Security Fuckup Megathread - v13.69 - plugins may violate privacy

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

Workaday Wizard: Oct 23, 2009; by Pragmatica

swiftonsecurity is 99% noise

# ¿ Jan 5, 2017 18:57

Adbot: ADBOT LOVES YOU

# ¿ May 5, 2024 21:01

Workaday Wizard: Oct 23, 2009; by Pragmatica

Wiggly Wayne DDS posted:

i change who's on my list frequently (usually if something big happens), and kick off people who are just noise but this has done me well so far: https://twitter.com/zylche/lists/security

mostly i just look there for what's happening and if there's any big news my bigger follow list will have something to say/retweet someone of value

link doesn't work

# ¿ Jan 5, 2017 20:16

Workaday Wizard: Oct 23, 2009; by Pragmatica

i don't know any company that backs up workstations lol

# ¿ Jan 11, 2017 13:25

Workaday Wizard: Oct 23, 2009; by Pragmatica

Subjunctive posted:

nothing of value should be lost if a workstation is blown away

how much disk quota do your employees have on the file server?

e: not defending saving files locally btw

# ¿ Jan 11, 2017 15:33

Workaday Wizard: Oct 23, 2009; by Pragmatica

*that mcrib is back comic but with secfuck is back instead*

# ¿ Jan 16, 2017 22:21

Workaday Wizard: Oct 23, 2009; by Pragmatica

cinci zoo sniper posted:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=852751

the unix philosophy ladies and gentlemen :kiss:

# ¿ Feb 1, 2017 13:29

Workaday Wizard: Oct 23, 2009; by Pragmatica

i'm so sick of parsing structured output so let's all parse text :v:

# ¿ Feb 1, 2017 13:30

Workaday Wizard: Oct 23, 2009; by Pragmatica

Winkle-Daddy posted:

my post was more directed at trying to find out what alternative to mitm'ing ssl that poster might be suggesting, obviously there are poo poo vendors (F5 *cough*) and better ones. There are poo poo deployments and good deployments. but your packets are getting inspected in corporate america.

we use f5 for ssl offloading, load balancing, and as a waf and we didn't face any issues yet. what's so bad about it?

# ¿ Feb 9, 2017 10:04

Workaday Wizard: Oct 23, 2009; by Pragmatica

i hear a lot of people saying AD is real bad wrt cyber security

can someone give me the rundown on why it's bad and how the heck are you supposed to replace it's functionality?

# ¿ Feb 12, 2017 13:49

Workaday Wizard: Oct 23, 2009; by Pragmatica

i'm not clicking any of these links :tinfoil:

# ¿ Mar 7, 2017 16:45

Workaday Wizard: Oct 23, 2009; by Pragmatica

do you keep print outs of your passwords?

# ¿ Mar 11, 2017 11:34

Workaday Wizard: Oct 23, 2009; by Pragmatica

cinci zoo sniper posted:

no

then what happens when your vault goes *poof*

# ¿ Mar 11, 2017 11:58

Workaday Wizard: Oct 23, 2009; by Pragmatica

i'm the third party services able to post on users accounts without any badge or label to identify their posts

# ¿ Mar 15, 2017 10:33

Workaday Wizard: Oct 23, 2009; by Pragmatica

bicycle posted:

twitter statistics is something I care about enough to give a third-party access to my accounts

understandable for read access, but write access ???

# ¿ Mar 15, 2017 11:18

Workaday Wizard: Oct 23, 2009; by Pragmatica

even simpler than that: just read "%TEMP%\~secretzzzz.txt.autosave"

# ¿ Mar 17, 2017 23:09

Workaday Wizard: Oct 23, 2009; by Pragmatica

Rectus posted:

just wait until someone makes an augmented reality game for cars. please tell me you can use the car controls as app input

https://www.youtube.com/watch?v=NRMpNA86e8Q

# ¿ May 15, 2017 19:25

Workaday Wizard: Oct 23, 2009; by Pragmatica

BangersInMyKnickers posted:

Also using the windows firewall to shim a kerberos IPsec layer in front of legacy protocols that don't natively support it also owns. Microsoft is good.

what?? how did you do that? I thought windows firewall was just a firewall :confused:

# ¿ May 24, 2017 07:36

Workaday Wizard: Oct 23, 2009; by Pragmatica

anthonypants posted:

i posted this on a gist and on medium since i wasn't sure which platform i liked better. i think i got the creator of rconfig to create a medium account so he could write a comment, telling me that my post was a "god awful long boring rant" and "not credible" since i should've contributed to the project instead. i guess i should've made it clearer that i explicitly chose not to do that considering what a dumpster fire it is.

hahahahaha... classic

# ¿ Jun 7, 2017 06:55

Workaday Wizard: Oct 23, 2009; by Pragmatica

anthonypants posted:

https://twitter.com/KevinMieles11/status/872857319117402112

nice ~~hat~~ wall

# ¿ Jun 10, 2017 06:31

Workaday Wizard: Oct 23, 2009; by Pragmatica

skip the middle man. connect a scsi cable to your optic nerves.

# ¿ Jun 11, 2017 18:59

Workaday Wizard: Oct 23, 2009; by Pragmatica

https://twitter.com/steved3/status/877452139773255680

# ¿ Jun 26, 2017 11:57

Workaday Wizard: Oct 23, 2009; by Pragmatica

cheese-cube posted:

looks like the account is already shutdown and/or banned. what were they posting?

he's australias #1 cyber guy

quote:

gistfile1.txt
from: ***@***.*** (aka Simon Smith from eVestigator aka 1IQ Pty Ltd)
to: <removed>

Subject: human being. You have gone too far. gently caress with me oval office and your try hard digital life is over. I deal with fuckers like you and crush them
Body:
Firstly you foreign chonga <removed> gently caress man with no experience at all and someone who thinks he actually knows something about the topic, the version was live and the audio quality and graphics were jumpy so it was recompiled and published.

Secondly, retard if you actually had a brain you would know that I am a forensic investigator who has caught over $78m worth of Cyberscammers and now almost 200 cyberstalkers and almost equally cybercriminals. I've been programming since you've been taking milk from your Mum's breast, so that's 28 years and have more skill in my small toe than you have I'm your whole body (including that tiny dick on your head).

Secondly uneducated kiddie, let's teach you something.

What you call a tracking script is not a script. Where do you see a script? From the dick in your head? Do you know anything about server side request headers? In my possession I have full headers including HTTP_REFERER, the user agent string, the validated server side session cookies as it was forced as mandatory or not counted robot dick.

Thirdly dumb poo poo if you knew anything about TCP/IP I do know for a fact the exact date and time and IP which is unique to any provider whether it be a VPN (as they log this as a minimum for their terms of service) and the IP address that I got for each point was confirmed at the exact time against the TOR exit nodes so they are either way identifiable as an endpoint and are known ISPs/VPNs. So technically you mentally deranged unqualified retard, all one has to do is summon any one of those providers and establish a paid client as they swapped between VPN within seconds made known to me through a non spoofed user agent and ASP session cookie trails that is available to the authorities.

Fourth, the location is not meant to be accurate. Of course it is just a GEOIP. It is irrelevant. The IP, date, and time is needed to identify the exact entity you stupid idiot. That's a given. It's done to give something viewable. What did you do red man? What is your contribution? Easy to criticise when you do nothing.

Now to your wireless argument which makes you look even more stupid. First of all they aren't attackers and this was no script so you look like the biggest fool right now. Secondly all IP addresses have got an ASN. Go look out up you dumb retard. Also have you heard of IP blocks and when I said CONFIRMED VPNs to any normal person that is designated as well by the forensics of the endpoint as to the CPE which is confirmed as fixed. If they were mobile or linked to a CPE there is a good 60 or so comparison points.

So tell me, what is your experience? I will tell you. Within the next week you will learn a few things. You will learn to shut your red face and mind your own business otherwise it gets shut for you, you will learn a lot about cyber safety and keeping your information secure and you will learn who not to gently caress with. If any words come out of that human being mask you learn ten times harder.

Got it big man?

<removed> Address of the Victim

Telephone:
<removed> Telephone of the Victim

Australia Telephone:
<removed> Telephone of the Victim

gently caress off and do business in your own country and get the gently caress away.

Nice VOIP fake number that rings out purporting to be Sydney. Mostly Australian clients hey? Only 9.5 years experience. Little fucker alien pentester wants to go a 27 year expert reverse software engineer voted #1 in Australia.
The last try hard 'pentester' that messed with me misplaced his online identity really fast. Mustn't have been very good hey? Bring it on oval office.

By the way...consider your Australian business demolished unless I get a full written apology within 24 hours.

Your business your server your everything destroyed oval office. Try me amateur. You hopeless amateur. Within 24 hours I will have a random sorry or you will see big man who you're loving with. 1 word and if your IP of which I've captured goes anywhere near me your customers and Australian little hub will have a pleasant surprise.

Learn your lesson junior. Don't gently caress with a expert reverse software engineer forensic expert you kiddle because I fucken chew up hackers and spit them out.

Say it and don't you dare post anything chonga. I'm watching everything now.

You're on the radar oval office

# ¿ Jun 26, 2017 12:24

Adbot: ADBOT LOVES YOU

# ¿ May 5, 2024 21:01

Workaday Wizard: Oct 23, 2009; by Pragmatica

yoloer420 posted:

I just want to clarify that nobody in Australia knew about this guy before his meltdown. He was not recognised or known to the community.

Australia is still cool I promise

australia has troy hunt so theyre safe

# ¿ Jun 26, 2017 12:48

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy