Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›2 »

apseudonym: Feb 25, 2011

Make sure you wrap your connection with SSL to stay safe.

# ¿ Nov 22, 2017 21:24

Adbot: ADBOT LOVES YOU

# ¿ May 22, 2024 08:12

apseudonym: Feb 25, 2011

Chalks posted:

You'd have expected these guys to have done at least a bit of penetration testing.

Their bug bounty didn't pay enough to catch anything.

# ¿ Nov 22, 2017 21:27

apseudonym: Feb 25, 2011

rafikki posted:

Nothing we didn't all know or suspect but an interesting write up: https://theintercept.com/2017/11/24/staggering-variety-of-clandestine-trackers-found-in-popular-android-apps/

"Clandestine Tracking" seems rather dishonest since half the article is discussing effectively cookies and backend correlation.

# ¿ Nov 25, 2017 16:12

apseudonym: Feb 25, 2011

Grassy Knowles posted:

not me, couldn't be

Then who?

# ¿ Nov 25, 2017 18:59

apseudonym: Feb 25, 2011

pseudorandom name posted:

https://twitter.com/BAKKOOONN/status/935629381560516608

The tweet linked is gone, please tell me it's real I need it to be real.

# ¿ Nov 28, 2017 23:42

apseudonym: Feb 25, 2011

minato posted:

makes sense, Santa is an anagram of @nsa

It took me too long to get this :smith:

# ¿ Nov 29, 2017 04:51

apseudonym: Feb 25, 2011

anthonypants posted:

https://twitter.com/taviso/status/935720439439015937

All your favorite software has security bugs.

# ¿ Nov 29, 2017 07:43

apseudonym: Feb 25, 2011

karoshi posted:

That page contains the word (trigger warning) "vendor" 12 times. There will be multiple vendor/ODM partitions that survive a system upgrade. Those are a juicy target. "SHIP IT!" vendor implementations will make those juicy targets easy to hit.

It's an abstraction layer for vendor code, of course it loving includes the word vendor.

It also separates out vendor code and allows us to better isolate it, it's an all around good thing.

# ¿ Nov 29, 2017 19:43

apseudonym: Feb 25, 2011

karoshi posted:

Sir, this is the SecLOL thread, not the sensible software architecture thread.

(I agree with that POV and I think it's a great way of keeping the OS upgraded, like iOS. It also adds new and exciting malware vectors. Now your sound driver can also inject a tracking DLL into every app. It might come preinstalled by your phone manufacturer (hello lenovo) or be a 3rd-party post initial boot add-on.)

No, the vendor code cannot inject a tracking dll into apps.

# ¿ Nov 29, 2017 19:45

apseudonym: Feb 25, 2011

wolrah posted:

There's an important distinction between physical access and physical control.

A machine in a public computer lab I have physical access to. A machine I can take home (or have stolen) I have physical control over. The difference is what I can do to the machine without raising suspicion.

Those public computer lab machines can be secured to a reasonable extent by password protecting the BIOS/OpenFirmware/EFI/whatever and boot menu then locking the case closed to prevent people from resetting it easily. An attacker generally can't start cutting the case with tools in the middle of a public area without people noticing. They can, however, use this bug to enable an admin account on the machine from which they can do pretty much whatever else they want.

A machine I can bring to a private location and disassemble without interference on the other hand is basically pwned unless it's using good encryption.

Destructive v non destructive is also an important distinction for stuff like evil maid

# ¿ Nov 29, 2017 23:28

apseudonym: Feb 25, 2011

Lain Iwakura posted:

oh. i am much, much happier now than say a year ago and even a decade ago. i have my own challenges to deal with but i am not losing my mind all the time anymore <3

# ¿ Nov 30, 2017 17:06

apseudonym: Feb 25, 2011

Lain Iwakura posted:

there's a defcon 604 meet once a month that may or may not be good. i have been interested in attending but because i haven't been before i am unsure how much fun i'll have considering other events' gender imbalances. it's really annoying because there are good people but i've always gotten on better with women than men and i feel like that this may be a challenge for me

I've completely given up on in person security groups and its done a lot for my sanity and faith in humanity.

# ¿ Dec 1, 2017 03:43

apseudonym: Feb 25, 2011

Grassy Knowles posted:

So you're not going to the 2600 meeting tomorrow

Never been to one.

