Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »

spankmeister: Jun 15, 2008

anthonypants posted:

according to this article, the dutch saw the russians phishing the us state department in november (what year?), and they told the nsa, and the nsa and fbi responded within 24 hours? and then the state department took down their email servers "for a whole weekend in order to upgrade the security"

then they describe what a phishing attack is, then they talk about what the dutch and american hacker teams do. besides, i don't even remember any big news coming from state department emails. there were the emails on hillary's personal server, which wasn't at the state department, and there was the podesta emails, who also didn't work for the state department. seems like this has less to do with the us election than russia's facebook spend

Yeah the article kind of sucks (and so does the translation imo) but if this is true then it's pretty awesome imo that they managed to gain such a level of access

# ? Jan 25, 2018 23:19

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 18:33

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

spankmeister posted:

Yeah the article kind of sucks (and so does the translation imo) but if this is true then it's pretty awesome imo that they managed to gain such a level of access

it is, and i'd like to hear more about that, but of the 1-2.5 years they had this access the most interesting thing is a 24-hour period during which they sent phishing emails to the us state department? that blows

# ? Jan 25, 2018 23:21

AARP LARPer: Feb 19, 2005; THE DARK SIDE OF SCIENCE BREEDS A WEAPON OF WAR; Buglord

oops!

Tech firms let Russia probe software widely used by U.S. government

Reuters posted:

Major global technology providers SAP (SAPG.DE), Symantec (SYMC.O) and McAfee have allowed Russian authorities to hunt for vulnerabilities in software deeply embedded across the U.S. government, a Reuters investigation has found.

The practice potentially jeopardizes the security of computer networks in at least a dozen federal agencies, U.S. lawmakers and security experts said. It involves more companies and a broader swath of the government than previously reported.

In order to sell in the Russian market, the tech companies let a Russian defense agency scour the inner workings, or source code, of some of their products. Russian authorities say the reviews are necessary to detect flaws that could be exploited by hackers.

But those same products protect some of the most sensitive areas of the U.S government, including the Pentagon, NASA, the State Department, the FBI and the intelligence community, against hacking by sophisticated cyber adversaries like Russia.

Reuters revealed in October that Hewlett Packard Enterprise (HPE.N) software known as ArcSight, used to help secure the Pentagon�s computers, had been reviewed by a Russian military contractor with close ties to Russia�s security services.

Now, a Reuters review of hundreds of U.S. federal procurement documents and Russian regulatory records shows that the potential risks to the U.S. government from Russian source code reviews are more widespread.

Beyond the Pentagon, ArcSight is used in at least seven other agencies, including the Office of the Director of National Intelligence and the State Department's intelligence unit, the review showed. Additionally, products made by SAP, Symantec and McAfee and reviewed by Russian authorities are used in at least eight agencies. Some agencies use more than one of the four products.

https://www.reuters.com/article/us-usa-cyber-russia/tech-firms-let-russia-probe-software-widely-used-by-u-s-government-idUSKBN1FE1DT

# ? Jan 25, 2018 23:22

Shaggar: Apr 26, 2006

fishmech posted:

there is such a thing as falling for scammy companies that will you sell you it, probably.

yeah and there are also hipaa audits which are various levels of same.

# ? Jan 25, 2018 23:23

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Dadbod Apocalypse posted:

oops!

Tech firms let Russia probe software widely used by U.S. government

https://www.reuters.com/article/us-usa-cyber-russia/tech-firms-let-russia-probe-software-widely-used-by-u-s-government-idUSKBN1FE1DT

how is this an oops? if they want to sell software to the russians this is sop

# ? Jan 25, 2018 23:25

AARP LARPer: Feb 19, 2005; THE DARK SIDE OF SCIENCE BREEDS A WEAPON OF WAR; Buglord

AARP LARPer fucked around with this message at 23:29 on Jan 25, 2018

# ? Jan 25, 2018 23:26

Wiggly Wayne DDS: Sep 11, 2010

welcome to procurement?

