As was foretold, we've added advertisements to the forums! If you have questions, or if you encounter any bugs, please visit this thread: https://forums.penny-arcade.com/discussion/240191/forum-advertisement-faq-and-reports-thread/
Options

[Computer Security Thread] CVEs, or "Crap! Vulnerabilities! Eughhhhh..."

1717274767795

Posts

  • Options
    MugsleyMugsley DelawareRegistered User regular
    So the proper answer is to be a capitalist and write a Cellebrite competitor?

  • Options
    PhyphorPhyphor Building Planet Busters Tasting FruitRegistered User regular
    Carpy wrote: »
    bowen wrote: »

    You also have to prove that it was Signal's app that caused it, and with the intention of fubaring your investigation. Would you say it's the fault of Microsoft that a lawyer is using a known vulnerable email client because they're not smart enough to understand or know better or use better tools when outlook runs code that fubars the machine and/or evidence because you left the preview pane on?

    If Microsoft knew the lawyer had the preview pane on and intentionally emailed the lawyer malicious code that would be run then yes. Like how is that even a question?

    Are you really asserting a 4th amendment right to counter hack the government? If the search is illegal then your recourse is to challenge the search itself. Altering, damaging, or degrading someone else's system is just going to lead you into trouble.

    Signal wants to damage Cellebrite's credibility and admissibility in court. They're going to do that through posts highlighting errors and vulnerabilities and disclosing PoCs to show how someone could theoretically mess with the chain of evidence. Maybe those PoCs fall off a truck in front of people who would use them and don't have a business to worry about.

    At no point is Signal going to intentionally release code that would damage someone's system just because their founder is irritated at some greyware firm.

    I would agree normally, but moxie marlinspike is a pretty unusual person

    Also releasing proof of vulnerabilities tends to get those vulnerabilities fixed and nothing else. That's not the goal

  • Options
    autono-wally, erotibot300autono-wally, erotibot300 love machine Registered User regular
    https://www.bbc.com/news/world-57394831
    The FBI began operating an encrypted device network called ANOM, and covertly distributed devices with the chat app among the criminal underworld via informants.

    The idea for the operation came after two other encrypted platforms were taken down by law enforcement agencies, leaving criminal gangs in the market for new secure phones.

    The devices were initially used by alleged senior crime figures, giving other criminals the confidence to use the platform.

    kFJhXwE.jpgkFJhXwE.jpg
  • Options
    nexuscrawlernexuscrawler Registered User regular
    The DOJ got most of the money back from the Colonial hack apparently. They're pretty light on details but said they tracked the Bitcoin wallets and seized one. MY guess is they'd have to have had an informant on the inside right?

  • Options
    SixSix Caches Tweets in the mainframe cyberhex Registered User regular
    The DOJ got most of the money back from the Colonial hack apparently. They're pretty light on details but said they tracked the Bitcoin wallets and seized one. MY guess is they'd have to have had an informant on the inside right?

    Or someone made a mistake, which may be more likely. Apparently the money sat in that wallet for a while, which is weird because why not move it?

    can you feel the struggle within?
  • Options
    zagdrobzagdrob Registered User regular
    Six wrote: »
    The DOJ got most of the money back from the Colonial hack apparently. They're pretty light on details but said they tracked the Bitcoin wallets and seized one. MY guess is they'd have to have had an informant on the inside right?

    Or someone made a mistake, which may be more likely. Apparently the money sat in that wallet for a while, which is weird because why not move it?

    If I had to guess, it's that the hack attracted a lot more attention than DarkSide expected or planned for. I wouldn't be surprised if this was normal for them to leave money in the wallet for a while before cashing it out. Not to mention breaking down their operations likely interfered with their 'typical' post-operation process.

    I also wouldn't be surprised if with the amount of heat they decided to wait for a while before going 'back' for the payout. Or just said fuck it and wrote off the takings from the hack as not worth the risk. Its not like this was a one-off or some incredible payday and they seem like a fairly cautious hacker group so their caution may have overridden their greed.

    Hard to really know for sure though.

