Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Shuu
Aug 19, 2005

Wow!

PuErhTeabag posted:

My friend is redoing a website for a local business and found this homebuilt "crypto" gem written by a different local web developer in 2007. Luckily it didn't protect anything important, but still.


I'm censoring the numbers present just to be paranoid, but they are roughly 3.0e13 for the usernames and passwords (although one of the passwords is only about 1.4e10). Having 6 primes in the 97-122 range (lower case ascii) makes it reallllly easy to figure out most of the letters by factoring, especially when three of those primes are a, e, and m.

Oh, and this was just published in the source of the webpage,.

Amazing. That reminds me of some code I wish I had saved during an investigation awhile ago.

After finding a public web app that allowed login as admin using admin/admin I first assumed it was just your typical default admin account situation. Nope. There was a hardcoded list of two possible passwords: 'admin' and 'password', and depending on which word you entered you were logged in as either an admin or a general users, both having access to client data, even if the username you entered didn't exist. This was a major tech company.

Adbot
ADBOT LOVES YOU

EVIL Gibson
Mar 23, 2001

Internet of Things is just someone else's computer that people can't help attaching cameras and door locks to!
:vapes:
Switchblade Switcharoo

PuErhTeabag posted:

My friend is redoing a website for a local business and found this homebuilt "crypto" gem written by a different local web developer in 2007. Luckily it didn't protect anything important, but still.


code:
function submitentry(){
password = document.password1.password2.value.toLowerCase()
username = document.password1.username2.value.toLowerCase()
passcode = 1
usercode = 1
for(i = 0; i < password.length; i++) {
passcode *= password.charCodeAt(i);
}
for(x = 0; x < username.length; x++) {
usercode *= username.charCodeAt(x);
}

if((usercode==censored&&passcode==censored)||(usercode==censored&&passcode==censored))
{
window.location=username+".html"}

else{
alert("password/username combination wrong")}
}

I'm censoring the numbers present just to be paranoid, but they are roughly 3.0e13 for the usernames and passwords (although one of the passwords is only about 1.4e10). Having 6 primes in the 97-122 range (lower case ascii) makes it reallllly easy to figure out most of the letters by factoring, especially when three of those primes are a, e, and m.

Oh, and this was just published in the source of the webpage,.

I can top this. When doing a full scan (for the first time since never) of all sites owned by the place I was working at, we found a page where you could download some privatish stuff for customers across the US and it was just the easiest SQL injection ever.

The reason why?

The instructions on the PAGE ITSELF was telling the customers how to SQL inject the page to fetch the data they needed.

This site was not hidden behind login/cookies or anything. It was restricted behind an IP filter, but it was like 100+ customers across the US.

incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010
So this is maximum lovely microsoft. Doesn't patch a known exploit for a few years, when tasked on this bullshit just replies "keep your system up to date by installing this patch" and the dial-tone clicks.

Fame Douglas
Nov 20, 2013

by Fluffdaddy
That's what happens when the NSA doesn't allow you to fix it for a while.

Last Chance
Dec 31, 2004

Fame Douglas posted:

That's what happens when the NSA doesn't allow you to fix it for a while.

Pfft, next you're going to say that BitLocker is only for Windows Pro users and not home users because the Gov't wants to make it more marginally more expensive/difficult to encrypt files.

PuErhTeabag
Sep 2, 2018

Shuu posted:

...There was a hardcoded list of two possible passwords: 'admin' and 'password', and depending on which word you entered you were logged in as either an admin or a general users, both having access to client data, even if the username you entered didn't exist. This was a major tech company.

That's totally believable and amazing.

EVIL Gibson posted:

...
The instructions on the PAGE ITSELF was telling the customers how to SQL inject the page to fetch the data they needed.

This site was not hidden behind login/cookies or anything. It was restricted behind an IP filter, but it was like 100+ customers across the US.

That's kind of bizarre, but also believable.

When I was working in a different industry I learned that a large US company's warranty return information isn't user locked - so it was possible to query their database for return information of other suppliers just by knowing supplier codes.

Sheep
Jul 24, 2003
At a previous job we found out that one of our vendors' "secure file transfer" solutions was actually just bog standard FTP. Also, they used one shared set of credentials for all of their clients to upload data to a wide open rwx folder, where all the data all of their clients ever uploaded sat indefinitely. Did I mention that this system stored PII & PHI?

The best part is that we ended up paying them to develop a new file transfer system. Still can't wrap my head around that one.

Sheep fucked around with this message at 07:31 on Aug 18, 2020

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
I'm sure they did the responsible thing and disclosed the breach, right? Right?

droll
Jan 9, 2020

by Azathoth

Sheep posted:

The best part is that we ended up paying them to develop a new file transfer system. Still can't wrap my head around that one.

SaaS vendor that our 'IT Business Partner and Project Manager' onboarded is asking us to to pay them to fix their application because even with SAML SSO enabled, users are still required to create passwords and can login directly bypassing our IdP. Apparently the first S in SSO actually stands for 'sconvenience' ??

edit: Oh and an end user just got hit with a change password policy in said SaaS, and it confused them because they're coming in from our SAML IdP, so the vendor's suggestion was to increase their local password policy to expire every 365 days.

droll fucked around with this message at 18:28 on Aug 18, 2020

some kinda jackal
Feb 25, 2003

 
 
https://www.sans.org/dataincident2020

quote:

What is known for certain?
On August 6th, as part of a systematic review of email configuration and rules we identified a suspicious forwarding rule and initiated our incident response process. This rule was found to have forwarded a number of emails from a specific individual's e-mail account to a suspicious external email address. The forwarded emails included files that contained some subset of email, first name, last name, work title, company name, industry, address, and country of residence. SANS quickly stopped any further release of information from the account.

As a result of this incident, 513 emails were forwarded to a suspicious external email address. Most of these emails were harmless, but some of these emails contained files with personally identifiable information (PII). As a result, approximately 28,000 records of PII were forwarded to a suspicious external email address.

Are there additional details on what occurred:
We have identified a single phishing e-mail as the vector of the attack. As a result of the e-mail, a single employee's email account was impacted. Aside from the affected user, we currently believe that no other accounts or systems at SANS were compromised.

What information was disclosed?
Upon initial investigation, we know that the data accessed DID NOT contain any of the following information:

Passwords
Financial information such as credit card numbers
We know that the data did include subsets of the following types of personal information:

Email
Work Title
First name & Last name
Work phone
Company name
Industry
Address
Country of residence


All the expensive SANS training in the world coul--ehh nevermind

Cup Runneth Over
Aug 8, 2009

She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate


droll posted:

SaaS vendor that our 'IT Business Partner and Project Manager' onboarded is asking us to to pay them to fix their application because even with SAML SSO enabled, users are still required to create passwords and can login directly bypassing our IdP. Apparently the first S in SSO actually stands for 'sconvenience' ??

edit: Oh and an end user just got hit with a change password policy in said SaaS, and it confused them because they're coming in from our SAML IdP, so the vendor's suggestion was to increase their local password policy to expire every 365 days.

lol, vendors

wolrah
May 8, 2006
what?

Sheep posted:

At a previous job we found out that one of our vendors' "secure file transfer" solutions was actually just bog standard FTP. Also, they used one shared set of credentials for all of their clients to upload data to a wide open rwx folder, where all the data all of their clients ever uploaded sat indefinitely. Did I mention that this system stored PII & PHI?

The best part is that we ended up paying them to develop a new file transfer system. Still can't wrap my head around that one.

This sounds very much like Patterson Dental, makers of Eaglesoft, who had an open FTP that definitely stored customer data including PHI on the reg until a security researcher publicized the PHI part. They then called the FBI on him.

I still work with Patterson because the dental software world is horrible and there isn't really much choice, and while they swapped the FTP for a HTTPS based web upload page that has its own problems, they are still definitely one of those companies that acts we're the unreasonable IT nazis when we refuse to give everyone local admin.

evil_bunnY
Apr 2, 2003

Martytoof posted:

https://www.sans.org/dataincident2020



All the expensive SANS training in the world coul--ehh nevermind
This is actually a good writeup, and it further underlies that MS doesn't give a loving poo poo if you phish from azure.

Happiness Commando
Feb 1, 2002
$$ joy at gunpoint $$

There's a horror story about Eaglesoft that's been posted here before. Not Infosec but it was something like a multi-office practice and Eaglesoft's default/hard-coded behavior was doing SELECT * on their entire patient database across their entire practice and trying to load DICOM images over a WAN link every time records were accessed. Or something.

Eaglesoft is poo poo and probably all the other dental software is poo poo too.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

evil_bunnY posted:

This is actually a good writeup, and it further underlies that MS doesn't give a loving poo poo if you phish from azure.

What does this have to do with Azure?

droll
Jan 9, 2020

by Azathoth
We don't allow end users to create forwards outside of our email domain for this very reason. A CEO at another company in our industry got phished and the attacker set up a forward to steal all their juicy secrets.

Sickening
Jul 16, 2007

Black summer was the best summer.

droll posted:

We don't allow end users to create forwards outside of our email domain for this very reason. A CEO at another company in our industry got phished and the attacker set up a forward to steal all their juicy secrets.

Forwarding rules outside of the company should be off in a tenant by default. I drat well know its in the secure score rating and one of the first things they suggest you do outside of MFA. Getting owned by this is willful neglect by today's standards.

Internet Explorer
Jun 1, 2005





I think Microsoft is moving that direction. I know I saw a recent Major Change Update 10x A Day Notification about it.

Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...

droll posted:

SaaS vendor that our 'IT Business Partner and Project Manager' onboarded is asking us to to pay them to fix their application because even with SAML SSO enabled, users are still required to create passwords and can login directly bypassing our IdP. Apparently the first S in SSO actually stands for 'sconvenience' ??

edit: Oh and an end user just got hit with a change password policy in said SaaS, and it confused them because they're coming in from our SAML IdP, so the vendor's suggestion was to increase their local password policy to expire every 365 days.

Ask me about having to write unit tests for a vendor because A) they didn't have any and B) they didn't believe me when I stated that something was broken via C) their support forums that required MSIE 7 and wouldn't allow you to sign in with anything else (until you changed your useragent...)

Happiness Commando posted:

There's a horror story about Eaglesoft that's been posted here before. Not Infosec but it was something like a multi-office practice and Eaglesoft's default/hard-coded behavior was doing SELECT * on their entire patient database across their entire practice and trying to load DICOM images over a WAN link every time records were accessed. Or something.

Eaglesoft is poo poo and probably all the other dental software is poo poo too.

You're thinking of This TDWTF article

wolrah
May 8, 2006
what?

When I first read that story I had to check some details because I was convinced it was about my client.

CyberPingu
Sep 15, 2013


If you're not striving to improve, you'll end up going backwards.
So I presume everyone saw that article about the Security Consulting firm gaming the CREST exam for all their interns by having NDA breaching mock exams on a GitHub repo...


Right?

Rufus Ping
Dec 27, 2006





I'm a Friend of Rodney Nano
Rather than presuming why don't you link to it

CyberPingu
Sep 15, 2013


If you're not striving to improve, you'll end up going backwards.

Rufus Ping posted:

Rather than presuming why don't you link to it

Huh sorry I thought I had


https://www.theregister.com/2020/08/14/crest_investigates_ncc_group/

Powered Descent
Jul 13, 2008

We haven't had that spirit here since 1969.

As seen in the Idiots on Social Media thread over in PYF:

https://twitter.com/bt_uk/status/1291348291251208195?s=21

Screenshotted for posterity:

Factor Mystic
Mar 20, 2006

Baby's First Post-Apocalyptic Fiction

beuges posted:

What's the thread's opinion of ZeroTier?

I used to run it every day (personal user, using windows & iphone app) and it's really good. I piped RDP over it and there's no noticeable lag or anything... the best compliment I can give is that I don't have to think about it at all. The app UI is slightly janky, but you get what you pay for I guess.

Bonzo
Mar 11, 2004

Just like Mama used to make it!
https://twitter.com/frontendbeast/status/1296046119089315841

Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...
It's actually the Ø glyph, not a 0. Joke's on the people who thought they were being insecure :smugdog:

some kinda jackal
Feb 25, 2003

 
 
Those FUCKERS stole MY PASSWORD >:|

CyberPingu
Sep 15, 2013


If you're not striving to improve, you'll end up going backwards.

gently caress sake lads.

Absurd Alhazred
Mar 27, 2010

by Athanatos
From the Post Good Tweets (ed because I thought it was the flight sim thread? woops!) thread:

Imagine if someone had instead deliberately injected specifically malformed data into OSM to trigger a vulnerability:

Absurd Alhazred fucked around with this message at 16:54 on Aug 20, 2020

Schadenboner
Aug 15, 2011

by Shine

Absurd Alhazred posted:

From the Flight Sim thread:


Imagine if someone had instead deliberately injected specifically malformed data into OSM to trigger a vulnerability:

Airforceproud95 has really been stepping up his game?

:shrug:

Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...

Schadenboner posted:

Airforceproud95 has really been stepping up his game?

:shrug:

"November Romeo Three Zero Niner Seven Very Heavy, please confirm, you are requesting clearance to land THE MOON?"

Schadenboner
Aug 15, 2011

by Shine

Volmarias posted:

"November Romeo Three Zero Niner Seven Very Heavy, please confirm, you are requesting clearance to land THE MOON?"

I think that would be "Super"?

:shrug:

E: Although I think that it's mostly to do with wing wake/turbulence and damned if I know what a oblate spheroid would do?

Schadenboner fucked around with this message at 17:48 on Aug 20, 2020

Wiggly Wayne DDS
Sep 11, 2010



Absurd Alhazred posted:

From the Post Good Tweets (ed because I thought it was the flight sim thread? woops!) thread:


Imagine if someone had instead deliberately injected specifically malformed data into OSM to trigger a vulnerability:
what exactly would someone inject into buildings:stories? this would have passed sanity checks after microsoft grabbed the data from osm, you can see the values used here: https://taginfo.openstreetmap.org/keys/building:levels

as mentioned the dataset is the same they use in bing maps, this isn't live updates they're pulling from osm

Schadenboner
Aug 15, 2011

by Shine
So the moon is like 7.342×10^22 kg, I don't know what the prefix for 10^22 is.

BALL LUNA ZETTA-SUPER would be off by an order of magnitude and the ICAO might have an issue?

:shrug:

Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...
To be fair, if it's a one off, I think they'd be ok with a special variant.

Klyith
Aug 3, 2007

GBS Pledge Week

Wiggly Wayne DDS posted:

what exactly would someone inject into buildings:stories? this would have passed sanity checks after microsoft grabbed the data from osm, you can see the values used here: https://taginfo.openstreetmap.org/keys/building:levels

:hehe:

Wiggly Wayne DDS
Sep 11, 2010



$ gets a good result as well, but again without knowing what you're blinding injecting to...?

stevewm
May 10, 2005
Some time ago I posted about a card processing companies' website we use having absolutely useless 2FA.

After trying multiple times to get a hold of someone about it and never receiving a response, nearly 2 years later it is still this way. Ready to name and shame... FirstAmerican Payment Systems is the name. This is their backend website known as "FirstView".



This is the challenge screen you are presented with. You can select to receive a code via email or text. Except you don't need to do it. You can just click "User Settings" at the bottom which takes you to the settings screen inside the account. From there you can click Home to get to the main screen. Since the introduced "2FA" i've never actually had to do it!

Even worse.. the email and phone number are clickable links. Clicking on them lets you update the email or phone number used to "verify". So if someone did get your username/password. They could easily change the email/phone number the "2FA" codes go to.


Thankfully you can't really do anything on this website. It only shows the last 4 of card numbers, no names, and you cannot perform any type of transactions. It is reporting only.

Adbot
ADBOT LOVES YOU

fankey
Aug 31, 2001

In applications where a device TPM is required for key storage ( for 802.1x and HTTPS, not things like full disk encryption ) what is the general view on fTPMs like Intel Platform Trust or ARM TrustZone? Are there any standards that require discrete TPMs? My searching indicates vulnerabilities have been found in both fTPMs and dTPMs so it doesn't seem like one is more inherently secure. I'm coming at it from the product side and wondering if the platforms support fTPMs will we ever realistically run into any requirements that explicitly state using a dTPM.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply