The Infosec Thread: Yes, time to move off Entrust

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›509 »

CLAM DOWN: Feb 13, 2007

quote:

To which I'd like to add: I have never in my adult life wished violence on any human being. I have witnessed too much of it and its barbaric effects, stood by the graves of too many people cut down too young. I do not hate you and I do not wish any harm to befall you.

But if you get hit by a bus while crossing the street, I'll tell the driver everyone deserves a mulligan once in a while.

You fool. You absolute, unmitigated, unadulterated, complete and utter, fool.

Peace to everyone � including you, you son of a bitch.

� Rob

# ? Jun 29, 2019 20:43

Adbot: ADBOT LOVES YOU

# ? May 31, 2024 22:32

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

I thought hard about including that quote but it was already long enough. That's absolutely the right response to someone exploting a *checks notes* 3750-day attack.

# ? Jun 29, 2019 20:51

Double Punctuation: Dec 30, 2009; Ships were made for sinking;
Whiskey made for drinking;
If we were made of cellophane
We'd all get stinking drunk much faster!

Well, if somebody signed a key 150,000 times, why can’t you verify it 150,000 times? Seems reasonable to me. :colbert:

# ? Jun 29, 2019 22:05

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

It gets ~~worse~~ somehow even better.

quote:

I don't even know what to call this attacker. There are no polite words. There is only "this sonufabitch."

quote:

We ignored them, which was the right thing to do. You don't let people who don't understand problems dictate which problems will be solved.

Then came September 2010. One keyserver operator in the European Union, Peter Pramberger, found himself facing a lawsuit by an OpenPGP user who was angry he could not have his email address deleted from the keyservers. Under EU data privacy regulations he had the right to demand this, but the keyserver network specifically lacked the capability to comply. It was designed that way for a reason.

The privacy trolls came out in force after that. They didn't want to hear technical explanations of difficulty, or lack of resources, or lack of competent people, or the fact none of us were paid and none of us could afford to take a year off work to do the overhaul they demanded.

We carefully designed this system to never be able to remove, only repudiate. It's clearly the superior way of doing things. Have you heard the good word of Bitcoin?

What do you mean that it falls afoul of laws? Censorship :bahgawd:

quote:

Special criticism goes to the Electronic Frontier Foundation, which paid Micah Lee to publish premade attack tools to exploit these design misfeatures in the keyserver network. Oh, sure, "academic freedom" and "it was about research".

Academic freedom should not be construed as permission to publish attack tools against a critical service with known vulnerabilities. Publishing a proof of concept is great and completely within the bounds of acceptable behavior. Publishing attack code is not.

Thanks for nothing, EFF.

Man, who knew that all this time the One Weird Trick for keeping software secure was to refuse to fix it and browbeat anyone who talked about it.

quote:

Let me make it clear, I'm not accusing that guy of being the responsible party. I don't have evidence to support that, or any other attribution. That jerk's raw sense of entitlement, and his callous talk about how he's vandalized certificates in the past, is not unusual to see among GnuPG's users. It's a long list.

quote:

But I tremble with fear for how people I know in hostile regimes are currently at risk of having their tools broken � and then I look at the preening self-righteousness of those louts who feel entitled to burn things down just to make a point.

They're children, the lot of them, children with matches and gasoline who are prancing and cavorting in our living rooms.

They have no idea the damage they do.

And more to the point, I genuinely don't think they care, either.

I'm eliding his whole argument about repressive governments because it boils down to "everyone not a democratic western country is an ignorant savage unable to exploit a flaw without clear written directions, therefore this is all the fault of the people who pointed out the flaw, not on us for refusing to fix it."

Harik fucked around with this message at 22:34 on Jun 29, 2019

# ? Jun 29, 2019 22:29

Arsenic Lupin: Apr 12, 2012; This particularly rapid💨 unintelligible 😖patter💁 isn't generally heard🧏‍♂️, and if it is🤔, it doesn't matter💁.

quote:

We ignored them, which was the right thing to do. You don't let people who don't understand problems dictate which problems will be solved.

quote:

All it took to strike down a keyserver in the EU was a couple of pages of privacy directive

Or, as we call it in English, a law.

e: See Rakshazi's comment, which is a thing of glory.

quote:

Hello, @rjh
Hope you are doing well.

I have some questions and misunderstood some moments. Could you help me with that, please?

So, if I understand correctly:

SKS keyserver was proof of concept, without any additional security layers for incoming user data. (IMHO: user = jerk, don't trust him, never)

Each of the problems you describe here and in https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f gist are about poorly developed proof-of-concept tool used in production.

So, my questions is:
Why you use such bad tool and scolds attacker at the same time? BTW, you wrote that you know about such problems for a decade.

I'm very sorry, but from my point of view is like https://meme-arsenal.com/create/meme/1138028

Best regards,
Nikita.

PS: it's internet, so don't trust me, please.

Arsenic Lupin fucked around with this message at 22:47 on Jun 29, 2019

# ? Jun 29, 2019 22:41

Cup Runneth Over: Aug 8, 2009; She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate

Not since the gamers have I seen a man so angry that we live in a society

# ? Jun 29, 2019 22:47

Arsenic Lupin: Apr 12, 2012; This particularly rapid💨 unintelligible 😖patter💁 isn't generally heard🧏‍♂️, and if it is🤔, it doesn't matter💁.

Oh, and if you're curious, here's the post he's ranting about. (Apparently my Google-fu is good enough. So proud.) This is a reply to rjh, who is saying some really dumb things.

quote:

> (Responding here because Stefan's message hasn't hit my mail server yet)
My previous message to you and the list was bounced from your mail server.
>
>>>> [rjh] It's from 2003. It doesn't need modernization.
>>> [stefan] No? I for one would like to be sure that i am the only person who can
>>> upload my public key to a key server directory.
> [rjh] Which is not a modernization issue. It's a feature request, and the
> feature you're asking for is DRM. Literally. You're asking that the
> keyserver network be rewritten to give you the ability to manage how
> information, which you think belongs to you, gets shared: that's DRM.
> DRM schemes are awful and they don't work.
>
[stefan] O.K. than it is a feature request. You also triggered something in me
with the words " which you think belongs to you".

If i am not mistaken you have also a keybase account, if not i applogize.
How about this; let's make "your" public key the ideal canditate for a
global trollwot session, were every GnuPG Linux user can participate
and add some funny things to "your" public key. This would be
also interesting to see how many signatures a public key can bear.

Maybe people can do also other things with "your" pub key and post
the used techniques here, like i did in the past with Erika Mustermann's
pub key and the added fake sig from Werner.

This would imho give you and people you talk to in conferences etc.
also a better view what i am talking about.

Best regards
Stefan

I don't read this as a direct threat so much as a "this situation is screwed up, consider this hypothetical as it pertains to you".

# ? Jun 29, 2019 22:56

BUG JUG: Feb 17, 2005

im the academic freedom doesn't actually mean academic freedom argument.

# ? Jun 29, 2019 23:41

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

im the recommending a known-broken security tool with trivial tracking capabilities to dissidents in hostile regimes

# ? Jun 30, 2019 01:13

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Saying "This is critical for democracy in authoritarian nations" is just their way of trying to feel like what they do is anything more than letting nerds poorly cosplay as spies.

# ? Jun 30, 2019 15:52

Harik: Sep 9, 2001; From the hard streets of Moscow
First dog to touch the stars; Plaster Town Cop

Volmarias posted:

Saying "This is critical for democracy in authoritarian nations" is just their way of trying to feel like what they do is anything more than letting nerds poorly cosplay as spies.

I wish that's all it was. They've deluded themselves into thinking hiding the body of the message is enough, and built a system that anyone at all can use to map the contacts of dissidents and any authoritarian regime can trivially snoop to ping alerts when someone gets in contact with any of the well-known NGOs or journalists covering their country.

All that on top of the impressive array of footguns the overly complex techno-nerd system leaves loaded with a hair trigger.

# ? Jun 30, 2019 18:23

Arsenic Lupin: Apr 12, 2012; This particularly rapid💨 unintelligible 😖patter💁 isn't generally heard🧏‍♂️, and if it is🤔, it doesn't matter💁.

Yes, but are they blockchain footguns?

# ? Jun 30, 2019 18:25

Absurd Alhazred: Mar 27, 2010; by Athanatos

https://twitter.com/campuscodi/status/1145367923407458304

I heard killing the messenger solves the problem every time.

# ? Jun 30, 2019 19:21

PBS: Sep 21, 2015

Absurd Alhazred posted:

https://twitter.com/campuscodi/status/1145367923407458304

I heard killing the messenger solves the problem every time.

I feel like downloading all the records was a bit excessive.

# ? Jul 1, 2019 05:23

Methylethylaldehyde: Oct 23, 2004; BAKA BAKA

PBS posted:

I feel like downloading all the records was a bit excessive.

Hard to downplay how bad the breech was when the proof of concept was "every record".

# ? Jul 1, 2019 09:07

Twerk from Home: Jan 17, 2009; This avatar brought to you by the 'save our dead gay forums' foundation.

Absurd Alhazred posted:

https://twitter.com/campuscodi/status/1145367923407458304

I heard killing the messenger solves the problem every time.

This was a really irresponsible way to disclose, I understand why he's facing legal consequences.

# ? Jul 1, 2019 14:57

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

Found a cool tool for your Pen Testing lab: Generates usernames/passwords for AD:

https://stealingthe.network/rapidly-creating-fake-users-in-your-lab-ad-using-youzer/

# ? Jul 1, 2019 16:07

The Iron Rose: May 12, 2012; Cat Army

CommieGIR posted:

Found a cool tool for your Pen Testing lab: Generates usernames/passwords for AD:

https://stealingthe.network/rapidly-creating-fake-users-in-your-lab-ad-using-youzer/

I was all "why wouldn't you just write this yourself in PowerShell" until I realized it pulled from real world password lists which is admittedly pretty cool.

# ? Jul 1, 2019 16:29

BUG JUG: Feb 17, 2005

The Iron Rose posted:

I was all "why wouldn't you just write this yourself in PowerShell" until I realized it pulled from real world password lists which is admittedly pretty cool.

Why would you need a script to just put in "password1" for 40% of your hypothetical users?

# ? Jul 1, 2019 22:26

wolrah: May 8, 2006; what?

BUG JUG posted:

Why would you need a script to just put in "password1" for 40% of your hypothetical users?

"password1" doesn't meet complexity requirements.

"Password123!" on the other hand...

# ? Jul 2, 2019 17:46

Powered Descent: Jul 13, 2008; We haven't had that spirit here since 1969.

https://twitter.com/gossithedog/status/1146885884928843776?s=21

:bravo:

# ? Jul 6, 2019 00:12

EVIL Gibson: Mar 23, 2001; Internet of Things is just someone else's computer that people can't help attaching cameras and door locks to!; Switchblade Switcharoo

Powered Descent posted:

https://twitter.com/gossithedog/status/1146885884928843776?s=21

You all should do some basic apk decompile testing on new apps because it is not uncommon to find really easy attacks.

a "built to be vulnerable" practice lab like Hackazon (great lab for both android and webserver practice- it has a great randomization feature where the same attack will not always work) has harder to find vulns compared to an new app that forgot to turn off the login for the bug monitoring service inside their build which has the default creds preloaded.

# ? Jul 6, 2019 14:51

Bald Stalin: Jul 11, 2004; Our posts

Google Push 2FA seems like a flaky service. I tried initiating from my work G Suite and my personal Gmail just now, not popping up on my just-rebooted android. This has happened once before last month, it just started working on its own again 30mins later.

edit: it just started working again. Flaky as gently caress.

Bald Stalin fucked around with this message at 22:26 on Jul 7, 2019

# ? Jul 7, 2019 22:16

BlankSystemDaemon: Mar 13, 2009

In what amounts to less fuckup, more impressive work - it seems someone has managed to reverse engineer a local privilege escalation based on the description provided by Peter Holm (the FreeBSD developer who initially informed the security officer):

K� at Secfault Security posted:

In February 2019 the FreeBSD project issued an advisory about a possible vulnerability in the handling of file descriptors.

UNIX-like systems such as FreeBSD allow to send file descriptors to other processes via UNIX-domain sockets. This can for example be used to pass file access privileges to the receiving process.

Inside the kernel, file descriptors are used to indirectly reference a C struct which stores the relevant information about the file object. This could for instance include a reference to a vnode which describes the file for the file system, the file type, or the access privileges.

What really happens if a UNIX-domain socket is used to send a file descriptor to another process is that for the receiving process, inside the kernel a reference to this struct is created. As the new file descriptor is a reference to the same file object, all information is inherited. For instance, this can allow to give another process write access to a file on the drive even if the process owner is normally not able to open the file writable.

The advisory describes that FreeBSD 12.0 introduced a bug in this mechanism. As the file descriptor information is sent via a socket, the sender and the receiver have to allocate buffers for the procedure. If the receiving buffer is not large enough, the FreeBSD kernel attempts to close the received file descriptors to prevent a leak of these to the sender. However, while the responsible function closes the file descriptor, it fails to release the reference from the file descriptor to the file object. This could cause the reference counter to wrap.

The advisory further states that the impact of this bug is possibly a local privilege escalation to gain root privileges or a jail escape. However, no proof-of-concept was provided by the advisory authors.

This blog post catches up on that and describes Secfault Security�s research to exploit the bug in order to obtain a privilege escalation to root.

Unfortunately this PoC doesn't elaborate on whether it can escape jails, or not. If it can, that's quite an impressive feat - although I reckon most systems, except Netflix's CDN and embedded systems running FreeBSD all over the world, tend to run ZFS nowadays.
Maybe it'll help with the PS4 homebrew scene? OrbisOS is FreeBSD 9.x and they've been struggling with escaping jails for years and years, without much success.

# ? Jul 8, 2019 21:05

RFC2324: Jun 7, 2012; http 418

D. Ebdrup posted:

In what amounts to less fuckup, more impressive work - it seems someone has managed to reverse engineer a local privilege escalation based on the description provided by Peter Holm (the FreeBSD developer who initially informed the security officer):

Unfortunately this PoC doesn't elaborate on whether it can escape jails, or not. If it can, that's quite an impressive feat - although I reckon most systems, except Netflix's CDN and embedded systems running FreeBSD all over the world, tend to run ZFS nowadays.
Maybe it'll help with the PS4 homebrew scene? OrbisOS is FreeBSD 9.x and they've been struggling with escaping jails for years and years, without much success.

based on my work in hosting, only thing most systems use zfs for is filers

# ? Jul 8, 2019 23:37

Cugel the Clever: Apr 5, 2009; I LOVE AMERICA AND CAPITALISM DESPITE BEING POOR AS FUCK. I WILL NEVER RETIRE BUT HERE'S ANOTHER 200$ FOR UKRAINE, SLAVA

The Zoom video conferencing app for Mac is a giant clusterfuck, apparently:
* silently props up an HTTP server that isn't cleared out by uninstalling the app and loads at startup
* automatically reinstalls the app and joins a meeting when a Zoom link is activated in the user's browser (requires no user interaction beyond visiting a page)
* automatically connects the user to a call with video and audio enabled

These are all "features", of course.

https://twitter.com/RayRedacted/status/1148377787516030978

# ? Jul 9, 2019 04:21

22 Eargesplitten: Oct 10, 2010

I know people in here were talking about hashivault. Is that the kind of thing that could be deployed via bash and/or python? I'm doing it on AWS, trying to knock out a few birds with one stone by working on an AWS cert, doing a hashivault implementation in a free tier instance as a proof of concept, and learning bash or python for a personal project and so I know WTF I'm doing if I go to a Linux shop.

# ? Jul 9, 2019 04:30

CLAM DOWN: Feb 13, 2007

https://twitter.com/mathowie/status/1148391109824921600

# ? Jul 9, 2019 04:39

Achmed Jones: Oct 16, 2004

�Deployed via bash/python� doesn�t make a ton of sense. New clusters will generally be spun up manually(-ish) so that root tokens, unseal keys, etc can be secured and distributed. New servers in a cluster will be spun up using whatever: docker container, AMI, maybe puppet or ansible, maybe terraform will he involved for infrastructure spinup. Any of those could automate things in bash or python or anything else, but programming languages are not themselves deployment pipelines.

# ? Jul 9, 2019 05:29

Internet Explorer: Jun 1, 2005

I can't believe that Zoom issue. Saw it earlier. That's so egregious, a reasonable response is up there with "banning all Zoom software from our network for a long time. "

# ? Jul 9, 2019 06:48

Mustache Ride: Sep 11, 2001

22 Eargesplitten posted:

I know people in here were talking about hashivault. Is that the kind of thing that could be deployed via bash and/or python? I'm doing it on AWS, trying to knock out a few birds with one stone by working on an AWS cert, doing a hashivault implementation in a free tier instance as a proof of concept, and learning bash or python for a personal project and so I know WTF I'm doing if I go to a Linux shop.

Here, codified terraform vault cluster in aws using AMIs: https://github.com/hashicorp/terraform-aws-vault
Bash script to install vault: https://github.com/hashicorp/terraform-aws-vault/tree/master/modules/install-vault
Bash script to run vault: https://github.com/hashicorp/terraform-aws-vault/tree/master/modules/run-vault

Also Ansible if you want Python instead: https://github.com/TerryHowe/ansible-modules-hashivault

# ? Jul 9, 2019 07:14

BlankSystemDaemon: Mar 13, 2009

RFC2324 posted:

based on my work in hosting, only thing most systems use zfs for is filers

Really? Because the hosts I know all use ZFS for provisioning and easy rollback.
Welp, I hope they've got their fleets up-to-date, then.

# ? Jul 9, 2019 09:48

RFC2324: Jun 7, 2012; http 418

D. Ebdrup posted:

Really? Because the hosts I know all use ZFS for provisioning and easy rollback.
Welp, I hope they've got their fleets up-to-date, then.

I wish, we use what the customer wants, and neither our sales or our customers know what zfs is

# ? Jul 9, 2019 10:32

BlankSystemDaemon: Mar 13, 2009

RFC2324 posted:

I wish, we use what the customer wants, and neither our sales or our customers know what zfs is

Cleraly the solution is to get rid of users. :colbert:

In other news, this is pretty impressive:

Mor Levi, Assaf Dahan, and Amit Serper at CyberReason posted:

Earlier this year, Cybereason identified an advanced, persistent attack targeting telecommunications providers that has been underway for years, soon after deploying into the environment.
Cybereason spotted the attack and later supported the telecommunications provider through four more waves of the advanced persistent attack over the course of 6 months.
Based on the data available to us, Operation Soft Cell has been active since at least 2012, though some evidence suggests even earlier activity by the threat actor against telecommunications providers.
The attack was aiming to obtain CDR records of a large telecommunications provider.
The threat actor was attempting to steal all data stored in the active directory, compromising every single username and password in the organization, along with other personally identifiable information, billing data, call detail records, credentials, email servers, geo-location of users, and more.
The tools and TTPs used are commonly associated with Chinese threat actors
During the persistent attack, the attackers worked in waves- abandoning one thread of attack when it was detected and stopped, only to return months later with new tools and techniques.

# ? Jul 9, 2019 16:56

Wiggly Wayne DDS: Sep 11, 2010

what's impressive?

# ? Jul 9, 2019 17:03

22 Eargesplitten: Oct 10, 2010

Achmed Jones posted:

�Deployed via bash/python� doesn�t make a ton of sense. New clusters will generally be spun up manually(-ish) so that root tokens, unseal keys, etc can be secured and distributed. New servers in a cluster will be spun up using whatever: docker container, AMI, maybe puppet or ansible, maybe terraform will he involved for infrastructure spinup. Any of those could automate things in bash or python or anything else, but programming languages are not themselves deployment pipelines.

Sorry, I meant would it be feasible to do the whole thing through a CLI as a fairly fresh CLI user (mostly Windows cmd and PowerShell) or would that just be masochistic? Not so much automating as avoiding the GUI. Because everyone knows real gurus have dusty mice.

# ? Jul 9, 2019 18:58

Cup Runneth Over: Aug 8, 2009; She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate

Haha, CLIs

https://github.com/webpack/webpack-cli/issues/962

# ? Jul 9, 2019 19:03

Bald Stalin: Jul 11, 2004; Our posts

Anyone here ever used Zoom on a Mac or support Mac users?

https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/

# ? Jul 9, 2019 20:11

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

Ranter posted:

Anyone here ever used Zoom on a Mac or support Mac users?

https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/

A HTTP server for every application! A dream has come to life!

# ? Jul 9, 2019 20:25

Adbot: ADBOT LOVES YOU

# ? May 31, 2024 22:32

BUG JUG: Feb 17, 2005

A HTTP server? In MY vpn??

# ? Jul 9, 2019 20:36

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›509 »