Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »

Space Skeleton: Sep 28, 2004

waded into my spam folder to see if I am still getting some from them and the answer is no

I do however have some spam harassing me about past due invoices from people at that company by name but from other addresses now like "Legit Name <randomname@hahest.com>"

# ? Nov 8, 2017 16:32

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 00:00

Shame Boy: Mar 2, 2010

the only spam i got today starts with "This grandma is looking hot!"

# ? Nov 8, 2017 16:37

Wiggly Wayne DDS: Sep 11, 2010

finally a sane voice in the tls middlebox discussion: https://mailarchive.ietf.org/arch/msg/saag/DabDtIemZ1PIVRVIFbyBPI4YQ2w

# ? Nov 8, 2017 17:31

Diva Cupcake: Aug 15, 2005

infernal machines posted:

they received it when they were expecting some shared files to come in, message body was
code:
Title: ACTION REQUIRED: Shared Documents

Hello,

<name>, sent you a secured  file via SharePoint Online.

Go To [url="https://twofeetstanding.com/@%23$%25%5e&%25$%23/index.php"]Shared Documents[/url]

If you have any questions,please let me know.


Many Thanks,

Sincerely
the link goes to a landing page that suggest you sign in with one of several types of email account, selecting Office 365 or Aol gets you an exact ripoff of that service's login page.

since the email is coming directly from another compromised account the headers are right and the signature etc. are all what you'd expect to see, so of course the user didn't look at the URL before trying to sign in.

this was sent from the email account of the SVP of the other firm

Exact same format, title and body, came in yesterday (FinTech) only linking to a different URL.

code:

https://grxserviciosgraficos.es/%26%5E*%24(%24*%23%5E%23%5E%25%26*%5E%23%26(*%40%26%5E%40%5E%25%25%26*%5E(%26%23%23*%26%5E%25%40%24%40%26%25*%5E(%26%40%40%40

# ? Nov 8, 2017 18:22

Jewel: May 2, 2009

probably missed this posted somewhere else in yos but lol. logitech is bricking a product for everybody because certs cost money

https://community.logitech.com/s/question/0D55A0000745EkC/harmony-link-eos-or-eol

quote:

Hi Stan � and everyone else.

In the past week, we notified Harmony Link customers that the product will no longer function March of 2018. Depending on the warranty status � we offered replacements or a discount towards a new Harmony Hub or any Harmony remote.

I understand some of you have Harmony Links that are working perfectly fine right now. However, there is a technology certificate license that will expire next March. The certificate will not be renewed as we are focusing resources on our current app-based remote, the Harmony Hub.

I recognize the frustration of this and apologize for any inconveniences this causes.

Thank you for voicing your opinion.

-Will

https://twitter.com/MalwareJake/status/928309887087665157

# ? Nov 8, 2017 18:23

Truga: May 4, 2014; Lipstick Apathy

can't you just firewall the thing to prevent it bricking itself?

e: also
https://twitter.com/internetofshit/status/928294833202061314

how do people still buy logitech poo poo that aren't mice?

Truga fucked around with this message at 18:41 on Nov 8, 2017

# ? Nov 8, 2017 18:38

hobbesmaster: Jan 28, 2008

their keyboards are good too

i do not understand anything about how or why they�re bricking these things. hell why isn�t it a self signed certificate that each device has pinned and stored in a secure element?

# ? Nov 8, 2017 18:43

flakeloaf: Feb 26, 2003; Still better than android clock

weak solder joints have killed 2 mice and 2 keyboards, and my mx revolution makes the whole system run about as smooth as george vi in a rap battle so i've been done with logitech for a while

# ? Nov 8, 2017 18:44

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Jewel posted:

probably missed this posted somewhere else in yos but lol. logitech is bricking a product for everybody because certs cost money

https://community.logitech.com/s/question/0D55A0000745EkC/harmony-link-eos-or-eol

https://twitter.com/MalwareJake/status/928309887087665157

what the gently caress costs money here? are they issuing a PKI cert to every single device instead of just generating them out of their own CA and adding it to the trust store?

