Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

passwords rotated by 360 degrees

# ? Jun 30, 2017 04:14

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 06:17

Shifty Pony: Dec 28, 2004; Up ta somethin'

we have 60 day rotation and warning emails about passwords expiring start getting sent out at 15 days from expiration.

1/4 of my working days I get a password reminder email.

# ? Jun 30, 2017 04:34

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Jesus, I try to float 6mo expiration and fallback to annual when the inevitable pushback occurs.

# ? Jun 30, 2017 05:01

communism bitch: Apr 24, 2009

Shifty Pony posted:

wired has a story on it which isn't entirely awful. it goes over the pattern of the attacks starting out as largely manually executed against a particular system and then iterating until they are automated attacks based on modular tools which could be more easily adapted for use against other targets. if you dig a bit online about each of the incidents in the article there are usually a few blog posts by researchers.

Wicked, thanks.

# ? Jun 30, 2017 06:06

ate shit on live tv: Feb 15, 2004; by Azathoth

Just allow users to keep passwords for a year, but mandate 20+ character passphrases.

Good password: The boy bounced the basketball on July 21st
lovely lazy password encouraged by over-zealous password rotation policies: Summer2017!
Next quarters password: Fall2017!@#$

# ? Jun 30, 2017 06:10

Dex: May 26, 2006; Quintuple x!!!

Would not escrow again.

VERY MISLEADING!

we had some company-wide webex password update enforced recently. usual rules apply, except they also check on the password change form whether your password contains common english words

thankfully Abcde123 passed all the checks so i'm secure as gently caress now

# ? Jun 30, 2017 09:16

Wiggly Wayne DDS: Sep 11, 2010

spankmeister posted:

Straight up blackmail lmao

they're getting better at this: https://steemit.com/shadowbrokers/@theshadowbrokers/response-to-response-to-doxing

e: more info on how vulnerable the medoc update process was: http://blog.uk.fujitsu.com/information-security/petya-medoc-and-the-delivery-of-malicious-software/

Wiggly Wayne DDS fucked around with this message at 10:59 on Jun 30, 2017

# ? Jun 30, 2017 10:55

spankmeister: Jun 15, 2008

Wiggly Wayne DDS posted:

they're getting better at this: https://steemit.com/shadowbrokers/@theshadowbrokers/response-to-response-to-doxing

e: more info on how vulnerable the medoc update process was: http://blog.uk.fujitsu.com/information-security/petya-medoc-and-the-delivery-of-malicious-software/

wow, someone at fujitsu knows how to use nmap

such cyber

# ? Jun 30, 2017 14:10

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

MononcQc posted:

and here I am with a work computer that has cylance running on it, which just loves to randomly decide vim or scp are viruses and quarantines them

it is my understanding that this is how cylance works

# ? Jun 30, 2017 17:29

maskenfreiheit: Dec 30, 2004

anthonypants posted:

it is my understanding that this is how cylance works

vim is a notorious hacking tool.

# ? Jun 30, 2017 17:31

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Microsoft should go the apple route and only execute signed code without a prompt and force some kind of manual intervention for anything unsigned

# ? Jun 30, 2017 17:38

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Do a full applocker rollout on top of it and all these heuristics/sandboxing solutions become irrelevant

# ? Jun 30, 2017 17:39

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

BangersInMyKnickers posted:

Microsoft should go the apple route and only execute signed code without a prompt and force some kind of manual intervention for anything unsigned

this would simultaneously own so hard and destroy any business-line applications. a win-win

# ? Jun 30, 2017 17:55

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Make a windows enterprise-only GPO that allows you to disable code signing validation boom slam-dunk I am pdresident of mcmicrosoft

https://www.youtube.com/watch?v=ZqnrZrPRBaI

# ? Jun 30, 2017 17:57

Wrath of the Bitch King: May 11, 2005; Research confirms that black is a color like silver is a color, and that beyond black is clarity.

BangersInMyKnickers posted:

Jesus, I try to float 6mo expiration and fallback to annual when the inevitable pushback occurs.

We enforce 45 days here. It sucks.

# ? Jun 30, 2017 18:57

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Anybody know what services or processes need to be whitelisted on the windows firewall to make updates work on an outbound deny default config? I've cleared both BITS and WU services but it still fails and I see something hitting 443 outbound and getting dropped but I am having a hell of a time figuring out what process or service its associated with. I made a blanket 443 out allow rule and it started working again but there's something else that is now a dependency for updates to work properly and this poo poo isn't documented by MS.

# ? Jun 30, 2017 19:02

cinci zoo sniper: Mar 15, 2013

BangersInMyKnickers posted:

Anybody know what services or processes need to be whitelisted on the windows firewall to make updates work on an outbound deny default config? I've cleared both BITS and WU services but it still fails and I see something hitting 443 outbound and getting dropped but I am having a hell of a time figuring out what process or service its associated with. I made a blanket 443 out allow rule and it started working again but there's something else that is now a dependency for updates to work properly and this poo poo isn't documented by MS.

you need 80 and 443 for http and https wsus access respectively. restrict the ports to

code:

http://windowsupdate.microsoft.com 

http://*.windowsupdate.microsoft.com 

https://*.windowsupdate.microsoft.com 

http://*.update.microsoft.com 

https://*.update.microsoft.com 

http://*.windowsupdate.com 

http://download.windowsupdate.com

http://download.microsoft.com 

http://*.download.windowsupdate.com 

http://wustat.windows.com 

http://ntservicepack.microsoft.com

# ? Jun 30, 2017 19:04

Wrath of the Bitch King: May 11, 2005; Research confirms that black is a color like silver is a color, and that beyond black is clarity.

BangersInMyKnickers posted:

Anybody know what services or processes need to be whitelisted on the windows firewall to make updates work on an outbound deny default config? I've cleared both BITS and WU services but it still fails and I see something hitting 443 outbound and getting dropped but I am having a hell of a time figuring out what process or service its associated with. I made a blanket 443 out allow rule and it started working again but there's something else that is now a dependency for updates to work properly and this poo poo isn't documented by MS.

The actual process is almost 100% going to be some subfunction/process of svchost, so if you're looking for an actual executable to whitelist rather than specific connections for updates you're going to have trouble.

Even the latter is problematic because the update points change all the time, and Store Apps, Office, 365, etc. come from different locations.

TL;DR: Turn off Windows Firewall.

I take it that this isn't a place with an internal WSUS server you can whitelist?

Wrath of the Bitch King fucked around with this message at 19:09 on Jun 30, 2017

# ? Jun 30, 2017 19:06

Wiggly Wayne DDS: Sep 11, 2010

oh and you'll have to punch windows defender updates through elsewhere

%ProgramFiles%\Windows Defender\MSASCui.exe

iirc

# ? Jun 30, 2017 19:08

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

cinci zoo sniper posted:

you need 80 and 443 for http and https wsus access respectively. restrict the ports to

code:

http://windowsupdate.microsoft.com 

[url]http://*.windowsupdate.microsoft.com[/url] 

[url]https://*.windowsupdate.microsoft.com[/url] 

[url]http://*.update.microsoft.com[/url] 

[url]https://*.update.microsoft.com[/url] 

[url]http://*.windowsupdate.com[/url] 

[url]http://download.windowsupdate.com[/url]

[url]http://download.microsoft.com[/url] 

[url]http://*.download.windowsupdate.com[/url] 

[url]http://wustat.windows.com[/url] 

[url]http://ntservicepack.microsoft.com[/url]

Windows firewall doesn't whitelist on domains, I need to know what process is initiation the connection.

# ? Jun 30, 2017 19:10

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

I do have WSUS/SCCM available but I'm testing out some more edge lockdown configs for desktops. I have a suspicion that windows update fails to connect if the firewall is dropping the telemetry service connections which would be the most WTF thing imaginable. It's an unpatched 1607 install though so I'm letting it up updates in for the most recent patchset and I'll keep digging in from there.

# ? Jun 30, 2017 19:12

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Also the Windows Firewall is Very Good and you are wrong about it. This is the OS's fault for having an absurdly convoluted update mechanism that routes through 3+ services

# ? Jun 30, 2017 19:13

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

one of our dbas is having trouble browsing to a network share presented by our backup appliance from his workstation and my first guess is that it's using smbv1. this should be good.

e: slightly disappointed that wasn't it. welp

anthonypants fucked around with this message at 19:17 on Jun 30, 2017

# ? Jun 30, 2017 19:14

Wrath of the Bitch King: May 11, 2005; Research confirms that black is a color like silver is a color, and that beyond black is clarity.

The last time I did this I used a 3rd party firewall that isolates things down to the process (Netlimiter, etc.) along with Wireshark to run it down on a machine with WF disabled.

That'll probably save you the most time. It wouldn't surprise me if the system did a connection check for something like connect.microsoft.com as a preliminary step before updating and then proceeded based on the result (or lack thereof).

Turning off WF was a joke.

# ? Jun 30, 2017 19:15

Wiggly Wayne DDS: Sep 11, 2010

BangersInMyKnickers posted:

Also the Windows Firewall is Very Good and you are wrong about it. This is the OS's fault for having an absurdly convoluted update mechanism that routes through 3+ services

yeah windows firewall is very good which is why diagnosing this issue is so easy

seriously though if they bothered to make any of this at all functional and didn't quietly throw in their own rules you'd be able to lockdown most consumer systems pretty easily

# ? Jun 30, 2017 19:16

RISCy Business: Jun 17, 2015; bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork; Fun Shoe

run you are own windows update server

# ? Jun 30, 2017 19:17

cinci zoo sniper: Mar 15, 2013

BangersInMyKnickers posted:

Windows firewall doesn't whitelist on domains, I need to know what process is initiation the connection.

wuauclt.exe i think

# ? Jun 30, 2017 19:18

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Wiggly Wayne DDS posted:

yeah windows firewall is very good which is why diagnosing this issue is so easy

seriously though if they bothered to make any of this at all functional and didn't quietly throw in their own rules you'd be able to lockdown most consumer systems pretty easily

There should be a canned outbound rule to allow whatever stuff needs for WU but yeah, you get to figure it out yourself. There's also a default ruleset that includes the stuff needed for kerberos/policy/AD whatever but it doesn't include ldap/ldaps and whoooopsie that one is necessary too

# ? Jun 30, 2017 19:19

Wiggly Wayne DDS: Sep 11, 2010

it is under svchost for the record, i don't remember which services it uses though

# ? Jun 30, 2017 19:20

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

To be clear, 3rd party firewall's "solution" to this problem is to allow anything running under a svchost process to do whatever it wants with the network interface which is poo poo.

# ? Jun 30, 2017 19:20

The MUMPSorceress: Jan 6, 2012; ^SHTPSTS; Gary’s Answer

anthonypants posted:

cylance works

you contradict yourself :v:

# ? Jun 30, 2017 19:21

Wrath of the Bitch King: May 11, 2005; Research confirms that black is a color like silver is a color, and that beyond black is clarity.

BangersInMyKnickers posted:

There should be a canned outbound rule to allow whatever stuff needs for WU but yeah, you get to figure it out yourself. There's also a default ruleset that includes the stuff needed for kerberos/policy/AD whatever but it doesn't include ldap/ldaps and whoooopsie that one is necessary too

Yeah MS is notoriously bad at making their own poo poo interoperable. Having to add LDAP rules is pretty lol. I haven't messed with it in a while; do you still have to create rules for RDP when within the domain?

quote:

To be clear, 3rd party firewall's "solution" to this problem is to allow anything running under a svchost process to do whatever it wants with the network interface which is poo poo.

They are. I used it temporarily just to get some information, then peeled it all off. I'm definitely not advocating it as an actual use case.

# ? Jun 30, 2017 19:22

maskenfreiheit: Dec 30, 2004

Wrath of the Bitch King posted:

We enforce 45 days here. It sucks.

The FTC put out a great blog on this subject:
https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes

TL;DR: more frequent forced changes == frustrated users == weaker PWs

# ? Jun 30, 2017 19:23

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

cis autodrag posted:

you contradict yourself

if it didn't work then it wouldn't be quarantining executables, now would it

# ? Jun 30, 2017 19:23

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

from the schadenthread, emphasis mine

Raygereio posted:

Remember that WannaCry ransomware attack from last may? Afterwards the company I work for pushed out an internal memo telling all employees not to worry and that such attack could never hit us.

And then they got hit by NotPetya last Tuesday. I had a couple of days off so I didn't pay that much attention to it. But when I arrived at work this morning I was greeted by the cheerful message that production wasn't affected that badly and that the lines could still run the last few days. But supplies will run out Monday and we'll probably have to stop production Sunday because no one can open the doors of the warehouses the finished products are supposed to go to.
The IT department never applied the goddamned patches for the EternalBlue exploit to all the vulnerable machines. Apparently the US based corporate headquarters was still working the costs before they would give the go ahead to apply those upgrades. When I informed about the status of their backups, the questioned IT-goon gave me a thousand yard stare, mumbled something incomprehensible and quickly walked away. Currently the crisis team's best guess is that critical stuff will be fixed in two weeks.
This is one of the largest pharmaceutical companies in the world.

# ? Jun 30, 2017 21:23

Ciaphas: Nov 20, 2005; > BEWARE, COWARD

cinci zoo sniper posted:

looks like he found a vuln in his employment status

Reminds me of that guy who "pranked" his fellows at some chemical lab by putting almond extract into an A/C intake

# ? Jun 30, 2017 23:07

cinci zoo sniper: Mar 15, 2013

Ciaphas posted:

Reminds me of that guy who "pranked" his fellows at some chemical lab by putting almond extract into an A/C intake

im not sure what effect that does but ive seen some of my coworkers smoking next to the intake of building-wide air ventillation system

# ? Jun 30, 2017 23:09

vOv: Feb 8, 2014

cinci zoo sniper posted:

im not sure what effect that does but ive seen some of my coworkers smoking next to the intake of building-wide air ventillation system

it doesn't do anything per se but usually smelling almonds in a chemical plant means 'cyanide spill'

# ? Jun 30, 2017 23:11

cinci zoo sniper: Mar 15, 2013

vOv posted:

it doesn't do anything per se but usually smelling almonds in a chemical plant means 'cyanide spill'

# ? Jun 30, 2017 23:11

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 06:17

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

Ciaphas posted:

Reminds me of that guy who "pranked" his fellows at some chemical lab by putting almond extract into an A/C intake

I remember that article.

Schadenfreude is a wonderful thing

# ? Jun 30, 2017 23:42

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »