Security Fuckup Megathread - v15.1 - Stop!!! I Kill You Researcher

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v15.1 - Stop!!! I Kill You Researcher

«‹›81 »

Shame Boy: Mar 2, 2010

Caganer posted:

so fb is opting everyone into facial recognition

they already were and just not telling you :ssh:

# ? Feb 27, 2018 19:59

Adbot: ADBOT LOVES YOU

# ? Jun 7, 2024 17:12

Wiggly Wayne DDS: Sep 11, 2010

ate all the Oreos posted:

they already were and were telling you years ago

# ? Feb 27, 2018 20:15

wyoak: Feb 14, 2005; a glass case of emotion; Fallen Rib

yeah I feel like Facebook was auto tagging my face years ago

# ? Feb 27, 2018 20:15

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

for like, a decade, at least.

# ? Feb 27, 2018 20:22

My PIN is 4826: Aug 30, 2003

looking forward to facebook telling people their own faces aren't theirs because a stranger's fake profile looked more appealing to a neural network

# ? Feb 27, 2018 20:32

Zil: Jun 4, 2011; Satanically Summoned Citrus

My PIN is 4826 posted:

looking forward to facebook telling people their own faces aren't theirs because a stranger's fake profile looked more appealing to a neural network

Will this lead to a deadly face off? :ohdear:

# ? Feb 27, 2018 20:42

Bunni-kat: May 25, 2010; Service Desk B-b-bunny...
How can-ca-caaaaan I
help-p-p-p you?

Only if you're John Travolta.

# ? Feb 27, 2018 21:44

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

or nic cage

# ? Feb 27, 2018 22:10

sadus: Apr 5, 2004

Duo Finds SAML Vulnerabilities Affecting Multiple Implementations

code:

    <Assertion ID="_id1234">
        <Subject>
            <NameID>user@user.com<!---->.evil.com</NameID>
        </Subject>
    </Assertion>

# ? Feb 27, 2018 23:31

Wiggly Wayne DDS: Sep 11, 2010

that's so obviously dumb i'm surprised it wasn't fully documented as a feature

# ? Feb 27, 2018 23:47

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

lol https://twitter.com/mattifestation/status/968656685765046272

# ? Feb 28, 2018 02:21

mrmcd: Feb 22, 2003; Pictured: The only good cop (a fictional one).

anthonypants posted:

lol https://twitter.com/mattifestation/status/968656685765046272

Yes, being able to read the documentation, a high level technique practiced by l33t hackers.

# ? Feb 28, 2018 02:30

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

well it's certainly not practiced by developers

# ? Feb 28, 2018 02:32

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

infernal machines posted:

well it's certainly not practiced by developers

or the computer janitors

# ? Feb 28, 2018 02:42

Potato Salad: Oct 23, 2014; nobody cares

sadus posted:

Duo Finds SAML Vulnerabilities Affecting Multiple Implementations
code:
    <Assertion ID="_id1234">
        <Subject>
            <NameID>user@user.com.evil.com</NameID>
        </Subject>
    </Assertion>

Nobody thought of XML canonicalization :stonkhat:

# ? Feb 28, 2018 04:42

vOv: Feb 8, 2014

Truga posted:

https://randomascii.wordpress.com/2018/02/25/compiler-bug-linker-bug-windows-kernel-bug/

this isn't a secfuck but it's pretty funny

# ? Feb 28, 2018 09:02

Wheany: Mar 17, 2006; Spinya^{ha^{ha^haha}ha}ha_{ha_{ha_haha}ha}ha!; Doctor Rope

My PIN is 4826 posted:

looking forward to facebook telling people their own faces aren't theirs because a stranger's fake profile looked more appealing to a neural network

Oh no, i would be devastated if facebook mistook me for someone else.

Just like i make absolutely sure to keep my interests accurate and up to date in google's ad preferences.

# ? Feb 28, 2018 09:15

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

The grey thread has been attracting a lot of flies lately.

