Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »

Number19: May 14, 2003; HOCKEY OWNS
FUCK YEAH

vmware's patches are out: https://www.vmware.com/security/advisories/VMSA-2018-0002.html

# ? Jan 4, 2018 01:25

Adbot: ADBOT LOVES YOU

# ? May 13, 2024 23:16

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Number19 posted:

vmware's patches are out: https://www.vmware.com/security/advisories/VMSA-2018-0002.html

well they're rated as Important and not Critical so i guess we don't have to apply them

# ? Jan 4, 2018 01:28

Number19: May 14, 2003; HOCKEY OWNS
FUCK YEAH

anthonypants posted:

well they're rated as Important and not Critical so i guess we don't have to apply them

maybe it�s harder to exploit on VMware for some reason. it seems weird to not have them marked critical

# ? Jan 4, 2018 01:33

apseudonym: Feb 25, 2011

Number19 posted:

maybe it�s harder to exploit on VMware for some reason. it seems weird to not have them marked critical

Do they reserve critical for host OS execution as opposed to info leak?

# ? Jan 4, 2018 01:36

ate shit on live tv: Feb 15, 2004; by Azathoth

You Am I posted:

Sorry, was a bit vague about my post, as I'm a newbie to this stuff. I have been in the IT industry for 15+ years and one thing that still shocks me is the lax IT security that most places have, including my current employer.

I guess I am leaning towards network security, but also some auditor skills will be useful to work out risks with existing or new systems within a workplace.

what does �network security� look like to you? because for me as the senior network engineer on the security task force at work, the biggest issue is the performance hit the mitigation of this intel bug will cause. the security risks of this particular bug are way outside our threat model. we don�t run other people�s untrusted code for our business, but we do crunch a lot of data.

# ? Jan 4, 2018 01:39

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

anthonypants posted:

well they're rated as Important and not Critical so i guess we don't have to apply them

lmao I�m loving triggered

# ? Jan 4, 2018 01:44

rafikki: Mar 8, 2008; I see what you did there. (It's pretty easy, since ducks have a field of vision spanning 340 degrees.)

~SMcD

You Am I posted:

Sorry, was a bit vague about my post, as I'm a newbie to this stuff. I have been in the IT industry for 15+ years and one thing that still shocks me is the lax IT security that most places have, including my current employer.

I guess I am leaning towards network security, but also some auditor skills will be useful to work out risks with existing or new systems within a workplace.

For example I have having a tough time understanding this latest Intel bug, as programming is a very weak skill I have, so if there's a resource or website that can dumb stuff like that down to me, and also help me learn about exploits like this, it would be helpful.

Unfortunately you picked a bad time to ask career questions as you've probably noticed this meltdown and spectre stuff is causing a big uproar in basically all of the IT threads. On the plus side, welcome to IT Security! Where the rules are made up and the best practices don't matter since some gigantic fuckup will come along and ruin everything. And really, this is the sec fuckup thread, you might be better off asking in the general IT thread (https://forums.somethingawful.com/showthread.php?threadid=3653857) or the infosec thread (https://forums.somethingawful.com/showthread.php?threadid=3750534).

All that said, since you say you're leaning towards network security, does that mean you have a background in networking already?

# ? Jan 4, 2018 01:47

Plorkyeran: Mar 22, 2007; To Escape The Shackles Of The Old Forums, We Must Reject The Tribal Negativity He Endorsed

the spectre attack which probably does work on amd chips is different from the meltdown attack that amd proudly declared themselves immune to.

# ? Jan 4, 2018 01:48

suffix: Jul 27, 2013; Wheeee!

spectre.pdf posted:

As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs

that's cool because having >90% of personal devices rowhammerable wasn't enough
physical computers are such a drag
turn of turbo key until further notice

# ? Jan 4, 2018 02:09

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Time to go back to using PowerPC Macs. 🙃

they're probably affected but whatever

# ? Jan 4, 2018 02:12

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

Lain Iwakura posted:

Time to go back to using PowerPC Macs. 🙃

they're probably affected but whatever

I look forward to my DEC Alpha becoming a hot commodity again.

# ? Jan 4, 2018 02:31

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

btw, -- chrome://flags/#enable-site-per-process -- is the button you want to push to protect your chrome from javascript attacks until chrome 64 lands.

I can't find any information on mitigation in firefox so, uh, just assume your passwords are all gone now.