I've had a lot of bad experiences with people really dont know what they're talking about and people who manage to be super creepy (and I'm honestly not as perceptive as I could wish) to want to go to security meetups.

# ¿ Dec 1, 2017 04:36

apseudonym: Feb 25, 2011

Subjunctive posted:

I believe that it means that if you open a visio file it can grab a payload and execute it, hidden with visio's benign-looking process

I too am scared of interpreters.

# ¿ Dec 4, 2017 20:16

apseudonym: Feb 25, 2011

Wiggly Wayne DDS posted:

https://twitter.com/HaifeiLi/status/938842714342174720

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11937

Lol av

# ¿ Dec 7, 2017 22:43

apseudonym: Feb 25, 2011

anthonypants posted:

it points to localhost. if you have the blizzard app open https://localbattle.net:22885 in a web browser

the certificate is almost certainly so they can do secure traffic relating to drm

That cert should get revoked so hard. I'm sure Ryan will have fun https://twitter.com/sleevi_/status/939574006759424006

# ¿ Dec 9, 2017 20:35

apseudonym: Feb 25, 2011

pseudorandom name posted:

chrome feeds your entire browsing history into google adsense

No, they don't.

# ¿ Dec 15, 2017 20:45

apseudonym: Feb 25, 2011

Suspicious Dish posted:

linus thinks bugs are bugs, and that includes security bugs, and would rather fix the bugs through careful engineering than add protection layers.
spender believes strongly that the right way forward is adding protection layers that make bugs in the kernel inert, and if it breaks things, he sees that as the actual bug.

both linus and spender are hotheads who will never agree on anything. linus is right when he says security people are insane, and spender is right when he says linux security is a shitshow.

your operating system is a piece of poo poo, bicth

Spender is far worse than Linus, which says a lot, if he weren't such a toxic jerk in his interactions with others and actually worked to get his changes upstream instead of screaming about how right he is we might actually have those hardening changes in devices instead of angry Twitter posts about how right he is.

# ¿ Dec 21, 2017 21:05

apseudonym: Feb 25, 2011

cheese-cube posted:

unrelated but what's the go with HPKP? i seem to recall some recent discussion about it being abandoned due to lacklustre uptake? is it worth configuring still?

It's a big foot gun and you should be really careful.

# ¿ Dec 23, 2017 07:28

apseudonym: Feb 25, 2011

Bulgogi Hoagie posted:

https://twitter.com/russianembassyc/status/944627945175334912

So... A spyware app?

# ¿ Dec 23, 2017 23:53

apseudonym: Feb 25, 2011

Bulgogi Hoagie posted:

spyware for the people

NSA Wizard?

# ¿ Dec 23, 2017 23:59

apseudonym: Feb 25, 2011

Partycat posted:

Would it be worse to put the Snowden app on your phone , knowing it would open you up to FSB backdoors - if it also locked out CIA backdoors ?

But it doesn't lock out anything...

# ¿ Dec 24, 2017 06:45

apseudonym: Feb 25, 2011

I'm not going to defend Uber but the first one is pretty dumb (and dumb on Uber making not having pinning a security bug).

# ¿ Dec 24, 2017 20:54

apseudonym: Feb 25, 2011

canis minor posted:

This is fun - gain access to Lastpass without loging in

https://hackernoon.com/lastpass-authenticator-app-is-not-secure-77b9743c3007

This article is bullshit, HTH.

# ¿ Dec 28, 2017 02:10

apseudonym: Feb 25, 2011

Lutha Mahtin posted:

so did ccc fix their rape problem yet, or

Are they still hosting/supporting Appelbaum?

I don't know why that guy still gets the amount of support he gets :smithicide:

# ¿ Dec 30, 2017 08:35

apseudonym: Feb 25, 2011

graph posted:

hello posting pals

i'm torn on the intersection of infosec stuff and the trash fire that is the infosec industry, the latter of which will undoubtedly keep coming up

i know lots of folks enjoy the content in this thread, but in my opinion there's also a need to talk about the trash fire. i don't know if the happy medium is in here, or in another thread, or even in another subforum

i just wanted to post this because i do see the reports, i do care, and i am talking about it with other posters. thanks for listening

The industry is the biggest sec gently caress of all

# ¿ Dec 31, 2017 02:12

apseudonym: Feb 25, 2011

https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html

# ¿ Jan 3, 2018 23:35

apseudonym: Feb 25, 2011

Failed speculative executions need to be indistinguishable from them not happening at all

Else sadness

# ¿ Jan 4, 2018 01:05

apseudonym: Feb 25, 2011

Number19 posted:

maybe it�s harder to exploit on VMware for some reason. it seems weird to not have them marked critical

Do they reserve critical for host OS execution as opposed to info leak?

# ¿ Jan 4, 2018 01:36

apseudonym: Feb 25, 2011

James Baud posted:

This is the single biggest case of "fix worse than the disease" I can remember for everyone who isn't a hosting platform/shared system.

This is the single biggest misunderstanding of worst case performance impact I can remember.

# ¿ Jan 4, 2018 04:18

apseudonym: Feb 25, 2011

Notorious b.s.d. posted:

figuring out where the interesting bytes are is typically why i want to leak a bunch of kernel memory, no?

with aslr and kpti i can't know where anything is without either having control over the process (to read its /proc/maps) or dumping a lot of memory....

not by design, but maybe accidentally -- no one is writing shellcode for sparc in this day and age

on the other hand you probably have eight gazillion unpatched holes in solaris, unless you are paying $10k+ a year to oracle

ASLR defeating Info leaks are extremely common and the early version of this work was against KASLR, putting a lot of reliance of ASLR this day in age is pretty risky.

This is less about getting a kernel address so you can set up your rop gadgets and more "gently caress it give me those crypto keys without bothering to get exec"

# ¿ Jan 4, 2018 19:03

apseudonym: Feb 25, 2011

akadajet posted:

this poo poo again?
https://twitter.com/MacRumors/status/951133444909580288

Lol Apple

# ¿ Jan 10, 2018 21:59

apseudonym: Feb 25, 2011

Proteus Jones posted:

LOL. FBI still trying to wage a "woe is me" PR war against encryption.

https://motherboard.vice.com/en_us/article/59wkkk/fbi-hacker-says-apple-are-jerks-and-evil-geniuses-for-encrypting-iphones

First they said we helped pedophiles with encryption and now they just call us jerks

# ¿ Jan 11, 2018 20:15

apseudonym: Feb 25, 2011

mrmcd posted:

If u think about it, I bet Lowtax has access to all my shitposts and PMs.

But not your good posts :thunk:

# ¿ Jan 12, 2018 02:47

apseudonym: Feb 25, 2011

mrmcd posted:

I'm the poster that thinks "national intelligence and leo agencies are WATCHING ME" but also thinks they go "hmmm this encrypted traffic is all going to an IP at HostingShack LLC. Whelp I guess I've finally been bested. Guess another one got away, those foxes!"

Nation state actors are both incredibly powerful and incredibly incompetent adversaries at the same time.

Also no one ever MiTMs anything beyond the first hop, VPN services definitely dont mine your data like mad.

# ¿ Jan 12, 2018 05:19

apseudonym: Feb 25, 2011

mrmcd posted:

Personally though, I have a VPN box in France because my two kinks are EU cookie warnings and making my nsa case officer deal with French bureaucrats all day.

Dirty

# ¿ Jan 12, 2018 06:30

apseudonym: Feb 25, 2011

Wiggly Wayne DDS posted:

really all history has shown is that criminal groups are incredibly slow to adopt to new exploit techniques, and your nation state attackers would rather not have that white elephant of a vuln sitting in their systems as well. there's a strange misconception on the quantity of black hat attackers producing malware, their development processes and sophistication. really that is a topic in dire need of analysis because the reality really doesn't add up to the expectation of competency there, even accounting for nsa exploits being released and turnaround time for those being used outside of targeted attacks

Criminals are in it for :10bux:

not for exploiting hot new vulns, which the security bug hype doesn't really match up with.

# ¿ Jan 19, 2018 19:04

Adbot: ADBOT LOVES YOU

# ¿ May 22, 2024 08:12

apseudonym: Feb 25, 2011

Wiggly Wayne DDS posted:

i'm this entire thread
https://twitter.com/tobiaschneider/status/957317886112124928

The cyberpunk future we deserve

# ¿ Jan 28, 2018 01:00

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›2 »