Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

Post reply on HN
Print view View original

281–290 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#281

Post by kps »

dandare wrote: post #258
ccurrens wrote: post #2

> If you find password protected zips in the release the password is probably either "Intel123" or "intel123". This was not set by me or my source, this is how it was aquired from Intel. Can't say I'm surprised, people are lazy. Another large tech company I used to work for commonly used an only-slightly more complex password. But it was never changed, so people who had left the team still could have access to things…

A company I know insists on rotating passwords fairly often. Everybody just increases the number at the end of their favourite password, i. e. intel1255

I once worked at a place that required passwords to be changed every month and contain at least one upper and lower case letter, digit, and punctuation, and not match any previous password.

So the password for August, 2020 would be “August, 2020”.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#282

Post by kps »

akira2501 wrote: post #100
orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

A manufacturer wanted to upgrade one of their equipment lines to be more modern. The developers of the original product, both hardware and software, were no longer with the company. Since they just wanted to add some new features on top and present a better rack-based interface to the user, they decided to build a bigger box, put one of the old devices inside the box, then put a modern PC in there, and just link the…

Reminds me a little of a place I worked.

They sold very expensive devices that were actually an off-the-shelf 1U PC with custom software (which provided the real value). The problem — and this dates it — was that the PCs had a game port¹, which gave away that this custom hardware was really just a regular consumer PC. So they had some fancy plastic panels made to clip on the front and hide the game port.

¹ https://en.wikipedia.org/wiki/Game_port

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#283

Post by augusto-moura »

gspr wrote: post #125
hawkoy wrote: post #71

Earlier quoted context omitted.

Not reliable. Most people torrenting this are hopefully using a vpn.

Why?

Torrent is not the most private way of downloading things, because if you share your already downloaded binary you are posting your ip in a tracker as a leecher or seeder. You actually can see live what torrents (at least the most popular) are you downloading[1], the site is only tracking the most popular hashes, but is easy to some entity track this intel hash specifically

[1] https://iknowwhatyoudownload.com/en/peer/

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#285

Post by rodgerd »

myself248 wrote: post #97
marcosdumay wrote: post #36

Earlier quoted context omitted.

Usually this. Or in my workplace, an image. Antivirus are some crazy shit that may trigger on any random action and will teach people to follow the most unsafe procedures without questioning, so they can get anything done.

I've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.

The thing is, usability is security. People will do anything to be able to do their job (because people like being able to, you know, eat and stuff). Things that stop you doing your job are bad for security.

I wish more of the security industry would get their frigging heads around this. PGP did less for messaging security over decades of availability than iMessage and Signal did in a few weeks of availability.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#286

Post by brongondwana »

dlivingston wrote: post #134
bogidon wrote: post #80

Earlier quoted context omitted.

Yes, yes. Seems like an outdated term. Downvotes accepted.

Pick your battles. This isn’t a hill worth dying on (or even a hill worth getting slightly bruised on).

I have learned that flat out telling people that a hill isn't worth dying on tends to cause a bunch of corpses to collect up - if you don't want a molehill covered in bodies you need to persuade them to go die somewhere else.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#287

Post by kps »

Traster wrote: post #75

This is more embarrassing than harmful. Having worked at companies like intel, it's not really that damaging leaking some of this IP - the worst that happens is some open source project gets slightly better or you have a few more bugs (not that Intel are lacking in that area). The second we see internal marketing, pricing & road map slides- that's when you know they're in real trouble.

> Having worked at companies like intel

I've worked at a company very much like Intel¹ and the really closely guarded secret — the one where two vetted people turn the launch key at the same time — was the microcode patching keys.

¹ I'm not saying it was Intel, but it was Intel

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#288

Post by japgolly »

zeroimpl wrote: post #279
dcow wrote: post #275

Earlier quoted context omitted.

Again, I don't believe it's accurate or honest to call this coercion. These files were obtained from a content delivery network by visiting a url in a browser. Nothing deceptive, cunning, crafty, or coercive about it. Let me ask you, what files am I allowed to access on a public network? Must I ask owners permission before visiting their websites? Must I be able to find it with a search engine? What constitutes a fil…

Were the files listed when going to http://server.com ? No, the user had to: 1. Find the server via nmap 2. Guess at some URLs until the server finally responded with some hidden data. While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.

Exploration of public areas isn't illegal. There's no law mandating that viewing a website though the browser is legal, and any other means not. Techies legitimately access websites in all kinds of programmatic ways. Intel made their data publicly available. That it wasn't accidental doesn't change that.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#289

Post by triangleman »

xenophonf wrote: post #245
greedo wrote: post #215

Earlier quoted context omitted.

It's worse when the asshat convinces your manager that every internal site, whether dev or not needs https. Certs everywhere. Our team spends a decent % of our time generating and managing certs...

That’s me. I’m that asshat. It’s called defense in depth. I recommend automating certificate issuance and renewal. It’s totally worth it.

Book or tutorial recommendations please.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#290

Post by ummonk »

dcow wrote: post #198
dleslie wrote: post #17

Earlier quoted context omitted.

Of course it's not legal. This is exfiltrated intellectual property being shared without license.

I don't believe this is accurate or in any way obvious even if this is the stance the courts would ultimately take. These files were downloaded from a publicly available CDN server discovered while browsing the internet. No authorization mechanisms were bypassed, no computer systems were hacked. These files are the result of a GET request to an Akamai server that happened to be hosting the files. Despite how this wil…

If someone leaves their door unlocked and open it doesn't mean I have a right to walk in and take what I want.
Post reply on HN