secfuck v18.51: who needs they entrussy revoked

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.51: who needs they entrussy revoked

«‹›973 »

shackleford: Sep 4, 2006

public address system or personal assistant?

# ? Apr 18, 2024 04:08

Adbot: ADBOT LOVES YOU

# ? Jun 8, 2024 12:14

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

palo alto?

# ? Apr 18, 2024 04:10

Shame Boy: Mar 2, 2010

personal altoids

# ? Apr 18, 2024 04:21

Frozen Peach: Aug 25, 2004; garbage man from a garbage can

pain in the rear end

# ? Apr 18, 2024 04:31

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Poopy Assumptions

# ? Apr 18, 2024 05:21

Progressive JPEG: Feb 19, 2003

prepare anus

# ? Apr 18, 2024 06:32

spankmeister: Jun 15, 2008

Plain Almonds

# ? Apr 18, 2024 06:53

Pendragon: Jun 18, 2003; HE'S WATCHING YOU

was talking with our MSP. they have 750 palo altos and the majority of them have IoC log entries of some kind. they�re hoping that the entries are benign or researchers testing stuff and don�t actually indicate compromise.

# ? Apr 18, 2024 13:28

Antigravitas: Dec 8, 2019; Die Rettung fuer die Landwirte:

That's a nice thing to hope.

# ? Apr 18, 2024 13:30

fins: May 31, 2011; Floss Finder

Wiggly Wayne DDS posted:

okay for the next set we're going to go to a closed bug report and a secfuck read this for context: https://ian.sh/etugra and https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/yqALPG5PC4s
2022-11-18: E-Tugra: Incident Report (Security Issues)
- e-Tugra is (at least for a specific time period...?) a managed SubCA under SSL.com and have severe security issues

holy lmao at the pen test reports. this is pretty much the entirety of the reports. page 1, cover page. page 2, blurb + these graphs. page 3, graph legend. there is no page 4.

plus the whole "3 minutes" thing. are they being wilfully ignorant?

# ? Apr 18, 2024 13:38

Wiggly Wayne DDS: Sep 11, 2010

some movement on this issue: 2024-04-10: Entrust: CPS typographical (text placement) error
- as a tldr Entrust mis-issued 6008 certs and are not doing anything about them

Jeremy Rowley posted:

Entrust isn't revoking these certificates because re-issuance would result in the exact same certificate? Do I have that correct?

that is the executive vice president at digicert. i wasn't going to mention this until there was more activity on the issue though as

Wayne posted:

I'm looking for clarity here. Entrust states that there iss no intention to revoke but cite no authority overriding their obligations.

The issue was noted internally at Entrust on 2024-03-26, but it took 16 days before any public notice appeared. We're still lacking any real information on what happened internally.

I will also note that several of the certificates listed have been revoked (superseded):
https://crt.sh/?sha256=34DF91A45C4BF0D54A5879A241C763DB6969002E7739572C6C322E075136AEB7 (2024-03-26 17:08:49 UTC)
https://crt.sh/?sha256=3260F0A3FD4D68674686F6C4A8C2BDB642F2D2E4A8E02D0F0EF93CC0F9711C28 (2024-03-26 17:13:03 UTC)
https://crt.sh/?sha256=75CA61256BF5B55FC6B0B89EEA34F709FA1002350E31513AB6E11350D175F0D1 (2024-03-26 19:19:08 UTC)
https://crt.sh/?sha256=1E190D5B285DFD5A01781132707B4E54F20A4DF31C1F2E82A465E48B3C4DB4D5 (2024-03-26 19:35:29 UTC)
https://crt.sh/?sha256=CE480E4CC20F38C8860C79BE6ECE3583626CA3829AE1D08ADB650E8C3B2FD318 (2024-03-27 18:10:22 UTC)

I don't need to fully explain that the sample above does not paint a good light on Entrust's internal consistency and transparency to the public.

Q1) Can you document what caused Entrust to start revocation for a day, and then stop?

Q2) Can Entrust provide us with a breakdown of outstanding mis-issued certificates, expired certificates, revoked certificates, and a timeframe for each revocation batch (time issued to team, time taken to revoke)?

Q3) What internal discussions occurred at Entrust to change this approach?

Q4) Did Entrust privately inform any Root Programs of this incident prior to this public report?

Q5) Will there be any additional revocations as required?

Q6) Can Entrust please explain why they feel they feel they are under no obligation to abide by their own CPS for certificate mis-issuance revocation? The report does not explain what authorities they are relying on.

Q7) Having read Entrust's CPS I can see no mechanism for 'exceptional circumstances' to avoid revocation. Could Entrust clarify where this is as it has been a common theme throughout these incidents?

Q8) If there will be an update to Entrust's CPS to carve out exceptional circumstances, I trust that there is an understanding that this is not applied retroactively?

Q9) Given the issues in the past month, can Entrust confirm that they are technically capable of mass revocation and reissuance within 24 hours?

Q10) Given the issues in the past month, can Entrust confirm that they are organizationally capable of approving a mass revocation and reissuance event within 24 hours?

i .. noticed some problems this morning when glancing at their impacted certs list and couldn't wait for someone else to pass along the message. there isn't a good way i'm aware of to mass check crt.sh links but that sample doesn't look great for entrust's account of their timeline

# ? Apr 18, 2024 13:39

Raymond T. Racing: Jun 11, 2019

go get em wayne

# ? Apr 18, 2024 14:12

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

i am pointing strongly at the don�t touch the poop rule BUT

i am waiving it as the bugzilla is open to the public, technically

wayne is very clearly capable and acting in good faith as to the purpose of the bugzilla

nothing is being exploited (which is what traditionally has gotten threads iced)

i am running up a yellow flag for the rest of the thread and this is not an invitation or okay for everyone else to go hogge wilde

# ? Apr 18, 2024 14:16

Raymond T. Racing: Jun 11, 2019

hogge wilde: oscar wilde�s lesser known brother who�s into ye olde sec fucks

Raymond T. Racing fucked around with this message at 14:41 on Apr 18, 2024

# ? Apr 18, 2024 14:25

Kovacs: Jul 19, 2006

quote:

there isn't a good way i'm aware of to mass check crt.sh links

crt.sh can be queried directly (it's a big postgres db) with any postgresql client (I'm partial to TablePlus).
crt.sh port 5432
u: guest
no password
database: certwatch

# ? Apr 18, 2024 14:47

Wiggly Wayne DDS: Sep 11, 2010

Kovacs posted:

crt.sh can be queried directly (it's a big postgres db) with any postgresql client (I'm partial to TablePlus).
crt.sh port 5432
u: guest
no password
database: certwatch

...thank you i never looked further than a vague glance at the site

# ? Apr 18, 2024 14:49

Antigravitas: Dec 8, 2019; Die Rettung fuer die Landwirte:

Using a database client to interact with a database over the internet is one of those things that's probably fine, but it feels intuitively so, so wrong to me.

# ? Apr 18, 2024 15:08

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

Antigravitas posted:

Using a database client to interact with a database over the internet is one of those things that's probably fine, but it feels intuitively so, so wrong to me.

super meat boy did this for its custom level database

it turns out your intuition would have been entirely correct in that case

# ? Apr 18, 2024 15:14

Shame Boy: Mar 2, 2010

Antigravitas posted:

Using a database client to interact with a database over the internet is one of those things that's probably fine, but it feels intuitively so, so wrong to me.

yeah i was gonna say, i can't immediately think of why this is bad but holy moly does it feel bad in my gut

# ? Apr 18, 2024 15:36

Truga: May 4, 2014; Lipstick Apathy

the exposed db is probably a readonly mirror of the real db, making it a non-issue

# ? Apr 18, 2024 15:55

Bonfire Lit: Jul 9, 2008; If you're one of the sinners who caused this please unfriend me now.

Jabor posted:

super meat boy did this for its custom level database

it turns out your intuition would have been entirely correct in that case

super meat boy also used hard-coded credentials with full access, which is somewhat worse than just exposing a db to the public

# ? Apr 18, 2024 16:01

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Truga posted:

the exposed db is probably a readonly mirror of the real db, making it a non-issue

I assume the issue isn't "whoops we can write something" but instead "whoops turns out DB servers aren't generally as battle hardened as web servers at this point, and exploits do get found that might allow a foothold and place to pivot via RCE"

# ? Apr 18, 2024 16:08

Kovacs: Jul 19, 2006

Shame Boy posted:

yeah i was gonna say, i can't immediately think of why this is bad but holy moly does it feel bad in my gut

It's even more fun periodically justifying it to the security team when they whinge about port 5432 being open. It's a public-good service, dammit.
It is read-only, too.

# ? Apr 18, 2024 16:36

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Pendragon posted:

was talking with our MSP. they have 750 palo altos and the majority of them have IoC log entries of some kind. they�re hoping that the entries are benign or researchers testing stuff and don�t actually indicate compromise.

hope is my favourite strategy

Captain Foo posted:

i am pointing strongly at the don�t touch the poop rule BUT

i am waiving it as the bugzilla is open to the public, technically

wayne is very clearly capable and acting in good faith as to the purpose of the bugzilla

nothing is being exploited (which is what traditionally has gotten threads iced)

i am running up a yellow flag for the rest of the thread and this is not an invitation or okay for everyone else to go hogge wilde

screw you, you�re not my dad. I�ll yell in bugzilla if I want to

# ? Apr 18, 2024 16:37

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

Subjunctive posted:

hope is my favourite strategy

screw you, you�re not my dad. I�ll yell in bugzilla if I want to

you know what I�m talking about

# ? Apr 18, 2024 16:39

Wiggly Wayne DDS: Sep 11, 2010

yeah as nice as the db is i can't use it to do what i really need, it's good for domain lookups but for extracting ocsp status and revocation time for a batch of 6k sha256 sums it's not any better despite storing all of that data in blobs per-cert. in theory i could reverse engineer the list with ca_id but it doesn't support issuer notbefore and notafter lookups

i've grabbed a crl and am looking to do some data analysis, but tying them back to certs is a headache (it's serial number, timestamp, reason). i can figure out their activity period and revocation capability but it's tying it back to a specific cert list is a nightmare

# ? Apr 18, 2024 16:42

The Fool: Oct 16, 2003

waiting with bated breath for the part 2 on amir's substack

# ? Apr 18, 2024 17:40

Sickening: Jul 16, 2007; Black summer was the best summer.

I wonder if all of these security researchers made it to palo alto's hall of fame? Its very prestigious. As a member of it myself, I was honored that they put my name on it and gave me absolutely nothing else considering the exploit i found for them was terrifying.

But they also didn't actually fix it and it showed up in the news months later. Oopsie doodle.

# ? Apr 18, 2024 17:45

Shame Boy: Mar 2, 2010

Truga posted:

the exposed db is probably a readonly mirror of the real db, making it a non-issue

still feels like an issue

# ? Apr 18, 2024 17:52

Wiggly Wayne DDS: Sep 11, 2010

Shame Boy posted:

still feels like an issue

eh not really

# ? Apr 18, 2024 17:58

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

skill issue, maybe

# ? Apr 18, 2024 18:43

Shame Boy: Mar 2, 2010

Wiggly Wayne DDS posted:

eh not really

like i know that if properly configured it shouldn't be an issue it just feels like an issue, idk

# ? Apr 18, 2024 18:47

The Fool: Oct 16, 2003

yeah, hard to get over the "don't expose the db to the internet" rhetoric that's been drilled into us for 20 years

# ? Apr 18, 2024 18:51

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

I dunno who�s fuzzing the Postgres protocol handler but I bet they aren�t using exactly the same config as you are

# ? Apr 18, 2024 19:03

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

also I don�t know how much Postgres likes having a ton of connection churn; proxysql is a hero to many for a reason

# ? Apr 18, 2024 19:05

uninterrupted: Jun 20, 2011

Subjunctive posted:

also I don�t know how much Postgres likes having a ton of connection churn; proxysql is a hero to many for a reason

pgbouncer is the only way we can keep Postgres usable

# ? Apr 18, 2024 19:08

Raymond T. Racing: Jun 11, 2019

idk how to do the fancy quote url stuff: https://bugzilla.mozilla.org/show_bug.cgi?id=1890898

quote:

"Our CDN statistics show that between March 22, 2024, 15:02 UTC and March 26, 2024, 17:07 UTC our CPS versions 3.18 and 3.19 were downloaded 30 times by desktop or mobile browsers, excluding Entrust networks.
- Of these 30 downloads we have been able to identify 10 downloads to specific subscribers.
- The downloads are divided over 9 unique IP addresses, one from a known subscriber, one from a known CA.
- The data likely includes downloads from Entrust employees which we have not been able to identify.
- The CPS covers the multiple certificate types we offer.
- This data indicates that the number of subscribers and relying parties that have seen this error is minimal."

Can you help me better understand this statement and how it relates to the principle expectation of a publicly-trusted CA adhering to its documented policies at all times? Also, can you share more about why this justification was offered?

One way of interpreting this statement is an attempt to justify and/or diminish non-compliance on the basis that very few people downloaded the CPS during the affected time period.

The underlying issue with this type of justification is that it appears to downplay the fundamental expectation that a CA must adhere to its stated policies and procedures at all times. The CA/Browser Forum Baseline Requirements and other related guidelines emphasize that compliance must be continuous and is not conditional on the extent to which documented policies are accessed by external parties.

Fundamentally, a statement claiming that a mistake did not result in significant harm does not diminish the significance of that mistake. The principle at stake is the integrity and trustworthiness of Entrust, which is expected to uphold its commitments irrespective of the level of direct oversight or detection by others in the ecosystem.

Additionally, as stated on https://www.ccadb.org/cas/incident-report, the Action Items section is supposed to contain a list of remediation items that will be undertaken to ensure that a similar incident does not reoccur in the future and that it is not sufficient for the actions to simply stop the incident in question. What actions will prevent this from happening again? Beyond that, �Transparency" is not one of the described Action categories listed on https://www.ccadb.org/cas/incident-report.

the argument is "well no one read the CPS that was wrong, so it's fine"??? this is a new low for me in the saga good lord

# ? Apr 18, 2024 21:12

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

quote:

code:

Flags: needinfo?(bruce.morton)

you got that right, bugzilla

# ? Apr 18, 2024 21:38

lament.cfg: Dec 28, 2006; we have such posts
to show you

A few weeks ago I had no idea the CA/Browser Forum existed and today I won�t be satiated until we bathe in Entrust�s blood. This thread rules.

# ? Apr 18, 2024 22:07

Adbot: ADBOT LOVES YOU

# ? Jun 8, 2024 12:14

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

someone at work today asked if we should join CA/BF because we do a lot of stuff with certs and why not, and I eventually became relatively sure that they aren�t Wayne

(no, we should not)

# ? Apr 18, 2024 22:21

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.51: who needs they entrussy revoked

«‹›973 »