Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›6 »

Wiggly Wayne DDS: Sep 11, 2010

OSI bean dip posted:

if you guys want me to put images or highlights from previous threads, just share them and i'll put them into the second post or some poo poo

all of it

# ¿ Apr 8, 2016 19:39

Adbot: ADBOT LOVES YOU

# ¿ May 22, 2024 06:42

Wiggly Wayne DDS: Sep 11, 2010

cheese-cube posted:

i'll buy this tag for the next 10 ppl who quote this post (might take me a couple of days to do so, ive just moved house and have no internet yet)

# ¿ Apr 9, 2016 19:01

Wiggly Wayne DDS: Sep 11, 2010

cheese-cube posted:

anyway, the following ppl should have baud dudes tags now. if not then let me know.

cool thanks

# ¿ Apr 10, 2016 01:18

Wiggly Wayne DDS: Sep 11, 2010

Let's Encrypt is leaving beta https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors.html

amongst their new sponsors is Gemalto:

quote:

�We�re very proud to be a Gold Sponsor for Let�s Encrypt which leverages our industry-leading hardware security modules to protect their certificate authority system,� says Todd Moore, Vice President of Encryption Product Management at Gemalto. �Encryption by default is critical to privacy and security, and by working with Let�s Encrypt Gemalto is helping to deliver trust for the digital services that billions of people use every day.�

someone make :gchq:

# ¿ Apr 12, 2016 17:05

Wiggly Wayne DDS: Sep 11, 2010

Subjunctive posted:

I thought, nay hoped, that they meant vice-presidents.

same

# ¿ Apr 12, 2016 17:55

Wiggly Wayne DDS: Sep 11, 2010

http://badlock.org/

The security vulnerabilities can be mostly categorised as man-in-the-middle or denial of service attacks.

Man-in-the-middle (MITM) attacks:
There are several MITM attacks that can be performed against a variety of protocols used by Samba. These would permit execution of arbitrary Samba network calls using the context of the intercepted user.

Impact examples of intercepting administrator network traffic:
Samba AD server - view or modify secrets within an AD database, including user password hashes, or shutdown critical services.
standard Samba server - modify user permissions on files or directories.

Denial-of-Service (DoS) attacks:
Samba services are vulnerable to a denial of service from an attacker with remote network connectivity to the Samba service.

booooooooooooooooooring

# ¿ Apr 12, 2016 18:02

Wiggly Wayne DDS: Sep 11, 2010

BangersInMyKnickers posted:

so you could spoof a DC and use that to get a root payload on a client system enrolled in the domain probably

https://technet.microsoft.com/en-us/library/security/ms16-047

quote:

Windows SAM and LSAD Downgrade Vulnerability- CVE-2016-0128

An elevation of privilege vulnerability exists in the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote protocols when they accept authentication levels that do not protect them adequately. The vulnerability is caused by the way the SAM and LSAD remote protocols establish the Remote Procedure Call (RPC) channel. An attacker who successfully exploited this vulnerability could gain access to the SAM database.

To exploit the vulnerability, an attacker could launch a man-in-the-middle (MiTM) attack, force a downgrade of the authentication level of the SAM and LSAD channels, and then impersonate an authenticated user. The security update addresses the vulnerability by modifying how the SAM and LSAD remote protocols handle authentication levels.

# ¿ Apr 12, 2016 18:11

Wiggly Wayne DDS: Sep 11, 2010

Number19 posted:

oh hey, we should look at the rest of the MS security bulletins because loving lol:

https://technet.microsoft.com/library/security/MS16-045

or point at more relevant samba vulns patched the same day

i'll start: https://access.redhat.com/security/cve/CVE-2015-5370

quote:

Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC).

# ¿ Apr 12, 2016 18:53

Wiggly Wayne DDS: Sep 11, 2010

Migishu posted:

So, this was linked to me earlier:

https://news.vice.com/article/exclusive-canada-police-obtained-blackberrys-global-decryption-key-how

enough about your theoretical vulnerabilities

# ¿ Apr 14, 2016 17:00

Wiggly Wayne DDS: Sep 11, 2010

if the HMRC's site gets breached a password hash is the least of your worries

android security annual report is out: https://security.googleblog.com/2016/04/android-security-2015-annual-report.html

# ¿ Apr 19, 2016 18:40

Wiggly Wayne DDS: Sep 11, 2010

goddamnedtwisto posted:

what's the reason for hating lastpass again? is it the general "trusting a third party with all your logins" thing or is there something specifically bad about lastpass?

breaches and vulnerabilities over years with no sign of change (up to dismissing public third party audits)

# ¿ Apr 21, 2016 19:13

Wiggly Wayne DDS: Sep 11, 2010

anthonypants posted:

also they're owned by logmein now, the company that bought hamachi back in the day

i forgot about that particular cherry

# ¿ Apr 21, 2016 19:20

Wiggly Wayne DDS: Sep 11, 2010

Thermopyle posted:

like i said, its more that I'm just too used to the lastpass way...which lets me select the sites credentials via mouse right on the form input, or it automatically fills the input as soon as the site loads

1password does this

# ¿ Apr 22, 2016 18:33

Wiggly Wayne DDS: Sep 11, 2010

prefect posted:

i bought 1password because people in here recommended it, and i'm not even close to used to it after one whole day. (also it doesn't import from password safe, so this will be a migration that never, ever fully ends)

tip for anyone interested: the 1password account vault-syncing thing doesn't work with windows before 10

you export as csv and import as csv (you can define the fields as well)

# ¿ Apr 22, 2016 19:50

Wiggly Wayne DDS: Sep 11, 2010

anthonypants posted:

rip applocker http://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html

...does anyone actually use applocker

microsoft still insisting that applocker isn't a security boundary (do they have any officially at this point?)

# ¿ Apr 22, 2016 23:19

Wiggly Wayne DDS: Sep 11, 2010

Subjunctive posted:

are there apps that will stream off a NAS or whatever? my upstream can probably handle that

plex/emby/etc

depends on the videos you watch though, plex hates anything that's more than a few hours long and badly encoded - emby will work with whatever it can.

resume ability is nice, but the security options of each are Lacking so segregate and have backups

# ¿ Apr 26, 2016 09:06

Wiggly Wayne DDS: Sep 11, 2010

Ghost Farts posted:

i think every synology nas can do that through synology's apps for android or ios. i'm not sure about synology's security track record though

i've only saw and heard bad things about synology, doesn't stop everyone recommending them though

# ¿ Apr 26, 2016 18:06

Wiggly Wayne DDS: Sep 11, 2010

i am strictly talking about security atm though, not extra features consumers nitpick over

# ¿ Apr 26, 2016 18:18

Wiggly Wayne DDS: Sep 11, 2010

jony ive aces posted:

extra features irrelevant consumer anklebiters nitpick over like being able to actually recover your data

lysidas' post wasn't up when i posted, just remember synolocker existed

goddamnedtwisto posted:

i'm sure i've heard the name chris vickery before, isn't he the guy who just scans for open mongodb instances? also lol at "oh it was just a test server", because apparently that makes it okay

yeah security research at mackeeper: http://www.bbc.com/news/technology-36128745

# ¿ Apr 26, 2016 18:33

Wiggly Wayne DDS: Sep 11, 2010

regarding apple's 1970 bug here's some ntpd vulnerabilities that could be used

http://blog.talosintel.com/2016/04/vulnerability-spotlight-further-ntpd_27.html

# ¿ Apr 27, 2016 21:23

Wiggly Wayne DDS: Sep 11, 2010

Dessert Rose posted:

guess what, sometimes your crypto really does need to be as physically secure as possible, because people can die if someone fucks up. it's not all just "lol time to change some passwords and get a year of identity protection"

we've been saying that for years but nadim still persists

# ¿ Apr 28, 2016 20:19

Wiggly Wayne DDS: Sep 11, 2010

pr0zac posted:

wait

are we talking about eve online now?

they are one and the same

# ¿ Apr 28, 2016 20:36

Wiggly Wayne DDS: Sep 11, 2010

for certain quantities of knowledge

# ¿ May 1, 2016 22:19

Wiggly Wayne DDS: Sep 11, 2010

Tayter Swift posted:

current security status: password must be between 8 and 12 characters long and must contain a special character

the only special character allowed is an exclamation mark

saw a new one - uppercase letter every 8th character

# ¿ May 2, 2016 15:28

Wiggly Wayne DDS: Sep 11, 2010

https://medium.com/@rhuber/imagemagick-is-on-fire-cve-2016-3714-379faf762247

quote:

There are multiple vulnerabilities in ImageMagick, a package commonly used by web services to process images. One of the vulnerabilities can lead to remote code execution (RCE) if you process user submitted images. The exploit for this vulnerability is being used in the wild.

# ¿ May 3, 2016 18:05

Wiggly Wayne DDS: Sep 11, 2010

i've never seen anyone competent from that office

# ¿ May 4, 2016 17:54

Wiggly Wayne DDS: Sep 11, 2010

Parallel Paraplegic posted:

at least it's using SSL when it wgets a kernel module and insmod's it without checking anything about what it is

lol j/k it's using tftp

sure, here: https://patrick.codes/stuff/shd

that guy is run with no arguments at the end of the rcS script (right after a thankfully commented-out call to telnet ). looks like the rest of the os is just some stock thing Atheros threw together to run on their little embedded chipset, except for some calibration and test tools that look like they're for the HS110 (which also monitors how much power the device is using - i have one but I haven't taken it apart yet) and "public.key" which looks like some kind of SSL key but openssl couldn't figure it out.

looks like it's just verifying the firmware's signed properly:
.globl rsaVerifySignByBase64EncodePublicKeyBlob
is called by checkFirmware twice, and it'll yell about the firmware RSA sig being ok. i see 4 possible keys near the checks

# ¿ May 12, 2016 18:31

Wiggly Wayne DDS: Sep 11, 2010

Wiggly Wayne DDS posted:

looks like it's just verifying the firmware's signed properly:
.globl rsaVerifySignByBase64EncodePublicKeyBlob
is called by checkFirmware twice, and it'll yell about the firmware RSA sig being ok. i see 4 possible keys near the checks

adding onto this the aes stuff seems to just be openssl used by the web server they have and some cloud management feature - cert in /etc/2048_newroot.cer

binary seems to control just about everything -dhcp client/server, gpio, wlan, firmware (download, verify, flash), "fake_httpd" (throw out headers then shut up), ntp, etc. not surprised there's 20 versions running given how often it forks.

# ¿ May 12, 2016 19:04

Wiggly Wayne DDS: Sep 11, 2010

they've just deployed their patent-pending cryptanalysis-resistant trade secret algorithm on their web server surely

# ¿ May 13, 2016 15:45

Wiggly Wayne DDS: Sep 11, 2010

atomicthumbs posted:

i had to temporarily set selinux to permissive mode to install my php-based portfolio cms because ????

selinux was just trying to protect you

# ¿ May 13, 2016 19:50

Wiggly Wayne DDS: Sep 11, 2010

Malloc Voidstar posted:

http://www.morbo.org/2016/05/technical-debt-episode-1.html

quote:

Should all of this have failed, it will make a last ditch effort to fork/exec "netstat -ni" and hash the output of that.

# ¿ May 21, 2016 00:22

Wiggly Wayne DDS: Sep 11, 2010

http://ieee-security.org/TC/SP2016/papers/0824a018.pdf
A2: Analog Malicious Hardware

quote:

Abstract�While the move to smaller transistors has been a boon for performance it has dramatically increased the cost to fabricate chips using those smaller transistors. This forces the vast majority of chip design companies to trust a third party � often overseas � to fabricate their design. To guard against shipping chips with errors (intentional or otherwise) chip design
companies rely on post-fabrication testing. Unfortunately, this type of testing leaves the door open to malicious modifications
since attackers can craft attack triggers requiring a sequence of unlikely events, which will never be encountered by even
the most diligent tester.

In this paper, we show how a fabrication-time attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate) and stealthy (i.e., requires an unlikely trigger sequence before effecting a chip�s functionality). In the open spaces of an already placed and routed design, we construct a circuit that uses capacitors to siphon charge from nearby wires as they transition between digital values. When the capacitors fully charge, they deploy
an attack that forces a victim flip-flop to a desired value. We weaponize this attack into a remotely-controllable privilege escalation by attaching the capacitor to a wire controllable and by selecting a victim flip-flop that holds the privilege bit
for our processor. We implement this attack in an OR1200 processor and fabricate a chip. Experimental results show that our attacks work, show that our attacks elude activation by a diverse set of benchmarks, and suggest that our attacks evade known defenses.

http://www.cs.vu.nl//~kaveh/pubs/pdf/dedup-sp16.pdf
Dedup Est Machina: Memory Deduplication as an Advanced Exploitation Vector

quote:

Abstract�Memory deduplication, a well-known technique to reduce the memory footprint across virtual machines, is now also a default-on feature inside the Windows 8.1 and Windows 10 operating systems. Deduplication maps multiple identical copies of a physical page onto a single shared copy with copy-on-write semantics. As a result, a write to such a shared page triggers a page fault and is thus measurably slower than a write to a normal page. Prior work has shown that an attacker able to craft pages on the target system can use this timing difference as a simple single-bit side channel to discover that certain pages exist in the system.

In this paper, we demonstrate that the deduplication side channel is much more powerful than previously assumed, potentially providing an attacker with a weird machine to read arbitrary data in the system. We first show that an attacker controlling the alignment and reuse of data in memory is able to perform byte-by-byte disclosure of sensitive data (such as randomized 64 bit pointers). Next, even without control over data alignment or reuse, we show that an attacker can still disclose high-entropy randomized pointers using a birthday attack. To show these primitives are practical, we present an end-to-end JavaScript-based attack against the new Microsoft Edge browser, in absence of software bugs and with all defenses turned on. Our attack combines our deduplication-based primitives with a reliable Rowhammer exploit to gain arbitrary memory read and write access in the browser.

We conclude by extending our JavaScript-based attack to cross-process system-wide exploitation (using the popular nginx web server as an example) and discussing mitigation strategies.

# ¿ May 25, 2016 19:36

Wiggly Wayne DDS: Sep 11, 2010

Sharktopus posted:

wow 3 pages of real garbage

thanks dudes

agreed

Truga posted:

post some content then

have some security content:

Wiggly Wayne DDS posted:

http://ieee-security.org/TC/SP2016/papers/0824a018.pdf
A2: Analog Malicious Hardware

http://www.cs.vu.nl//~kaveh/pubs/pdf/dedup-sp16.pdf
Dedup Est Machina: Memory Deduplication as an Advanced Exploitation Vector

# ¿ May 26, 2016 12:04

Wiggly Wayne DDS: Sep 11, 2010

Parallel Paraplegic posted:

pci is mandating that we all install AV's, so what hilarious things has Avast! done that I can laugh at with the IT guy

https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=avast

# ¿ May 26, 2016 20:43

Wiggly Wayne DDS: Sep 11, 2010

Cocoa Crispies posted:

lol that's a really loving unethical way to validate a password dump

given the limited number of checked accounts they could very well have had permission from the users

# ¿ May 27, 2016 21:03

Wiggly Wayne DDS: Sep 11, 2010

whole lot of non-fuckup chat itt that could use its own thread

# ¿ Jun 1, 2016 17:41

Wiggly Wayne DDS: Sep 11, 2010

count_von_count posted:

Is there a good overview of the current vulnerabilities in TeamViewer? Asking for a friend.

funny you should ask there's rumours going about of a big fuckup happening there

# ¿ Jun 1, 2016 18:15

Wiggly Wayne DDS: Sep 11, 2010

more importantly who's the neighbour in essex who just happened to have that machine

# ¿ Jun 1, 2016 19:53

Wiggly Wayne DDS: Sep 11, 2010

Thanks Ants posted:

so is this teamviewer-using malware linked to the service being offline or are these separate issues

their pr have been linking people trying to confirm problems with a statement from may 23rd, and ignoring alleged 2fa users being affected so expect stories to go up shortly and the pr team to get a talking to

# ¿ Jun 1, 2016 20:42

Adbot: ADBOT LOVES YOU

# ¿ May 22, 2024 06:42

Wiggly Wayne DDS: Sep 11, 2010

Volmarias posted:

Look into this thread, and listen to what your heart tells you.

then look at the other it threads to remind yourself how isolated security is

# ¿ Jun 3, 2016 13:49

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

«‹›6 »