Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

Post reply on HN
Print view View original

181–190 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#181

Post by johnnyfaehell »

dogma1138 wrote: post #172
johnnyfaehell wrote: post #126

Earlier quoted context omitted.

Say we use the Microsoft Windows code that got leaked, was anyone black listed for that? Also, I would assume other processor companies hire people from other processor companies and everyone all wants the best, most of the basic knowledge would have already made it's way to AMD and other companies.

But that isn’t basic knowledge, if you work in firmware development, embedded, SOC design etc. and your employer or future employers might be competing against Intel in some market segment (which given the sheer amount of products Intel has isn’t an unlikely scenario) I would be very careful about admitting not to mention publishing content based on this leak. If you work in a completely unrelated field then you don’…

But if you've worked at Intel those should be part of your job for a majority of people and when they leave that knowledge goes to.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#182

Post by asddubs »

jopsen wrote: post #171
ccktlmazeltov wrote: post #146

Earlier quoted context omitted.

this is hilarious

Makes perfect sense. Defense in depth, if you can grep the source code and not find any references to md5, then you have quickly verified that the code probably doesn't use md5. This you can easily verify again later, you can even make a test for it :) Even if in practice this had no impact, removing md5 usage, will make it harder to accidentally introduce it in the future.

yeah I can see that, what if someone ends up being smart and re-using the verification procedure for a file that does have security impact, DRY right?

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#183

Post by the8472 »

jopsen wrote: post #171
ccktlmazeltov wrote: post #146

Earlier quoted context omitted.

this is hilarious

Makes perfect sense. Defense in depth, if you can grep the source code and not find any references to md5, then you have quickly verified that the code probably doesn't use md5. This you can easily verify again later, you can even make a test for it :) Even if in practice this had no impact, removing md5 usage, will make it harder to accidentally introduce it in the future.

The issue is not md5. The issue one wants to detect is weak hash functions used in cases where they're not appropriate. The fact that crc32 passed means that any obscure hash function would have passed too, even if it had been used in a context were it isn't appropriate.

All it means that the audit is superficial and doesn't catch the error category, just famous examples within that category. That kind of superficial sanning may be worth something when unleashed on security-naive developers or even as optional input for more experienced ones. But "hard compliance rules" and "superficial scans" combine to create a lot of busywork which makes people less motivated to work with auditors instead of against them.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#184

Post by Delk »

stefan_ wrote: post #38
pjc50 wrote: post #21

Earlier quoted context omitted.

Yes - but not for hostile purposes, but because your own company's antivirus won't let you mail an executable to a colleague.

Your company's antivirus, or GMail . A binary? A zip with a binary? Nuh-uh.

To be fair, emailing binaries (apart from known types such as images, PDFs, etc.) is a rare enough use case for legitimate purposes and an easy enough way of spamming malware to clueless random people that it's probably a reasonable default for gmail.

Having an option to allow them might be okay though. (I barely use gmail so I don't know if it has one or not.)

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#185

Post by Aaronstotle »

crdrost wrote: post #139
gspr wrote: post #125

Earlier quoted context omitted.

Why?

Because until this thing gets diffused and dissected by everyone and their mothers, the law is likely to view it as publication of confidential trade secrets, and people who can be confirmed to be spreading such things can get federal time, e.g. [1] for example. Using a VPN is the barest of mechanisms to try to obscure your identity to avoid this sort of punishment. [1] https://www.wsj.com/articles/SB1000142405297020…

I think there's a big difference between selling chemical secrets to a hostile government and this torrent. Namely, that no one is selling this information, it's available to anyone who can grab a magnet file.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#186

Post by therein »

jopsen wrote: post #171
ccktlmazeltov wrote: post #146

Earlier quoted context omitted.

this is hilarious

Makes perfect sense. Defense in depth, if you can grep the source code and not find any references to md5, then you have quickly verified that the code probably doesn't use md5. This you can easily verify again later, you can even make a test for it :) Even if in practice this had no impact, removing md5 usage, will make it harder to accidentally introduce it in the future.

    // We use MD5 to check if config files are changed. This is not used anywhere else.
    typedef DigestMD5 ConfigFileHasher;

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#187

Post by willis936 »

tartrate wrote: post #123
svnpenn wrote: post #14

Someone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21

I'd assume spreading this is not legal?

I’d assume it isn’t and just not talk about it loudly.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#188

Post by sjg007 »

marcosdumay wrote: post #36
pjc50 wrote: post #21

Earlier quoted context omitted.

Yes - but not for hostile purposes, but because your own company's antivirus won't let you mail an executable to a colleague.

Usually this. Or in my workplace, an image. Antivirus are some crazy shit that may trigger on any random action and will teach people to follow the most unsafe procedures without questioning, so they can get anything done.

Antiviruses will quarantine compiler output...

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#189

Post by sjg007 »

Delk wrote: post #184
stefan_ wrote: post #38

Earlier quoted context omitted.

Your company's antivirus, or GMail . A binary? A zip with a binary? Nuh-uh.

To be fair, emailing binaries (apart from known types such as images, PDFs, etc.) is a rare enough use case for legitimate purposes and an easy enough way of spamming malware to clueless random people that it's probably a reasonable default for gmail. Having an option to allow them might be okay though. (I barely use gmail so I don't know if it has one or not.)

Ah you must be young...

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#190

Post by [deleted] »

jopsen wrote: post #171
ccktlmazeltov wrote: post #146

Earlier quoted context omitted.

this is hilarious

Makes perfect sense. Defense in depth, if you can grep the source code and not find any references to md5, then you have quickly verified that the code probably doesn't use md5. This you can easily verify again later, you can even make a test for it :) Even if in practice this had no impact, removing md5 usage, will make it harder to accidentally introduce it in the future.

[deleted]
Post reply on HN