  • Options
    nexuscrawlernexuscrawler Registered User regular
    Maybe they avoid dumping that amount of bitcoins into a tumbler at once and do it bit by bit to avoid attention.

  • Options
    bowenbowen How you doin'? Registered User regular
    Probably both of those to some degree.

    That's a lot of money all at once and would draw attention so you'd want to do it slowly over a long period of time if you could.

    not a doctor, not a lawyer, examples I use may not be fully researched so don't take out of context plz, don't @ me
  • Options
    LD50LD50 Registered User regular
    https://www.bbc.com/news/world-57394831
    The FBI began operating an encrypted device network called ANOM, and covertly distributed devices with the chat app among the criminal underworld via informants.

    The idea for the operation came after two other encrypted platforms were taken down by law enforcement agencies, leaving criminal gangs in the market for new secure phones.

    The devices were initially used by alleged senior crime figures, giving other criminals the confidence to use the platform.

    That's really cool. I like this a lot actually. They found a way to pursue criminals without passing legislation fucking up cryptography or by strong-arming legitimate companies into cooperating.

  • Options
    TetraNitroCubaneTetraNitroCubane The Djinnerator At the bottom of a bottleRegistered User regular
    edited June 2021
    One of the topics circulating the mainstream news currently is the RockYou2021 password list, a list of supposedly 8.4 billion passwords that has surfaced online.
    Based on comments from the user, the passwords in the collection range from 6 to 20 characters with non-ASCII characters and white spaces removed. The user actually claimed that the list has 82 billion passwords.

    But CyberNews refuted that claim, saying that its own test found around 10 times fewer entries, putting the figure closer to 8.4 billion. That's still a substantial number, especially considering that there are 4.7 billion active internet users around the world.

    I'm see a lot of people in unofficial channels say that this is greatly exaggerated, and that the list is itself overinflated with dictionary words. It's also likely that this data includes recycled credentials from previously know breaches and password dumps.

    The file itself is over 100 GB - and is a text file.

    TetraNitroCubane on
  • Options
    V1mV1m Registered User regular
    I hope you're not trying to imply that they'd lie about how many there were?

  • Options
    TetraNitroCubaneTetraNitroCubane The Djinnerator At the bottom of a bottleRegistered User regular
    V1m wrote: »
    I hope you're not trying to imply that they'd lie about how many there were?

    Do you think people would do that? Just go on the internet and tell lies?

  • Options
    TetraNitroCubaneTetraNitroCubane The Djinnerator At the bottom of a bottleRegistered User regular
    edited June 2021
    I'm struggling with determining which thread this news goes into. Is it computer security news? Is it international relations? Is it conspiracy theory related (spoiler: It's about to be)?

    John McAfee is dead.
    Anti-virus software entrepreneur John McAfee has been found dead in a Barcelona prison cell, just hours after a Spanish court agreed to extradite him to the US to face tax evasion charges.

    The Catalan Justice Department said prison medics tried to resuscitate him, but were not successful.

    It said in a statement that "everything indicates" Mr McAfee took his own life.

    A controversial figure, Mr McAfee's company released the first commercial anti-virus software.

    It helped to spark a multi-billion dollar industry in the computer world.

    TetraNitroCubane on
  • Options
    ShadowfireShadowfire Vermont, in the middle of nowhereRegistered User regular
    Everything related to McAfee has been conspiracy related for decades.

    WiiU: Windrunner ; Guild Wars 2: Shadowfire.3940 ; PSN: Bradcopter
  • Options
    CantidoCantido Registered User regular
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    3DS Friendcode 5413-1311-3767
  • Options
    SoggybiscuitSoggybiscuit Tandem Electrostatic Accelerator Registered User regular
    Cantido wrote: »
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    I bought my own modem, but I use and EdgeRouter and UniFi system for my house.

    General take: don’t rent unless you have no other choice. You will spend more in fees the first year than you would by just buying your hardware outright. If you have any custom needs a standalone modem is the best way to go.

    Steam - Synthetic Violence | XBOX Live - Cannonfuse | PSN - CastleBravo | Twitch - SoggybiscuitPA
  • Options
    schussschuss Registered User regular
    I mostly own so fucking Comcast doesn't rent me out as an access point.

  • Options
    SoggybiscuitSoggybiscuit Tandem Electrostatic Accelerator Registered User regular
    schuss wrote: »
    I mostly own so fucking Comcast doesn't rent me out as an access point.

    Suddenlink is doing this as well I think. A excellent reason to avoid ISP hardware as well.

    Steam - Synthetic Violence | XBOX Live - Cannonfuse | PSN - CastleBravo | Twitch - SoggybiscuitPA
  • Options
    TetraNitroCubaneTetraNitroCubane The Djinnerator At the bottom of a bottleRegistered User regular
    edited June 2021
    Recently, users of Wester Digital's MyBook external harddrives have been having a hard time. Many of them found their data completely wiped, and what's worse, found themselves completely locked out of their devices.

    Turns out some real crazy stuff has been going on.
    People who own and use a Western Digital My Book Live cloud storage device may want to disconnect it from the internet as soon as possible. As first reported by Bleeping Computer, a number of people worldwide who own the network-attached storage device took to the company's forum to report that all their files had been deleted. Terabytes' worth of data, years of memories and months of hard work vanished in an instant. The users couldn't even log into WD's cloud infrastructure for diagnosis, because their passwords were no longer working.

    Several owners looked into the cause of the issue and determined that their devices were wiped after receiving a remote command for a factory reset. The commands starting going out at 3PM on Wednesday and lasted throughout the night.

    Western Digital, for their part, initially claimed that individual accounts had been compromised by the fault of the users themselves. They quickly shifted to blaming malware for the situation in an official statement:
    Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers' data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available.

    Again, blame is implicitly laid at the feet of the users for allowing the malware to get in there in the first place.

    Well, it turns out that there were actually TWO day-0 flaws in the MyBook software from the get go, that were being leveraged to essentially take over and wipe the MyBook devices. There's a pretty thorough explanation on Ars here.
    Last week’s mass-wiping of Western Digital My Book Live storage devices involved the exploitation of not just one vulnerability but also a second critical security bug that allowed hackers to remotely perform a factory reset without a password, an investigation shows.

    The vulnerability is remarkable because it made it trivial to wipe what is likely petabytes of user data. More notable still was that, according to the vulnerable code itself, a Western Digital developer actively removed code that required a valid user password before allowing factory resets to proceed.
    The undocumented vulnerability resided in a file aptly named system_factory_restore. It contains a PHP script that performs resets, allowing users to restore all default configurations and wipe all data stored on the devices.

    Normally, and for good reason, factory resets require the person making the request to provide a user password. This authentication ensures that devices exposed to the Internet can only be reset by the legitimate owner and not by a malicious hacker.

    As the following script shows, however, a Western Digital developer created five lines of code to password-protect the reset command. For unknown reasons, the authentication check was cancelled, or in developer parlance, it was commented out, as indicated by the double / character at the beginning of each line.

    Deepening this mess is the fact that, by all accounts, the data loss is merely collateral damage. The malicious actors in question were likely just trying to gain control of the MyBook devices to establish a botnet. And making it even MORE complex, there may have been waring factions trying to fight each other for control of these devices.
    The discovery raises a vexing question: if the hackers had already obtained full root access by exploiting CVE-2018-18472, what need did they have for this second security flaw? There’s no clear answer, but based on the evidence available, Abdine has come up with a plausible theory—that one hacker first exploited CVE-2018-18472 and a rival hacker later exploited the other vulnerability in an attempt to wrest control of those already compromised devices.
    The most likely answer is that the mass wipe and reset was performed by a different attacker, very possibly a rival who either attempted to take control of the rival’s botnet or simply wanted to sabotage it.

    What a ride.

    TetraNitroCubane on
  • Options
    CantidoCantido Registered User regular
    Cantido wrote: »
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    I bought my own modem, but I use and EdgeRouter and UniFi system for my house.

