Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

Post reply on HN
Print view View original

331–340 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#331

Post by Buge »

andreareina wrote: post #303
kbenson wrote: post #300

Earlier quoted context omitted.

Sometimes the point isn't technical, but social. So MD5 isn't used for security purposes right now. At some point someone will want some hashing function, and they'll probably look at what the code already uses. The last thing you want is someone a bit clueless goi g "it was good enough there, it's good enough here" and using MD5 where they shouldn't. Removing it from a codebase helps with that problem. The problem h…

Isn't that what code review is for? To me that sounds like arguing against string formatting because someone could think it's ok for SQL queries. An auditor's job doesn't end at saying what things should be changed, it should include why as well (granted, we don't know the full content of the auditor's report here, maybe they did say why).

If someone is dumb enough to add it, someone is dumb enough to let it through code review.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#332

Post by souprock »

jasonladuke0311 wrote: post #302
triangleman wrote: post #289

Earlier quoted context omitted.

Book or tutorial recommendations please.

https://certbot.eff.org/

How could that work? For security, an internal site lacks a connection to the internet.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#333

Post by swiley »

pjc50 wrote: post #21
schmichael wrote: post #4

Earlier quoted context omitted.

Password protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password protected zips with a heaping dose of care as they may have been used to evade automated defenses.

Yes - but not for hostile purposes, but because your own company's antivirus won't let you mail an executable to a colleague.

Shouldn’t you put it in either eg artifactory or a code repo?

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#334

Post by souprock »

searchableguy wrote: post #312
greedo wrote: post #215

Earlier quoted context omitted.

It's worse when the asshat convinces your manager that every internal site, whether dev or not needs https. Certs everywhere. Our team spends a decent % of our time generating and managing certs...

I am confused. Isn't that easily automated?

It's not easily automated. Somehow, you have to safely get a certificate across the air gap to the internal network.

So I guess an internet-connected system grabs the certificates, then they get burned to DVD-R, then... a robot moves the DVD-R to the internal network? It's not easy. It's all much worse if the networks aren't physically adjacent. One could be behind a bunch of armed guards and interlocking doors.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#335

Post by mrweasel »

searchableguy wrote: post #312
greedo wrote: post #215

Earlier quoted context omitted.

It's worse when the asshat convinces your manager that every internal site, whether dev or not needs https. Certs everywhere. Our team spends a decent % of our time generating and managing certs...

I am confused. Isn't that easily automated?

We have a ton of internal stuff, most of it doesn’t even have external DNS. We use long lived certs signed with our own CA. we’d prefer using and automated solution, using a “real” CA, but non seems to be available.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#336

Post by NegativeLatency »

akira2501 wrote: post #104
myself248 wrote: post #97

Earlier quoted context omitted.

I've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.

> If you force users to trade convenience for security I _wish_ it was better security they were making the trade for. It often isn't though. These programs are large, expensive, and don't do much most of the time. I feel there's a perverse incentive for developers to make their AV products as noisy as is possible to justify their own existence. And yet.. even with full AV rollouts locked down at the highest level, b…

There was that one AV with a JS interpreter running as root

https://news.ycombinator.com/item?id=22544554

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#337

Post by Legogris »

johnklos wrote: post #42
svnpenn wrote: post #14

Someone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21

You can't download from mega.nz unless you have their "downloader" app or an account, or if you have Firefox or Safari. It's useless. The torrent works.

It's the other way around re ff/chrome

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#338

Post by manmal »

heavenlyblue wrote: post #165
skissane wrote: post #135

Earlier quoted context omitted.

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

You don’t actually need to listen to auditors. People like you (who can’t be bothered to argue because it’s apparently too hard) is the reason that smartass is still selling their services.

In some companies, you do. Medical certifications require regular audits, and failing an audit is _not_ good.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#339

Post by biddlesby »

totetsu wrote: post #243
hawkoy wrote: post #71

Earlier quoted context omitted.

Not reliable. Most people torrenting this are hopefully using a vpn.

so.. I shouldn't have clicked that link on my office network?

All good, just make sure to restart your computer at the next available opportunity

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#340

Post by reallydontask »

andreareina wrote: post #301
waheoo wrote: post #280

Earlier quoted context omitted.

I agree with your sentiment in general, but this is telling a dumbass where to go. Its not a hard argument to win. Md5 here is fine, its not a security check.

Not hard to win if everyone is being reasonable. Given an auditor that thinks all uses of MD5 are proscribed, what would you put the odds of them being reasonable at? ETA: per 'kbenson it's not hard to conceive of a situation where proscribing MD5 is reasonable. Taking 'skissane's account at face value is probably reasonable, but my implicit assumption that the auditor would not explain if pressed isn't being charita…

indeed

Specially with the audit/pen test theatre where they have to put something in the report, otherwise why are they getting paid £20K for two days work?

So most people choose the past of least resistance, when it doesn't matter much, so that you fight where it does.

Post reply on HN