Posts by A random security guy

Hash snag: Security shamans shame SHA-1 standard, confirm crucial collisions citing circa $45k chip cost

Linus Torvalds dismissed concerns about attacks on Git SHA-1 hashes

Come again?

Tracking President Trump with cellphone location data, Greta-Thunberg-themed malware, SharePoint patch, and more

Re: "Greta" malware

Was watching The Crown where the much respected Churchill denies the impact on London's air due to the burning of huge amounts of coal. He just calls it "Weather". Finally backs down when he realized someone close to him gets killed AND he could make political capital out of the situation.

I bet the oil companies haven't figured out how to take advantage of the climate crises; the moment they do they will be screaming 'Global Warming cause neutrons to fall apart".

Don't Xiaomi pics of other people's places! Chinese kitmaker fingers dodgy Boxing Day cache update after Google banishes it from Home

Cache access problem without authentication?

Nowhere did I see any mention of cache access authentication. I think the problem is way deeper and they are just hoping that using unique ID's will make the problem go away. This is what GDPR and CCPA are slowly but surely addressing. I doubt that if the fix is simple else Google would not have disabled integrations; bugs (and even security bugs) occur frequently and are patched all the time. There must have been something more systemic.

VMware warning, OpenBSD gimme-root hole again, telco hit with GDPR fine, Ring camera hijackings, and more

Re: Upgrades

XP is still alive. Many PoS and ATM terminals still have it. And they are getting hacked all the time.

Ever wonder how hackers could possibly pwn power plants? Here are 54 Siemens bugs that could explain things

In theory, yes. In practice, the said infrastructure can span miles of wiring. The information has to be sent to other systems. Nothing is isolated.

Re: Asking the obvious question...

If you look at VPN related CVE’s you would realize that there is nothing like high security VPN especially if the software is not patched.

Valuable personal info leaks from Facebook – not Zuck selling it, unencrypted hard drives of staff data stolen

Serious compliance problem

This all comes from the top; they play fast and loose with all personal data. Given their revenue and size, by now Payroll/Accounting and HR should have had multiple levels of security and audit, including alerts on data exports, inability to connect foreign drives, inability to even bulk download data to drives, etc.

I have seen much smaller (and definitely less techie) organizations do a better job controlling access. They must have violated a few California laws. There are also SOX/GLBA issues since these breaches materially impact the company.

Next year will be interesting as CCPA will kick in. FB is, obviously, wanting to gut the law. Happy that I turned down their job offer. Being a security professional is hard enough, being tainted by FB would have made my future bleak.

Stop us if you've heard this one before: Yet another critical flaw threatens Exim servers

Surprised that this wasn't caught earlier.

Should be very simple to exploit.

Accept certain inalienable truths: Prices will rise, politicians will philander... And US voting machines will be physically insecure

Re: Blame Huawei

I ran the security team of a company (not disclosing it). The device ran a full linux and it had to start and record within 4 seconds.

A system can be fine-tuned to come up fast. Maybe they are using Windows with hard disk.

We finally got one! Russian 'fesses up to cracking bank servers, netting big bucks

Re: Russian? New York?

States rights and all that ...

Confused why Trump fingered CrowdStrike in that Ukraine call? You're not the only one...

President of the US clueless

First he is clueless about the tech

Next he shows how clueless he is to a foreign head of state

Furthermore the foreign head of state praises him and has him eating out of his hands

Then he gives Ukraine $400m in military aid to attack his competitor's son in exchange for the investigation. $400m of our money.

FedEx execs: We had no idea cyberattack would be so bad. Investors: Is that why you sold $40m+ of your own shares?

No one will go to prison

The SEC will settle this for a 1 time fee and 'continued monitoring'.

D-Link, Comba network gear leave passwords open for potentially whole world to see

DLink agreed to make security enhancements with the FTC

https://www.ftc.gov/news-events/press-releases/2019/07/d-link-agrees-make-security-enhancements-settle-ftc-litigation

All our agreements, enforcements, and settlements are a joke.

The very fact that they were unreachable for security issues means that they have already flouted the FTC agreement:

Smart home products manufacturer D-Link Systems, Inc., has agreed to implement a comprehensive software security program in order to settle Federal Trade Commission allegations over misrepresentations that the company took reasonable steps to secure its wireless routers and Internet-connected cameras.

