The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.

[Computer Security Thread] CVEs, or "Crap! Vulnerabilities! Eughhhhh..."

1909192939496»

Posts

  • SiliconStewSiliconStew Registered User regular
    edited May 7
    Carpy wrote: »
    Shadowfire wrote: »
    Not really. If you use a VPN because you're at a public WiFi access point (coffee shop, airport, whatever), this is a pretty big issue.

    The age-old security advice of don't connect to untrusted public wifi hasn't changed.

    The issue with public wifi was HTTP transmitting everything in cleartext, which has mainly been solved by browsers forcing everything into HTTPS and warning you before they'll open an HTTP site.

    TunnelVison doesn't change this either. You still have all the protections of your transport layer, you just lose the second encrypted envelope and the IP cloaking. It's a massive blow for people who legitimately need the privacy of a VPN on a hostile network and a big deal for enterprise but it doesn't change the fundamental risk profile of public wifi

    The issue with connecting to any untrusted network is it is a Man In The Middle. Which by definition potentially exposes you to all manner of man-in-the-middle attacks, which is what this is. This is not a novel discovery, it's just a PSA reminder that VPNs can't protect you from all MitM attacks and never did.

    SiliconStew on
    Just remember that half the people you meet are below average intelligence.
  • CarpyCarpy Registered User regular
    Are there specific public wifi mitm attack scenarios or incident reports that you're worried about?

  • LD50LD50 Registered User regular
    Carpy wrote: »
    Are there specific public wifi mitm attack scenarios or incident reports that you're worried about?

    Stuff like firesheep was pretty prevalent for awhile.

  • furlionfurlion Riskbreaker Lea MondeRegistered User regular
    https://www.datacenterdynamics.com/en/news/google-cloud-accidentally-deleted-unisupers-private-cloud-subscription/

    This is why redundant backups are so necessary. For quite possibly the first time in world history IT managed to convince upper management to not only have storage at two different locations, but to have further redundancy with an entirely separate service. The vague wording makes it clear no one is trying to lay blame directly which makes me think it was a fuck up on Google's end.

    sig.gif Gamertag: KL Retribution
    PSN:Furlion
  • Inquisitor77Inquisitor77 2 x Penny Arcade Fight Club Champion A fixed point in space and timeRegistered User regular
    The Cloud: We'll probably fuck up less, but boy howdy when we do...

  • LD50LD50 Registered User regular
    The Cloud: We'll probably fuck up less, but boy howdy when we do...

    I don't know about that. Since starting my current job our local datacenter only caught on fire once, but the Azure one has twice.

  • gavindelgavindel The reason all your software is brokenRegistered User regular
    Thermal events are just alternative winter heating!

    Book - Royal road - Free! Seraphim === TTRPG - Wuxia - Free! Seln Alora
  • USBPoetUSBPoet Stuck in the permafrost Chicago, ILRegistered User regular
    Learning cybersec is a headache until you print out an acronym cheatsheet. My courses got so much easier when I finally had a diagram for all the flarkin' acronyms!!

    bqujhi1171qx.png
  • IncenjucarIncenjucar VChatter Seattle, WARegistered User regular
    USBPoet wrote: »
    Learning cybersec is a headache until you print out an acronym cheatsheet. My courses got so much easier when I finally had a diagram for all the flarkin' acronyms!!

    A good habit because tech comes up with new acronyms faster than new ideas.

  • USBPoetUSBPoet Stuck in the permafrost Chicago, ILRegistered User regular
    Incenjucar wrote: »
    USBPoet wrote: »
    Learning cybersec is a headache until you print out an acronym cheatsheet. My courses got so much easier when I finally had a diagram for all the flarkin' acronyms!!

    A good habit because tech comes up with new acronyms faster than new ideas.

    Haha, yeah. Sometimes I wonder if I was born like, maybe 10 or 20 years earlier if it would have been easier to understand before things skyrocketed up.

    bqujhi1171qx.png
  • IncenjucarIncenjucar VChatter Seattle, WARegistered User regular
    USBPoet wrote: »
    Incenjucar wrote: »
    USBPoet wrote: »
    Learning cybersec is a headache until you print out an acronym cheatsheet. My courses got so much easier when I finally had a diagram for all the flarkin' acronyms!!

    A good habit because tech comes up with new acronyms faster than new ideas.

    Haha, yeah. Sometimes I wonder if I was born like, maybe 10 or 20 years earlier if it would have been easier to understand before things skyrocketed up.

    If anything it's gotten easier because the foundations have been laid, there's just a lot of noise. Plus developers are often narrowly focused because companies are more interested in cheap and fast over good and secure. Security is a lot of telling people to stop touching the hot stove just because it looks slightly different than the last stove.

  • LostNinjaLostNinja Registered User regular
    So I have been using Kaspersky for years. With it now out of service, and me not hearing great things about it’s automatic replacement, what is the general AV direction?

    For a while I recall the sentiment being Microsoft Defender is good now and quite adequate without needing a 3rd party. Is that still the case?

  • urahonkyurahonky Cynical Old Man Registered User regular
    I've been using BitDefender and really liked it.

  • Inquisitor77Inquisitor77 2 x Penny Arcade Fight Club Champion A fixed point in space and timeRegistered User regular
    LostNinja wrote: »
    So I have been using Kaspersky for years. With it now out of service, and me not hearing great things about it’s automatic replacement, what is the general AV direction?

    For a while I recall the sentiment being Microsoft Defender is good now and quite adequate without needing a 3rd party. Is that still the case?

    Default Windows is fine. You should just straight up uninstall Kaspersky and make sure it hasn't installed something else in its place: https://www.cnet.com/tech/services-and-software/kaspersky-antivirus-software-is-automatically-transitioning-to-ultraav/

    I use Bitdefender but that's just because I like some of the features it has to help me manage my mother's computer. Otherwise I'd be fine with just default Windows protection.

    The biggest thing you can do to protect yourself is to use Firefox + Ublock Origin on your PC, and then just avoiding shady stuff in general. You have a bigger risk of getting your authentication credentials stolen or getting socially engineered than by downloading a virus, and both of those things are managed best by getting something like 1Password and managing your own behavior.

  • LostNinjaLostNinja Registered User regular
    Thanks I’ll look into BitDefender too.

    Also I saw articles like that and didn’t let Kaspersky do the update to start downloading the weird replacement, and just fully uninstalled Kaspersky itself.

  • MugsleyMugsley DelawareRegistered User regular
    Yes, it is

  • furlionfurlion Riskbreaker Lea MondeRegistered User regular
    Anyone see that news about a pretty severe Linux bit of malware? Sets up shop to mine crypto because of course it does. It's called Perfctl. https://thehackernews.com/2024/10/new-perfctl-malware-targets-linux.html?m=1. Strange to see such a sophisticated payload targeted at the smaller user base and much more likely to notice Linux user.

    sig.gif Gamertag: KL Retribution
    PSN:Furlion
  • LD50LD50 Registered User regular
    furlion wrote: »
    Anyone see that news about a pretty severe Linux bit of malware? Sets up shop to mine crypto because of course it does. It's called Perfctl. https://thehackernews.com/2024/10/new-perfctl-malware-targets-linux.html?m=1. Strange to see such a sophisticated payload targeted at the smaller user base and much more likely to notice Linux user.

    They're targeting servers, which makes sense, as servers have more hardware power to throw at crypto mining than grandma's windows 8 laptop. Servers are usually headless, and lots of companies have enough of them that they don't really closely monitor them unless something is breaking.

  • TryCatcherTryCatcher Registered User regular
    Well, from two days ago, we are starting to see what everybody knew it was coming. AP reports that Delta Airlines is suing Crowdstrike:
    ATLANTA (AP) — Delta Air Lines sued CrowdStrike on Friday, claiming the cybersecurity company had cut corners and caused a worldwide technology outage that led to thousands of canceled flight in July.

    The airline is asking for compensation and punitive damages from the outage, which started with a faulty update sent to several million Microsoft computers. Delta said the outage crippled its operations for several days, costing more than $500 million in lost revenue and extra expenses.
    The U.S. Department of Transportation is investigating why Delta took longer to recover than other carriers. Transportation Secretary Pete Buttigieg said the department also would look into complaints about Delta customer service during the outage, including long waits for help and reports that unaccompanied minors were stranded at airports.
    Yeah, the US government is already very much involved, so is going to be bad. And both sides are tearing each other apart:
    “CrowdStrike caused a global catastrophe because it cut corners, took shortcuts, and circumvented the very testing and certification processes it advertised, for its own benefit and profit,” Delta said in the lawsuit, which was filed in Fulton County Superior Court in Georgia, near the company’s headquarters.

    A CrowdStrike spokesperson said the company tried to resolve the dispute — one of its lawyers said in August that CrowdStrike’s liability to Delta was less than $10 million.

    The spokesperson said Delta’s claims are based on “misinformation, demonstrate a lack of understanding of how modern cybersecurity works, and reflect a desperate attempt to shift blame for its slow recovery away from its failure to modernize its antiquated IT infrastructure.”

    10 million at that scale is a thinly-veiled insult. It doesn't matter if this is Delta trying to shift blame, if this is how Crowdstrike is going to deal with the pile of litigation against it, it only takes one judge to decide to just turn them into a smoking crater.

  • furlionfurlion Riskbreaker Lea MondeRegistered User regular
    I feel like this is pretty fitting for here. This is the data from have i been pwned of leaked passwords with a date in the yyyymmdd format. Someone on Reddit put it together. On the one hand, my birth year is the most popular as is true and right, on the other pretty disappointed in my fellow millennials at the stupid use of a date as a password.
    32mocxqx98sn.jpg

    sig.gif Gamertag: KL Retribution
    PSN:Furlion
Sign In or Register to comment.