# ? Feb 28, 2018 16:47

Shame Boy: Mar 2, 2010

my (fairly large) apartment complex company got bought out by an (even larger) other company and they just updated the rent paying portal to a completely new version. i noticed they were doing that bullshit where they catch paste events and prevent you from pasting in your account number so i went into the code to disable that and captured some of the POST's just to check em' out and hoo boy, the line item prices and total that i paid in rent are being sent in the POST body :thumbsup:

i'm not sure if it would actually change anything if i edited them (and I'm not going to try because I don't want to be loving evicted) but lmao

# ? Feb 28, 2018 17:15

apseudonym: Feb 25, 2011

Lain Iwakura posted:

The grey thread has been attracting a lot of flies lately.

I tried to be nice and helpful :smith:

# ? Feb 28, 2018 17:46

spankmeister: Jun 15, 2008

ate all the Oreos posted:

my (fairly large) apartment complex company got bought out by an (even larger) other company and they just updated the rent paying portal to a completely new version. i noticed they were doing that bullshit where they catch paste events and prevent you from pasting in your account number so i went into the code to disable that and captured some of the POST's just to check em' out and hoo boy, the line item prices and total that i paid in rent are being sent in the POST body

i'm not sure if it would actually change anything if i edited them (and I'm not going to try because I don't want to be loving evicted) but lmao

You could try to overpay by a cent or something like that to see if it works.

# ? Feb 28, 2018 18:07

ChubbyThePhat: Dec 22, 2006; Who nico nico needs anyone else

apseudonym posted:

I tried to be nice and helpful

Some are beyond help.

# ? Feb 28, 2018 18:09

redleader: Aug 18, 2005; Engage according to operational parameters

ate all the Oreos posted:

my (fairly large) apartment complex company got bought out by an (even larger) other company and they just updated the rent paying portal to a completely new version. i noticed they were doing that bullshit where they catch paste events and prevent you from pasting in your account number so i went into the code to disable that and captured some of the POST's just to check em' out and hoo boy, the line item prices and total that i paid in rent are being sent in the POST body

i'm not sure if it would actually change anything if i edited them (and I'm not going to try because I don't want to be loving evicted) but lmao

overpay by a couple of hundred dollars, then take them to your local renter disputes court or whatever

# ? Feb 28, 2018 19:30

sadus: Apr 5, 2004

mozilla.dev.security.policy > How do you handle mass revocation requests?

:munch:

# ? Feb 28, 2018 21:51

Wiggly Wayne DDS: Sep 11, 2010

it's fine it's only 23k private keys, and they emailed it to digicert to prove they needed revoking

# ? Feb 28, 2018 21:52

suffix: Jul 27, 2013; Wheeee!

Caganer posted:

so fb is opting everyone into facial recognition

not europeans

# ? Feb 28, 2018 22:09

flakeloaf: Feb 26, 2003; Still better than android clock

not currently available to you :canada:

# ? Feb 28, 2018 22:10

compuserved: Mar 20, 2006; Nap Ghost

sadus posted:

mozilla.dev.security.policy > How do you handle mass revocation requests?

incredible

# ? Feb 28, 2018 23:11

Proteus Jones: Feb 28, 2013

Wiggly Wayne DDS posted:

it's fine it's only 23k private keys, and they emailed it to digicert to prove they needed revoking

Well, they sure as poo poo need it now.

# ? Feb 28, 2018 23:55

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

my boss wondered why i was sighing loudly earlier today...

# ? Mar 1, 2018 00:05

Qtotonibudinibudet: Nov 7, 2011; Omich poluyobok, skazhi ty narkoman? ya prosto tozhe gde to tam zhivu, mogli by vmeste uyobyvat' narkotiki

i want to believe there was some lovely discussion between the security engineers at trustico trying to explain why they didn't need to revoke the Symantec certs, just issue new ones from another provider and the CEO was like "nope im in charge and im taking this into my own hands" and welp

# ? Mar 1, 2018 01:31

SeaborneClink: Aug 27, 2010; MAWP... MAWP!

so uh... I'm gonna ask the dumb question here and say "why the gently caress would my SSL reseller have a copy of my private key to even email in the first place?"

If you're sending your private key along with the CSR, you're doing it wrong.