# ? Jan 25, 2018 23:29

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

infernal machines posted:

how is this an oops? if they want to sell software to the russians this is sop

yeah lol

# ? Jan 25, 2018 23:31

spankmeister: Jun 15, 2008

kaspersky provided or intended to provide source code access to the US govt for the exact same reasons

# ? Jan 25, 2018 23:33

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

BangersInMyKnickers posted:

lol this is literally routine poo poo that we do [...] but now [russia is doing it] and waa-waa-waa

# ? Jan 25, 2018 23:37

in a well actually: Jan 26, 2011; dude, you gotta end it on the rhyme

oh no the russians might be able to figure out that sep is poo poo

# ? Jan 25, 2018 23:39

Shaggar: Apr 26, 2006

Dadbod Apocalypse posted:

oops!

Tech firms let Russia probe software widely used by U.S. government

https://www.reuters.com/article/us-usa-cyber-russia/tech-firms-let-russia-probe-software-widely-used-by-u-s-government-idUSKBN1FE1DT

anthonypants posted:

PCjr sidecar posted:

oh no the russians might be able to figure out that sep is poo poo

# ? Jan 25, 2018 23:40

hobbesmaster: Jan 28, 2008

Dadbod Apocalypse posted:

they should put a column for �Linux� up there too

# ? Jan 26, 2018 00:00

spankmeister: Jun 15, 2008

PCjr sidecar posted:

oh no the russians might be able to figure out that sep is poo poo

# ? Jan 26, 2018 00:03

Hed: Mar 31, 2004; Fun Shoe

anthonypants posted:

have you looked at the current state of standardized infosec testing and certification

I�m not really familiar with them because I don�t make decisions based off someone�s testing and certification. Can you be more explicit about what you�re getting at?

# ? Jan 26, 2018 02:33

necrotic: Aug 2, 2005; I owe my brother big time for this!

they don't mean anything, as you just implied

# ? Jan 26, 2018 02:39

Schadenboner: Aug 15, 2011; by Shine

anthonypants posted:

have you looked at the current state of standardized infosec testing and certification

It gives you a perfect way to "bad culture fit" any applicant you don't like, whether they have a certification (poseur) or they don't (unproven).

Certifications are great!

# ? Jan 26, 2018 02:53

Evis: Feb 28, 2007; Flying Spaghetti Monster

The reversers I know can read binary better than source so I�m not sure this matters at all.

e: edited this for accuracy

Evis fucked around with this message at 04:22 on Jan 26, 2018

# ? Jan 26, 2018 04:02

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Hed posted:

I�m not really familiar with them because I don�t make decisions based off someone�s testing and certification. Can you be more explicit about what you�re getting at?

that's weird because it looked like you were either suggesting that one of them become the new official certification, or that you think throwing another one on the pile would make a difference

# ? Jan 26, 2018 04:51

Hed: Mar 31, 2004; Fun Shoe

I was trying to point out that I haven�t seen licensure solve the purported problems in other engineering fields so I don�t see how going down the path in software and infosec would make a difference.
In other words, proposals sound great around the dinner table but based on how I believe it would be legislated it would accomplish little positive. State by state licensure and leaving industry exemptions (which industry would demand being in any legislation in the US) would make it completely pointless while raising barriers to entry, a net negative for society.
If I really wanted to put a dent in the problem I believe the least worst solution would be to put real penalties behind undesired outcomes, in the vein of HIPPA as discussed previously. As it is I�m skeptical because racking up pointless credit monitoring seems to be the currently anchored �penalty� for poor decisions.

# ? Jan 26, 2018 12:46

MORE CURLY FRIES: Apr 8, 2004

anthonypants posted:

# ? Jan 26, 2018 13:50

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

Evis posted:

The reversers I know can read binary better than source so I�m not sure this matters at all.

e: edited this for accuracy

well yeah if you throw code into binja you get a nice flowchart instead of someone else's c

# ? Jan 26, 2018 14:01

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

SEP endpoint is actually "okay" for an AV product these days (they're all poo poo) but oh boy is the management platform a soft loving target with system/root hooks in to every single system on the network

# ? Jan 26, 2018 15:22

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

Seems like Cisco AMP and Cisco VPN breaks a lot of things these days, I wouldn't be surprised if its vulnerable as hell.