GitHub upgrades two-factor authentication with WebAuthn support

Re: More or less secure

Hopefully there is a pin to protect the hardware and the hardware is built to protect keys and passwords and to destroy them after X number of tries.

Apple blinks on iPhone repairs, touts parts program for independent tech mechanics... sort of

Fixing phones

My observations

Some fixes are easy, some aren’t. For example,

Battery replacement: Easy

Changing lightning connector assembly: very difficult

Finding new original parts: extremely difficult

I had to settle for a used/refurbished lightning assembly.

Glad Apple is being forced to supply these parts.

It makes sense for Apple to require an Apple certified technician as these repairs are hard.

I have repaired countless phones for me and my friends and have always had problems finding parts.

I wonder if I’ll be able to buy these parts. Next step: upgrade the flash.

Google security crew sheds light on long-running super-stealthy iOS spyware operation

Re: So, can we know...

Website: It is far more effective to hack websites that are poorly administered rather than websites you control to prevent a direct trail to you. Hackers employ indirection to prevent casual administrators from determining who is running the CnC operations. A skilled forensics person will be able to do a better job. But that takes money. Better is to rebuild the website.

Entire populations: State sponsored?

Targeting ethnic groups? Implies state sponsored.

Targeting people BORN in certain geographical regions? => state sponsored.

Longevity of operation is years? State sponsored?

Only monitoring for years? State Sponsored?

Exploits worth more than $20M? State sponsored?

These exploits would have been worth a lot of money.

For Foxit's sake: PDF editor biz breached, users' passwords among stolen data

At least 6 and at most 20 characters long

In this day and age of unstructured data, 20 characters seems like a stupid upper limit. All they have to do is google minimum password strength and out pops 8 characters. For 20 characters to be truly effective, they need to be chosen randomly. A highly unlikely scenario.

Are US border cops secretly secreting GPS trackers on vehicles without a warrant? EFF lawyers want to know

Maybe I could start a screening service?

Would it be legal to start a screening service that tells customers if their vehicles are being tracked or not?

Microsoft: Reckon our code is crap? Prove it and $30k could be yours

Not very profitable.

First you have to find the issues. Then you have to write the proof-of-concept that shows how you can do remote code execution. Then you have to convince MSFT that it is a real bug. Moreover, if it requires chained exploits you have to give up the other exploits.

Thanks MSFT. Will look at your stuff maybe later. When I can convince my engineers to actually use Windows.

Chrome add-on warns netizens when they use a leaked password. Sometimes, they even bother to change it

It is just password; wait for biometrics related credentials stuffing

When you have to chop off your fingers or get rid of eyes ...

https://www.vpnmentor.com/blog/report-biostar2-leak/

Not very Suprema: Biometric access biz bares 27 million records and plaintext admin creds

Storing fingerprints in clear-text?

Whoever thought of storing biometrics in clear was smoking something. You have to process them and store only the processed information, not the whole image. Theft of fingerprints mean that anyone can masquerade as you; they can murder someone and leave fingerprints that look like yours.

You can easily secure America's e-voting systems tomorrow. Use paper – Bruce Schneier

Physical security

There is a reason why all governments use special couriers to send specially secured documents. One time pads are still being used.

Re: Trust

Have they done anything in the last 1 year?

It's 2019 – and you can completely pwn millions of Qualcomm-powered Androids over the air

Secure code enforcement issues

Remember: if we don't fix these issues the government will step in. In this case I think this may not be a bad thing.

What I have seen while working with large organizations, especially SoC vendors:

1. Code is considered a money pit.

2. Getting the code out in time is more important than quality.

3. Huge sections of code are zealously guarded. Try getting access to BRC WiFi code for their WiFi chips.

4. A flawed view of Performance trumps integer overflow/underflow, null pointer checks, buffer size checks, return value checks. A good CPU can perform these checks with no measurable impact on performance but ...

5. Static code analysis is generally turned off, especially for kernel and driver level code because software engineers get too many warnings (go figure). In one cellular modem company they turned off Klockwork static code analysis as it was giving too many warnings. In another they would not use it as people were UPSET that their code was being flagged. So it was turned off.

