Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »

Dyscrasia: Jun 23, 2003; Give Me Hamms Premium Draft or Give Me DEATH!!!!

infernal machines posted:

welp. a fairly high value investment firm i work for just got popped by one of those credential harvesting phishing messages, sent seemingly legitimately from another investment firm they work with, who evidently had their office 365 accounts breached some time ago and were unaware of it until now.

That sounds like something I've been seeing too. Credential harvesting and spreading further malicious links.

# ? Nov 8, 2017 01:22

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 11:44

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

I'm 90% sure this Debian security advisory is someone's Markov chain bot taking the piss:

quote:

slurm-llnl: Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.

# ? Nov 8, 2017 02:36

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Farmer Crack-rear end posted:

any additional details you can share? we love to send stories about this kind of stuff happening out as company-wide broadcasts to reinforce our "DON'T TRUST EMAIL" campaign

i understand if you can't though

they received it when they were expecting some shared files to come in, message body was

code:

Title: ACTION REQUIRED: Shared Documents

Hello,

<name>, sent you a secured  file via SharePoint Online.

Go To [url="https://twofeetstanding.com/@%23$%25%5e&%25$%23/index.php"]Shared Documents[/url]

If you have any questions,please let me know.


Many Thanks,

Sincerely

the link goes to a landing page that suggest you sign in with one of several types of email account, selecting Office 365 or Aol gets you an exact ripoff of that service's login page.

since the email is coming directly from another compromised account the headers are right and the signature etc. are all what you'd expect to see, so of course the user didn't look at the URL before trying to sign in.

this was sent from the email account of the SVP of the other firm

infernal machines fucked around with this message at 03:22 on Nov 8, 2017

# ? Nov 8, 2017 03:14

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Dyscrasia posted:

That sounds like something I've been seeing too. Credential harvesting and spreading further malicious links.

i've seen a bunch specifically targeting office 365 users, sent to domains using hosted exchange plans. a few get the style of the service notices down too

# ? Nov 8, 2017 03:15

mod saas: May 4, 2004; Grimey Drawer

Pikavangelist posted:

Security Fuckup Megathread - v14.2 - added P0-dropeverything and removed F3-annoyance

# ? Nov 8, 2017 04:37

Space Skeleton: Sep 28, 2004

client of ours (we do not do IT) is sending out waves of "THIS IS YOUR OVERDUE INVOICE!" spam, some of it looks like viruses, some of it seems to be demanding money transfers

they are a property management company who probably gets paid rents from a few dozen buildings in and around NYC

this has been going on for over a month now and each passing week the people there who I talk to sound more worn down because their very expensive security consultants keep fixing it then someone in the office reinfects themselves somehow

# ? Nov 8, 2017 04:53

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

alternate possibility: their very expensive security consultants have not fixed it and just keep cleaning up symptoms, not the actual breach

# ? Nov 8, 2017 04:59

maskenfreiheit: Dec 30, 2004

FB wants ppl to send them their nudes

so they can hash them and bar them from being shared on FB
https://www.theguardian.com/technology/2017/nov/07/facebook-revenge-porn-nude-photos

(I'm curious how intelligent this hashing scheme is or if someone can just flip a bit)

# ? Nov 8, 2017 05:27

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

maskenfreiheit posted:

FB wants ppl to send them their nudes

so they can hash them and bar them from being shared on FB
https://www.theguardian.com/technology/2017/nov/07/facebook-revenge-porn-nude-photos

(I'm curious how intelligent this hashing scheme is or if someone can just flip a bit)

does anyone think this will work

# ? Nov 8, 2017 05:31

Midjack: Dec 24, 2007

someone in the bubble thread had the idea to scrape reddit and 4chan for memes and upload them to get hashed and added to the banlist

# ? Nov 8, 2017 05:34

pseudorandom name: May 6, 2007

presumably they feed the images into the child pornography recognition algorithm and just store the output in a different result set

and no doubt compare it against the child pornography set

# ? Nov 8, 2017 05:36

There Will Be Penalty: May 18, 2002; Makes a great pet!

mrmcd posted:

I'm 90% sure this Debian security advisory is someone's Markov chain bot taking the piss:

quote:

Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.

*** NAUGHTY PROGRAMMER!!! *** SPANK SPANK SPANK!!! *** Now go fix your code. Tut tut tut!

# ? Nov 8, 2017 05:57

flakeloaf: Feb 26, 2003; Still better than android clock

and facebook can't let people hash teh photos themselves and just send them the hashes, instead of opening teh "show everyone i know this stuff and also sell it to every advertiser" web page and dragging homegroan onto it becaaaaaaaaaause

# ? Nov 8, 2017 06:04

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

flakeloaf posted:

and facebook can't let people hash teh photos themselves and just send them the hashes becaaaaaaaaaause

Midjack posted:

someone in the bubble thread had the idea to scrape reddit and 4chan for memes and upload them to get hashed and added to the banlist

# ? Nov 8, 2017 06:04

flakeloaf: Feb 26, 2003; Still better than android clock

i'm not seeing the problem

(i am but i put not value on it)

(mlmp)

# ? Nov 8, 2017 06:05

pseudorandom name: May 6, 2007

flakeloaf posted:

and facebook can't let people hash teh photos themselves and just send them the hashes, instead of opening teh "show everyone i know this stuff and also sell it to every advertiser" web page and dragging homegroan onto it becaaaaaaaaaause

because hashes are useless and they don't want to share the algorithm with the public

# ? Nov 8, 2017 06:09

Dixie Cretin Seaman: Jan 22, 2008; all hat and one catte; Hot Rope Guy

if facebook cared at all about human privacy they'd let you hash locally in some provisional database, then have a human do the visual check on the first uploaded image that matches the hash.. that also seems like slightly less work for them since not every image is going to show up

# ? Nov 8, 2017 06:37

spankmeister: Jun 15, 2008

mrmcd posted:

I'm 90% sure this Debian security advisory is someone's Markov chain bot taking the piss:

Don't @ me

# ? Nov 8, 2017 07:44

spankmeister: Jun 15, 2008

maskenfreiheit posted:

(I'm curious how intelligent this hashing scheme is or if someone can just flip a bit)

There's special hashing algos for images that take this kind of stuff into account. Also cropping and mirroring etc.

# ? Nov 8, 2017 07:47

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

spankmeister posted:

There's special hashing algos for images that take this kind of stuff into account. Also cropping and mirroring etc.

so write an app people can download that does the hashing, open sores it on github or something, let people hash their own goddamn pictures and let them upload the hashes.

# ? Nov 8, 2017 07:55

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

i'm not sure who the intended audience is, but i'm comfortable saying they probably wouldn't bother with that as opposed to just streamlining it through facebook itself

# ? Nov 8, 2017 08:04

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

maybe add snapchat integration or something

# ? Nov 8, 2017 08:05

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

if you could compute the hashes on your own, then the person who's stolen your nudes could do exactly the same thing and figure out how much they need to tweak the image until it no longer matches.

# ? Nov 8, 2017 08:54

geonetix: Mar 6, 2011

it�s all too much effort for something only Facebook really cares about too I guess. let them innovate on censorship

# ? Nov 8, 2017 08:54

Workaday Wizard: Oct 23, 2009; by Pragmatica

there are already systems for detecting nudes with a very high detection rate. just buy the ones the chinese use or something.

# ? Nov 8, 2017 09:34

Powerful Two-Hander: Mar 10, 2004; Mods please change my name to "Tooter Skeleton" TIA.

maskenfreiheit posted:

FB wants ppl to send them their nudes

so they can hash them and bar them from being shared on FB
https://www.theguardian.com/technology/2017/nov/07/facebook-revenge-porn-nude-photos

(I'm curious how intelligent this hashing scheme is or if someone can just flip a bit)

dear valued user,

I am the Facebook nudes inspector, to ensure your nudes are safe please send them to me so I can inspect them. Also, please provide an estimate of your income so we can assess the level of protection you require.

Please send your nudes to officialnudeinspector@facebork.com thank you.

Mark Zuckerberg

# ? Nov 8, 2017 10:04

Workaday Wizard: Oct 23, 2009; by Pragmatica

is facebook sending requests for nudes? can we lock fuckerberg up for soliciting nudes from minors?

# ? Nov 8, 2017 10:13

Loving Africa Chaps: Dec 3, 2007; We had not left it yet, but when I would wake in the night, I would lie, listening, homesick for it already.

Shinku ABOOKEN posted:

is facebook sending requests for nudes? can we lock fuckerberg up for soliciting nudes from minors?

Robot's can't be sent to jail

# ? Nov 8, 2017 10:47

Chris Knight: Jun 5, 2002; me @ ur posts; Fun Shoe

Loving Africa Chaps posted:

Robot's can't be sent to jail

yet

# ? Nov 8, 2017 12:19

Wheany: Mar 17, 2006; Spinya^{ha^{ha^haha}ha}ha_{ha_{ha_haha}ha}ha!; Doctor Rope

spankmeister posted:

There's special hashing algos for images that take this kind of stuff into account. Also cropping and mirroring etc.

apparently just turning the image to grayscale, scaling the image to some small size, like 16x16 and turning it into a bitstream by storing a 1 if the next pixel is brighter and 0 if the pixel is darker is shockingly effective at detecting dupes

# ? Nov 8, 2017 12:43

fins: May 31, 2011; Floss Finder

yep, robust (perceptual) image hashing is pretty nifty.

and caused me to come accross the best figure in a patent

sperg.jpg

# ? Nov 8, 2017 12:54

Shifty Pony: Dec 28, 2004; Up ta somethin'

pseudorandom name posted:

presumably they feed the images into the child pornography recognition algorithm and just store the output in a different result set

and no doubt compare it against the child pornography set

nah this is Facebook.

they'll ban the account of the victim for uploading nudity in violation of the TOS.

# ? Nov 8, 2017 13:36

flakeloaf: Feb 26, 2003; Still better than android clock

flesh colour detection is also very good

at showing me pictures of furniture and the desert

# ? Nov 8, 2017 13:44

Space Skeleton: Sep 28, 2004

infernal machines posted:

alternate possibility: their very expensive security consultants have not fixed it and just keep cleaning up symptoms, not the actual breach

asked this morning because you make a good point and I was told that they know who hosed it up because the guy clicked and gave permissions to some poo poo when he plugged in an infected USB device

they were infected via stuff given away at a trade show for property managers and have reinfected themselves at least twice so far

of course I'm just talking to office person #4 who orders their stuff from us so they might not really know

a property management company sending out fake past due invoices to all their tenants seems like a nightmare scenario to me though

# ? Nov 8, 2017 14:49

evil_bunnY: Apr 2, 2003

Shifty Pony posted:

they'll ban the account of the victim for uploading nudity in violation of the TOS.

If you're laughing at this remember which timeline we're in, and also what twitter's currently doing.

# ? Nov 8, 2017 15:09

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

flakeloaf posted:

and facebook can't let people hash teh photos themselves and just send them the hashes, instead of opening teh "show everyone i know this stuff and also sell it to every advertiser" web page and dragging homegroan onto it becaaaaaaaaaause

I'm the technically illiterate end user that somehow knows what a hash is and won't gently caress it up.

fins posted:

spurt.jpg

Fixed

Space Skeleton posted:

asked this morning because you make a good point and I was told that they know who hosed it up because the guy clicked and gave permissions to some poo poo when he plugged in an infected USB device

they were infected via stuff given away at a trade show for property managers and have reinfected themselves at least twice so far

Beautiful

# ? Nov 8, 2017 15:20

flakeloaf: Feb 26, 2003; Still better than android clock

Volmarias posted:

I'm the technically illiterate end user that somehow knows what a hash is and won't gently caress it up.

i was going to say "use the one butan app to turn your photo into a number so we can check it" but then i remembered that "snapchat is hard to use" is on this very page

evil_bunnY posted:

If you're laughing at this remember which timeline we're in, and also what twitter's currently doing.

our algo detected an 88% similarity between your nipple and a swastika and we'd ban you for that if being a white supremacist was a problem here, game on

# ? Nov 8, 2017 15:24

Shame Boy: Mar 2, 2010

Wheany posted:

apparently just turning the image to grayscale, scaling the image to some small size, like 16x16 and turning it into a bitstream by storing a 1 if the next pixel is brighter and 0 if the pixel is darker is shockingly effective at detecting dupes

i independently invented this (and what I think is an even better one, that can be sorted in a database by "closeness") in highschool and was pretty proud of myself and then forgot about it and read years later that's actually what a lot of programs do these days :argh:

# ? Nov 8, 2017 15:34

Shame Boy: Mar 2, 2010

Shifty Pony posted:

nah this is Facebook.

they'll ban the account of the victim for uploading nudity in violation of the TOS.

according to what I've seen this is for facebook messenger not facebook itself

also to upload the pictures you send them, using facebook messenger, to the magic porn sorting hat or w/e

# ? Nov 8, 2017 15:36

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 11:44

Shifty Pony: Dec 28, 2004; Up ta somethin'

evil_bunnY posted:

If you're laughing at this remember which timeline we're in, and also what twitter's currently doing.

I was not joking. I fully expect people to get banned by trying to use this "feature".

Space Skeleton posted:

they were infected via stuff given away at a trade show for property managers and have reinfected themselves at least twice so far

drat, that's kind of impressive and can't be a one man show.

I'm not seeing any warnings in the real estate press about it either, I wonder how many have been infected and don't know it.

# ? Nov 8, 2017 15:45

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »