|
Carbon dioxide posted:https://east-ee.com/2017/02/28/rebreakcaptcha-breaking-googles-recaptcha-v2-using-google/ you can potentially steal user session cookies cross-tab using the chrome speech recognition + speech synthesis APIs which is pretty clever
|
#
?
Mar 2, 2017 00:23
|
|
|
|
| # ? Jun 6, 2024 16:02 |
|
|
how would you trick the target tab into reading out its session cookies? if you have that ability you probably don't need a rube goldberg speech synthesis thing at all
|
|
#
?
Mar 2, 2017 00:34
|
|
|
salted hash browns posted:I thought the issue with OpenVPN was you were always relying on 3rd party VPN clients that would occasionally leak traffic under certain situations? That using a normal built-in IPSEC VPN was the more robust option? yes. this is a big issue for example on windows with wifi networks, where if a network goes down, its routes are removed from the table, and when it goes up they are readded, with the highest priority. wifi has a hiccup -> you are no longer passing through the vpn. the native windows vpn client, on the other hand, creates a proper point-to-point network, which has a higher priority than broadcast networks by default. it's more a limitation of the openvpn driver for windows, which can only create tap (i.e. broadcast) and not tun (i.e. p-to-p) networks, but still, it means you can't safely use openvpn on windows
|
|
#
?
Mar 2, 2017 00:44
|
|
|
lmao https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/quote:The summary is that, while the bug was very bad and had the potential to be much worse, based on our analysis so far: 1) we have found no evidence based on our logs that the bug was maliciously exploited before it was patched; 2) the vast majority of Cloudflare customers had no data leaked; 3) after a review of tens of thousands of pages of leaked data from search engine caches, we have found a large number of instances of leaked internal Cloudflare headers and customer cookies, but we have not found any instances of passwords, credit card numbers, or health records; and 4) our review is ongoing. quote:Initially, the new parser code would only get executed under a very limited set of circumstances. Fewer than 180 sites from 22 September 2016 through 13 February 2017 had the combination of the HTML flaw and the set of features that would trigger the new version of the parser. During that time period, pages that had both characteristics and therefore would trigger the bug were accessed an estimated 605,037 times. quote:The Cloudbleed bug wasn't like a typical data breach. To analogize to the physical world, a typical data breach would be like a robber breaking into your office and stealing all your file cabinets. The bad news in that case is that the robber has all your files. The good news is you know exactly what they have. quote:For a limited period of time we keep a debugging log of requests that pass through Cloudflare. This is done by sampling 1% of requests and storing information about the request and response. We are then able to look back in time for anomalies in HTTP response codes, response or request body sizes, response times, or other unusual behavior from specific networks or IP addresses. just read the entire analysis from their... it's very comforting...
|
|
#
?
Mar 2, 2017 00:52
|
|
|
is nadim still considered a crank
|
|
#
?
Mar 2, 2017 02:49
|
|
|
http://money.cnn.com/2017/03/01/technology/yahoo-marissa-mayer-security-breachquote:Yahoo's (YHOO, Tech30) board decided not to award CEO Marissa Mayer a cash bonus "that was otherwise expected to be paid to her" due to the security incidents, according to a company filing on Wednesday.
|
|
#
?
Mar 2, 2017 04:29
|
|
|
hackbunny posted:openvpn driver for windows, which can only create tap (i.e. broadcast) and not tun (i.e. p-to-p) networks what? it can create tun interfaces just fine unless it's doing something bizarre behind the scenes I don't know about
|
|
#
?
Mar 2, 2017 05:57
|
|
|
windows doesnt support proper ptp and by default openvpn uses a /30 instead
|
|
#
?
Mar 2, 2017 06:03
|
|
|
i finally got l2tp and ipsec set up on my routerboard, i'm proud of myself 
|
|
#
?
Mar 2, 2017 06:07
|
|
|
MiniFoo posted:Today, in no particular order: Quickbooks, TeamViewer, Apple ID. Varkk posted:We use teamviewer host pushed out via GPO to avoid that. However we still have some external clients with no domain infrastructure where this can be an issue. MANime in the sheets posted:At an MSP, it's a relatively cheap way to use a simple program that even users can figure out. For a while we had a website where they could just download a one use one way client. Then internal systems put a new version of that up before help desk had a license for the new version.... we use Kaseya for the most part now. Probably more secure, and requires no intervention from the user for us to remote in. lampey posted:Was there ever a resolution to the teamviewer hack? Varkk posted:It was a bunch of people using the same email address/pass combo for LinkedIn and teamviewer. Coupled with some malware bundling it for remote access on victims around the same time. SEKCobra posted:We use Teamviewer to support our clients, how the gently caress else am I gonna be able to have a end user start a program while on a call and get to their desktop? I give them a link to download our QS and they give me the ID, done. Jesus Christ.
|
|
#
?
Mar 2, 2017 16:30
|
|
|
i find isllight works really good for remote support needs. you get a one time code that your client puts into the isllight client (which is just an exe file, no install, no services, no nothing), and they can then share their desktop if they want. the protocol isn't exactly stellar (it's some fork of vnc iirc), but it's cheap and reliable and super easy. alternatively, chrome remote desktop? Doesn't that have a remote assistance option? no idea how it works tho.
|
|
#
?
Mar 2, 2017 16:35
|
|
|
i liked how teamviewer managed to create the narrative that they didn't get breached
|
|
#
?
Mar 2, 2017 16:36
|
|
|
OSI bean dip posted:i liked how teamviewer managed to create the narrative that they didn't get breached I am glad my company isn't stupid enough to use Teamviewer, and the CEO is a CCIE in security.
|
|
#
?
Mar 2, 2017 16:40
|
|
|
Truga posted:alternatively, chrome remote desktop? Doesn't that have a remote assistance option? no idea how it works tho. It does, though I've never had the chance to use it. It works pretty great for me as a regular remote desktop app though.
|
|
#
?
Mar 2, 2017 16:45
|
|
|
OSI bean dip posted:i liked how teamviewer managed to create the narrative that they didn't get breached hey we didn't get breached, a bunch of our customers did 
|
|
#
?
Mar 2, 2017 17:02
|
|
|
ate all the Oreos posted:what? it can create tun interfaces just fine unless it's doing something bizarre behind the scenes I don't know about did someone say bean tun
|
|
#
?
Mar 2, 2017 17:20
|
|
|
ratbert90 posted:I am glad my company isn't stupid enough to use Teamviewer, and the CEO is a CCIE in security. we had problems with people putting teamviewer on various systems circumventing access controls. it got so bad that i broke my rule about outright blocking poo poo on the firewall Lain Iwakura fucked around with this message at 17:59 on Mar 2, 2017 |
|
#
?
Mar 2, 2017 17:56
|
|
|
I guess it easier than finding people who get how to use DW, which also has its own fuckups
|
|
#
?
Mar 2, 2017 18:02
|
|
|
cjs: talking to a new lady in marketing who is super concerned that b2b emails from surveymonkey are getting flagged as spam when they're sent to herself. i think they're getting flagged because we don't do javascript in emails and i would very much like to keep that setting the way it is
|
|
#
?
Mar 2, 2017 19:13
|
|
|
anyone coming to vancouver for cansecwest?
|
|
#
?
Mar 2, 2017 19:19
|
|
|
Hehquote:At 9:37AM PST, an authorized S3 team member using an established playbook executed a command which was intended to remove a small number of servers for one of the S3 subsystems that is used by the S3 billing process. Unfortunately, one of the inputs to the command was entered incorrectly and a larger set of servers was removed than intended.
|
|
#
?
Mar 2, 2017 19:48
|
|
|
anthonypants posted:cjs: talking to a new lady in marketing who is super concerned that b2b emails from surveymonkey are getting flagged as spam when they're sent to herself. i think they're getting flagged because we don't do javascript in emails and i would very much like to keep that setting the way it is i'd be surprised if surveymonkey emails had javascript in, since their delivery rates would be pretty horrific. can you see them in a message trace? it might be something simple like they're being sent with your domain set as the from, and you have policies in place to drop them if they originate from outside your exchange environment.
|
|
#
?
Mar 2, 2017 20:44
|
|
|
yeah i'd double check the dkim config in surveymonkey.
|
|
#
?
Mar 2, 2017 20:49
|
|
|
Thanks Ants posted:i'd be surprised if surveymonkey emails had javascript in, since their delivery rates would be pretty horrific. can you see them in a message trace? it might be something simple like they're being sent with your domain set as the from, and you have policies in place to drop them if they originate from outside your exchange environment. quote:STATUS
|
|
#
?
Mar 2, 2017 20:59
|
|
|
Not a security fuckup, just a regular fuckup.
|
|
#
?
Mar 2, 2017 22:50
|
|
|
Varkk posted:Not a security fuckup, just a regular fuckup. ehhhhhhhh
|
|
#
?
Mar 2, 2017 22:53
|
|
|
I want to believe he forgot the where
|
|
#
?
Mar 2, 2017 22:55
|
|
|
Shaggar posted:yeah i'd double check the dkim config in surveymonkey. yes check dkim + spf + dmarc
|
|
#
?
Mar 2, 2017 23:17
|
|
|
Some guy from Amazon posted:
|
|
#
?
Mar 2, 2017 23:21
|
|
|
ate poo poo on live tv posted:*millions of dollars in lost revenue for customers* If you are only in 1 region and being down for 10 hours costs you significant money you're the fuckup
|
|
#
?
Mar 2, 2017 23:26
|
|
|
https://twitter.com/isislovecruft/status/837429812390154240
|
|
#
?
Mar 2, 2017 23:30
|
|
|
jre posted:If you are only in 1 region and being down for 10 hours costs you significant money you're the fuckup I don't think one customer had millions of dollars of loss but thousands of customers had thousands of dollars of loss v  v
|
|
#
?
Mar 2, 2017 23:31
|
|
|
what
|
|
#
?
Mar 2, 2017 23:32
|
|
|
Varkk posted:Not a security fuckup, just a regular fuckup. you're a fuckup Varkk posted:We use teamviewer host pushed out via GPO to avoid that. However we still have some external clients with no domain infrastructure where this can be an issue. edit: props to ratbert who actually pointed this out several posts up Pile Of Garbage fucked around with this message at 03:07 on Mar 3, 2017 |
|
#
?
Mar 3, 2017 00:38
|
|
|
cheese-cube posted:you're a fuckup 
|
|
#
?
Mar 3, 2017 00:42
|
|
|
Varkk posted:Not a security fuckup, just a regular fuckup. so tell me, why are you pushing teamviewer via gpo?
|
|
#
?
Mar 3, 2017 00:51
|
|
|
its a lot of effort running around making your environment more vulnerable by hand
|
|
#
?
Mar 3, 2017 01:00
|
|
|
we had our app pentested recently and i just read their report: * our app is vulnerable to script upload attacks (they actually upload direct to s3) * our cookies aren't set as http-only (those particular cookies are created by javascript) * our webserver software is vulnerable to BEAST (ssl is actually terminated by our load balancers, webserver only sees http traffic) christ, now i know how bug bounty people feel
|
|
#
?
Mar 3, 2017 01:10
|
|
|
just wait until you get someone's report that is really a raw output from nessus
|
|
#
?
Mar 3, 2017 01:13
|
|
|
|
| # ? Jun 6, 2024 16:02 |
|
|
Like a .Nessus or just a CSV? Because the second one doesn't seem so bad. Edit: I ask because I may be the fuckup 
ZeusCannon fucked around with this message at 01:36 on Mar 3, 2017 |
|
#
?
Mar 3, 2017 01:20
|
|
