https://twitter.com/deletescape/status/1291422841834016770 Hmm…
I’m completely ignorant about this but is it possible that they’re referring to a “debugging backdoor”?
[deleted]
20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
51–60 of 476 posts
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#52At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|
It seems like a thin line between a debugging feature and a backdoor; "merely a debugging server that could be enabled and allowed you to inspect internal state during runtime" seems like a backdoor to me, doubly so if it's network-accessible. If Intel has, say, an undocumented way to trigger a debug mode that lets you read memory and bypass restrictions (ex. read kernel memory from user mode, or read SGX memory), is that not a backdoor? Or is the name based on intent?
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#53[deleted]
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#54Someone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21
The countries of origin of the peers downloading that torrent is pretty cool to see. A fairly broad cross-section of the world.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#55Someone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21
You can't download from mega.nz unless you have their "downloader" app or an account, or if you have Firefox or Safari. It's useless. The torrent works.
> firefox works
> it's useless
does not compute
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#56Someone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21
You can't download from mega.nz unless you have their "downloader" app or an account, or if you have Firefox or Safari. It's useless. The torrent works.
A web app that only works in non-Chromium browsers isn't useless.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#57The bad news just doesn’t end for this company,does it?
Hmmm indeed
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#58At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|
We use the term “manhole” for those sorts of things
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#59The bad news just doesn’t end for this company,does it?
At this point it's just more 2020...
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#60Intel denies it was hacked: https://twitter.com/TheRegister/status/1291461942624677889
https://del.dog/sourcestatements.txt
source: They have a server hosted online by Akami CDN that wasn't properly secure. After an internet wide nmap scan I found my target port open and went through a list of 370 possible servers based on details that nmap provided with an NSE script.
source: I used a python script I made to probe different aspects of the server including username defaults and unsecure file/folder access.
source: The folders were just lying open if you could guess the name of one. Then when you were in the folder you could go back to root and just click into the other folders that you didn't know the name of.
deletescape: holy shit that's incredibly funny
source: Best of all, due to another misconfiguration, I could masqurade as any of their employees or make my own user.
deletescape: LOL
source: Another funny thing is that on the zip files you may find password protected. Most of them use the password Intel123 or a lowercase intel123 source: Security at it's finest.