    General take: don’t rent unless you have no other choice. You will spend more in fees the first year than you would by just buying your hardware outright. If you have any custom needs a standalone modem is the best way to go.

    I would be interested in recommendations for broadband modems or modem/router hybrids, then.

    3DS Friendcode 5413-1311-3767
  • Options
    OrcaOrca Also known as Espressosaurus WrexRegistered User regular
    Cantido wrote: »
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    I use my own modem and a separate router so the limit of ISP control is my modem.

    I use used to use a Motorola SB6260 (hazy in exact model) but that finally failed after 8 years. I replaced it with an Arris S33.

    In all cases, check your ISP’s compatibility list before you buy your modem.

  • Options
    CantidoCantido Registered User regular
    Orca wrote: »
    Cantido wrote: »
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    I use my own modem and a separate router so the limit of ISP control is my modem.

    I use used to use a Motorola SB6260 (hazy in exact model) but that finally failed after 8 years. I replaced it with an Arris S33.

    In all cases, check your ISP’s compatibility list before you buy your modem.

    Damn. I move around a lot for work.

    3DS Friendcode 5413-1311-3767
  • Options
    OrcaOrca Also known as Espressosaurus WrexRegistered User regular
    Cantido wrote: »
    Orca wrote: »
    Cantido wrote: »
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    I use my own modem and a separate router so the limit of ISP control is my modem.

    I use used to use a Motorola SB6260 (hazy in exact model) but that finally failed after 8 years. I replaced it with an Arris S33.

    In all cases, check your ISP’s compatibility list before you buy your modem.

    Damn. I move around a lot for work.

    Run the numbers on rental then. If you can predict how long it will take to pay down it may still make sense to buy. If you're moving every 3 months it may be better for you to rent.

    I've seen cases where the rental fee is small enough that the payoff date is 3 years in the future. More frequently it's like within 6 months.

  • Options
    MugsleyMugsley DelawareRegistered User regular
    edited June 2021
    FiOS: we used Verizon's "modem/router" but I added my own router for wifi and general network connections. Yes, devices were double-NATted but that didn't affect things much since we weren't doing any LAN play. If we go back to FiOS, I intend to dig deep into whether I need their shit hardware at all.

    Comcast: I bought my own modem because fuck Comcast.

    Mugsley on
  • Options
    SixSix Caches Tweets in the mainframe cyberhex Registered User regular
    Mugsley wrote: »
    FiOS: we used Verizon's "modem/router" but I added my own router for wifi and general network connections. Yes, devices were double-NATted but that didn't affect things much since we weren't doing any LAN play. If we go back to FiOS, I intend to dig deep into whether I need their shit hardware at all.

    Comcast: I bought my own modem because fuck Comcast.

    In my last apartment with FIOS it depended on what services you wanted. For just internet, I didn’t need any of their hardware and could just use my router. If I wanted TV as well, I needed to use their router.

    can you feel the struggle within?
  • Options
    tsmvengytsmvengy Registered User regular
    Cantido wrote: »
    Orca wrote: »
    Cantido wrote: »
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    I use my own modem and a separate router so the limit of ISP control is my modem.

    I use used to use a Motorola SB6260 (hazy in exact model) but that finally failed after 8 years. I replaced it with an Arris S33.

    In all cases, check your ISP’s compatibility list before you buy your modem.

    Damn. I move around a lot for work.

    We have FIOS and I ret the modem/router because the break-even was more than two years (I believe) and they seem to come out with new models in about that timeframe.

    Regular old cable modem is a bit different because usually they are cheaper to buy and there isn't much reason to upgrade.

    steam_sig.png
  • Options
    TelMarineTelMarine Registered User regular
    edited June 2021
    Recently, users of Wester Digital's MyBook external harddrives have been having a hard time. Many of them found their data completely wiped, and what's worse, found themselves completely locked out of their devices.

    Turns out some real crazy stuff has been going on.
    People who own and use a Western Digital My Book Live cloud storage device may want to disconnect it from the internet as soon as possible. As first reported by Bleeping Computer, a number of people worldwide who own the network-attached storage device took to the company's forum to report that all their files had been deleted. Terabytes' worth of data, years of memories and months of hard work vanished in an instant. The users couldn't even log into WD's cloud infrastructure for diagnosis, because their passwords were no longer working.

