Migishu posted:

Security Fuckup Megathread - v13.0.1 - looks like them secfuck boys are at it again

Crazy Achmed posted:

Someone stole a couple of those insane razer triple-monitor laptops from ces. Does this count tangentially as a secfuck?

quote:

Merrigan and Gevers are maintaining a public Google Drive document (read-only) that is tracking the various victims and ransom demands. Merrigan said it appears that at least 29,000 MongoDB databases that were previously published online are now erased. Worse, hardly anyone who’s paid the ransom demands has yet received their files back.

Boiled Water posted:

alternatively: Here ends ransomware as a way to extract value from idiots with computers, here also starts using ransomware to hamper your competitors. Think industrious espionage but instead of stealing your competitors secrets you lock them away behind a wall of crypto and cyber.

Wiggly Wayne DDS posted:

in other juniper news: https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753&actp=search

spankmeister posted:

I only ever see those in lovely airports

hackbunny posted:

quote:

So far, however, the damage done by cyber attacks, both real (Stuxnet's destruction of Iranian uranium enrichment centrifuges and a few brief power outages alleged to have been caused by Russian hackers using BlackEnergy malware) and imagined or exaggerated (the Iranian "attack" on a broken flood control dam in Rye, New York), cannot begin to measure up to an even more significant cyber-threat—squirrels.

That was the message delivered at the Shmoocon security conference on Friday by Cris "SpaceRogue" Thomas, former member of the L0pht Heavy Industries hacking collective and now a security researcher at Tenable. In his presentation—entitled, "35 Years of Cyberwar: The Squirrels Are Winning"—SpaceRogue revealed the scale of the squirrelly threat to worldwide critical infrastructure by presenting data gathered by CyberSquirrel 1, a project that gathers information on animal-induced infrastructure outages collected from sources on the Internet.

OSI bean dip posted:

when i worked at an isp, three years in a row and approximately in the same spot affecting the same fiber line, we'd have a backhoe dig up our link between our data centre in edmonton to a town in northern alberta. it happened like clockwork around the beginning of october

backhoes are a menace

Powaqoatse posted:

awesome post!

but it does seem that they are "serious criminals" (if guilty) so i dunno what you mean by that one sentence

hackbunny posted:

fun fact: they kept the information stolen from other freemasons in a folder (or category, I should reread the report) called "BROS". spankmeister gave a good summary of freemasons in italy and their historical significance

fishmech posted:

it's literally not an ethernet port, it just has the same shape. it's some sort of serial port that you connect up to a device that actually interfaces with the smart meter and through that the utility's network.

the connection allows for optional controls that help change power load. again, the idea behind it is that you'd eventually have all your appliances hooked up to it including hvac, but even only having one or two appliances controllable, across a bunch of households, could be useful to the utility company.

for power saving on clothes washer, you'd probably be able to set it so it waits to go into a spin cycle at times of peak load or something. after all, just letting the clothes soak for a little bit longer isn't going to hurt anything.

fishmech posted:

they're not internet devices at all, let alone internet of things devices.

Cocoa Crispies posted:

https://twitter.com/pr1ntf/status/823322800194666497

hackbunny posted:

Global Systems Comm. CA. is it even legit?

quote:

anyway, this is installed as a trusted ca in the system certificate store

Subjunctive posted:

Not true in California at least.

OSI bean dip posted:

https://www.youtube.com/watch?v=FUyaItsRInQ

cheese-cube posted:

this. but what happened to your av hackbunny?

CommunistPancake posted:

...why would it have to be a Photoshop or AI file? why does the file type mean that nobody can connect to the computer and put up their own image / animation / video file?

Jimmy Carter posted:

isn't teamviewer the app that all those scammers calling from "Microsoft security" tell you to use?

OSI bean dip posted:

nothing but receipts:
https://twitter.com/lmaostack

quote:

For the love of God, please close this port, skid

minivanmegafun posted:

when it's connected to a point of sale system, as most receipt printers are?

Storysmith posted:

if a receipt printer has a way to talk to it over the public internet do you really believe the pos terminal itself does not

anthonypants posted:

it's very likely, because these are just dumb printers with like port 9100 or whatever open. opening up that port to the world is probably the easiest way for the pos system to be able to talk to it, because whoever installed it was also a pos
you should check out the twitter that was linked a few posts up then because it's actually a guy who's owned pos printers, specifically, and not pos installations as a whole as you seem to believe

power botton posted:

with all the leaked Snowden docs it was proved the NSA even has a term for this: AnEx (Anal Exfiltration)

infernal machines posted:

is it still sop for "internet security" suits to mitm ssl traffic with self-signed certs?

like, i can't imagine a bigger way to make yourself less secure than that.

ate all the Oreos posted:

but ddos'ing 8chan is a public good


wait he's the attention marbles guy?

A Pinball Wizard posted:

https://arstechnica.com/security/2017/02/newly-discovered-flaw-undermines-https-connections-for-almost-1000-sites/

hackbunny posted:

the only qualified statement we can make about it is that we aren't qualified to make statements about it, though

Truga posted:

https://www.vusec.net/projects/anc/

aslr

quote:

AnC, on the other hand, exploits a fundamental mechanism that is in place for efficient code execution that is present in all modern processors. Hence, it is not straightforward to “fix” AnC. Furthermore, AnC runs from JavaScript and does not need to make assumptions on core placement, significantly increasing its impact over Jump over ASLR.

anthonypants posted:

Cloudflare's statement: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

quote:

Cloudflare pointed out their bug bounty program, but I noticed it has a top-tier reward of a t-shirt.

crazysim posted:

somebody has posted a cloudbleed logo in that report. there's someone who is really deserving of a tshirt right now.

quote:

According to the above-linked bug report, the WebKit repository became corrupted late Thursday night when someone wanted to test how the system would handle the PDFs. Almost immediately, the system experienced failures. The errors persisted into Friday and eventually prompted one user to ask, "Is it fixable, or are we just totally hosed? Are we going to need to delete all the SVN history since this commit from the server in order to avoid the hash collision?" Responses indicated that the repository remained at least partially corrupted even after the PDFs were deleted. This message on a WebKit e-mail list showed mirroring systems remained unable to be updated.

Chris Knight posted:

oops

https://twitter.com/matthew_d_green/status/836552317138788353

Jabor posted:

"you have to say if you're a cop", but instead we figure it out based on us spying on you

quote:

[–]akesh45 [-1] 4 points 19 hours ago
I should add dahua, hikvison, etc are huge companies.... your concern is valid however unless theyre truly stupid, i have doubts such a backdoor exists. It would kill alot of business for years. Then again.... sony got hacked multiple times so i cant say its not valid.

cheese-cube posted:

Ask Slashdot: Should You Use Password Managers?





hrm


lol what a dingus

there's also plenty of comments where people are bragging about their super unique passphrase algo. morons. ofc it is slashdot afterall

anthonypants posted:

is 1password v6 on windows still garbage?

anthonypants posted:

i got that the other day too, so i opened it in ie instead. turns out you can't request same-day printing so i just went in to the store

anthonypants posted:

gently caress whoever at microsoft thinks "paste as plain text" needs to be hidden in as many right-click submenus as possible