Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »

Workaday Wizard: Oct 23, 2009; by Pragmatica

ripgrep is fast 💨

# ? Dec 8, 2017 10:15

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 20:29

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

man i just got my muscle memory to remember ack, tell me why i should try out something else

# ? Dec 8, 2017 11:01

necrotic: Aug 2, 2005; I owe my brother big time for this!

the silver searcher (ag) and ripgrep are both insanely fast compared to grep. not sure how any of them compare to ack, never used it.

# ? Dec 8, 2017 11:20

cinci zoo sniper: Mar 15, 2013

necrotic posted:

the silver searcher (ag) and ripgrep are both insanely fast compared to grep. not sure how any of them compare to ack, never used it.

the platinum searcher (pt) is nice on windows spacemacs

# ? Dec 8, 2017 11:29

Cybernetic Vermin: Apr 18, 2005

necrotic posted:

the silver searcher (ag) and ripgrep are both insanely fast compared to grep. not sure how any of them compare to ack, never used it.

use ripgrep (edit: or platinum searcher as suggested above), nice re2-style non-backtracking implementation (in the form of rust regex) backing it, consistenly fast and good :thumbsup:

ack is perl regexes (silver searcher a mix of raw boyer-moore and the rest backed by pcre), so as usual it is fast except when it isn't

(and, no, this is not likely to matter hugely for your own personal searching needs, but if you get to choose freely anyway~)

Cybernetic Vermin fucked around with this message at 11:59 on Dec 8, 2017

# ? Dec 8, 2017 11:35

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

ah well pcre4lyf so suck it, vermin

# ? Dec 8, 2017 13:16

Cybernetic Vermin: Apr 18, 2005

eh, in *this* context liking pcre is fine, but you know my opinion in general :p

Cybernetic Vermin fucked around with this message at 14:05 on Dec 8, 2017

# ? Dec 8, 2017 13:23

Cybernetic Vermin: Apr 18, 2005

just finishing up an endless slog of a paper ok backreference semantics and feeling a bit worn out on the subject. getting drunk tonight.

# ? Dec 8, 2017 14:06

necrotic: Aug 2, 2005; I owe my brother big time for this!

no lets go into a several page debate over the best regex library

# ? Dec 8, 2017 15:03

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

Meat Beat Agent posted:

ag | peanuts

# ? Dec 8, 2017 15:50

spankmeister: Jun 15, 2008

egrep in the streets, fgrep in the sheets

# ? Dec 8, 2017 17:52

Farmer Crack-Ass: Jan 2, 2001; this is me posting irl

Meat Beat Agent posted:

ag | peanuts

paging graph, graph please report to the Security Fuckup Megathread. thank you

# ? Dec 8, 2017 17:52

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

Cybernetic Vermin posted:

just finishing up an endless slog of a paper ok backreference semantics and feeling a bit worn out on the subject. getting drunk tonight.

its cool no worries

# ? Dec 8, 2017 20:45

Bunni-kat: May 25, 2010; Service Desk B-b-bunny...
How can-ca-caaaaan I
help-p-p-p you?

Cybernetic Vermin posted:

use ripgrep (edit: or platinum searcher as suggested above), nice re2-style non-backtracking implementation (in the form of rust regex) backing it, consistenly fast and good

I remember RE2 having a fair bit of backtracking. Especially in Claire's version.

Cybernetic Vermin posted:

eh, in *this* context liking pcre is fine, but you know my opinion in general :p

PCRE is terrible, it should be on consoles only.

# ? Dec 8, 2017 21:08

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

The Secfuck hit my email today:

quote:

Hi Harik,

I'm a reporter with Forbes.

Looking at this blog re vulnerabilities in the Vaultek system: https://www.twosixlabs.com/bluesteal-popping-gatt-safes/

Are you still involved in Vaultek?

Can you provide comment?

Thanks,
XXX, forbes reporter.

It starts out bad and it keeps getting worse.

I have so many comments I want to give them. Starting with :lol:

, moving through various stages of maniacal laughter, and ending with :suicide:

A year ago I offered to help and vet their security a year ago but they "knew what they were doing." I had no idea what they'd actually chosen to do until today and holy gently caress it's a tire fire.

# ? Dec 8, 2017 21:08

Wiggly Wayne DDS: Sep 11, 2010

it's fine you just disable bluetooth and use a key instead, no one's managed to beat that yet

# ? Dec 8, 2017 21:20

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

What's your favorite part?

