Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

Post reply on HN
Print view View original

61–70 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#61

Post by kmeisthax »

gabcoh wrote: post #28
dleslie wrote: post #17

Earlier quoted context omitted.

Of course it's not legal. This is exfiltrated intellectual property being shared without license.

Is the person publishing this liable or just their source? Because this seems to be a hobby for the person publishing it and yet they also aren't concealing their identity. They list their former employer on their website.

Misappropriating trade secrets for financial gain is a punishable offense, and this data would qualify as a trade secret, at least for as long as it's not general knowledge to everyone or it has yet to be reverse-engineered. Aside from that, much of the data in these files has standard copyright and patent concerns.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#62

Post by [deleted] »

technonerd wrote: post #60
pdevr wrote: post #29

Intel denies it was hacked: https://twitter.com/TheRegister/status/1291461942624677889

https://del.dog/sourcestatements.txt source: They have a server hosted online by Akami CDN that wasn't properly secure. After an internet wide nmap scan I found my target port open and went through a list of 370 possible servers based on details that nmap provided with an NSE script. source: I used a python script I made to probe different aspects of the server including username defaults and unsecure file/folder acc…

[deleted]

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#64

Post by saagarjha »

somehnguy wrote: post #43
schmichael wrote: post #4

Earlier quoted context omitted.

Password protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password protected zips with a heaping dose of care as they may have been used to evade automated defenses.

Yes. Whenever I email or transfer a zip via any method really I always put a basic password on it. I've been bitten way too many times by dumb filters that pick some file out of the zip and declare that it is malicious. I also don't trust messenger apps to not pull my files out and do who knows what with them. A basic password prevents this junk 99% of the time for almost no effort. It won't stop a determined system…

Gmail doesn't seem to like archives it can't open :/

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#65

Post by dosshell »

dleslie wrote: post #17
gabcoh wrote: post #16

Is releasing this legal? It seems like this person isn't really disguising their identity or concerned about breaking the law. In their profile they even seem to brag about leaking company's code.

Of course it's not legal. This is exfiltrated intellectual property being shared without license.

Which country laws does apply? Is it really illegal to share this in the whole world? Im not so sure about that.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#66

Post by saagarjha »

johnklos wrote: post #42
svnpenn wrote: post #14

Someone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21

You can't download from mega.nz unless you have their "downloader" app or an account, or if you have Firefox or Safari. It's useless. The torrent works.

I thought Mega didn't work in Safari, because it wouldn't have enough cache or whatever in-memory thing it does?

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#67

Post by dleslie »

dosshell wrote: post #65
dleslie wrote: post #17

Earlier quoted context omitted.

Of course it's not legal. This is exfiltrated intellectual property being shared without license.

Which country laws does apply? Is it really illegal to share this in the whole world? Im not so sure about that.

Intel is an American company; so wherever there is an extradition treaty with the USA and where there are also similar laws.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#68

Post by samtheprogram »

crazypython wrote: post #56
johnklos wrote: post #42

Earlier quoted context omitted.

You can't download from mega.nz unless you have their "downloader" app or an account, or if you have Firefox or Safari. It's useless. The torrent works.

A web app that only works in non-Chromium browsers isn't useless.

Golly, it doesn't work in Chrome? What's the technical limitation here? Or did they just choose not to support it?

Asking because as someone who uses FF as their daily driver and is surprised something is supported in it that isn't in Chrome...

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#69

Post by jdminhbg »

yjftsjthsd-h wrote: post #52
orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

It seems like a thin line between a debugging feature and a backdoor; "merely a debugging server that could be enabled and allowed you to inspect internal state during runtime" seems like a backdoor to me, doubly so if it's network-accessible. If Intel has, say, an undocumented way to trigger a debug mode that lets you read memory and bypass restrictions (ex. read kernel memory from user mode, or read SGX memory), is…

I think the difference is whether it's something that's always enabled. You could presumably make it available or not at compile time, so the software shipped to a customer wouldn't have it, but maybe if they were having issues, you could ship them a version with the debug server with their permission.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#70

Post by bogidon »

SEJeff wrote: post #58
orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

We use the term “manhole” for those sorts of things

Ew
Post reply on HN