Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

Post reply on HN
Print view View original

341–350 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#341

Post by raverbashing »

kbenson wrote: post #300
waheoo wrote: post #280

Earlier quoted context omitted.

I agree with your sentiment in general, but this is telling a dumbass where to go. Its not a hard argument to win. Md5 here is fine, its not a security check.

Sometimes the point isn't technical, but social. So MD5 isn't used for security purposes right now. At some point someone will want some hashing function, and they'll probably look at what the code already uses. The last thing you want is someone a bit clueless goi g "it was good enough there, it's good enough here" and using MD5 where they shouldn't. Removing it from a codebase helps with that problem. The problem h…

The reason they ask is that they have to fill a checkbox that says "no MD5" and of course they're don't know that CRC32 is worse

And to be very fair, a lot of security issues would be caught with basic checkbox ticking. Are you using a salted password hashing function instead of storing passwords in plaintext? Are you using a firewall? Do you follow the principles of least privilege?

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#342

Post by mschuster91 »

souprock wrote: post #332
jasonladuke0311 wrote: post #302

Earlier quoted context omitted.

https://certbot.eff.org/

How could that work? For security, an internal site lacks a connection to the internet.

Internal sites? Set up your own CA infrastructure.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#343

Post by somehnguy »

anaphor wrote: post #87
svnpenn wrote: post #14

Someone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21

"Invalid magnet URI" from rtorrent

Works fine in Transmission

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#344

Post by dcow »

dleslie wrote: post #292
dcow wrote: post #262

Earlier quoted context omitted.

This isn't slipping through various open doors. There were no doors . This is literally a public server on the public internet serving files publicly. Intel is grossly negligent in securing their assets if they're hosting what they consider to be confidential trade secrets on public CDN servers. The analog would be if I posted a flyer on a telephone pole with what I considered confidential information and someone els…

> This is literally a public server on the public internet serving files publicly. The flyer analogy does not work because the services were not broadcasting or otherwise advertising their presence. Following the house analogy, the thief tested all the front doors on the street and opened those which were not locked.

Then search engines must not be legal. They crawl the public internet and index what they find.

What you’re effectively saying is that the flyer is unknowable unless a Street-view car drove past and snapped a picture of it and its owner engaged in SEO to make sure it landed near the top of search results.

There is no “house” in this analogy (which you might call a corporate/private network secured or otherwise). No private network was accessed. This stuff was on the street, in the free pamphlet section of the newspaper stand.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#345

Post by roydivision »

astura wrote: post #317
nine_k wrote: post #298

Earlier quoted context omitted.

Windows development seems to be fun as of recently. Didn't touch it for couple of decades. Sometimes I think that modern Windows is a nice platform already, even comfortable. (Like, you know, C++17 is very unlike C++98.) But then I'm reminded of the necessity to run an antivirus in front of it in a corporate environment.

We have to have antivirus on our Linux computers for compliance. Yes such a thing exists... https://www.mcafee.com/enterprise/en-us/products/virusscan-e...

There are legitimate use cases for anti virus on Linux, for instance when running mail or file servers.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#347

Post by Akronymus »

Nasrudith wrote: post #250
totetsu wrote: post #242

Earlier quoted context omitted.

for not using gmail? The hooked me in school

For not sending binaries by email - there is no shame to being young in this case as it means never developing the bad habits. Before Dropbox and similiar it was far more a norm and various file sharing systems like SharePoint may wind up not actually used. Non-computer technical people often do so in companies all the time and practically use it as an ersatz version control system to the cringe of IT.

We "thankfully" have shared folders we can use to drop stuff to specific users.

But most of our software lives on a RDP server anyways.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#348

Post by gmac »

skissane wrote: post #135
orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

Funny: we had the exact same thing from a pen tester. I think we replaced it with SHA256, though.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#349

Post by faeyanpiraat »

biddlesby wrote: post #339
totetsu wrote: post #243

Earlier quoted context omitted.

so.. I shouldn't have clicked that link on my office network?

All good, just make sure to restart your computer at the next available opportunity

How would that help?

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#350

Post by data_ders »

Sylamore wrote: post #299
Polylactic_acid wrote: post #225

Earlier quoted context omitted.

I have a feeling that these auditor people just make up bullshit when they can't find something real. The last few we have got have come up with total non issues marked as severe because they are easy to "exploit". Meanwhile I have been finding and fixing real security issues regularly. To be fair it would be extremely difficult for an external person to find issues in the limited time they have so the audit comes do…

One thing I learned when I worked in internal IT security when dealing with auditors was that they will boil the ocean to find an issue, so never be perfect and leave a few relatively easy but not obvious to spot issues for them to write up that don't actually affect the security of your environment. If you don't leave them this bait, they will spend weeks to find a trivial issue (like using MD5 to check for config f…

3D chess! I agree sometimes it feels as if the security review questions are just set-ups for follow-ups that they didn’t include in the initial form (for whatever reason)
Post reply on HN