The Infosec Thread: Yes, time to move off Entrust

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›509 »

BlankSystemDaemon: Mar 13, 2009

BangersInMyKnickers posted:

new WAF/IPS feature: randomly injected latency to create excessive noise for timing attacks

Sheep posted:

Honestly this seems like it is probably the most straightforward mitigation.

FreeBSDs ipfw has dummynet which can already do this (along with many other fun things), see the man-page section on pipe, queue and scheduler configuration with particular attention to the profiles that let you do probabilistic delay.

Edit: Thinking about it, I do wonder if there's a way you can use ipfw tee to send traffic to an IDS which could then feed information back into dummynet so that it would only do latency injection when it detected a specific set of traffic patterns.

BlankSystemDaemon fucked around with this message at 14:25 on Jul 28, 2018

# ? Jul 28, 2018 11:55

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 07:58

Dylan16807: May 12, 2010

Random noise slows down timing attacks but not nearly as much as you'd want it to.

# ? Jul 28, 2018 17:58

EVIL Gibson: Mar 23, 2001; Internet of Things is just someone else's computer that people can't help attaching cameras and door locks to!; Switchblade Switcharoo

Double Punctuation posted:

If Spectre required admin access, then it wouldn’t be an exploit.

Yes, Spectre is limited to the address space of wherever the vulnerable code is running, so it was initially difficult to attack different processes without finding vulnerable system calls or a way to run bytecode in the kernel. But here’s the thing: What do you think is the process most attackers will want to exfiltrate data from? And what process will be running attacker-controlled JavaScript?

Let's see, random scanning monitoring pages like firewall poo poo, SPA services/services like Ruby on Rails or Node.js with their own special implantation and monitoring software you know is just filthed up with JavaScript because "UX" design.

Also the first part of your statement is backwards. I would be more worried of an attack that only works on admin because then the person doing the attack knows not only the attack works but because the attack works there is no doubt that they are touching an admin account.

# ? Jul 28, 2018 18:21

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

EVIL Gibson posted:

Also the first part of your statement is backwards. I would be more worried of an attack that only works on admin because then the person doing the attack knows not only the attack works but because the attack works there is no doubt that they are touching an admin account.

??? "This attack lets the admin do things they could do already" is not an exploit. I don't think you parsed their statement properly.

# ? Jul 28, 2018 18:35

Wiggly Wayne DDS: Sep 11, 2010

EVIL Gibson posted:

I would be more worried of an attack that only works on admin because then the person doing the attack knows not only the attack works but because the attack works there is no doubt that they are touching an admin account.

priv esc is dead folks, pack your bags

# ? Jul 28, 2018 18:58

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Wiggly Wayne DDS posted:

priv esc is dead folks, pack your bags

It had a good run.

# ? Jul 28, 2018 18:59

Potato Salad: Oct 23, 2014; nobody cares

Volguus posted:

Thunderbird rules. Thunderbird works. There are many like it, but this one is mine. My Thunderbird is my best friend. It is my life. I must master it as I must master my life. Without me, my Thunderbird is useless. Without my Thunderbird, I am useless.

Sir this is a modern business

# ? Jul 30, 2018 00:13

Last Chance: Dec 31, 2004

Can you use Thunderbird with Exchange

# ? Jul 30, 2018 01:07

Potato Salad: Oct 23, 2014; nobody cares

Iirc only via imap

# ? Jul 30, 2018 01:14

in a well actually: Jan 26, 2011; dude, you gotta end it on the rhyme

There is a forked plugin for native exchange support in Thunderbird, but how you feel about some random GitHub that may not work with future versions of Thunderbird is another infosec discussion.

# ? Jul 30, 2018 02:10

Beccara: Feb 3, 2005

Apart from the FT ePass is anyone aware of any u2f device that also supports GIDS Smart card or loading JavaCardOS applets? Really would like to have U2F and GIDS support. YubiKey seems to have the ability to load JCOS applets but it isn't clear anymore that the manager keys are freely available

# ? Jul 30, 2018 02:47

Absurd Alhazred: Mar 27, 2010; by Athanatos

https://twitter.com/SwiftOnSecurity/status/1024103949639589888

# ? Jul 31, 2018 02:29

EVIL Gibson: Mar 23, 2001; Internet of Things is just someone else's computer that people can't help attaching cameras and door locks to!; Switchblade Switcharoo

Wiggly Wayne DDS posted:

priv esc is dead folks, pack your bags

...

Best practice is to make service accounts for each sensitive external services so even if that service owner is compromised, they are basically only locked down to to what they are permitted.

# ? Jul 31, 2018 19:04

adorai: Nov 2, 2002; 10/27/04 Never forget; Grimey Drawer

EVIL Gibson posted:

...

Best practice is to make service accounts for each sensitive external services so even if that service owner is compromised, they are basically only locked down to to what they are permitted.

Hence the privilege escalation comment.

# ? Aug 1, 2018 13:22

Potato Salad: Oct 23, 2014; nobody cares

Imagine putting "Endorsed by @SwiftOnSecurity" on your resume

# ? Aug 2, 2018 03:16

Dans Macabre: Apr 24, 2004

Potato Salad posted:

Imagine putting "Endorsed by @SwiftOnSecurity" on your resume

# ? Aug 2, 2018 03:28

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Absurd Alhazred posted:

https://twitter.com/SwiftOnSecurity/status/1024103949639589888

I like how the letter is written by Susan Bradley but the Computerworld article is written by Woody Leonhard.

# ? Aug 2, 2018 03:46

xThrasheRx: Jul 12, 2005; Surrealistic

EVIL Gibson posted:

...

Best practice is to make service accounts for each sensitive external services so even if that service owner is compromised, they are basically only locked down to to what they are permitted.

...Until they privesc to administrator.

But yes, separation of duties/least privilege is good

# ? Aug 2, 2018 11:23

Diva Cupcake: Aug 15, 2005

vomit
https://twitter.com/duosec/status/1024989452031143936

# ? Aug 2, 2018 13:45

Judge Schnoopy: Nov 2, 2005; dont even TRY it, pal

Goodbye duo, I really liked your service and how it worked with, but wasn't directly integrated into, anyconnect.

# ? Aug 2, 2018 13:54

Albinator: Mar 31, 2010

That is not the news I wanted to start my day with.

# ? Aug 2, 2018 14:29

AlternateAccount: Apr 25, 2005; FYGM

*deletes app*

# ? Aug 2, 2018 16:37

Darchangel: Feb 12, 2009; Tell him about the blower!

Uh, stupid question for someone who's not familiar with the issues, why is being acquired by Cisco bad, aside from "giant company acquires another good, small company and ruins it"?
We just switched to Duo and F5 BigIP for VPN where I work, so this may be relevant to me.

# ? Aug 2, 2018 17:39

AlternateAccount: Apr 25, 2005; FYGM

Darchangel posted:

Uh, stupid question for someone who's not familiar with the issues, why is being acquired by Cisco bad, aside from "giant company acquires another good, small company and ruins it"?
We just switched to Duo and F5 BigIP for VPN where I work, so this may be relevant to me.

"This year has brought five undocumented backdoors in Cisco�s routers so far, and it isn't over yet. In March, a hardcoded account with the username �cisco� was revealed. The backdoor would have allowed attackers to access over 8.5 million Cisco routers and switches remotely."

# ? Aug 2, 2018 17:46

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Cisco has a reputation of cornering markets and ratcheting up the costs to near-intolerable levels while cutting support and development.

# ? Aug 2, 2018 17:50

Diva Cupcake: Aug 15, 2005

Features and product innovation go down.
Security goes down.
Support goes down.
Prices go up.

# ? Aug 2, 2018 17:53

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

Diva Cupcake posted:

vomit
https://twitter.com/duosec/status/1024989452031143936

"And probably more exciting on the national scale, Duo Security�s $1.17 billion valuation is the highest valuation we have seen of any venture-backed company in Michigan."

hell yeah tech bubble is coming to the motor city

# ? Aug 2, 2018 18:08

BlankSystemDaemon: Mar 13, 2009

Diva Cupcake posted:

Features and product innovation go down.
Security goes down.
Support goes down.
Prices go up.

Bitcoin people learned a lot from Cisco, in their chanting of "Up up up!"

# ? Aug 2, 2018 18:26

BlankSystemDaemon: Mar 13, 2009

CRIP EATIN BREAD posted:

"And probably more exciting on the national scale, Duo Security�s $1.17 billion valuation is the highest valuation we have seen of any venture-backed company in Michigan."

hell yeah tech bubble is coming to the motor city

Don't worry, tech industry bubble is about ready to burst.

# ? Aug 2, 2018 18:27

AlternateAccount: Apr 25, 2005; FYGM

They also like to create obnoxious and nonsensical dependencies, so that to use one product successfully, you've really gotta use this OTHER product. They want to be the go-to for SO many categories of product that they're not actually competitive in :\

# ? Aug 2, 2018 18:29

feedmegin: Jul 30, 2008

CRIP EATIN BREAD posted:

hell yeah tech bubble is coming to the motor city

Ann Arbor is not Detroit.

# ? Aug 2, 2018 19:13

Darchangel: Feb 12, 2009; Tell him about the blower!

Sounds like Cisco is a fine example of business know-how. By which I mean a bunch of money grubbing assholes who aren't particularly good at what they purport to do.
Guess they're really good at kickbacks and free lunches, 'cuz I see they're poo poo all over the place.

# ? Aug 3, 2018 00:04

Dans Macabre: Apr 24, 2004

Cisco bought opendns and so far haven't hosed that up

# ? Aug 3, 2018 00:19

Absurd Alhazred: Mar 27, 2010; by Athanatos

Very cyberpunk:

https://twitter.com/alt_kia/status/1024786909199884288

# ? Aug 3, 2018 01:02

psydude: Apr 1, 2008

NevergirlsOFFICIAL posted:

Cisco bought opendns and so far haven't hosed that up

Kind of hard to gently caress up a DNS security company. I mean, they'll definitely try their hardest.

# ? Aug 3, 2018 03:57

AlternateAccount: Apr 25, 2005; FYGM

Yeah but Umbrella spawned out of it, and ain�t that some poo poo.

# ? Aug 3, 2018 04:00

Cup Runneth Over: Aug 8, 2009; She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate

Absurd Alhazred posted:

Very cyberpunk:

https://twitter.com/alt_kia/status/1024786909199884288

What the gently caress, context please

# ? Aug 3, 2018 11:12

Thanks Ants: May 21, 2004; #essereFerrari

AlternateAccount posted:

Yeah but Umbrella spawned out of it, and ain�t that some poo poo.

Does it still not work on IPv6 networks?

# ? Aug 3, 2018 11:41

prisoner of waffles: May 8, 2007; Ah! well a-day! what evil looks
Had I from old and young!
Instead of the cross, the fishmech
About my neck was hung.

Cup Runneth Over posted:

What the gently caress, context please

I'm guessing that it's "truck or trailer owner slaps GPS unit on truck or trailer, but truck driver doesn't like how they get treated when this information is gathered on them and brings a GPS-jammer on their drive; unwitting bystanders have their GPS jammed along the drivers route."

# ? Aug 3, 2018 14:52

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 07:58

Thanks Ants: May 21, 2004; #essereFerrari

And they've been able to track the jammers by looking at the signature of the interference being generated

# ? Aug 3, 2018 14:54

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›509 »