# ? Jan 26, 2018 15:35

Jewel: May 2, 2009

https://twitter.com/fs0c131y/status/956628910308982785

# ? Jan 26, 2018 15:46

flakeloaf: Feb 26, 2003; Still better than android clock

i'm poor smelly mezzanine

# ? Jan 26, 2018 15:51

Shame Boy: Mar 2, 2010

Jewel posted:

https://twitter.com/fs0c131y/status/956628910308982785

im (?: [Two three four five] (?: son | daughter)) (?: parents)

# ? Jan 26, 2018 15:52

cinci zoo sniper: Mar 15, 2013

Jewel posted:

https://twitter.com/fs0c131y/status/956628910308982785

the rest of that thread is rad but what about the text file itself?

# ? Jan 26, 2018 16:33

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

Jewel posted:

https://twitter.com/fs0c131y/status/956628910308982785

1+ just can't stop selling phones with exfil and backdoors!

# ? Jan 26, 2018 18:27

Phone: Jul 30, 2005; 親子丼をほしい。

Jonny 290 posted:

any yosposter has a standing offer to come pet the cats if they visit denver, but im smokin u out and we dont play around

im down

# ? Jan 26, 2018 21:39

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Jewel posted:

https://twitter.com/fs0c131y/status/956628910308982785

this guy runs android police dot com https://twitter.com/ArtemR/status/956966193625120768

# ? Jan 26, 2018 21:44

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

*woop*woop* it�s the android police

*woop*woop* it�s a site for the obese

# ? Jan 26, 2018 21:47

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Cocoa Crispies posted:

*woop*woop* it�s the android police

*woop*woop* it�s a site for the obese

# ? Jan 26, 2018 21:52

jre: Sep 2, 2011; To the cloud ?

Cocoa Crispies posted:

*woop*woop* it�s the android police

*woop*woop* it�s a site for the obese

# ? Jan 26, 2018 22:01

30 TO 50 FERAL HOG: Mar 2, 2005

Cocoa Crispies posted:

*woop*woop* it�s the android police

*woop*woop* it�s a site for the obese

# ? Jan 26, 2018 22:02

salted hash browns: Mar 26, 2007; ykrop

Cocoa Crispies posted:

*woop*woop* it�s the android police

*woop*woop* it�s a site for the obese

lol

# ? Jan 26, 2018 22:03

Kazinsal: Dec 13, 2011

Cocoa Crispies posted:

*woop*woop* it�s the android police

*woop*woop* it�s a site for the obese

# ? Jan 26, 2018 22:06

big shtick energy: May 27, 2004

Hed posted:

I was trying to point out that I haven�t seen licensure solve the purported problems in other engineering fields so I don�t see how going down the path in software and infosec would make a difference.
In other words, proposals sound great around the dinner table but based on how I believe it would be legislated it would accomplish little positive. State by state licensure and leaving industry exemptions (which industry would demand being in any legislation in the US) would make it completely pointless while raising barriers to entry, a net negative for society.
If I really wanted to put a dent in the problem I believe the least worst solution would be to put real penalties behind undesired outcomes, in the vein of HIPPA as discussed previously. As it is I�m skeptical because racking up pointless credit monitoring seems to be the currently anchored �penalty� for poor decisions.

# ? Jan 26, 2018 22:07

spankmeister: Jun 15, 2008

Cocoa Crispies posted:

*woop*woop* it’s the android police

*woop*woop* it’s a site for the obese

# ? Jan 26, 2018 22:12

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 18:33

flakeloaf: Feb 26, 2003; Still better than android clock

Cocoa Crispies posted:

*woop*woop* it’s the android police

*woop*woop* it’s a site for the obese

# ? Jan 26, 2018 22:12

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »