20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions • Hacker News Board

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#421

Post by waheoo » Fri, Aug 07, 2020, 12:03 PM UTC

Delk wrote: post #396

waheoo wrote: post #280

Earlier quoted context omitted.

I agree with your sentiment in general, but this is telling a dumbass where to go. Its not a hard argument to win. Md5 here is fine, its not a security check.

As a technical choice, that's true. So the argument shouldn't be hard to win, assuming you're dealing with reasonable people, who are also answering to reasonable people. Those people (e.g. the leadership) also need to care enough about that detail to just not dismiss your argument because making the change is not a problem for them. And they need to not be so security-oriented (in a naive way) as to consider a "safe…

Oh sorry, I thought we were discussing working with rational people.

If you're working with irrational people you're going to have to do irrational things, but that's kind of a given isn't it? We don't really need to discuss that.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#422

Post by GuB-42 » Fri, Aug 07, 2020, 12:30 PM UTC

skissane wrote: post #135

orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

Not only that but MD5 still doesn't have an effective preimage attack, so it is still good enough for things like hashing passwords or to check is someone else didn't tamper with your files.

Still, when it comes to security:

- MD5 is actually too fast for hashing passwords, but there is still no better way than bruteforce if you want to crack md5-hashed-salted passwords.

- Even if there is no effective preimage attack now, it is still not a good idea to use an algorithm with known weaknesses, especially if something better is available.

What MD5 is useless for is digital signature. Anyone can produce two different documents with the same MD5.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#423

Post by majewsky » Fri, Aug 07, 2020, 12:53 PM UTC

akira2501 wrote: post #104

myself248 wrote: post #97

Earlier quoted context omitted.

I've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.

> If you force users to trade convenience for security I _wish_ it was better security they were making the trade for. It often isn't though. These programs are large, expensive, and don't do much most of the time. I feel there's a perverse incentive for developers to make their AV products as noisy as is possible to justify their own existence. And yet.. even with full AV rollouts locked down at the highest level, b…

My guess/fear is that most AV software gets deployed because some insurance policy requires you to tick that box.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#424

Post by majewsky » Fri, Aug 07, 2020, 12:57 PM UTC

astura wrote: post #317

nine_k wrote: post #298

Earlier quoted context omitted.

Windows development seems to be fun as of recently. Didn't touch it for couple of decades. Sometimes I think that modern Windows is a nice platform already, even comfortable. (Like, you know, C++17 is very unlike C++98.) But then I'm reminded of the necessity to run an antivirus in front of it in a corporate environment.

We have to have antivirus on our Linux computers for compliance. Yes such a thing exists... https://www.mcafee.com/enterprise/en-us/products/virusscan-e...

There was a discussion in our IT Security department about how to install McAfee on CoreOS servers. (For the uninitiated, CoreOS is a Linux distribution that comes without a package manager. It's intended as a base to run containers on, so you would deploy all software via container images.)

I remember someone suggesting to put McAfee into a fully isolated container that only exposes the port where it reports compliance, allowing it to scan itself to death all day long.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#425

Post by majewsky » Fri, Aug 07, 2020, 12:59 PM UTC

danudey wrote: post #221

pjc50 wrote: post #21

Earlier quoted context omitted.

Yes - but not for hostile purposes, but because your own company's antivirus won't let you mail an executable to a colleague.

In February, I e-mailed a python script to one of our developers to help debug an issue with their SSL configuration. Two days ago, I needed the script again but couldn't find it. Went to our e-mail thread and it said "the following potentially malicious attachments were blocked", showing mine, but... even from my outgoing mailbox? That seems ridiculous and problematic, considering that it sent fine at the time. I kn…

If I had to deploy AV for mail, I would absolutely scan outgoing mail as well. Imagine if some compromised mail account in my org sends malware to accounts in other companies. These companies could then sue my company for negligence if they can show that we did not scan our mail for viruses on outbound (which could potentially be done by examining mail headers).