# ? Jan 4, 2018 02:42

RISCy Business: Jun 17, 2015; bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork; Fun Shoe

its so hot in here

# ? Jan 4, 2018 03:03

pseudorandom name: May 6, 2007

Plorkyeran posted:

the spectre attack which probably does work on amd chips is different from the meltdown attack that amd proudly declared themselves immune to.

http://www.amd.com/en/corporate/speculative-execution

code:

Variant One 	Bounds Check Bypass 		Resolved by software / OS updates to be made available by system vendors and manufacturers. Negligible performance impact expected.
Variant Two 	Branch Target Injection 	Differences in AMD architecture mean there is a near zero risk of exploitation of this variant. Vulnerability to Variant 2 has not been demonstrated on AMD processors to date.
Variant Three 	Rogue Data Cache Load 		Zero AMD vulnerability due to AMD architecture differences.

one and two are Spectre, three is Meltdown

# ? Jan 4, 2018 03:03

spit on my clit: Jul 19, 2015; by Cyrano4747

mrmcd posted:

btw, -- chrome://flags/#enable-site-per-process -- is the button you want to push to protect your chrome from javascript attacks until chrome 64 lands.

I can't find any information on mitigation in firefox so, uh, just assume your passwords are all gone now.

im sorry what

# ? Jan 4, 2018 03:33

repiv: Aug 13, 2009

mrmcd posted:

I can't find any information on mitigation in firefox so, uh, just assume your passwords are all gone now.

mozilla is pushing out some really hacky workarounds until they can figure out a proper solution

https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/

# ? Jan 4, 2018 03:35

Malloc Voidstar: May 7, 2007; Fuck the cowboys. Unf. Fuck em hard.

Linus Torvalds posted:

Date Wed, 3 Jan 2018 15:51:35 -0800
Subject Re: Avoid speculative indirect calls in kernel

On Wed, Jan 3, 2018 at 3:09 PM, Andi Kleen <andi@firstfloor.org> wrote:
> This is a fix for Variant 2 in
> https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
>
> Any speculative indirect calls in the kernel can be tricked
> to execute any kernel code, which may allow side channel
> attacks that can leak arbitrary kernel data.

Why is this all done without any configuration options?

A *competent* CPU engineer would fix this by making sure speculation
doesn't happen across protection domains. Maybe even a L1 I$ that is
keyed by CPL.

I think somebody inside of Intel needs to really take a long hard look
at their CPU's, and actually admit that they have issues instead of
writing PR blurbs that say that everything works as designed.

.. and that really means that all these mitigation patches should be
written with "not all CPU's are crap" in mind.

Or is Intel basically saying "we are committed to selling you poo poo
forever and ever, and never fixing anything"?

Because if that's the case, maybe we should start looking towards the
ARM64 people more.

Please talk to management. Because I really see exactly two possibibilities:

- Intel never intends to fix anything

OR

- these workarounds should have a way to disable them.

Which of the two is it?

Linus

🤔

incidentally i have no idea what http://www.firstfloor.org/ do but their site is cool

# ? Jan 4, 2018 03:43

Bulgogi Hoagie: Jun 1, 2012; We

i�m learning a lot of new things today

# ? Jan 4, 2018 03:44

A Pinball Wizard: Mar 23, 2005; I know every trick, no freak's gonna beat my hands; College Slice

I only have one question at this point

when will templeos get patched?

# ? Jan 4, 2018 03:45

Toad King: Apr 23, 2008; Yeah, I'm the best

A Pinball Wizard posted:

I only have one question at this point

when will templeos get patched?

this is a feature with templeos: there's no need for virtual memory because God said everything should be free (to rwx)

# ? Jan 4, 2018 03:52

Hexyflexy: Sep 2, 2011; asymptotically approaching one

A Pinball Wizard posted:

I only have one question at this point

when will templeos get patched?

It contains the ultimate xen secret - you do not need security for something which possess no data.

# ? Jan 4, 2018 03:55

AggressivelyStupid: Jan 9, 2012

Terry is in prison at the moment so it'll be a while, assuming templeOS even needs patched

# ? Jan 4, 2018 03:55

Malloc Voidstar: May 7, 2007; Fuck the cowboys. Unf. Fuck em hard.

https://twitter.com/misc0110/status/948706387491786752

# ? Jan 4, 2018 03:57

akadajet: Sep 14, 2003

mrmcd posted:

btw, -- chrome://flags/#enable-site-per-process -- is the button you want to push to protect your chrome from javascript attacks until chrome 64 lands.

I can't find any information on mitigation in firefox so, uh, just assume your passwords are all gone now.

the gently caress is this about?

# ? Jan 4, 2018 04:02

akadajet: Sep 14, 2003

AggressivelyStupid posted:

Terry is in prison at the moment so it'll be a while, assuming templeOS even needs patched

It's ring 0 only. I don't think this affects it one way or the other.

# ? Jan 4, 2018 04:04

Bulgogi Hoagie: Jun 1, 2012; We

https://twitter.com/misc0110/status/948706387491786752

# ? Jan 4, 2018 04:04

James Baud: May 24, 2015; by LITERALLY AN ADMIN

This is the single biggest case of "fix worse than the disease" I can remember for everyone who isn't a hosting platform/shared system.

# ? Jan 4, 2018 04:17

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

James Baud posted:

This is the single biggest case of "fix worse than the disease" I can remember for everyone who isn't a hosting platform.

source your quotes

# ? Jan 4, 2018 04:18

apseudonym: Feb 25, 2011

James Baud posted:

This is the single biggest case of "fix worse than the disease" I can remember for everyone who isn't a hosting platform/shared system.

This is the single biggest misunderstanding of worst case performance impact I can remember.

# ? Jan 4, 2018 04:18

James Baud: May 24, 2015; by LITERALLY AN ADMIN

If you're executing arbitrary code to exploit the side channel, you're already 99% of the way to everything that matters in most of the world.

# ? Jan 4, 2018 04:22

endlessmonotony: Nov 4, 2009; by Fritz the Horse

James Baud posted:

If you're executing arbitrary code to exploit the side channel, you're already 99% of the way to everything that matters in most of the world.

You don't understand a single loving thing about the situation.

# ? Jan 4, 2018 04:28

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

James Baud posted:

If you're executing arbitrary code to exploit the side channel, you're already 99% of the way to everything that matters in most of the world.

most of the world disables javascript?

# ? Jan 4, 2018 04:29

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

akadajet posted:

the gently caress is this about?

Spectre leaks memory contents in user space for the same process, meaning it's theoretically possible for javascript to read data from other pages or parts of the browser.

The experimental chrome flag should mitigate most of the risk until chrome 64 which is due on Jan 23, which supposedly has additional hardening, at the cost of ~10-20% more ram usage! :toot:

see: https://www.chromium.org/Home/chromium-security/ssca
https://support.google.com/chrome/a/answer/7581529

# ? Jan 4, 2018 04:53

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Jabor posted:

most of the world disables javascript?

they ought to

# ? Jan 4, 2018 04:54

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

Also when the first "javascript from a dodgy porn site steals all your butts from buttcoinloverexchange.com in another tab" lands I'm gonna laugh really, really hard.

# ? Jan 4, 2018 04:58

redleader: Aug 18, 2005; Engage according to operational parameters

Malloc Voidstar posted:

https://twitter.com/misc0110/status/948706387491786752

# ? Jan 4, 2018 05:02

redleader: Aug 18, 2005; Engage according to operational parameters

repiv posted:

mozilla is pushing out some really hacky workarounds until they can figure out a proper solution

https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/

i like how they link to workarounds for their mitigation attempts in the very same blog post that introduces them

# ? Jan 4, 2018 05:04

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

microsoft has patch kb4056892 out tonight for windows 10, which might the fix for this bug, or it might not. who knows

# ? Jan 4, 2018 05:19

Zil: Jun 4, 2011; Satanically Summoned Citrus

anthonypants posted:

microsoft has patch kb4056892 out tonight for windows 10, which might the fix for this bug, or it might not. who knows

# ? Jan 4, 2018 05:22

Adbot: ADBOT LOVES YOU

# ? May 13, 2024 23:16

flakeloaf: Feb 26, 2003; Still better than android clock

anthonypants posted:

microsoft has patch kb4056892 out tonight for windows 10, which might the fix for this bug, or it might not. who knows

quote:

Addresses issue where event logs stop receiving events when a maximum file size policy is applied to the channel.
Addresses issue where printing an Office Online document in Microsoft Edge fails.
Addresses issue where the touch keyboard doesn�t support the standard layout for 109 keyboards.
Addresses video playback issues in applications such as Microsoft Edge that affect some devices when playing back video on a monitor and a secondary, duplicated display.
Addresses issue where Microsoft Edge stops responding for up to 3 seconds while displaying content from a software rendering path.
Addresses issue where only 4 TB of memory is shown as available in Task Manager in Windows Server version 1709 when more memory is actually installed, configured, and available.
Security updates to Windows SMB Server, the Windows Subsystem for Linux, Windows Kernel, Windows Datacenter Networking, Windows Graphics, Microsoft Edge, Internet Explorer, and the Microsoft Scripting Engine.

way to bury the lede

# ? Jan 4, 2018 05:23

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »