The Infosec Thread: Yes, time to move off Entrust

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›7 »

evil_bunnY: Apr 2, 2003

orange sky posted:

Well, class actions can still gently caress the company's bottom line

(and result in downsizing on the lower positions, loving the poors again)

Equifax CEO just got the boot. He's gonna get a bunch of money for loving up im sure, but i bet he would have preferred to stay. CIO left a while ago.

Of course now lobbyists will make sure class actions can never amount to anything.

# ¿ Sep 27, 2017 16:25

Adbot: ADBOT LOVES YOU

# ¿ May 22, 2024 11:15

evil_bunnY: Apr 2, 2003

Avenging_Mikon posted:

Will? Isn't there literally a bill in the House that says "Class action can't do poo poo all" right now?

That's what I meant yes

# ¿ Sep 27, 2017 16:47

evil_bunnY: Apr 2, 2003

Yeah smaller outfits just don't have the mind of resources for the constant audits/fixes you need either.

# ¿ Sep 29, 2017 19:45

evil_bunnY: Apr 2, 2003

None of the banks here even offer anything but 2FA for their websites. You can log onto the app with a code + print tho.

# ¿ Sep 30, 2017 12:53

evil_bunnY: Apr 2, 2003

Pablo Bluth posted:

So rogue SMB servers can bypass Windows Defender by feeding a different clean file to Defender before delivering the real payload for running, and MS consider fixing this a "feature request". I can't claim to be an expert in the field, but making sure sure you're scanning a copy of what's actually going to be run/opened seems like a key step.

Hahaha that's amazing

# ¿ Oct 1, 2017 21:37

evil_bunnY: Apr 2, 2003

CLAM DOWN posted:

https://googleprojectzero.blogspot.ca/2017/10/over-air-vol-2-pt-3-exploiting-wi-fi.html

Some truly nutty peeps there.

hobbesmaster posted:

There�s an enormous number of IoT radio modules that only support 1.1 and will probably not ever get upgraded in the field.

There's a reason it's called the internet of poo poo. All those lovely loving devices are just 6mo of security research away from being massive liabilities.

# ¿ Oct 11, 2017 18:19

evil_bunnY: Apr 2, 2003

Portland Sucks posted:

Unfortunately our IT gets pushed around like a bunch of chumps because "LOL NOT OPS" and really only have authority over the employee work stations and finance systems at this point. We have two independent networks because our production engineers staged a coup years back since IT wouldn't give them admin privs on the prod servers so they figured it'd just be easier to own their own network. Odds are if their formal notice to IT doesn't work they'll just fine a way to have the affected computers moved to the unsecured hacked together production network or else they'll just RFI new servers for it and move their lovely VB scripts on to those. I love this guys.

surprise! it's a management problem

Fluue posted:

I plan on drilling that into them. They don't seem to be aware of the breadth of that hack. There's a lot of post- credit pull verification that goes on that involves the user providing more information that's harder to fake, but by that point they already have a credit pull on their record. Not sure what the implications are for the business if they get a credit pull disputed.

Just pull the marketing people's PII from one of the gazillion public sources. That'll get their little hearts racing.

Powered Descent posted:

https://twitter.com/SwiftOnSecurity/status/922856687987552256

incumbent telcos are the loving worst

evil_bunnY fucked around with this message at 15:36 on Oct 25, 2017

# ¿ Oct 25, 2017 15:33

evil_bunnY: Apr 2, 2003

my bitter bi rival posted:

I need a beer.

You need a good AD consultant.

# ¿ Nov 2, 2017 20:03

evil_bunnY: Apr 2, 2003

doctorfrog posted:

Like, is this a new gilded age of corporate/rich person impunity, or am I just getting more to the age where I notice it more and my bile just rises faster?

It's long been like this/worse, some people are finally noticing simply by virtue of information being easier to disseminate. This also means truthers, birthers, etc also get more of an audience, unfortunately.

# ¿ Nov 22, 2017 11:21

evil_bunnY: Apr 2, 2003

CLAM DOWN posted:

This industry is loving toxic.

What makes you think it�s different elsewhere? It�s lovely for women everyfuckingwhere.

# ¿ Dec 30, 2017 12:17

evil_bunnY: Apr 2, 2003

CLAM DOWN posted:

I told my boss all about this and he laughed and went home.

Perfectly reasonable reaction.

# ¿ Jan 4, 2018 10:29

evil_bunnY: Apr 2, 2003

A parody macho man account with legit secfuck content would be p amazing

# ¿ Jan 19, 2018 18:20

evil_bunnY: Apr 2, 2003

hobbesmaster posted:

Who is delivering pizza to FOBs in Afghanistan?

Or CIA black sites. Or Chinese artificial island airfields.

# ¿ Jan 29, 2018 12:05

evil_bunnY: Apr 2, 2003

Thermopyle posted:

I'm not sure if I do or don't agree with you here.

Is it not possible for a vendor to accidentally leave most operating systems in an insecure state on their devices?

That's the #1 issue with android: OEMs have no loving clue what they're doing, and after a couple years no incentive to fix anything at all.

# ¿ Feb 13, 2018 22:20

evil_bunnY: Apr 2, 2003

you wanna bet the server component doesnt input-sanitize the info from the client DRM?

# ¿ Feb 19, 2018 16:57

evil_bunnY: Apr 2, 2003

Jabor posted:

Peep the penalties for non-compliance too. 4% of global turnover (or 20 million euros, if that's a bigger number) if you don't get free and informed consent before doing something.

That�s the kind of penalty they�ll only dish out to egregious/repeat offenders, but yeah gdpr�s got Teeth now.

# ¿ Feb 22, 2018 13:37

evil_bunnY: Apr 2, 2003

andrew smash posted:

I keep urls stored in the url field in the relevant keepass database entry and tell keepass to �open in browser�. Am I owning myself?

No. I think it�s better because it protects you from typos.

# ¿ Feb 23, 2018 15:34

evil_bunnY: Apr 2, 2003

Internet Explorer posted:

gently caress you, Equifax execs.

Senior ex-Equifax executive charged with insider trading
CIO allegedly sold $1 million worth of stock 10 days before public learned of breach.

And they're more likely to suffer repercussions from that than the actual leak.

# ¿ Mar 14, 2018 22:40

evil_bunnY: Apr 2, 2003

Maneki Neko posted:

What we find is that the people crafting the RFP just tailor it so their preferred vendor is the only one who can win anyway.

It�s a thin line between writing the rfp to a supplier�s benefit and writing one where you want the outcome to not be challenged once the select the offer that�s obviously the best matches to your requirements.

# ¿ Mar 16, 2018 22:48

evil_bunnY: Apr 2, 2003

Avenging_Mikon posted:

In this day and age, is there a meaningful separation of opsec and infosec?

There is for tradecraft/wetwork. So, not for normies.

Then there's physical security.

# ¿ Mar 20, 2018 20:52

evil_bunnY: Apr 2, 2003

CLAM DOWN posted:

https://blog.frizk.net/2018/03/total-meltdown.html

That�s a 500 IQ secfuck holy poo poo

# ¿ Mar 28, 2018 13:51

evil_bunnY: Apr 2, 2003

https://twitter.com/theregister/status/979472597157949440?s=21

# ¿ Mar 29, 2018 22:54

evil_bunnY: Apr 2, 2003

You make them hire your one-man firm.

# ¿ Apr 3, 2018 11:17

evil_bunnY: Apr 2, 2003

ohgodwhat posted:

Uh in the staging environment?

How's that related?

# ¿ Apr 3, 2018 12:56

evil_bunnY: Apr 2, 2003

FlyingCowOfDoom posted:

I'm trying to understand why they would keep employee records in a test environment, why the gently caress do you not have those locked down? What testing was being done that needed that info?

You think a company with infosec that horrible didn't just clone the live dataset?

# ¿ Apr 3, 2018 22:25

evil_bunnY: Apr 2, 2003

Dadbod Apocalypse posted:

I remember some medical software company got busted a year ago or so for going on the road to demonstrate its software in public, pulling up patient records and poo poo. Using a hospital's actual patient database. Which was live. And the hospital had no idea the vendor was doing this.

I'm not surprised in the slightest.

# ¿ Apr 4, 2018 12:39

evil_bunnY: Apr 2, 2003

BangersInMyKnickers posted:

large sections of our phone network died a few weeks back because NTP stopped working and enough phones and PBXs clock drifted that they wouldn't talk to each other

# ¿ May 9, 2018 21:47

evil_bunnY: Apr 2, 2003

My dumbass take is that's it's a very real concern for people facing adversarial third parties, but it's not like they've opened pandora's chest.

# ¿ May 14, 2018 13:16

evil_bunnY: Apr 2, 2003

Subjunctive posted:

Benign 3rd parties have never really been much of a problem in security.

Hahahaha oh god

# ¿ May 14, 2018 14:12

evil_bunnY: Apr 2, 2003

Beccara posted:

LocalSystem level access on a PDC

lol no

# ¿ May 25, 2018 22:06

evil_bunnY: Apr 2, 2003

IIRC A factory reset kills the runtime, and after they seized the c2 domain the bootlader can�t grab the runtime and fails silently to normal operation. The problem is of course that none of these POS devices have any kind of security updates process, so they�re effectively just waiting for the next exploit to come along.

# ¿ Jun 1, 2018 15:34

evil_bunnY: Apr 2, 2003

Furism posted:

Well, yeah, privacy matters and mass-collecting DNA by anyone Doesn't Sound Good and people probably shouldn't do it. My point was just that being Jewish or not is irrelevant in this context.

Dude you're being daft AF

# ¿ Jun 8, 2018 21:34

evil_bunnY: Apr 2, 2003

Even the very latest Ubuntu has an smb client that doesn�t auto negotiate to v2.

# ¿ Jun 9, 2018 16:26

evil_bunnY: Apr 2, 2003

We mount our shared storage by specifying vers=2 but yeah it�s just dumb that it can�t auto negotiate up if it can do v2

# ¿ Jun 9, 2018 16:49

evil_bunnY: Apr 2, 2003

Absurd Alhazred posted:

Even the Wild Wild Midwest must have some kind of privacy laws.

lmao

# ¿ Jun 15, 2018 14:47

evil_bunnY: Apr 2, 2003

BangersInMyKnickers posted:

The ops people don't want to lose visibility, but the vast majority of those are coming from garbage ISPs full of crap that nobody cares about.

If the ops children to justify logging that garbage for visibility maybe they'd like to propose some rules that make use of their precious insight.

# ¿ Jun 28, 2018 21:09

evil_bunnY: Apr 2, 2003

cheese-cube posted:

Turns out Strava wasn't the only opsec disaster app out there: https://www.bellingcat.com/resources/articles/2018/07/08/strava-polar-revealing-homes-soldiers-spies/

This was painfully obvious to everyone with 2 brain cells when the strava thing hit. It was an opsec issue, not a strava one.

# ¿ Jul 8, 2018 14:37

evil_bunnY: Apr 2, 2003

cheese-cube posted:

Yeah well why didn't you take your two brain cells and write a detailed research piece about it instead of posting in retrospect like a lovely Nostradamus. Also I never said it wasn't an opsec issue?

A bunch of people smarter than both of us did exactly this after the strava thing. Also please calm down.

# ¿ Jul 8, 2018 16:06

evil_bunnY: Apr 2, 2003

The Fool posted:

If keeping your location secret is a part of your job, then maybe don't use services whose entire purpose is to share your location.

calm down nostradamus

# ¿ Jul 8, 2018 22:33

Adbot: ADBOT LOVES YOU

# ¿ May 22, 2024 11:15

evil_bunnY: Apr 2, 2003

Thanks Ants posted:

Just seems sensible to not make all runs public by default, and to not link all 'anonymous' exercises up to each other.

Can't sell the data to munis if you do that. Also can't have growth-inducing social features. TELL YER FWIENDS

# ¿ Jul 9, 2018 10:41

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›7 »