# ? Nov 8, 2017 18:45

cinci zoo sniper: Mar 15, 2013

flakeloaf posted:

weak solder joints have killed 2 mice and 2 keyboards, and my mx revolution makes the whole system run about as smooth as george vi in a rap battle so i've been done with logitech for a while

what that gently caress is wrong with your mice. i dont want their keyboards these days since i have hyperspecific mechanical preferences, but i still love their mices. i have large, heavy hands, and they are large and built like bricks. i just wish they did remake g9x, knowing the fate of the old one i'd stockpile a couple of those for a decade in advace

# ? Nov 8, 2017 18:51

haveblue: Aug 15, 2005; Toilet Rascal

BangersInMyKnickers posted:

what the gently caress costs money here? are they issuing a PKI cert to every single device instead of just generating them out of their own CA and adding it to the trust store?

the harmony link is a headless universal remote-like box that lets a phone app control IR devices, I guess it relies on an internet backend to do this. I don't know what a "technology certificate license" is but that sounds like a euphemism/cs-peon-speak for "we're tired of paying a cloud provider to run this service for legacy devices and we're betting the ensuing PR shitstorm doesn't do any lasting damage"

I have a harmony remote and if they shut off service I think I only lose the ability to reconfigure it (through a terrible web wrapper app), it won't brick the whole thing. still a v. lovely move

# ? Nov 8, 2017 18:54

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

haveblue posted:

the harmony link is a headless universal remote-like box that lets a phone app control IR devices, I guess it relies on an internet backend to do this. I don't know what a "technology certificate license" is but that sounds like a euphemism/cs-peon-speak for "we're tired of paying a cloud provider to run this service for legacy devices and we're betting the ensuing PR shitstorm doesn't do any lasting damage"

I have a harmony remote and if they shut off service I think I only lose the ability to reconfigure it (through a terrible web wrapper app), it won't brick the whole thing. still a v. lovely move

maybe they cheaped out on a chip that doesn't support modern certs?

# ? Nov 8, 2017 19:00

flakeloaf: Feb 26, 2003; Still better than android clock

cinci zoo sniper posted:

what that gently caress is wrong with your mice. i dont want their keyboards these days since i have hyperspecific mechanical preferences, but i still love their mices. i have large, heavy hands, and they are large and built like bricks. i just wish they did remake g9x, knowing the fate of the old one i'd stockpile a couple of those for a decade in advace

the mx518 cables started having intermittent connection problems where they meet the mouse pcb, which was apparently a well-documented issue with them

no clue what's wrong with the revo but i'm guessing it's software

using a rat7 now and it seems to suit needs

# ? Nov 8, 2017 19:02

hobbesmaster: Jan 28, 2008

Cocoa Crispies posted:

maybe they cheaped out on a chip that doesn't support modern certs?

you can always do it in software

# ? Nov 8, 2017 19:05

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Cocoa Crispies posted:

maybe they cheaped out on a chip that doesn't support modern certs?

but again, SHA2 requirements are only for PKI certs. This all should have been done through a private CA

# ? Nov 8, 2017 19:07

cinci zoo sniper: Mar 15, 2013

flakeloaf posted:

the mx518 cables started having intermittent connection problems where they meet the mouse pcb, which was apparently a well-documented issue with them

no clue what's wrong with the revo but i'm guessing it's software

using a rat7 now and it seems to suit needs

yeah well documented issues seems to be a trope with logitech mice. g9x for example had negative accel that took a long rear end time to be fixed via firmware upgrade

# ? Nov 8, 2017 19:09

Schadenboner: Aug 15, 2011; by Shine

flakeloaf posted:

the mx518 cables started having intermittent connection problems where they meet the mouse pcb, which was apparently a well-documented issue with them

no clue what's wrong with the revo but i'm guessing it's software

using a rat7 now and it seems to suit needs

Im the RAPID-FIRE.

# ? Nov 8, 2017 19:10

cinci zoo sniper: Mar 15, 2013

Schadenboner posted:

Im the RAPID-FIRE.

they are decent mice, but the company is kill

# ? Nov 8, 2017 19:11

Truga: May 4, 2014; Lipstick Apathy

haveblue posted:

I don't know what a "technology certificate license" is

it's probably a license for some extremely lovely idiotic patent like slide to unlock, and those can be expensive.

# ? Nov 8, 2017 19:13

flakeloaf: Feb 26, 2003; Still better than android clock

Schadenboner posted:

Im the RAPID-FIRE.

oh yeah it looks ridiculous, but it feels right and it just works

# ? Nov 8, 2017 19:21

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

flakeloaf posted:

no clue what's wrong with the revo but i'm guessing it's software

very important lesson re: logitech mice, don't ever install the software.

holy poo poo, amount of garbage they pack into that stuff is insane. want to re-map buttons? great well here's a half dozen different services and a complete explorer overhaul to add a bunch of fancy animations to the windows switcher that works less well than what was builtin in to begin with

# ? Nov 8, 2017 20:01

cinci zoo sniper: Mar 15, 2013