with ransomware last year and had to be shut down until hundreds of thousands of dollars were payed out.

I work in the equipment testing lab. The lab manager (who btw owns) and I are the people that maintain and develop software that handles all the test requests and test data, among other things.

I go into his office this morning and we notice that a folder in the network drive where all of our test data is stored had a bunch of [document in the folder filename].locky files. We immediately wrote a ticket, which immediately got escalated to the head of global network security. I then noticed that all the locky files were 0 bytes and I right clicked on the properties to see the owner. Every file was owned by the same guy and we work fairly closely with him so we messaged him right away. He tries being all coy saying he had no idea what we're talking about *wink*. Turns out they're all just empty and it was just a "prank".

Our IT sends out almost daily memos reminding people what to look for in a phishing attempt after we had production shut down last year. They were making GBS threads themselves this morning and wanted to speak with him right away. We told him this and his defense was "well I was just trying to check up on you guys, IT sends out phishing tests to employees all the time too!!"

tldr: A genius at work this morning decided to put a bunch of blank [filename].locky files on a network drive where all of our test data is stored as a "prank".

Robert Hanssen also claimed to be merely testing his employers' information security

# ? Jun 29, 2017 17:10

Meat Beat Agent: Aug 5, 2007; felonious assault with a sproinging boner

i bet that dude will WannaCry after he gets fired lol

# ? Jun 29, 2017 17:11

cinci zoo sniper: Mar 15, 2013

Meat Beat Agent posted:

i bet that dude will WannaCry after he gets fired lol

:wow:

# ? Jun 29, 2017 17:12

ThePeavstenator: Dec 18, 2012; Establish the Buns

cinci zoo sniper posted:

not blaming you or anything, just didnt expect that it wasnt even a computer toucher. this is getting into windows xp screenshot wallpaper tier of pranks, only in the worst place at the worst time

The system is primarily used by non computer touchers. Product engineers write up test requests, and techs run the tests and record data and results in the system. It's primarily data for NPD but we also do production testing as well so that data is on the system too.

ThePeavstenator fucked around with this message at 17:18 on Jun 29, 2017

# ? Jun 29, 2017 17:14

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

I love learning poo poo like this

Thank you secfuck thread

# ? Jun 29, 2017 17:19

neutral milf hotel: Oct 9, 2001; by Fluffdaddy

Meat Beat Agent posted:

i bet that dude will WannaCry after he gets fired lol

# ? Jun 29, 2017 17:47

Adbot: ADBOT LOVES YOU

# ? May 13, 2024 23:10

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Meat Beat Agent posted:

i bet that dude will WannaCry after he gets fired lol

:thurman:

# ? Jun 29, 2017 18:13

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

Powered by: vBulletin Version 2.2.9 (SABB-v2.24.05)
Copyright ©2000, 2001, Jelsoft Enterprises Limited.
Copyright ©2024, Jeffrey of YOSPOS