    Several owners looked into the cause of the issue and determined that their devices were wiped after receiving a remote command for a factory reset. The commands starting going out at 3PM on Wednesday and lasted throughout the night.

    Western Digital, for their part, initially claimed that individual accounts had been compromised by the fault of the users themselves. They quickly shifted to blaming malware for the situation in an official statement:
    Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers' data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available.

    Again, blame is implicitly laid at the feet of the users for allowing the malware to get in there in the first place.

    Well, it turns out that there were actually TWO day-0 flaws in the MyBook software from the get go, that were being leveraged to essentially take over and wipe the MyBook devices. There's a pretty thorough explanation on Ars here.
    Last week’s mass-wiping of Western Digital My Book Live storage devices involved the exploitation of not just one vulnerability but also a second critical security bug that allowed hackers to remotely perform a factory reset without a password, an investigation shows.

    The vulnerability is remarkable because it made it trivial to wipe what is likely petabytes of user data. More notable still was that, according to the vulnerable code itself, a Western Digital developer actively removed code that required a valid user password before allowing factory resets to proceed.
    The undocumented vulnerability resided in a file aptly named system_factory_restore. It contains a PHP script that performs resets, allowing users to restore all default configurations and wipe all data stored on the devices.

    Normally, and for good reason, factory resets require the person making the request to provide a user password. This authentication ensures that devices exposed to the Internet can only be reset by the legitimate owner and not by a malicious hacker.

    As the following script shows, however, a Western Digital developer created five lines of code to password-protect the reset command. For unknown reasons, the authentication check was cancelled, or in developer parlance, it was commented out, as indicated by the double / character at the beginning of each line.

    Deepening this mess is the fact that, by all accounts, the data loss is merely collateral damage. The malicious actors in question were likely just trying to gain control of the MyBook devices to establish a botnet. And making it even MORE complex, there may have been waring factions trying to fight each other for control of these devices.
    The discovery raises a vexing question: if the hackers had already obtained full root access by exploiting CVE-2018-18472, what need did they have for this second security flaw? There’s no clear answer, but based on the evidence available, Abdine has come up with a plausible theory—that one hacker first exploited CVE-2018-18472 and a rival hacker later exploited the other vulnerability in an attempt to wrest control of those already compromised devices.
    The most likely answer is that the mass wipe and reset was performed by a different attacker, very possibly a rival who either attempted to take control of the rival’s botnet or simply wanted to sabotage it.

    What a ride.

    Years ago I bought a NAS drive and started putting my backups there. After backing up is complete, I just turn it off, so I use it as an offline backup storage.

    TelMarine on
    3ds: 4983-4935-4575
  • Options
    SoggybiscuitSoggybiscuit Tandem Electrostatic Accelerator Registered User regular
    Cantido wrote: »
    Orca wrote: »
    Cantido wrote: »
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    I use my own modem and a separate router so the limit of ISP control is my modem.

    I use used to use a Motorola SB6260 (hazy in exact model) but that finally failed after 8 years. I replaced it with an Arris S33.

    In all cases, check your ISP’s compatibility list before you buy your modem.

    Damn. I move around a lot for work.

    Usually, the Arris modems are broadly compatible. They will often advertise their compatibility on the box. The S33 Orca said they use is *supposed* to work on Cox/Spectrum/Xfinity which are the major providers. Compatibility may vary by area as well so that’s another thing to consider.

    It’s definitely a YMMV type thing if you are traveling a lot.

    Steam - Synthetic Violence | XBOX Live - Cannonfuse | PSN - CastleBravo | Twitch - SoggybiscuitPA
  • Options
    ShadowfireShadowfire Vermont, in the middle of nowhereRegistered User regular
    Cantido wrote: »
    Orca wrote: »
    Cantido wrote: »
    Household networking question:

    Do you all rent out the hybrid modem/router your ISP gives you or do you invest in your own modem, router or hybrid?

