The Infosec Thread: Yes, time to move off LastPass

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off LastPass

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

OSI bean dip posted:

Any basic understanding of prime numbers would be enough to not let you wonder about why these are the largest pairs. I am not going to explain what is wrong in this code because if you're asking this then you shouldn't dare think about writing such.

Second of all, anything derived from TrueCrypt should not be trusted.

Can you explain the mathematics for the first bit for everyone else who's interested in understanding why?

As for Truecrypt forks, if we're going to apply that level of paranoia consistently, what can we use? We can't do public code reviews on commercial, closed source FDE tools like Bitlocker and PGP. We can't rule out government intereference in Truecrypt, nor can we rule it out with commercial offerings (MS removed the Elephant diffuser from Bitlocker :tinfoil:

), or undisclosed vulnerabilities that malicous actors are also exploiting etc etc

Mr Chips fucked around with this message at 13:51 on Nov 24, 2015

# ¿ Nov 24, 2015 11:35

Adbot: ADBOT LOVES YOU

# ¿ Apr 27, 2024 17:30

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

OSI bean dip posted:

. Unless you work for FireEye/Mandiant, you have no loving business using that term.

If no-one ITT works for them, can we stop talking about it?

# ¿ Dec 18, 2015 03:32

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

elite_garbage_man posted:

I know this was posted a while ago, but I hope it helps.

cheers, thanks for answering that question (and the others who did)

# ¿ Dec 18, 2015 05:41

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

what's the path to better kernel security look like if I'm heavily RHEL6-ified (including SELinux)? Is getting grsec into the mix feasible?

Mr Chips fucked around with this message at 12:31 on Jan 20, 2016

# ¿ Jan 20, 2016 12:24

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

I'm having an annoying argument with our central IT infosec team at the moment over whether Windows client machine AV is even worth the hassle/expense. We (big public sector org) keep getting hit by web and email based malware that the AV does nothing for, yet they insist it's critical for endpoint protection.

# ¿ May 2, 2016 03:17

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

dpbjinc posted:

You know, most organizations I see constantly have prompts to update Acrobat Reader and Java and whatever. You can argue about antivirus all you want, but regardless, it's not the most important step in security.

At least my section is all over this - patches are up to date, Applocker/SRPs have stoped a bunch of drive-bys, Flash is the one you get in Chrome or nothing at all, that one enterprise Java 6 app is published via RDS, etc etc

# ¿ May 2, 2016 04:20

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Is there anything more recent than Ormandy's 2012 stuff on Sophos being poo poo? Central IT at my workplace has a 'policy' that it has to be installed on all machines (including RHEL machines) and having it sitting there taking up 200+ Mbytes x 2000 VMs seems like a waste of resources.

# ¿ May 3, 2016 01:42

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Cugel the Clever posted:

How serious is this?

Noice.
Generally speaking, is it a reasonable assumption that other AV software is likely to have similar design and implementation flaws? Do other vendors do dumb poo poo like run things at ring0 that shouldn't be running there?

# ¿ May 18, 2016 01:55

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Cugel the Clever posted:

An honest, if inflammatory question: Does Classic Shell have legitimate use scenarios beyond autists obstinately refusing to adopt modern UI?

For Windows 8.1 users, having a start menu that doesn't take up the entire screen has a certain appeal

# ¿ Aug 3, 2016 23:12

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Cugel the Clever posted:

That's for Windows 8 users. 8.1 brought back a sane option a little more than a year later (maybe you need to toggle it in the options?).

Did they actually ship that? I remember some news articles in 2014 about how they were going to ship it, but don't have any 8.1 installs to look at any more.

# ¿ Aug 4, 2016 05:31

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Hughlander posted:

Rbl applied by mac family at the router level. "Dyn is under DNS 3com can access it, cheap Chinese up camera can't."

How will this cope with spoofed MAC addresses?

Mr Chips fucked around with this message at 00:54 on Oct 24, 2016

# ¿ Oct 24, 2016 00:38

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Hughlander posted:

Are the IOT devices on the bot net spoofing mac addresses while getting dhcp from the router? Haven't seen that in the reports...

If you're got root level access on a linux based device it shouldn't be hard (unless the device has been hardened to the point it wouldn't get compromised easily). I have NFI what most of this "IOT" smart lightbulb type crap runs, however.

# ¿ Oct 24, 2016 01:59

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

apropos man posted:

I noticed that ebay have disabled copy and paste in the browser

Have they? I was just able to log into ebay by pasting the password, with Chrome on Win10x64

edit: it seems that ublock origin is blocking the .js Ebay use in this case

Mr Chips fucked around with this message at 09:30 on Feb 25, 2017

# ¿ Feb 25, 2017 09:27

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

It should be possible to knock up a quick powershell script to read the contents of a PST mounted in Outlook (there's a bunch of API classes and methods documented on MSDN for this sort of thing), but if it was me doing it I'd have to second the suggestion of using libpst+readpst

Mr Chips fucked around with this message at 11:10 on Mar 18, 2017

# ¿ Mar 18, 2017 03:33

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

EVIL Gibson posted:

So that Intel bug was worse.

It's the AMT implementation which allows you to remotely log into Intel servers remotely. As an admin you could log in and do adminly things after putting in your password, which would be hashed, and then authenticate you

Turns out any password works! Not only will any password work, but no password is perfectly okay as well!

it's not quite like that, if you try manually logging into the admin account via the web interface with no password you won't get anywhere. You actually need to fiddle with the HTTP a bit, there's a synopsis from the guy who found it here: https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf

# ¿ May 7, 2017 05:54

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Cylance is a load of bollocks, isn't it? The information I can get about it is horribly vague, but couple of our assistant directors are carrying on like it's a silver bullet for windows client security after going to a Dell pissup.

# ¿ Jul 10, 2017 05:04

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Cup Runneth Over posted:

What's Upguard?

UpGuard is the first cyber resilience platform designed to reduce risk of outages and breaches by managing configurations, IT processes, and vendor risk.

# ¿ Aug 20, 2017 15:26

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Gotta be a honeypot, right?

# ¿ Sep 30, 2017 08:02

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

wolrah posted:

i5s are not safe.

"6th, 7th & 8th Generation Intel� Core� Processor Family"

That means any i3, i5, i7, or i9 with a 6xxx through 8xxx model code.

Also the older ones aren't necessarily safe, they're just using a different version of the ME hardware and software which hasn't been looked at as deeply because IIRC it can be fully neutered.

Dell are listing things going back to Ivy bridge CPUs as affected and due to receive updates: http://www.dell.com/support/article/us/en/19/sln308237/dell-client-statement-on-intel-me-txe-advisory--intel-sa-00086-?lang=en

It's not yet clear if those older Dell updates address the ME CVEs, or the TXE CVEs, that were included in this disclosure.

Edit: apparently Intel Manageability Engine Firmware 8.x/9.x/10.x were also affected by these CVEs, but:
"The two CVE IDs above were also resolved in earlier generations of corporate versions of Intel ME, where Intel� Active Management Technology shares the same code base. "

As in, this isn't the first time Intel have fixed this particular ME vulnerability. FFS.

Mr Chips fucked around with this message at 05:16 on Nov 23, 2017

# ¿ Nov 23, 2017 04:59

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Proteus Jones posted:

It's like Intel didn't learn a thing from the FDIV PR disaster.

Even if they did, it was a generation ago now, and they've probably unlearned it all.

# ¿ Jan 24, 2018 01:47

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

All this spectre/meltdown stuff, what's the actual risk to the kind of end-user who only uses their unpatched device for loving around on social media? A malicious JS somehow runs for days and eventually pulls a cached password out of memory?

# ¿ Jan 27, 2018 02:54

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Cheers. For this hypothetical home user, how important is a microcode update if the OS and browser are patched?

# ¿ Jan 27, 2018 03:15

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Speaking of KeepAss, is it reasonable to assume that the Argon2 key derivation function provides some protection against brute-force attacks?

# ¿ Feb 26, 2018 12:23

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

orange sky posted:

This fuckin picture

https://twitter.com/BoozAllenCyber/status/978632885438689280?s=19

I hope they choose their security algorithms better than their image scaling ones.

# ¿ Apr 4, 2018 02:52

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

It's all well and good to :goonsay:

that religion isn't genetic, but Judaism was under the Nuremburg laws. Nuns and priests were gassed because they had grandparents who ticked Jew on a census decades earlier.

# ¿ Jun 8, 2018 02:15

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Apart from the low level attack the original researchers used, has anyone come up with an easy way to test from Windows to see if any drive's TCG Opal implementation is broken?

# ¿ Nov 8, 2018 00:49

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Edit2:

The Fool posted:

You're too fast, see my edit.

New question edit:
https://imgur.com/a/19ToXVb

If a Samsung Evo 850 can be configured with the ATA Master Password Capability set to Max, it's apparently not vulnerable to the attack methods the researchers use. Is setting that value a BIOS/UEFI config item? RTFMing at the moment but it will take me some time

Mr Chips fucked around with this message at 04:04 on Nov 8, 2018

# ¿ Nov 8, 2018 00:56

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

D. Ebdrup posted:

The real question is whether you pronounce it X or 10.

Mac OS X ten point twelve

# ¿ Apr 18, 2020 15:59

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

beuges posted:

When I first sent them a query about it, I got this:

So I asked what security benefit was gained by disabling ctrl+a, and I got this:

I suspect whatever they're doing to make the magical eye icon work broke ctrl+a somehow and when the dev couldn't fix it they said it was intentional because it's a security feature and nobody bothered to question it so now it's wont-fix by-design instead.

did they also disable shift+end and double clicking in the password field?

# ¿ Apr 24, 2020 07:21

Adbot: ADBOT LOVES YOU

# ¿ Apr 27, 2024 17:30

Mr Chips: Jun 27, 2007; Whose arse do I have to blow smoke up to get rid of this baby?

Absurd Alhazred posted:

Discovery of a cosmic side-channel corruption attack:

https://twitter.com/FiloSottile/status/1411583960115814401

is only they'd been using a blockchain

# ¿ Jul 5, 2021 02:38

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off LastPass