What Google can do is easier said than done:

1. Require all drivers go to through third-party code inspection (Samsung and others may not trust Google).

2. Require all driver vendors to submit static code analysis and other code inspection summaries

3. Provide a timeline for delivering fixes to Google.

4. Go public with the issues if the code is not fixed according to schedule.

5. The cell-phone manufacturers deliver a plan to deliver the fixes on time

6. Stick to the plan.

Then do the same for other critical code.

Problems? Asking Samsung, Qualcomm, and others to do anything is difficult (as in the Japanese way of saying something is difficult). Samsung, after all is the biggest company in S. Korea.

It's a bird! It's a plane! No, it's two-dozen government surveillance balloons over America

Re: Hmm! Balloons at 65.000 ft?

Your options are limited: AA gun (120mm M1) and limited to the US government, SAM (limited access), and homing balloons.

Shotgun? In the good old South they would take pot-shots at the blink lights on smart meters because people thought they were aliens.

Re: Sierra Nevada Corporation

Why go after terrorists in Afghanistan if you can go after the ones in the US. Unfortunately, they are not. They are going after all of us.

It is for own safety and we should have nothing to hide </sarcasm>

I hate to say this but the Military Industrial Complex has actually some validity versus my field of computing where we have sold our soul to the government, FB, Google, Amazon, etc. for no benefit in the long run.

Another rewrite for 737 Max software as cosmic bit-flipping tests glitch out systems – report

This is strange an frightening.

Worked on critical infrastructure and fully redundant systems for years. The issue is that memory failure, cpu failures, io failures, storage failures, etc. are common.

These idiots didn’t have all this worked out and just slapped two systems to go into master/slave mode.

There will be more issues going forward. Doesn’t make me feel confident about their ability to design redundancy into their computing systems.

$9 engineers can’t do it.

Backdoors won't weaken your encryption, wails FBI boss. And he's right. They won't – they'll fscking torpedo it

Stalin would be so proud of him

What could go wrong. Cops show up and demand access. If you are honest you should have nothing to hide. </sarcasm>

Microsoft demos end-to-end voting verification system ElectionGuard, code will be on GitHub

All the source code open sourced?

Just wondering if ALL the source including the OS, drivers, communication protocols, etc. will be open sourced or just the voting application. This is not a trivial project. If MSFT decides to open source everything, good. Else democracy will be held hostage to a trillion dollar company.

Patch now before you get your NAS kicked: Iomega storage boxes leave millions of files open to the internet

What part of UPnP did you not get? </Sarcasm>

The UNIVERSAL means everyone can plug it in any ANYONE can play with it. Woe be to anyone who prevents hackers from accessing it.

More seriously, I was at Sun during the Java wars and attended a UPnP conference in Redmond. Strangely enough, one of their main architects happened to sit next to me during lunch. So I point blank asked him if UPnP had any security. And he answered honestly that they had none and they were probably never going to even though it was a bad idea. That time MSFT was gong-ho about functionality and security be damned. It has changed since then but the detritus is still floating around.

D-Link must suffer indignity of security audits to settle with the Federal Trade Commission

D-Link should have been banned from doing business

A company that claims its routers are secure and does not take any of the generally accepted practices for ensuring security should be banned from doing business.

D-Link got off rather lightly. Maybe we have to depend on our estranged neighbors from across the pond to stuff GDPR down their throats. Our tools and our organizations are too weak.

Must watch: GE's smart light bulb reset process is a masterpiece... of modern techno-insanity

Re: It might make sense though..

I wish I could hack the switch.

Hacking these medical pumps is as easy as copying a booby-trapped file over the network

Most murders are committed by people who know the victim.

Hacking a pump would be the perfect crime.

Mad at your wife/husband? Mad at your boss? Got fired?

Ransomware to get some extra cash?

Are they on pacemakers?

Can you attack an entire population?

Questions that every security guy has to worry about.

Re: Pumps

Windows 2007 is going eol starting 2020. A huge number of systems use windows.

The reasons for using windows? It is called Microsoft business muscle.

Re: Honestly, at least in .us. .

That is way more advanced than the systems I have seen.

Re: isolated networks?

It is very hard to truly isolate systems. Information needs to be transferred between LIS and HIS systems; your lab results from some remote lab, your vitals, your EMR, your nurse’ notes, etc. need to be all looked at by your physician.

The pharmacist downstairs may need to verify the actual drug dosage.

Connected systems improve patient outcomes.

Unless they get hacked.

Yubico YubiKey lets you be me: Security blunder sparks recall of govt-friendly auth tokens

Re: Normal software standards

At least they could have set it to all zeros or something first. Maybe it was taking too long to fill up the buffer. I guess they could not have initialized the buffer to a random state because the RNG was not yet initialized and producing the proper random numbers.

Facebook's at it again: Internal emails show it knew about Cambridge Analytica abuse 'months' before news broke

Facebook’s New App Will Pay You To Give Up Some Of Your Privacy

They promise not to collect anything personal. But they want to do everything you do on the phone.

Target: India and the US currently.

Prior history: They had an app that slurped user information and were kicked out by Apple.

Have they asked the Indian government person to monitor its citizens? Would like to know what they think. Why didn't they start with the UK or Europe? They have more money. Or would GDPR cause them grief.

Not very bright: Apple geniuses spend two weeks, $10,000 of repairs on a MacBook Pro fault caused by one dumb bug

Cheap as far as bug fixing is concerned

$10K for finding and fixing a bug (or at least finding the root cause) is peanuts. The rule of thumb is around $80K.

You. Quest and LabCorp. Explain these medical database super-hacks, say US senators as 425,000 more people hit

Re: even worse

Wow!!! So they probably have records of people who failed drug or HIV tests.

They. Don't. Care.

Neither the execs nor the major stockholders nor the politicians really care. They look at bottom line numbers. Execs' bottom line is their bonus and options, the stock holders for revenue numbers, and the politicians for the PAC donations.

They give lip-service to security. Even Intel's now Ex-CEO (Brian K) doesn't go to prison. Equifax? The less said the better.

Crime doesn't pay? Crime doesn't do secure coding, either: Akamai bug-hunters find hijack hole in bank phishing kit

Re: confused

They could be leaving backdoors or maybe writing water-tight code is a different art form?

Good hackers aren't always good coders ...

The two types are diametrically opposite even though A secure coder has a healthy respect for hackers and vice versa. But in my years, I never found a good white hat hacker to actually produce beautiful and secure code. They are very good at breaking things. I like it that way since they don't have a stake in building something secure, they don't have a bias. Any opinions? Maybe my data set is too small.

You go that way, we'll go Huawei: China Computer Federation kicks back at IEEE in tit-for-tat spat

Re: Huawei phones

Tracking all the activities of 320M people at a microscopic level (apps, cameras, videos, motion, location, messages,, emails) would endanger the US. 320M is not a large number from a computational perspective. And remember, all the information is available to the Chinese govt. As Cambridge Analytica clearly showed, just Facebook profiles are sufficient to manipulate large populations. I can bet the Chinese govt. would spend a 100B to be able to manipulate the US. Which is why Huawei can undercut all the competition.

The Chinese have obliterated Tiananmen from the working memories of their people. They have been ruthless about brainwashing their Uighiar populations. They will have fun manipulating our MAGA supporters.

We ain't afraid of no 'ghost user': Infosec world tells GCHQ to GTFO over privacy-busting proposals

Re: "...for example to stop terrorists..."

Add the fact that this whole Brexit effort was engineered by Cambridge Analytica, Brexit fans are definitely on the gullible side. And they, like trump supporters, fell for similar messages.

Mozilla returns crypto-signed website packaging spec to sender – yes, it's Google

Re: Can we get Web caching back, please?

I think I understand where you are coming from. HTTPS can do encryption and/or authentication of the traffic, not of a web page per se. HTTPS does guarantee the source and freshness of the page. HTTP can easily be hijacked with an MITM attack and older or wrong pages inserted in the stream.

That squid you so love: perfect MITM tool. And you do know how many of our routers are entirely hackable. So your DNS query can return an IP address for a server in some other country.

Even if a page is signed, it may be older than the latest version. What will end up happening is that you will have to reinvent something similar to HTTPS to make sure the pages arrive in order from the right server.

Re: Hmmm man in the middle?

Worse: if I know that an older page had a vulnerability but the new one didn't I'd ship you the old one. Since you are trying very hard not to hit the original server, You will get exploited.