Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »

maskenfreiheit: Dec 30, 2004

Jabor posted:

actual 4g coverage, or is someone there running a stingray?

my vpn tunnels all data including 4g so suck it FBI

# ? Jul 30, 2017 04:44

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 06:36

FAT32 SHAMER: Aug 16, 2012

fishmech posted:

nearly 10 year old defcon joke

ok that explains a lot more

# ? Jul 30, 2017 04:54

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

ShadowHawk posted:

Hey everyone, turns out I'm the main culprit of my very own CVE!

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11421
http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html
https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5

It's me, the guy who brought malicious vb script to Linux.

please stop touching computers

# ? Jul 30, 2017 04:57

fishmech: Jul 16, 2006; by VideoGames; Salad Prong

FAT32 SHAMER posted:

ok that explains a lot more

I think it was the post Graham did before he banned himself

# ? Jul 30, 2017 05:27

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

ShadowHawk posted:

Hey everyone, turns out I'm the main culprit of my very own CVE!

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11421
http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html
https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5

It's me, the guy who brought malicious vb script to Linux.

how in the gently caress could anybody be this stupid

# ? Jul 30, 2017 05:53

FAT32 SHAMER: Aug 16, 2012

I'm not really sure what's going on with that CVE other than it does bad stuff, but what's especially stupid about it?

# ? Jul 30, 2017 06:16

Notorious b.s.d.: Jan 25, 2003; by Reene

FAT32 SHAMER posted:

I'm not really sure what's going on with that CVE other than it does bad stuff, but what's especially stupid about it?

dude interpolates a filename into a command string that is then passed to vbscript.exe, which is stupid enough to execute arbitrary code passed on the command line

this was
a.) stupid
b.) totally unnecessary
c.) did i mention really, really stupid?

# ? Jul 30, 2017 06:21

FAT32 SHAMER: Aug 16, 2012

Notorious b.s.d. posted:

dude interpolates a filename into a command string that is then passed to vbscript.exe, which is stupid enough to execute arbitrary code passed on the command line

this was
a.) stupid
b.) totally unnecessary
c.) did i mention really, really stupid?

oh nice

that's bad

# ? Jul 30, 2017 06:27

ate shit on live tv: Feb 15, 2004; by Azathoth

Rufus Ping posted:

Well i'm bored in vegas, got no plans till an early dinner meetup tonight and already got my defcon badge so i will answer questions till my mifi is nearly out of batteries

to be clear, jello, you insipid loving backwoods redneck moron, i banned business catte because i had people at work being tracked down to be asked questions about me by the yospos irc sewing circle and frankly i didn't need that much internet in my real life. i still don't, so i'll ban this account too when my batteries get low and you can go back to being constantly wrong for another year. you kids proved that you aren't capable of being even vaguely grownup about people being honest in here about who they are or what they do, so i can't leave the two connected

btw i'm not answering anything about work that is either obvious trolling or over the line with poo poo i shouldn't/can't talk about, or poo poo i just don't feel like answering, but other than that let er rip

I recognize this reference

# ? Jul 30, 2017 06:35

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

FAT32 SHAMER posted:

I'm not really sure what's going on with that CVE other than it does bad stuff, but what's especially stupid about it?

there's a writeup in the second link and also it was quoted

# ? Jul 30, 2017 07:16

Bonfire Lit: Jul 9, 2008; If you're one of the sinners who caused this please unfriend me now.

Notorious b.s.d. posted:

dude interpolates a filename into a command string that is then passed to vbscript.exe, which is stupid enough to execute arbitrary code passed on the command line

it's not; dude writes the arbitrary code into a temporary file, which vbscript.exe then runs

anyway "script interpreter runs code passed to it" isn't really stupid but rather something script interpreters are supposed to do. the stupid part is handing raw user data to something that expects to be given executable code

Bonfire Lit fucked around with this message at 08:55 on Jul 30, 2017

# ? Jul 30, 2017 08:52

hackbunny: Jul 22, 2007; I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av

shadowhawk could you explain why the gently caress does a thumbnailer need to access the product version of an installer package, in the first place?

# ? Jul 30, 2017 09:42

Cybernetic Vermin: Apr 18, 2005

Notorious b.s.d. posted:

dude interpolates a filename into a command string that is then passed to vbscript.exe, which is stupid enough to execute arbitrary code passed on the command line

this was
a.) stupid
b.) totally unnecessary
c.) did i mention really, really stupid?

vbscript.exe is entirely innocent here, it is, say it with me ~~~a bash script where arbitrary user data is syntactically escaped into a string by haaaaand~~~

# ? Jul 30, 2017 10:32

Cybernetic Vermin: Apr 18, 2005

hackbunny posted:

shadowhawk could you explain why the gently caress does a thumbnailer need to access the product version of an installer package, in the first place?

code:

# Put a version label on the thumbnail:
if [ "$VERSION" ]
then
	convert -font -*-clean-medium-r-*-*-6-*-*-*-*-*-*-* \
	-background transparent -fill white label:"$VERSION" \
	-trim -bordercolor '#00001090' -border 2 \
	-fill '#00001048' \
	-draw $'color 0,0 point\ncolor 0,8 point' -flop \
	-draw $'color 0,0 point\ncolor 0,8 point' -flop \
	miff:- | composite -gravity southeast - $TEMPTHUMB $OUTPUTFILE
else
	cp $TEMPTHUMB $OUTPUTFILE
fi

not that this quite answers the question asked

# ? Jul 30, 2017 10:34

hackbunny: Jul 22, 2007; I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av

a bash script
that uses wine
to run windows script host
to run a vbscript script
to run a sql query on an msi file
to embed a very minor metadata label in a thumbnail icon

Cybernetic Vermin posted:

vbscript.exe is entirely innocent here, it is, say it with me ~~~a bash script where arbitrary user data is syntactically escaped into a string by haaaaand~~~

windows script host shares part of the blame though, as

code:

		# Workaround wine bug #19799: cscript crashes if you call WScript.Arguments(0)
		# [url]http://bugs.winehq.org/show_bug.cgi?id=19799[/url]

if it wasn't for working around that bug, the filename could have been passed as an argument, automatically quoted by bash and wine

blame wine too but especially wsh for being a fragile pos that requires external and easily corrupted metadata for something as simple as retrieving the command line arguments

# ? Jul 30, 2017 10:46

spankmeister: Jun 15, 2008

hackbunny posted:

a bash script
that uses wine
to run windows script host
to run a vbscript script
to run a sql query on an msi file
to embed a very minor metadata label in a thumbnail icon

# ? Jul 30, 2017 10:55

ShadowHawk: Jun 25, 2000; CERTIFIED PRE OWNED TESLA OWNER

Notorious b.s.d. posted:

a.) why would you do this, you colossal idiot
b.) why would you fess up to it here, of all places

To be clear I didn't actually write the code in question, I just put a packaging wrapper on it and had it installed by default. The original packaged version didn't do anything with MSI files, that came with a later upgrade that I just rubber stamped into the latest package version.

The thumbnailer's point was to show the windows embedded executable icons for executable files rather than a generic featureless square icon. The author added some other magic to make it do fancy things with MSI files too, which is where this vulnerability came from.

If I remember right the original reason the program used wine's built in handler instead of the (now proven safer) external msiinfo package was because it was already a dependency of Wine and you pretty much only installed this package because it came alongside Wine.

That said the attack surface of this vulnerability is only slightly larger than Wine itself -- "download wine and malicious file on filesystem and then browse to its folder" vs "download malicious file on filesystem, browse to folder, and then open with wine".

# ? Jul 30, 2017 11:57

ShadowHawk: Jun 25, 2000; CERTIFIED PRE OWNED TESLA OWNER

And yeah it's my fuckup but I was so used to thinking of the threat model of Wine being the actual malicious app itself and if a user launches such an app it's already over.

Now it turns out you can have an elaborate really long filename with script embedded into the name, and sometimes files can appear without user intent, so that makes it relatively worse.

The packages got updated within a day or two of the publication of the CVE though, so that's good.

# ? Jul 30, 2017 13:40

spankmeister: Jun 15, 2008

bugs like this is one of the reasons why the default browser behavior of just downloading files is so bad

# ? Jul 30, 2017 15:03

Shame Boy: Mar 2, 2010

spankmeister posted:

bugs like this is one of the reasons why the default browser behavior of just downloading files is so bad

don't worry, the automatic antivirus scan will stop anything bad! :downs:

# ? Jul 30, 2017 20:28

pseudorandom name: May 6, 2007

Today at DEFCON: SMBloris

The first three bytes of a SMB connection are the NBSS header, the last 17 bits of which is a length field. 2¹⁷ = 128 KB, so you can send a 3 bytes down a TCP connection to a Windows server and the kernel will allocate 128 KB of non-paged physical memory and wait 30 seconds before timing out. That's per TCP source port, for both IPv4 and IPv6, so 16 GB of non-paged physical memory per source machine. Memory is allocated in kernel mode with interrupts disabled, so when physical memory is exhausted, the Windows machine just hangs.

# ? Jul 30, 2017 20:48

Wiggly Wayne DDS: Sep 11, 2010

yeah the best part is when they told microsoft who said it's not a security issue and wontfix

# ? Jul 30, 2017 20:49

hobbesmaster: Jan 28, 2008

Microsoft: denied service is a feature!

# ? Jul 30, 2017 20:58

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

e: misread, nevermind

# ? Jul 30, 2017 23:57

Raere: Dec 13, 2007

Solution: Install more memory

# ? Jul 31, 2017 04:44

Lutha Mahtin: Oct 10, 2010; Your brokebrain sin is absolved...go and shitpost no more!