(I am not a lawyer.)

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#426

Post by kube-system » Fri, Aug 07, 2020, 1:54 PM UTC

SturgeonsLaw wrote: post #392

kps wrote: post #281

Earlier quoted context omitted.

I once worked at a place that required passwords to be changed every month and contain at least one upper and lower case letter, digit, and punctuation, and not match any previous password. So the password for August, 2020 would be “August, 2020”.

This is super common, to the point where Microsoft used a similar password scheme as an example when talking about password spraying attacks at an RSA conference presentation https://www.zdnet.com/article/microsoft-99-9-of-compromised-... It's why I'm advocating within my organisation to get rid of password expiration and enforce 2FA for clients, but there's a lot of inertia to push against with some of them. At leas…

If you need backup, NIST standards agree with you.

Scheduled password expiration weakens security by encouraging users to make predictable passwords, and by entrenching password resets as a routine and unscrutinized process.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#427

Post by WhyNotHugo » Fri, Aug 07, 2020, 2:06 PM UTC

strictfp wrote: post #406

skissane wrote: post #135

Earlier quoted context omitted.

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

Happened to me as well. Was writing an authentication service. We thought we were paying for an actual security audit, turns out we payed for a simple word scanning of our codebase. The review didn't find any of the canaries we left in the codebase, and we could never argue back with them. Big waste of money.

Huh. I'm thinking it'd be fun to write code with know issues (with varying degrees of obviousness) and hire a bunch of different "auditing companies" to see which ones pick up on that.

Publish the result for market comparison's sake.

Then again, that requires plenty of money and I can't see how to monetize that in any way.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#428

Post by pixl97 » Fri, Aug 07, 2020, 2:22 PM UTC

sjg007 wrote: post #188

marcosdumay wrote: post #36

Earlier quoted context omitted.

Usually this. Or in my workplace, an image. Antivirus are some crazy shit that may trigger on any random action and will teach people to follow the most unsafe procedures without questioning, so they can get anything done.

Antiviruses will quarantine compiler output...

Ugh, welcome to my life.

"You must exclude our program sub directory because temporary files are created containing interpreted code and your antivirus will ether block it outright, or lock the file so long you get application time outs"

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#429

Post by james412 » Fri, Aug 07, 2020, 2:27 PM UTC

mirekrusin wrote: post #259

james412 wrote: post #144

This kid has been posting these for fame (it's the same guy that posted the Daimler leak). I guess it's all fun and games until he finds himself in prison

I'm not sure you can even consider it "breaking in", it's more like tweeting that under intel.com/super-secret url you can see some internal, secret documents.

The definition of "unauthorized access" is intentionally very broad, and ultimately depends on the kind of lawyer you can afford. Publicly taking a piss in the face of Intel and Daimler in exchange for a little lame publicity seems an incredibly dumb tradeoff

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#430

Post by quotemstr » Fri, Aug 07, 2020, 2:31 PM UTC

nine_k wrote: post #298

silverdemon wrote: post #273

Earlier quoted context omitted.

This 100%. I recall many a fun night at $BIGCORP burning the midnight oil, receiving the warning emails that my "unauthorised software" had been reported to my manager, and that it had been quarantined away for my own safety and convenience. Given that $BIGCORP was a tech firm my manager would be intensely delighted that they would receive regular midnight notifications that I was doing my job. Whatever that damn thi…

Windows development seems to be fun as of recently. Didn't touch it for couple of decades. Sometimes I think that modern Windows is a nice platform already, even comfortable. (Like, you know, C++17 is very unlike C++98.) But then I'm reminded of the necessity to run an antivirus in front of it in a corporate environment.

I intensely dislike corporate "security product" culture. For whatever reason, every IT department thinks that you have to ruin Windows with tons of invasive antivirus and monitoring software. I've seen zero evidence that these performance-killing tools are necessary. It's all theater. Microsoft itself doesn't do this shit to Windows, and neither should anyone else.