Security Fuckup Megathread - v14.1 - Hello, is this a delivery order? - The Something Awful Forums

Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

plus if you forget to expense them it's :10bux:

:10bux:

down the drain

# ? Jul 19, 2017 15:25

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 23:38

ultramiraculous: Nov 12, 2003; "No..."; Grimey Drawer

pr0zac posted:

its helpful and we get to eat donuts together as a team the next day! (except for me cause I work remotely )

edit the punishment wiki to include "send pr0zac $10CAD in Tim Hortons gift card money" and then you can just Zoom call in while you eat your poutine donut or whatever

# ? Jul 19, 2017 15:50

cinci zoo sniper: Mar 15, 2013

surebet posted:

ha, try working in small accounting shops; all of the regulatory burden, none of the money to hire people who know what the gently caress a computer is

we had an archival box that was setup by the friend of a friend of one of the kids of someone who left 5 years ago or something and no one had the admin credentials, and only one account's credential escaped the sands of time so pretty much everyone was using that

it was accessible remotely from inside and outside the network, so the second you checked the external ip there was nothing preventing you from remoting in from a starbucks and doing whatever

i did an internship there so i was gone after 12 weeks, but man, that whole thing scared the bejesus out of me

:allbuttons:

we have like four different structural entities dealing with compliance and regulatory affairs

# ? Jul 19, 2017 16:07

pr0zac: Jan 18, 2004; ~*lukecagefan69*~; Pillbug

Cocoa Crispies posted:

because then they wouldn't have a ritual to use for punishment in a professional setting

its really not so much of a punishment as a "hey! sorry about being a dummy about security! I got donuts for everyone to apologize!" kinda thing

also this isn't like, mandated in our contracts or anything, its just a fun thing my team does

# ? Jul 19, 2017 18:00

Carbon dioxide: Oct 9, 2012

Twitter's own @support account has been suspended from Twitter.

https://twitter.com/support

# ? Jul 19, 2017 19:22

Bhodi: Dec 9, 2007; Oh, it's just a cat.; Pillbug

Carbon dioxide posted:

Twitter's own @support account has been suspended from Twitter.

https://twitter.com/support

:master:

# ? Jul 19, 2017 19:24

flakeloaf: Feb 26, 2003; Still better than android clock

Carbon dioxide posted:

Twitter's own @support account has been suspended from Twitter.

https://twitter.com/support

!kjv numbers 22:21

# ? Jul 19, 2017 19:24

Chris Knight: Jun 5, 2002; me @ ur posts; Fun Shoe

Carbon dioxide posted:

Twitter's own @support account has been suspended from Twitter.

https://twitter.com/support

that's because the real one is @twittersupport

# ? Jul 19, 2017 19:36

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Chris Knight posted:

that's because the real one is @twittersupport

Given that they can just take accounts from whoever, wouldn't they just have it 302?

# ? Jul 19, 2017 19:38

Meat Beat Agent: Aug 5, 2007; felonious assault with a sproinging boner

Chris Knight posted:

that's because the real one is @twittersupport

https://twitter.com/TwitterSupport/status/882649681720885248

moving to a different name and not parking the original still qualifies as a fuckup

# ? Jul 19, 2017 19:55

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Volmarias posted:

Given that they can just take accounts from whoever, wouldn't they just have it 302?

it's really dumb that they would just blackhole every previous @support post but That's Twitter

# ? Jul 19, 2017 20:00

haveblue: Aug 15, 2005; Can't post for 55 minutes!; Toilet Rascal

goddamnedtwisto posted:

if it's designed to go outside wouldn't it have to be waterproofed to an extent? maybe not enough to survive total immersion though, now i think about it

it's plausible that its upper shell would be rainproof but that wouldn't necessarily stop a large amount of water being introduced from the bottom and sides

# ? Jul 19, 2017 20:12

LP0 ON FIRE: Jan 25, 2006; _{beep boop}

i was just checking out some answers on stack overflow, then i noticed a message in my box:

quote:

Hello,

I'm writing in reference to your Stack Overflow account:

After reports of unusual voting patterns coming from your account, we found a lot of downvoting against specific users.

Please note that these downvotes have been invalidated. We need to ensure that the voting on Stack Exchange is anchored in the quality of the post, and not the person who wrote it.

If this is a simple misunderstanding, no harm done. The system has processes in place to detect various types of targeted voting between users, so if a user has wronged you in some way, please just move on. Everyone has their own criteria for why they vote, and sometimes we have to tolerate small indiscretions, even if those reasons are somewhat ill-advised. I'm not saying that is the case here, but voting irregularities are something that we take very seriously and can result in a prolonged suspension for all involved.

This is just a friendly notice to let you know what happened, so take care and enjoy the site.

We have temporarily suspended your account; you may return after 7 days.

Regards,
Stack Overflow Moderation Team

i never answer questions (something i should probably do more by now) or vote down, so it looks like my account was being used maybe in part as a coordinated attack, i don't know. the thing that sucks is the account is associated with my google account! the 7 day suspension is practically inconsequential to me as i don't really use other features than sometimes asking questions, but i'm a little freaked out someone must have my google password (which i just changed), unless there was some other way it was pulled off. i also have the account no longer associated with google if i made that change correctly

all the account settings are blocked including updating the password, even though i'm logged in (lol), so the only way i could update it was log out and go to forgot password

# ? Jul 19, 2017 20:22

ultramiraculous: Nov 12, 2003; "No..."; Grimey Drawer

Cocoa Crispies posted:

because then they wouldn't have a ritual to use for punishment in a professional setting

pr0zac posted:

its really not so much of a punishment as a "hey! sorry about being a dummy about security! I got donuts for everyone to apologize!" kinda thing

also this isn't like, mandated in our contracts or anything, its just a fun thing my team does

yeah if you're gonna talk about ritual punishment, I hear subjunctive was real into tabasco shots.

# ? Jul 19, 2017 21:09

burning swine: May 26, 2004

pr0zac posted:

its really not so much of a punishment as a "hey! sorry about being a dummy about security! I got donuts for everyone to apologize!" kinda thing

also this isn't like, mandated in our contracts or anything, its just a fun thing my team does

we do donuts for "broke the build" type situations

as for unlocked workstations, mandatory locking when away from your desk is company policy and pretty strongly enforced. So, when someone screws it up typically they get messed with in a minor, non-inconveniencing way

I just keep a wallpaper at a memorizable url to set:

# ? Jul 19, 2017 21:11

surebet: Jan 10, 2013; ａｖａｔａｒ
ｓｐｅｃｉａｌｉｓｔ

cinci zoo sniper posted:

we have like four different structural entities dealing with compliance and regulatory affairs

another, significantly larger place (~100 users) i worked at issued credentials with the same default password. i know for a fact that most of them kept the default password because most of them had it on a post-it on their monitor.

"only" client addresses in this case (manufacturing & sales company), externally accessible, most often heard response to "what the poo poo, why?" was "i don't have anything to hide"

# ? Jul 19, 2017 21:13

Bhodi: Dec 9, 2007; Oh, it's just a cat.; Pillbug

We used to send emails to the team distro with things like "Subject: I love my co-workers! Body: They are simply the best. I just wanted to take a moment and thank everyone for the wonderful things you do, like lock my computer when I forget!"

But that completely depends on your work atmosphere, there have been places where I'd pretend not to notice, places where I'd just quietly lock it, and places where I'd notify management.

# ? Jul 19, 2017 21:14

cinci zoo sniper: Mar 15, 2013

surebet posted:

another, significantly larger place (~100 users) i worked at issued credentials with the same default password. i know for a fact that most of them kept the default password because most of them had it on a post-it on their monitor.