Edit: https://twitter.com/GossiTheDog/status/968936949221294081

:stare:

well then.. jfc don't generate your private keys via a web form

SeaborneClink fucked around with this message at 01:38 on Mar 1, 2018

# ? Mar 1, 2018 01:34

EVGA Longoria: Dec 25, 2005; Let's go exploring!

SeaborneClink posted:

so uh... I'm gonna ask the dumb question here and say "why the gently caress would my SSL reseller have a copy of my private key to even email in the first place?"

because apparently they generate it in the browser and hold it "in cold storage" for "revocation".

also they have 3rd party js on the page that generates the keys

# ? Mar 1, 2018 01:36

Shaggar: Apr 26, 2006

either because they've collected them from compromised locations or their service was bad and required access to the private key for issuance which means they were compromised immediately.

# ? Mar 1, 2018 01:37

Shaggar: Apr 26, 2006

EVGA Longoria posted:

because apparently they generate it in the browser and hold it "in cold storage" for "revocation".

also they have 3rd party js on the page that generates the keys

lol that's so bad. javascript is the worst thing to ever happen to the internet.

# ? Mar 1, 2018 01:38

SeaborneClink: Aug 27, 2010; MAWP... MAWP!

Trustico with some hot cognitive dissonance takes on the mic

quote:

We didn't authorise DigiCert to contact our customers and we didn't approve the content of their e-mail. At no time had any private keys been compromised, nor had we ever informed to you that any private keys had been compromised.

quote:

Unfortunately, things didn't go very well for us today and we are extremely sorry for all the confusion and inconvenience that has been caused. We were relying on systems that would easily replace and issue SSL Certificates automatically, though that didn't occur and we ended up in quite a mess. DigiCert didn't work with us to understand the issues and resolve them, we felt we were at a dead end.

Edit: 4.9.1.1.3 cited as reason for revocation in the original email, for the curious

email to mozilla.dev.security.policy posted:

On 2/27/2018, at my request for proof of compromise, we received a file with
23k private keys matched to specific Trustico customers. This definitely
triggered our 24-hour revocation processing requirement under 4.9.1.1.3.
Once we received the keys, we confirmed that these were indeed the matching
private keys for the reported certificates. We will be revoking these
certificates today (February 28th, 2018).

quote:

4.9.1 Circumstances for revocation
4.9.1.1 Reasons for Revoking a Subscriber Certificate
The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs:

3. The CA obtains evidence that the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise or no longer complies with the requirements of Sections 6.1.5 and 6.1.6;

SeaborneClink fucked around with this message at 02:12 on Mar 1, 2018

# ? Mar 1, 2018 01:53

Proteus Jones: Feb 28, 2013

SeaborneClink posted:

Trustico with some hot cognitive dissonance takes on the mic

Edit: 4.9.1.1.3 cited as reason for revocation in the original email, for the curious

That whole thread is a great read with the dawning realization of what a trash fire Trustico was with the �cold storage� of PSKs. Seems that was done without obtaining customer consent. There was also no indication of it being a technical reason (what that would be? No idea) since they also processed submitted CSRs just fine in addition to having the generator.

# ? Mar 1, 2018 02:49

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

quote:

And given that there's no evidence that Trustico has acknowledged this fact, or indicated any intent to change their business practices, then I believe it's appropriate for all CAs to immediately suspend or terminate their relationship with Trustico -- as any CA who continued doing business with Trustico would now be knowingly allowing Trustico to compromise the keys of the certificates issued under their hierarchy.

gif of the wrestling man falling over

# ? Mar 1, 2018 05:10

Raere: Dec 13, 2007

CA's being bad? Oh poo poo it must be...any given day

# ? Mar 1, 2018 05:19

Adbot: ADBOT LOVES YOU

# ? Jun 7, 2024 17:12

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

Raere posted:

CA's being bad? Oh poo poo it must be...any given day

yeah but watching literal cartel members loving up and getting put out to pasture by their fellow oligopolists is kinda cool

# ? Mar 1, 2018 05:28

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v15.1 - Stop!!! I Kill You Researcher

«‹›81 »