|
My PIN is 4826 posted:the phishing simulation for this quarter was a ransom email, which was interesting yes the idiots used an actual working bitcoin address and yes it had a balance so somebody paid the ransom hahahahahahaha
|
#
?
Mar 7, 2019 20:31
|
|
|
|
| # ? Jun 12, 2024 07:37 |
|
|
my bitter bi rival posted:hahahahahahaha
|
|
#
?
Mar 7, 2019 20:57
|
|
|
figure out who did it with a blockchain explorer, shame them on slack
|
|
#
?
Mar 7, 2019 20:58
|
|
|
lol if you didn't use an unique address for every employee
|
|
#
?
Mar 7, 2019 21:02
|
|
|
my bitter bi rival posted:hahahahahahaha
|
|
#
?
Mar 7, 2019 21:13
|
|
|
My PIN is 4826 posted:the phishing simulation for this quarter was a ransom email, which was interesting yes the idiots used an actual working bitcoin address and yes it had a balance so somebody paid the ransom For-profit phishing, I like it.
|
|
#
?
Mar 7, 2019 21:17
|
|
|
pseudorandom name posted:lol if you didn't use an unique address for every employee sadly not, but the simulations are done for us by a third party so this will be a gift that keeps on giving as their template gets re-used elsewhere
|
|
#
?
Mar 7, 2019 21:19
|
|
|
Today I found two stored procedures called "encrypt" and "decrypt" in an old applications database. Turns out the "encryption" algorithm for passwords was ROT128 (ASCII is the alphabet) and then reversing the string. Yes this application was 99% stored procs why do you ask ThePeavstenator fucked around with this message at 00:29 on Mar 8, 2019 |
|
#
?
Mar 8, 2019 00:21
|
|
|
ZeusCannon posted:We legit dont have calc anymore on our end points and im pretty sure its because someone was like they cant confirm calc.exe if they dont have it My PIN is 4826 posted:the phishing simulation for this quarter was a ransom email, which was interesting yes the idiots used an actual working bitcoin address and yes it had a balance so somebody paid the ransom evil_bunnY fucked around with this message at 00:33 on Mar 8, 2019 |
|
#
?
Mar 8, 2019 00:29
|
|
|
My PIN is 4826 posted:the phishing simulation for this quarter was a ransom email, which was interesting yes the idiots used an actual working bitcoin address and yes it had a balance so somebody paid the ransom this is a pretty amazing idea and I'm stealing it right now.
|
|
#
?
Mar 8, 2019 00:51
|
|
|
From: CEO <really.the.CEO@yahoo.com> Subject: Important I need you to buy some gift cards for a client ASAP.
|
|
#
?
Mar 8, 2019 00:53
|
|
|
ThePeavstenator posted:Today I found two stored procedures called "encrypt" and "decrypt" in an old applications database. Turns out the "encryption" algorithm for passwords was ROT128 (ASCII is the alphabet) and then reversing the string. Not as secure as ROT26
|
|
#
?
Mar 8, 2019 00:55
|
|
|
the unusability of daily life is really annoying
|
|
#
?
Mar 8, 2019 01:29
|
|
|
If an employee pays up for a test ransom, do you get to keep it?
|
|
#
?
Mar 8, 2019 01:50
|
|
|
everyone is better off with fewer bitcoins so yes
|
|
#
?
Mar 8, 2019 01:51
|
|
|
univbee posted:i'm very seriously considering getting lastpass I have to use lastpass for work. it is unbelievable terrible garbage. maybe it's just the ~~enterprise~~ version, but holy gently caress. things "fail" to save even though they did actually save, so you end up with duplicate entries never, ever use attachments. wanna download from the website? Not possible unless you install their (hilariously insecure in the past) browser extension. But if you have a Mac, you can download their app on the App Store! my login process to this app: login. App crashes. Login again. Attempt to download an attachment. App hard-locks. Login again. Whoops this file name is longer than 32 characters, we can't save that! Please rename. This happens 100% of the time. There's not an app for windows. install the browser extension.
|
|
#
?
Mar 8, 2019 02:02
|
|
|
we have to turn off the lastpass browser extension whenever we don't need it or the laptop fans immediately spin up and stay that way for hours. good product.
|
|
|
#
?
Mar 8, 2019 02:25
|
|
|
ThePeavstenator posted:Today I found two stored procedures called "encrypt" and "decrypt" in an old applications database. Turns out the "encryption" algorithm for passwords was ROT128 (ASCII is the alphabet) and then reversing the string. Back in a previous life we were using HP Quality Center and had just enabled LDAP authentication. I decided to check the DB passwords and there was a bunch of suspicious looking 24-43-31... poo poo in the password field. Sure enough, they were just adjusting each character by a fixed offset in the corresponding top-secret string SmolkaWasHereMonSher
|
|
#
?
Mar 8, 2019 02:28
|
|
|
I have a secfuck question where I'm looking in the mirror and wondering if the secfuck is me. I'm getting some poo poo from an auditor about libxml2. They had brought it up previously, and I was able to respond to it with "lol, noob, learn how the gently caress package versions work on RHEL, none of these CVE's apply." It has been brought up again, but this time I'm not so sure I can reply with that same response because there's actually a bunch of low/medium CVE's listed for libxml2 in the RHEL CVE database with the status "Won't Fix" or "May be fixed in the future  " even for RHEL7.What are Wizard Security Professionals doing for this case? libxml2 seems like a package that would be installed quite a lot. ErIog fucked around with this message at 02:46 on Mar 8, 2019 |
|
#
?
Mar 8, 2019 02:33
|
|
|
compensating controls
|
|
#
?
Mar 8, 2019 02:39
|
|
|
please no more trolling the thread about using/recommending lastpass
|
|
#
?
Mar 8, 2019 11:33
|
|
|
well that sucks, although so far at least my test run seems to be behaving. i'm not spending all day changing and creating passwords, really all i want is the equivalent of an excel spreadsheet of passwords which needs its own password and 2fa to get into
|
|
#
?
Mar 8, 2019 15:08
|
|
|
univbee posted:well that sucks, although so far at least my test run seems to be behaving. i'm not spending all day changing and creating passwords, really all i want is the equivalent of an excel spreadsheet of passwords which needs its own password and 2fa to get into just use keepAss and throw it on a Dropbox
|
|
#
?
Mar 8, 2019 15:22
|
|
|
BattleMaster posted:If an employee pays up for a test ransom, do you get to keep it? carl mark force iv finds new career as phishing tester
|
|
#
?
Mar 8, 2019 15:25
|
|
|
univbee posted:well that sucks, although so far at least my test run seems to be behaving. i'm not spending all day changing and creating passwords, really all i want is the equivalent of an excel spreadsheet of passwords which needs its own password and 2fa to get into I betchu could do totp in vba. altho access might be more appropriate than excel
|
|
#
?
Mar 8, 2019 15:27
|
|
|
Janitor Prime posted:just use keepAss and throw it on a Dropbox i'm also setting this up for family members i'm going to be committing to a decision at some point this weekend and lastpass is currently looking the most needs-suiting
|
|
#
?
Mar 8, 2019 15:34
|
|
|
i've been yelling against using it since release. they've been hacked multiple times, glossed over what was impacted then, and designed the vault to allow online-only access with bypasses for the master key, 2fa or region locks please just go with 1password or keepass
|
|
#
?
Mar 8, 2019 15:44
|
|
|
"spreadsheet for passwords with a lock" is pretty much exactly keep rear end, you can't do 2FA but you can set it up to require a key file that you store on a USB stick or SD card or w/e if you want so just having the password isn't enough. It's not the same amount of security as 2FA (if they have full access to your machine they can probably just wait for you to plug the thing in and copy it) but it's better than just a password 
|
|
#
?
Mar 8, 2019 15:47
|
|
|
ErIog posted:I have a secfuck question where I'm looking in the mirror and wondering if the secfuck is me. libxml2 works fine with cves in it as long as it’s not used to process input or generate output. so eh yeah patch it
|
|
#
?
Mar 8, 2019 16:04
|
|
|
i think all computers are safe so long as they're not used to process input or generate output tbh
|
|
#
?
Mar 8, 2019 16:06
|
|
|
yeah, i keepass
|
|
#
?
Mar 8, 2019 16:08
|
|
|
Wiggly Wayne DDS posted:i've been yelling against using it since release. they've been hacked multiple times, glossed over what was impacted then, and designed the vault to allow online-only access with bypasses for the master key, 2fa or region locks i'll be evaluating all of this definitely. do you have any links discussing these points, and anything more recent than the 2016 hack? Shame Boy posted:i think all computers are safe so long as they're not used to process input or generate output tbh this sounds like a good solution
|
|
#
?
Mar 8, 2019 16:09
|
|
|
Which libxml cve are you worried about specifically? Asking about them generically is like asking a doctor who never met you if you should be taking prescriptions.
|
|
#
?
Mar 8, 2019 16:11
|
|
|
univbee posted:i'll be evaluating all of this definitely. do you have any links discussing these points, and anything more recent than the 2016 hack? Wiggly Wayne DDS posted:i've yelled and yelled about lastpass before. here's a post from 2015 after they have multiple breaches, which they said wasn't really a problem as they couldn't read your passwords due to the master password, also 2fa and other restrictions made the rest of the attackers data useless. what their pr forgot to mention was a vulnerability had been notified to them in that time period that showed a design decision allowing a bypass to requiring the master password: i may have had this argument a few times before, and followup arguments pointing at my prior arguments
|
|
#
?
Mar 8, 2019 16:42
|
|
|
ErIog posted:I have a secfuck question where I'm looking in the mirror and wondering if the secfuck is me. Grab the source RPM and rebuild it with a newer libxml2.
|
|
#
?
Mar 8, 2019 16:44
|
|
|
univbee posted:i'm also setting this up for family members keep rear end is good poo poo but not something I want to train my parents to use. slightly too many buttons/nerd features to work well for the technically disinclined. 1password is straightforward to use, and not a big sloppy mess of RCEs
|
|
#
?
Mar 8, 2019 17:09
|
|
|
yeah i may have to just suck it up and use 1password, i'll continue testing
|
|
#
?
Mar 8, 2019 17:12
|
|
|
this is a lastpast-free zone
|
|
#
?
Mar 8, 2019 17:22
|
|
|
univbee posted:i'll be evaluating all of this definitely. do you have any links discussing these points, and anything more recent than the 2016 hack?
|
|
#
?
Mar 8, 2019 18:26
|
|
|
|
| # ? Jun 12, 2024 07:37 |
|
|
Keepass and Mooltipass are still acceptable, right?
|
|
#
?
Mar 8, 2019 18:34
|
|