"only" client addresses in this case (manufacturing & sales company), externally accessible, most often heard response to "what the poo poo, why?" was "i don't have anything to hide"

:eyepop:

this is worse than top to bottom corrupt latvian telco manufacturer i worked for as a sales administrator in late 2000s

# ? Jul 19, 2017 21:14

ultramiraculous: Nov 12, 2003; "No..."; Grimey Drawer

also patch your iOSes because apple just closed out around 50 CVEs:

https://support.apple.com/en-us/HT207923

https://twitter.com/benhawkes/status/887745326232227840

# ? Jul 19, 2017 21:16

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Wi-Fi
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-9417: Nitay Artenstein of Exodus Intelligence

daaaaamn

# ? Jul 19, 2017 21:37

endlessmonotony: Nov 4, 2009; by Fritz the Horse

cinci zoo sniper posted:

this is worse than top to bottom corrupt latvian telco manufacturer i worked for as a sales administrator in late 2000s

Everything in Latvia not preserved in vodka is rotten.

# ? Jul 19, 2017 22:11

LP0 ON FIRE: Jan 25, 2006; _{beep boop}

BangersInMyKnickers posted:

Wi-Fi
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-9417: Nitay Artenstein of Exodus Intelligence

daaaaamn

never mind your magstrip credit cards, don'tt even bring your iphone to DEFCON

# ? Jul 19, 2017 22:15

Phone: Jul 30, 2005; 親子丼をほしい。

LP0 ON FIRE posted:

never mind, don'tt g o to DEFCON

# ? Jul 19, 2017 22:42

Bunni-kat: May 25, 2010; Service Desk B-b-bunny...
How can-ca-caaaaan I
help-p-p-p you?

ultramiraculous posted:

also patch your iOSes because apple just closed out around 50 CVEs:

https://support.apple.com/en-us/HT207923

https://twitter.com/benhawkes/status/887745326232227840

Does this affect devices using the iOS 11 beta?

# ? Jul 19, 2017 22:51

Farmer Crack-Ass: Jan 2, 2001; this is me posting irl

LP0 ON FIRE posted:

never mind your magstrip credit cards, don'tt even bring your iphone to DEFCON

just show up to DEFCON with a pad of paper, an analog watch, and one of those old big-rear end camcorders that takes full-size VHS cassettes

if someone fries the camcorder just toss it like the junk it is anyway lol

# ? Jul 19, 2017 23:00

Computer Serf: May 14, 2005; Buglord

fresh hack on the cyberpogs

about $80m transferred out and some project got cleaned out entirely of their 44,000 digital trading pog bytes.

:downsowned:

:downsowned:

https://press.swarm.city/parity-multisig-wallet-exploit-hits-swarm-city-funds-statement-by-the-swarm-city-core-team-d1f3929b4e4e

https://twitter.com/bcrypt/status/887790274876891136

# ? Jul 19, 2017 23:06

Diva Cupcake: Aug 15, 2005

BangersInMyKnickers posted:

Wi-Fi
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-9417: Nitay Artenstein of Exodus Intelligence

daaaaamn

At least he's getting a BH talk on it.

https://twitter.com/BlackHatEvents/status/876606723485773824

# ? Jul 19, 2017 23:23

ultramiraculous: Nov 12, 2003; "No..."; Grimey Drawer

actually wait I didn't realize the wifi chip exploit was different from the other one that google zero found way back when.

# ? Jul 19, 2017 23:30

lord of the files: Sep 4, 2012

Computer Serf posted:

fresh hack on the cyberpogs

about $80m transferred out and some project got cleaned out entirely of their 44,000 digital trading pog bytes.

https://press.swarm.city/parity-multisig-wallet-exploit-hits-swarm-city-funds-statement-by-the-swarm-city-core-team-d1f3929b4e4e

https://twitter.com/bcrypt/status/887790274876891136

'whitehat hacker' seems to only saved about $75mil worth, but why the hell wouldn't the creators of that wallet want that vuln there and to flip the switch?

# ? Jul 19, 2017 23:58

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Avenging_Mikon posted:

Does this affect devices using the iOS 11 beta?

it probably has a different patch schedule, and if you're in the public beta i don't even think you get patch notes

# ? Jul 20, 2017 00:22

maskenfreiheit: Dec 30, 2004

LP0 ON FIRE posted:

never mind your magstrip credit cards, don'tt even bring your iphone to DEFCON

not only am i bringingmy phone to defcon im gonna shitpost in yospos from defcon :c00l:

:c00l:

# ? Jul 20, 2017 00:26

vOv: Feb 8, 2014

Computer Serf posted:

fresh hack on the cyberpogs

about $80m transferred out and some project got cleaned out entirely of their 44,000 digital trading pog bytes.

https://press.swarm.city/parity-multisig-wallet-exploit-hits-swarm-city-funds-statement-by-the-swarm-city-core-team-d1f3929b4e4e

https://twitter.com/bcrypt/status/887790274876891136

i don't really know much about ethereum but i think this is what happened:

ethereum is all about 'smart contracts' and code that executes on the blockchain, so the multisig wallets were implemented using contracts. they had an initializer method that would set up the owners and stuff, but they forgot to specify the visibility, and it defaults to public (lmao) so someone could just reinitialize it with themselves as the owner

# ? Jul 20, 2017 02:37

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

vOv posted:

i don't really know much about ethereum but i think this is what happened:

ethereum is all about 'smart contracts' and code that executes on the blockchain, so the multisig wallets were implemented using contracts. they had an initializer method that would set up the owners and stuff, but they forgot to specify the visibility, and it defaults to public (lmao) so someone could just reinitialize it with themselves as the owner

if bitcoin is the intersection of people that don't understand math, don't understand economics, and don't understand encryption, ethereum is all of those plus people that don't understand programming

# ? Jul 20, 2017 02:44

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

Stolen from the bitcoin thread:

quote:

Solidity has far worse problems than not being an advanced research language. Just being a sanely designed normal language would be a big step up. Solidity is so riddled with bizarre design errors it makes PHP 4 look like a work of genius.

A small sampling of the issues:

Everything is 256 bits wide, including the "byte" type. This means that whilst byte[] is valid syntax, it will take up 32x more space than you expect. Storage space is extremely limited in Solidity programs. You should use "bytes" instead which is an actual byte array. The native 256-bit wide primitive type is called "bytes32" but the actual 8-bit wide byte type is called "int8".

Strings. What can we say about this. There is a string type. It is useless. There is no support for string manipulation at all. String concatenation must be done by hand after casting to a byte array. Basics like indexOf() must also be written by hand or implementations copied into your program. To even learn the length of a string you must cast it to a byte array, but see above. In some versions of the Solidity compiler passing an empty string to a function would cause all arguments after that string to be silently corrupted.

There is no garbage collector. Dead allocations are never reclaimed, despite the scarcity of available memory space. There is also no manual memory management.

Solidity looks superficially like an object oriented language. There is a "this" keyword. However there are actually security-critical differences between "this.setX()" and "setX()" that can cause wrong results:https://github.com/ethereum/solidity/issues/583 

Numbers. Despite being intended for financial applications like insurance, floating point is not supported. Integer operations can overflow, despite the underlying operation being interpreted and not implemented in hardware. There is no way to do overflow-checked operations: you need constructs like "require((balanceOf[_to] + _value) >= balanceOf[_to]);"

You can return statically sized arrays from functions, but not variably sized arrays.

For loops are completely broken. Solidity is meant to look like JavaScript but the literal 0 type-infers to byte, not int. Therefore "for (var i = 0; i < a.length; i ++) { a[i] = i; }" will enter an infinite loop if a[] is longer than 255 elements, because it will wrap around back to zero. This is despite the underlying VM using 256 bits to store this byte. You are just supposed to know this and write "uint" instead of "var".

Arrays. Array access syntax looks like C or Java, but array declaration syntax is written backwards: int8[][5] creates 5 dynamic arrays of bytes. Dynamically sized arrays work, in theory, but you cannot create multi-dimensional dynamic arrays. Because "string" is a byte array, that means "string[]" does not work.

The compiler is riddled with mis-compilation bugs, many of them security critical. The documentation helpfully includes a list of these bugs .... in JSON. The actual contents of the JSON is of course just strings meant to be read by humans. Here are some summaries of miscompile bugs:

In some situations, the optimizer replaces certain numbers in the code with routines that compute different numbers

Types shorter than 32 bytes are packed together into the same 32 byte storage slot, but storage writes always write 32 bytes. For some types, the higher order bytes were not cleaned properly, which made it sometimes possible to overwrite a variable in storage when writing to another one.

Dynamic allocation of an empty memory array caused an infinite loop and thus an exception

Access to array elements for arrays of types with less than 32 bytes did not correctly clean the higher order bits, causing corruption in other array elements.

As you can see the decision to build a virtual machine with that is natively 256-bit wide led to a huge number of bugs whereby reads or writes randomly corrupt memory.

Solidity/EVM is by far the worst programming environment I have ever encountered. It would be impossible to write even toy programs correctly in this language, yet it is literally called "Solidity" and used to program a financial system that manages hundreds of millions of dollars.

I don't know how to copy posts with quotes on mobile so go there and thank the original guy who dug up this hn post

# ? Jul 20, 2017 02:57

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

Also once you issue a "smart contract" you can never patch it. Hope you coded everything perfectly the first time!

# ? Jul 20, 2017 03:00

fishmech: Jul 16, 2006; by VideoGames; Salad Prong

Farmer Crack-rear end posted:

just show up to DEFCON with a pad of paper, an analog watch, and one of those old big-rear end camcorders that takes full-size VHS cassettes

if someone fries the camcorder just toss it like the junk it is anyway lol

Nah nah just show up with obscure devices on obscure yet still operating networks (if applicable).

Like let's say a gridpad with mobitex modem, one of those mid 80s digital watches that docked onto a keyboard assembly the size of your forearm, and a digital8 camcorder

# ? Jul 20, 2017 03:03

maskenfreiheit: Dec 30, 2004

mrmcd posted:

Also once you issue a "smart contract" you can never patch it. Hope you coded everything perfectly the first time!

there's going to be an entire :airquote:

:airquote:

smart

:airquote:

contract hacking talk at defcon that should be hilarious:

https://www.defcon.org/html/defcon-25/dc-25-speakers.html#Karagiannis

maskenfreiheit fucked around with this message at 03:07 on Jul 20, 2017

# ? Jul 20, 2017 03:04

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

maskenfreiheit posted:

there's going to be an entire smart contract hacking talk at defcon that should be hilarious:

https://www.defcon.org/html/defcon-25/dc-25-speakers.html#Karagiannis

Lol I hope someone drains an entire ICO live on stage.

# ? Jul 20, 2017 03:12

Phone: Jul 30, 2005; 親子丼をほしい。

cool, gchat is now adding %source=hangouts to links so now i get to click a link twice because

HEY: WARNING: THIS REDIRECT IS SENDING YOU TO THE SITE YOU WANTED TO GO TO

# ? Jul 20, 2017 03:16

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 23:38

JewKiller 3000: Nov 28, 2006; by Lowtax

i leave my desktop unlocked sometimes. nobody has ever touched it, because they're all deathly afraid of pissing me off. this is the way things should be

# ? Jul 20, 2017 03:32

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

Powered by: vBulletin Version 2.2.9 (SABB-v2.24.05)
Copyright ©2000, 2001, Jelsoft Enterprises Limited.
Copyright ©2024, Jeffrey of YOSPOS