Notorious b.s.d. posted:

a.) why would you do this, you colossal idiot
b.) why would you fess up to it here, of all places

a posser who can't laugh at he own fuckups, a shameful posser

# ? Jul 31, 2017 04:55

JewKiller 3000: Nov 28, 2006; by Lowtax

Rufus Ping posted:

Well i'm bored in vegas, got no plans till an early dinner meetup tonight and already got my defcon badge so i will answer questions till my mifi is nearly out of batteries

to be clear, jello, you insipid loving backwoods redneck moron, i banned business catte because i had people at work being tracked down to be asked questions about me by the yospos irc sewing circle and frankly i didn't need that much internet in my real life. i still don't, so i'll ban this account too when my batteries get low and you can go back to being constantly wrong for another year. you kids proved that you aren't capable of being even vaguely grownup about people being honest in here about who they are or what they do, so i can't leave the two connected

btw i'm not answering anything about work that is either obvious trolling or over the line with poo poo i shouldn't/can't talk about, or poo poo i just don't feel like answering, but other than that let er rip

go gently caress yourself with a shovel

# ? Jul 31, 2017 05:39

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

def con was good but Vegas is bad

# ? Jul 31, 2017 06:18

FCKGW: May 21, 2006

Cocoa Crispies posted:

def con was good but Vegas is bad

going to Vegas in two days

gonna peep dat atomic museum

# ? Jul 31, 2017 06:30

Shame Boy: Mar 2, 2010

my favorite part of visiting vegas a while ago was the ticket clickers that swarm on you and try to give you ads for prostitutes, i hope they still have those

# ? Jul 31, 2017 06:31

Ciaphas: Nov 20, 2005; > BEWARE, COWARD

ate all the Oreos posted:

my favorite part of visiting vegas a while ago was the ticket clickers that swarm on you and try to give you ads for prostitutes, i hope they still have those

i wouldn't say they swarm but they still seem to exist

Cocoa Crispies posted:

def con was good but Vegas is bad

eh living here's not so bad when it's not summer

# ? Jul 31, 2017 06:38

Shame Boy: Mar 2, 2010

Ciaphas posted:

i wouldn't say they swarm but they still seem to exist

eh living here's not so bad when it's not summer

they only swarmed if you took a ticket, all the other ones would see you and swarm you

my dad is an idiot and just wanted to take all the free things because he likes taking free worthless things so I saw this happen multiple times

# ? Jul 31, 2017 06:41

Max Facetime: Apr 18, 2009

Subjunctive posted:

stop.

actually never mind, I agree there's no point trying to bait fishmech when he's right like usual

as fishmech correctly points out, for all their hundreds of years of history corporations have only ever existed literally, as legal fairytales adults read to each other to make themselves feel better

I guess you saw that one coming a mile away :frogbon:

# ? Jul 31, 2017 06:52

Shame Boy: Mar 2, 2010

Max Facetime posted:

actually never mind, I agree there's no point trying to bait fishmech when he's right like usual

as fishmech correctly points out, for all their hundreds of years of history corporations have only ever existed literally, as legal fairytales adults read to each other to make themselves feel better

I guess you saw that one coming a mile away

that's not what stopping looks like friend

# ? Jul 31, 2017 07:33

goddamnedtwisto: Dec 31, 2004; If you ask me about the mole people in the London Underground, I WILL be forced to kill you; Fun Shoe

ate all the Oreos posted:

my favorite part of visiting vegas a while ago was the ticket clickers that swarm on you and try to give you ads for prostitutes, i hope they still have those

i have to ask what a "ticket clicker" is because it sort of sounds like victorian slang for a prostitute as it is

# ? Jul 31, 2017 07:55

Wiggly Wayne DDS: Sep 11, 2010

well this certainly is a response to a security issue: https://beingwinsysadmin.blogspot.co.uk/2017/07/bug-windows-10-default-user-profile-is.html

# ? Jul 31, 2017 08:03

Phrosphor: Feb 25, 2007; Urbanisation

Total VPN ban in China by 2018?

https://techcrunch.com/2017/07/10/china-vpn-ban/

# ? Jul 31, 2017 08:31

spankmeister: Jun 15, 2008

Also Russia just passed a similar law.

# ? Jul 31, 2017 08:50

cinci zoo sniper: Mar 15, 2013

spankmeister posted:

Also Russia just passed a similar law.

yeah, also affecting sim card purchases, use of anonymisers. they are trying to curb people getting around the state firewall

# ? Jul 31, 2017 08:53

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 06:36

Workaday Wizard: Oct 23, 2009; by Pragmatica

the only surprise is why didnt this happen earlier

# ? Jul 31, 2017 08:58

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »