Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›7 »

Wiggly Wayne DDS: Sep 11, 2010

JewKiller 3000 posted:

3do didn't have anything worth stealing either, though

unless you really like fmv

terror from the deep theoretically exists but i can't find a shred of evidence

# ¿ Jun 27, 2017 05:35

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 19:58

Wiggly Wayne DDS: Sep 11, 2010

Jewel posted:

Another day, another bitcoin ransomware.

https://twitter.com/ankit5934/status/879681380686340096

https://twitter.com/mikko/status/879702057829138433

"The way it is spreading suspects usage of eternalblue or eternalrock"

it's confirmed:
https://twitter.com/PolarToffee/status/879709615675641856

congrats on people not patching after the previous major incident

# ¿ Jun 27, 2017 15:45

Wiggly Wayne DDS: Sep 11, 2010

cinci zoo sniper posted:

that's the wannacry 2: electric tears?

considering there isn't a domain to conveniently sinkhole just prior to the us business networks waking up ya

# ¿ Jun 27, 2017 16:01

Wiggly Wayne DDS: Sep 11, 2010

spankmeister posted:

I hope this one comes in via email and then spreads internally

i saw talk of email spreading petya earlier before eternalblue got mentioned so i'd expect that amongst other spreading mechanisms

# ¿ Jun 27, 2017 16:04

Wiggly Wayne DDS: Sep 11, 2010

ratbert90 posted:

Hello! If you are seeing this it's because your pacemaker is no longer accessible, because it has been encrypted. Perhaps you are looking for a way to recover your heartbeat?

i thought we all agreed to disable the heartbeat extension

# ¿ Jun 27, 2017 16:09

Wiggly Wayne DDS: Sep 11, 2010

Migishu posted:

Looking forward to the Wiggly Wayne DDS overview of Defcon videos

eh i never do defcon (nor ever have), rarely anything of value. based on their speaker page for this year there's only a handful of interesting talks, and even then it's just further details of public research (sha-1 collision)

# ¿ Jun 27, 2017 18:10

Wiggly Wayne DDS: Sep 11, 2010

Shifty Pony posted:

a lot of reports from people dealing with infections of Petya seem to talk about affected systems rebooting to the ransom screen nearly simultaneously.

I wonder if there is some sort of coordination between infected systems to pull that off.

it spreads internally very fast and will spread for an hour before rebooting - the gap in machines rebooting is how long it took to infect them

WAR DOGS OF SOCHI posted:

does anyone here have a good sec twitter list they can point me to? i'd really appreciate it, because left to my own devices i'd probably end up with dudes like thrurrott on my list and my pants on my head.

i threw together a rough list that is kept vaguely updated: https://twitter.com/zylche/lists/security

given it's 2017 it's v hard to separate politics from pure sec feed though

# ¿ Jun 27, 2017 18:44

Wiggly Wayne DDS: Sep 11, 2010

i'll get out the stick i swear

# ¿ Jun 27, 2017 19:30

Wiggly Wayne DDS: Sep 11, 2010

more than just a rumour me-doc are saying they're spreading it http://www.me-doc.com.ua/vnimaniyu-polzovateley

and maersk use me-doc

https://twitter.com/wanapagan/status/879769249715286016

in the possibility that this was somehow meant to be contained to ukraine i have serious questions. like where the hell are any attempts at containing it

# ¿ Jun 27, 2017 19:39

Wiggly Wayne DDS: Sep 11, 2010

microsoft have a good writeup on petya https://blogs.technet.microsoft.com/mmpc/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

no confirmation for the email vector

waterhole attack being mentioned though
https://twitter.com/craiu/status/880011103161524224

so far the petya/notpetya arguments are on the dropper, which has changed in the past, so further analysis required

# ¿ Jun 28, 2017 12:13

Wiggly Wayne DDS: Sep 11, 2010

finally a new attack on sha2 https://github.com/laie/WorldsFirstSha2Vulnerability

# ¿ Jun 28, 2017 16:30

Wiggly Wayne DDS: Sep 11, 2010

infernal machines posted:

a breathless and poorly written piece on the petya variant that hit recently

tl;dr: it's not really ransomware as it straight up overwrites the boot sector and subsequent blocks, there's no way to decrypt them because they weren't actually encrypted at all, presumably this is by design.

for some reason it ignores the existence of low level file recovery tools like testdisk and photorec, which will likely recover the file data regardless of mbr and mft damage

e: the implication being this is a state-level attack disguised to look like ransomware to generate a different narrative

yeah that's just copypasting where everyone's analysis has been going. we can't say malware has intentional flaws and political motivation though otherwise the :tinfoil:

comes out

# ¿ Jun 29, 2017 05:54

Wiggly Wayne DDS: Sep 11, 2010

pseudorandom name posted:

does ExPetr actually rely on ETERNALBLUE or did the Russians just throw that in there to blame the NSA?

whoever the malware authors are use it but only for spreading internally - it isn't randomly scanning the internet. effectiveness is a higher design priority than little nods, but there is more than one variant hiding in this mess

# ¿ Jun 29, 2017 07:28

Wiggly Wayne DDS: Sep 11, 2010

the elephant in the room is that petya is ransomware already with a working payment chain, there was no need for these changes to exist

# ¿ Jun 29, 2017 13:16

Wiggly Wayne DDS: Sep 11, 2010

microsoft's thrown together exploit analysis on eternal champion: https://blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis/

# ¿ Jun 29, 2017 19:28

Wiggly Wayne DDS: Sep 11, 2010

spankmeister posted:

Straight up blackmail lmao

they're getting better at this: https://steemit.com/shadowbrokers/@theshadowbrokers/response-to-response-to-doxing

e: more info on how vulnerable the medoc update process was: http://blog.uk.fujitsu.com/information-security/petya-medoc-and-the-delivery-of-malicious-software/

Wiggly Wayne DDS fucked around with this message at 10:59 on Jun 30, 2017

# ¿ Jun 30, 2017 10:55

Wiggly Wayne DDS: Sep 11, 2010

oh and you'll have to punch windows defender updates through elsewhere

%ProgramFiles%\Windows Defender\MSASCui.exe

iirc

# ¿ Jun 30, 2017 19:08

Wiggly Wayne DDS: Sep 11, 2010

BangersInMyKnickers posted:

Also the Windows Firewall is Very Good and you are wrong about it. This is the OS's fault for having an absurdly convoluted update mechanism that routes through 3+ services

yeah windows firewall is very good which is why diagnosing this issue is so easy

seriously though if they bothered to make any of this at all functional and didn't quietly throw in their own rules you'd be able to lockdown most consumer systems pretty easily

# ¿ Jun 30, 2017 19:16

Wiggly Wayne DDS: Sep 11, 2010

it is under svchost for the record, i don't remember which services it uses though

# ¿ Jun 30, 2017 19:20

Wiggly Wayne DDS: Sep 11, 2010

cyber was definitely used by itself for years before then

# ¿ Jul 4, 2017 10:11

Wiggly Wayne DDS: Sep 11, 2010

well things get more and more interesting https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/

evidence of a backdoor in medoc since mid-april

# ¿ Jul 4, 2017 17:20

Wiggly Wayne DDS: Sep 11, 2010

actions are occurring

https://twitter.com/GossiTheDog/status/882362847677882368

https://twitter.com/codelancer/status/882363855145283584

# ¿ Jul 4, 2017 23:23

Wiggly Wayne DDS: Sep 11, 2010

i'm the blur on the tech showing off the servers but ignoring the clear reflection of their face

# ¿ Jul 5, 2017 16:26

Wiggly Wayne DDS: Sep 11, 2010

SeaborneClink posted:

What was it?

essentially "look at this setup" and linking to

https://twitter.com/GarbageDotNet/status/882620748023476224

they still have it liked though

# ¿ Jul 5, 2017 18:40

Wiggly Wayne DDS: Sep 11, 2010

what could possibly go wrong

https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html

# ¿ Jul 6, 2017 16:52

Wiggly Wayne DDS: Sep 11, 2010

gonadic io posted:

Also isn't doing pentesting with bespoke 0days kind of missing the point?

there are orgs that get pentested to this degree, mainly ones with nation states after them already

# ¿ Jul 7, 2017 10:34

Wiggly Wayne DDS: Sep 11, 2010

https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/71AXGTgcX9c

quote:

Hello,

I recently did an investigation where I tried to simply download private
keys from web servers with common filenames. I collected these
filenames simply from common tutorials on the web (server.key,
privatekey.key, myserver.key, key.pem and [hostname].key with and
without www).
In several cases I was able to download private keys belonging to
currently valid certificates.

I wrote about this today for the German news site Golem.de (with an
english translation available): https://www.golem.de/news/https-private-keys-on-web-servers-1707-128862.html

In the course of this I also learned quite a bit about the revocation
process. According to the baseline requirements a CA shall revoke keys
within 24 hours in case of a key compromise.

Some notes about my experiences:
* All certificates I reported are revoked now.

* In several cases the deadline wasn't hit and CAs took longer. Some
took over 4 days. In one case (Gandi) I learned that it's a branded
CA from Comodo. Comodo immediately revoked the cert after they
learned about it, but this raises interesting questions about the
responsibilities of branded CAs.

* The reporting process is wildly different. Some CAs provide email
addresses, others online forms, Symantec has forms with captchas. In
the April CA communications [1] mozilla announced that it wants to
compile a list of contact methods and has asked CAs for them. I would
encourage streamlining that process. I also think revocation should
be automatable (at least on the side of the reporter) and wonder
whether things like forms with captchas should be outruled.
Particularly interesting is Let's Encrypt that provides an API via
ACME to revoke if you posess the private key. IMHO that's ideal.

* Comodo re-issued certs with the same key. I wonder if there should be
a rule that once a key compromise event is known to the CA it must
make sure this key is blacklisted. (Or maybe one of the existing
rules already apply, I don't know.)

I had opened a private bug in mozillas bugtracker which contains some
more info and lists of the specific certificates. It's up to mozilla
when they'll open it, but from my side I think this can go public.

[1] https://wiki.mozilla.org/CA/Communications#April_2017_Responses
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1378074
--
Hanno B�ck

# ¿ Jul 12, 2017 20:29

Wiggly Wayne DDS: Sep 11, 2010

anthonypants posted:

how bad are the infosec books currently in the humble bundle https://www.humblebundle.com/books/cybersecurity-wiley

top of the line books 5 years ago, but great for learning. there's some trash in there but as random ref material a pretty strong pack

# ¿ Jul 18, 2017 00:20

Wiggly Wayne DDS: Sep 11, 2010

Wiggly Wayne DDS posted:

https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/71AXGTgcX9c

okay this gets better: https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html

# ¿ Jul 20, 2017 16:28

Wiggly Wayne DDS: Sep 11, 2010

i approve of the dutch national police's new approach:

https://twitter.com/musalbas/status/888129544170885121

# ¿ Jul 20, 2017 21:22

Wiggly Wayne DDS: Sep 11, 2010

mixture of write-once memory, challenge/response restricted memory and the restricted setting of the hardware itself so physical tampers aren't a real concern (re: cloning specifically)

# ¿ Jul 24, 2017 13:51

Wiggly Wayne DDS: Sep 11, 2010

Subjunctive posted:

what's the threat there?

presumably moving thousands of $ worth of merchandise across state lines, but turns out tsa didn't issue guidance like that at all so ???

# ¿ Jul 24, 2017 17:59

Wiggly Wayne DDS: Sep 11, 2010

https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-206-01

quote:

CRASHOVERRIDE, aka, Industroyer, is the fourth family of malware publically identified as targeting industrial control systems (ICS). It uses a modular design, with payloads that target several industrial communication protocols and are capable of directly controlling switches and circuit breakers. Additional modules include a data-wiping component and a module capable of causing a denial of service (DoS) to Siemens SIPROTEC devices.

NCCIC/ICS-CERT is in the process of analyzing samples of the CRASHOVERRIDE malware family, including an additional component for credential harvesting that is presumed to be related. As part of this analysis, ICS-CERT has developed a YARA signature to detect components, as well as potential variants of the malicious files ICS-CERT possesses.

Dragos, Inc., ESET, and US-CERT have released open source technical reports for the CRASHOVERRIDE malware family. These reports are available on their respective publisher�s web sites, found at the links below:

Dragos, Inc.: CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations (link is external)

ESET: Win32/Industroyer: a new threat for industrial control systems (link is external)

US-CERT: Alert (TA17-163A) CrashOverride Malware

# ¿ Jul 25, 2017 19:41

Wiggly Wayne DDS: Sep 11, 2010

lot of fuckups itt atm

# ¿ Jul 28, 2017 21:11

Wiggly Wayne DDS: Sep 11, 2010

why would you go to defcon ever:
https://twitter.com/JGamblin/status/890998008355069952

in what world is this groundbreaking research:
https://twitter.com/threatresearch/status/890607598738694144

no real surprises though:
https://twitter.com/ldmxcsr/status/891046114501173248

in other news:
https://twitter.com/kaepora/status/890667846837161986

# ¿ Jul 28, 2017 23:48

Wiggly Wayne DDS: Sep 11, 2010

we're still good for meeting up after your dinner plans right?

# ¿ Jul 30, 2017 04:34

Wiggly Wayne DDS: Sep 11, 2010

yeah the best part is when they told microsoft who said it's not a security issue and wontfix

# ¿ Jul 30, 2017 20:49

Wiggly Wayne DDS: Sep 11, 2010

well this certainly is a response to a security issue: https://beingwinsysadmin.blogspot.co.uk/2017/07/bug-windows-10-default-user-profile-is.html

# ¿ Jul 31, 2017 08:03

Wiggly Wayne DDS: Sep 11, 2010

who was asking if i was going to defcon again

# ¿ Aug 3, 2017 18:06

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 19:58

Wiggly Wayne DDS: Sep 11, 2010

spankmeister posted:

Has to be something like that. Twitter is up in arms and saying that def con is forever over

...is that a bad thing?

# ¿ Aug 3, 2017 18:49

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›7 »