    I use my own modem and a separate router so the limit of ISP control is my modem.

    I use used to use a Motorola SB6260 (hazy in exact model) but that finally failed after 8 years. I replaced it with an Arris S33.

    In all cases, check your ISP’s compatibility list before you buy your modem.

    Damn. I move around a lot for work.

    Usually, the Arris modems are broadly compatible. They will often advertise their compatibility on the box. The S33 Orca said they use is *supposed* to work on Cox/Spectrum/Xfinity which are the major providers. Compatibility may vary by area as well so that’s another thing to consider.

    It’s definitely a YMMV type thing if you are traveling a lot.

    Netgear modems are as well, usually. And the firmware Comcast does for them, at least, doesn't hide the signal levels so you can always come at them with line problems and prove your point.

    Not that I know from experience.

    WiiU: Windrunner ; Guild Wars 2: Shadowfire.3940 ; PSN: Bradcopter
  • Options
    FeralFeral MEMETICHARIZARD interior crocodile alligator ⇔ ǝɹʇɐǝɥʇ ǝᴉʌoɯ ʇǝloɹʌǝɥɔ ɐ ǝʌᴉɹp ᴉRegistered User regular
    Crosspost from sysadmin thread:
    Feral wrote: »
    Big fuckup regarding a vulnerability in Microsoft Print Spooler. Short version: the PrintNightmare vulnerability was supposed to have been patched, but Microsoft's patch didn't work. Then a Chinese security research firm accidentally published an exploit for the vulnerability to github. They took it down, but not fast enough to prevent the code from making it into the wild. So now using the Print Spooler service to run remote code, including privilege elevation, on domain controllers is trivial. Anybody inside your domain could use a script to get domain admin rights.

    https://us-cert.cisa.gov/ncas/current-activity/2021/06/30/printnightmare-critical-windows-print-spooler-vulnerability

    The only recommended fix right now is to disable Print Spooler on all domain controllers.

    If you absolutely, totally, cannot do that, then there are two mitigations that researchers are recommending:

    1) use group policy to disable "Allow Print Spooler to accept client connections" on domain controllers. This will prevent remote printer management (eg, through the Print Services MMC). If you want to change any printer settings after that, you'll have to do it locally on that machine. https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/

    2) Add an NTFS "Deny" rule to C:\Windows\System32\spool\drivers. This will prevent anybody from installing, deleting, or updating printer drivers until the Deny rule is lifted. https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/

    every person who doesn't like an acquired taste always seems to think everyone who likes it is faking it. it should be an official fallacy.

    the "no true scotch man" fallacy.
  • Options
    CarpyCarpy Registered User regular
    REvil is executing a supply chain attack against MSPs and their customers. Looks like a malicious update to Kaseya VSA was used to distribute the payload.


  • Options
    TetraNitroCubaneTetraNitroCubane The Djinnerator At the bottom of a bottleRegistered User regular
    There's been a patch issued for the Print Spooler vulnerability, PrintNightmare. Highly recommend that all install it immediately.
    The security flaw, known as PrintNightmare, affects the Windows Print Spooler service. Researchers at cybersecurity company Sangfor accidentally published a how-to guide for exploiting it.

    The researchers tweeted in late May that they had found vulnerabilities in Print Spooler, which allows multiple users to access a printer. They published a proof-of-concept online by mistake and subsequently deleted it -- but not before it was published elsewhere online, including developer site GitHub.

    Microsoft (MSFT) warned that hackers that exploit the vulnerability could install programs, view and delete data or even create new user accounts with full user rights. That gives hackers enough command and control of your PC to do some serious damage.

    Windows 10 is not the only version affected -- Windows 7, which Microsoft has ended support for last year, is also subject to the vulnerability.

  • Options
    TetraNitroCubaneTetraNitroCubane The Djinnerator At the bottom of a bottleRegistered User regular
    edited July 2021
    Guess what?

    Just kidding! The rapidly deployed patch apparently doesn't fix a damn thing!
    An emergency patch Microsoft issued on Tuesday fails to fully fix a critical security vulnerability in all supported versions of Windows that allows attackers to take control of infected systems and run code of their choice, researchers said.

    The threat, colloquially known as PrintNightmare, stems from bugs in the Windows print spooler, which provides printing functionality inside local networks. Proof-of-concept exploit code was publicly released and then pulled back, but not before others had copied it. Researchers track the vulnerability as CVE-2021-34527.

    It is HIGHLY recommended that anyone running a Windows Operating system go into Services, and disable the print spooler until this is properly fixed.

    TetraNitroCubane on
  • Options
    ThawmusThawmus +Jackface Registered User regular
    I gotta say it's a good day to have CUPS for a print server.

    Twitch: Thawmus83
  • Options
    CarpyCarpy Registered User regular
    Variant Analysis is hard, especially with a PoC in the wild and a need to get a patch out

  • Options
    bowenbowen How you doin'? Registered User regular
    Thawmus wrote: »
    I gotta say it's a good day to have CUPS for a print server.

    Yeah like I'm at the mercy of my users at this point, I can't cut them off from printers. I wonder how difficult it'd be to spin up a linux print server at this point.

    not a doctor, not a lawyer, examples I use may not be fully researched so don't take out of context plz, don't @ me
  • Options
    ThawmusThawmus +Jackface Registered User regular
    bowen wrote: »
    Thawmus wrote: »
    I gotta say it's a good day to have CUPS for a print server.

    Yeah like I'm at the mercy of my users at this point, I can't cut them off from printers. I wonder how difficult it'd be to spin up a linux print server at this point.

    Not hard at all, it's just cups and samba. The pain in the ass would be installing drivers for printers that aren't very linux friendly and doing some testing with alternatives.

    Printing, as I'm sure you'll be shocked to find out, is shitty no matter your OS.

    Twitch: Thawmus83
  • Options
    ShadowfireShadowfire Vermont, in the middle of nowhereRegistered User regular
    bowen wrote: »
    Thawmus wrote: »
    I gotta say it's a good day to have CUPS for a print server.

    Yeah like I'm at the mercy of my users at this point, I can't cut them off from printers. I wonder how difficult it'd be to spin up a linux print server at this point.

    I would appreciate you doing so. Because as soon as you're done Microsoft will probably publish a proper patch.

    WiiU: Windrunner ; Guild Wars 2: Shadowfire.3940 ; PSN: Bradcopter
  • Options
    TetraNitroCubaneTetraNitroCubane The Djinnerator At the bottom of a bottleRegistered User regular
    T-Mobile has been hacked. Recent rumblings abound about the severity of the hack, but the potential is that it could wind up being quite bad.
    Communications giant T-Mobile said today it is investigating the extent of a breach that hackers claim has exposed sensitive personal data on 100 million T-Mobile USA customers, in many cases including the name, Social Security number, address, date of birth, phone number, security PINs and details that uniquely identify each customer’s mobile device.

    On Sunday, Vice.com broke the news that someone was selling data on 100 million people, and that the data came from T-Mobile. In a statement published on its website today, the company confirmed it had suffered an intrusion involving “some T-Mobile data,” but said it was too soon in its investigation to know what was stolen and how many customers might be affected.
    Und0xxed said the hackers found an opening in T-Mobile’s wireless data network that allowed access to two of T-Mobile’s customer data centers. From there, the intruders were able to dump a number of customer databases totaling more than 100 gigabytes.

    They claim one of those databases holds the name, date of birth, SSN, drivers license information, plaintext security PIN, address and phone number of 36 million T-Mobile customers in the United States — all going back to the mid-1990s.

    The hacker(s) claim the purloined data also includes IMSI and IMEI data for 36 million customers. These are unique numbers embedded in customer mobile devices that identify the device and the SIM card that ties that customer’s device to a telephone number.

    Is it even legal to store SSNs in cleartext?

  • Options
    OrcaOrca Also known as Espressosaurus WrexRegistered User regular
    I can’t wait for my useless credit protection to get extended another few years.

Sign In or Register to comment.