Posts by vulture65537 130 publicly visible posts • joined 3 Jan 2019
Years ago when I was in a company that provided IT work to some police forces there was an encrypted email service called CJSM: Criminal Justice Secure Mail. But the customer contacts did not always use it, or their work addresses - they sometimes sent from Gmail.
If they want secure data that kind of thing needs to be banned and enforced.
I can still remember the name of the man with by far the highest number of password resets.
I've long believed pe testing is oversold because it captures attention that should mostly be on better (and maybe duller) forms of vulnerability assessment.
Around a decade ago my manager gave us a 1600-page PDF listing alleged defects in 5 servers. This was output from a network scanning tool. It claimed the latest Ted Hat was running a version (1.2) of rpcbind with format bugs discovered in 1998. Of course anyone unpacking the SRPM sees this has been patched long ago and the warning is bunk. The 1.2 banner seen on the network functions more as a protocol version than a software version. When I pointed this out the manager just decided I must know less about it than the people behind the scanner.
Meanwhile oodles of faults in filemodes and configuration and software not visible on the network go unreported.
I was at a job where a customer TLS certificate needed to be replaced as the old one was close to expiry. I was aware of this task coming up but it got handled by someone else. Then the customer complained the site had the self-signed-cert warning and it wasn't good .
Viewing in both IE and Firefox showed one had a working cert chain (what the other employee had seen) but the other browser used by the customer did not have it.
Investigation with the openssl s_client connect host whatever showed the cert chain was incomplete and one browser had fixed it up from another cert it had that fit.
I searched the web for this missing cert and added it to the file on the web server and the job was completed.
One country in an o international bank solved the problem of getting work done while minimising root access.
By setting an individual user's ac to UID 0. (Contrary to policy etc.)
Then acted like this was sensible in the "what we saw; what do you know about this" discussion.
By the time the head of information security at a bank was arguing that it was ok to not use TLS on the customer logon page I was gloomily staring at the email wondering is this even worth answering ... he won't read anything I write same as he didn't read any explanation of TLS even at the level the customer should know to check website before entering credentials
I had a stranger (not displaying ID badge);sit next to me in the open plan office and work on his laptop. After a few minutes he asked how to connect to the network.
I took a look at him and was about to reply something like:
I'm 75% expecting this to be a social engineering test but if you think we in the security department are going to help you get network access without seeing a badge you can write down that you were denied.
Before I've got that said it turns out another colleague knew him.
I worked where patches were much neglected so I wrote to our non-technical architect suggesting we might try where possible not to install risky s/w on servers if not needed. I suggested major kinds of risky s/w included mail transfer agents, printing software and X-windows.
He replied that none of these were risky. He didn't know I found CVE-2001-1198.
I'm sceptical of the idea "AI is now much better at finding and exploiting bugs than skilled people". Projects (e.g. Curl) have been flooded by dubious attempts to claim bug bounties.
Anyway if AI really had that ability it would not be much obstructed by hiding the source .. it would just do the same crunching on the binaries.
This old classic article
https://www.ranum.com/security/computer_security/editorials/dumb/
Says, among other things:
The #4th dumbest thing information security practitioners can do is implicitly encourage hackers by lionizing them. The media plays directly into this, by portraying hackers, variously, as "whiz kids" and "brilliant technologists"
Somewhere around 20 years ago there were 2 phish reporting sites (not gov) and I provided input to them.
I then rigged my MTA to send wrongly addressed mail (luser_relay feature) into a program that checked for links where the visible link and the real link were both https?: but they were not the same. Those got sent to the phish report sites. I then went out to work.
12 hours later I had 16000 recognised phishes and because I put no rate limit on my program the reporting sites blocked me.
Anderson's rewriting of atomic physics makes positive and negative charges into forward and backward.
"Poul Anderson's "Uncleftish Beholding" is a famous essay explaining atomic theory using a deliberately simplified, Germanic-rooted English, avoiding Latin/Greek words like "atom," instead coining "uncleft" (un-cleft/undivided) and "uncleftish" (atomic), demonstrating linguistic purism and showing how science might have ..."
I had someone tell me the message on the screen as a series of LETTERS rather than words. As soon as a computer was involved he lost the ability to read.
I've also seen a screen with brightness all the way down.
And (this one puzzled me for a minute) the computer has 2 video outlets and meaningful results require plugging into the right one.
Imagine if the map didn't get updated for two weeks so Plod phones the IT company and it turns out an rsync job has got stuck so no new data got delivered. There was a lock preventing two attempts at the same time
The rsync job was wrapped in a timer of a few hours to enforce complete or quit.
There's some truth in that. There are also poor configurations and poor understanding of what people use.
And there's a whole lot of attitude around "there can't be any security problem with our work and if anybody says there is we will reject their ideas". Security staff are wasting their time in an organisation that won't fix anything .
Aren't the most useful details of a printer where it is and what kind it is?
I've been asked to support a printer by someone who couldn't tell me anything about it at all. I resorted to sending test print jobs to the printers I could reach online asking whoever found them to phone me.