Mine is probably

JavaScript code:

function decodePayload(payload){
	var res = new Array();
	for(var i=1;i<payload.length-1;i=i+2){
	    var tmp;
	    tmpA = payload[i]-97;
	    tmpB = payload[i+1]-97;
	    tmpC = (tmpA<<4) + tmpB;
	    res.push(tmpC);
	}
	return res;
}

the fact that you can crack this "security" with node dot loving js.

# ? Dec 8, 2017 21:24

haveblue: Aug 15, 2005; Toilet Rascal

no one is immune to iot shenanigans

# ? Dec 8, 2017 21:30

Wiggly Wayne DDS: Sep 11, 2010

the part where the researchers waste time explaining that the pincode isn't used at all in the getAuthor part of the protocol just reflected back to the client then call it a vulnerability. after showing that the pincode is really just the pairing code

# ? Dec 8, 2017 21:33

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

Wiggly Wayne DDS posted:

the part where the researchers waste time explaining that the pincode isn't used at all in the getAuthor part of the protocol just reflected back to the client then call it a vulnerability. after showing that the pincode is really just the pairing code

I'm going to be tearing this apart myself to figure it out - since it'd be completely obvious that any number you enter in the app works to unlock the safe, the check that they match must be done in the app itself against something it saved? I wonder if the bluetooth PIN and device PIN are getting conflated somewhere.

Unfucking this mess is probably going to fall to me, which means yay chinese written app and firmware and hardware with chinese ICs that only have chinese datasheets and chinese support. I loving hate being right.

# ? Dec 8, 2017 21:57

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Harik posted:

The Secfuck hit my email today:

It starts out bad and it keeps getting worse.

I have so many comments I want to give them. Starting with , moving through various stages of maniacal laughter, and ending with

A year ago I offered to help and vet their security a year ago but they "knew what they were doing." I had no idea what they'd actually chosen to do until today and holy gently caress it's a tire fire.

give them the comments

# ? Dec 8, 2017 22:01

Wiggly Wayne DDS: Sep 11, 2010

Harik posted:

I'm going to be tearing this apart myself to figure it out - since it'd be completely obvious that any number you enter in the app works to unlock the safe, the check that they match must be done in the app itself against something it saved? I wonder if the bluetooth PIN and device PIN are getting conflated somewhere.

Unfucking this mess is probably going to fall to me, which means yay chinese written app and firmware and hardware with chinese ICs that only have chinese datasheets and chinese support. I loving hate being right.

i'd guess that they had it implemented properly at some point then someone went "why are we using the same code twice to authenticate the channel and the safe combo" and someone had the idea to solve that issue by ripping out parts of the safe combo validation but didn't feel comfortable altering the protocol itself
e: the "something that it saved" would be the bluetooth pairing code allowing it to talk to the machine at all surely

# ? Dec 8, 2017 22:28

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

anthonypants posted:

give them the comments

i wish. my energy is going towards a scathing internal postmortem on this one.

Wiggly Wayne DDS posted:

i'd guess that they had it implemented properly at some point then someone went "why are we using the same code twice to authenticate the channel and the safe combo" and someone had the idea to solve that issue by ripping out parts of the safe combo validation but didn't feel comfortable altering the protocol itself
e: the "something that it saved" would be the bluetooth pairing code allowing it to talk to the machine at all surely

you're being generous. look at how bad this all is and think really hard if that generosity is deserved. it's a bunch of kids who didn't know any better with no adults to tell them "no". to be fair to them, they managed to just as good a job as Intel so i guess they've got that going for them?

# ? Dec 8, 2017 23:19

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Harik posted:

The Secfuck hit my email today:

quote:

However the safe does not verify the pin code, so an attacker can obtain authorization and unlock the safe using any arbitrary value as the pin code.

I mean of course, who needs a code for a safe?

# ? Dec 8, 2017 23:36

Wiggly Wayne DDS: Sep 11, 2010

nsa needs to remove specific event log entries to hide their tracks and make sure they can never be recovered, just one catch:
https://blog.fox-it.com/2017/12/08/detection-and-recovery-of-nsas-covered-up-tracks/

quote:

Fox-IT discovered that when eventlogedit is used, the to-be-removed event record itself isn�t edited or removed at all: the record is only unreferenced.

# ? Dec 9, 2017 00:21

Trabisnikof: Dec 24, 2005

Wiggly Wayne DDS posted:

nsa needs to remove specific event log entries to hide their tracks and make sure they can never be recovered, just one catch:
https://blog.fox-it.com/2017/12/08/detection-and-recovery-of-nsas-covered-up-tracks/

apparently someone at the nsa never played uplink. gotta upgrade log deleter to v3

# ? Dec 9, 2017 00:25

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

Trabisnikof posted:

apparently someone at the nsa never played uplink. gotta upgrade log deleter to v3

# ? Dec 9, 2017 00:42

Ciaphas: Nov 20, 2005; > BEWARE, COWARD

Trabisnikof posted:

apparently someone at the nsa never played uplink. gotta upgrade log deleter to v3

man now i want to play that through again

# ? Dec 9, 2017 01:45

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Ciaphas posted:

man now i want to play that through again

# ? Dec 9, 2017 01:49

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

if anyone's shepherded a CVE who would be willing to give me advice (here or in PM) it'd be appreciated. I've dealt with security breaches before but never had to run the reporting/responding part, and nobody else here has either. Trying to get mitigation information out to people now that I've convinced marketing that "head in the sand and pretend nothing happened" isn't a valid response.

Trabisnikof posted:

apparently someone at the nsa never played uplink. gotta upgrade log deleter to v3

# ? Dec 9, 2017 01:50

Proteus Jones: Feb 28, 2013

Harik posted:

if anyone's shepherded a CVE who would be willing to give me advice (here or in PM) it'd be appreciated. I've dealt with security breaches before but never had to run the reporting/responding part, and nobody else here has either. Trying to get mitigation information out to people now that I've convinced marketing that "head in the sand and pretend nothing happened" isn't a valid response.

https://cve.mitre.org/about/faqs.html

https://cve.mitre.org/cve/request_id.html

# ? Dec 9, 2017 02:08

vOv: Feb 8, 2014

Meat Beat Agent posted:

ag | peanuts

idgi

# ? Dec 9, 2017 02:20

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

vOv posted:

idgi

here is a hint

Only registered members can see post attachments!

# ? Dec 9, 2017 02:23

vOv: Feb 8, 2014

anthonypants posted:

here is a hint

# ? Dec 9, 2017 02:29

Chris Knight: Jun 5, 2002; me @ ur posts; Fun Shoe

Meat Beat Agent posted:

ag | peanuts

# ? Dec 9, 2017 02:38

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

Proteus Jones posted:

https://cve.mitre.org/about/faqs.html

https://cve.mitre.org/cve/request_id.html

the CVEs are already filed by a third party, I'd be the vendor of the vulnerable product. Lots of CVEs have links to mitigations and fixes, but I don't see how to get them added on. that's separate from the "vendor statement" which is just the PR bullshit used to downplay how bad they hosed up.

it sounds like this needed to have been done before it went public but I'm just picking up the pieces of previous idiocy at this point.

fortunately bluetooth unlock is a dumb fluff feature and it's trivial for the end user to turn off.

# ? Dec 9, 2017 02:44

atomicthumbs: Dec 26, 2010; We're in the business of extending man's senses.

necrotic posted:

the silver searcher (ag) and ripgrep are both insanely fast compared to grep. not sure how any of them compare to ack, never used it.

remember how in like 1989 a ton of Mac software was named like this? Like "The [software noun]"

would have to dig up my Macintosh Bible to come up with actual examples

# ? Dec 9, 2017 03:08

Proteus Jones: Feb 28, 2013

Harik posted:

the CVEs are already filed by a third party, I'd be the vendor of the vulnerable product. Lots of CVEs have links to mitigations and fixes, but I don't see how to get them added on. that's separate from the "vendor statement" which is just the PR bullshit used to downplay how bad they hosed up.

it sounds like this needed to have been done before it went public but I'm just picking up the pieces of previous idiocy at this point.

fortunately bluetooth unlock is a dumb fluff feature and it's trivial for the end user to turn off.

I don't think you can get that stuff added. After it's submitted, it's a done deal as far as I know.

I'd simply release your company's announcement through your regular channels and reference the CVE like:

quote:

SAFE MAKING Co.: This Thing We Did What hosed Up (CVE-2017-XXXXX)

# ? Dec 9, 2017 04:15

fishmech: Jul 16, 2006; by VideoGames; Salad Prong

atomicthumbs posted:

remember how in like 1989 a ton of Mac software was named like this? Like "The [software noun]"

would have to dig up my Macintosh Bible to come up with actual examples

The Good Finder
The Utility That's $40 Registration On The Mac But It's Free On Windows Or Maybe Like $5

# ? Dec 9, 2017 05:05

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 20:29

cinci zoo sniper: Mar 15, 2013

anthonypants posted:

here is a hint

idgi

# ? Dec 9, 2017 09:29

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »