Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

471–476 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#471
post #470

Earlier quoted context omitted.

> This is exactly what the auditor is doing. The auditor was asked to do it and is being paid to do it. Presumably, the people arguing are paid to implement the will of those that pay them. At some point people need to stop arguing and do what they're paid to do or quit. Doing this over wanting to use MD5 seems a pretty poor choice of a hill to die on. > This is a really fast one, md5 is fine here, you didn't check t…

> do what they're paid to do or quit. I'm paid to tell idiots where to go. My boss doesn't pay me 6 figures to toe the line and fill in boxes. She pays me to use my judgement to move the company forward. I'm not wasting my time and her money on this sort of garbage and if they can't see the difference between casual use and secure use them we need to rethink our relationship with this company or they need to send us…

> I'm not wasting my time and her money

I've very specifically couched all my recommendations for this for when it's trivial to do. Arguing about this with someone instead of doing it, when doing it may have some benefits but really only costs a few minutes instead of just doing so is definitely wasting her time and money.

> You just used the line "do what you're told or quit".

I noted what I wished people would do in very specific cases where they're wasting way too much time and effort to win a stupid argument rather than make a small change of dubious, not possibly not zero, positive security impact.

I don't see anything weird about acknowleding some of the extreme traits of the culture I live in while also wishing they would change, at least in specific cases where I think they do more harm than good.

Honestly, I'm confused why you would even make some cognitive leap that since I live in an area with a specific culture I must act in the manner I described that culture, especially when I did it in a denigrating way. I guess you think all Americans must be the same? That doesn't seem a useful way to interact with people.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#472
post #2

> If you find password protected zips in the release the password is probably either "Intel123" or "intel123". This was not set by me or my source, this is how it was aquired from Intel. Can't say I'm surprised, people are lazy. Another large tech company I used to work for commonly used an only-slightly more complex password. But it was never changed, so people who had left the team still could have access to things…

Another password is "I accept" (based on the leakers Twitter messages).

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#474
post #171

Earlier quoted context omitted.

Makes perfect sense. Defense in depth, if you can grep the source code and not find any references to md5, then you have quickly verified that the code probably doesn't use md5. This you can easily verify again later, you can even make a test for it :) Even if in practice this had no impact, removing md5 usage, will make it harder to accidentally introduce it in the future.

The issue is not md5. The issue one wants to detect is weak hash functions used in cases where they're not appropriate. The fact that crc32 passed means that any obscure hash function would have passed too, even if it had been used in a context were it isn't appropriate. All it means that the audit is superficial and doesn't catch the error category, just famous examples within that category. That kind of superficial…

> But "hard compliance rules" and "superficial scans" combine to create a lot of busywork which makes people less motivated to work with auditors instead of against them.

Absolutely :)

The fact is that if you have experienced engineers a security audit is rarely able to find anything. You would basically have to do code reviews, and this is hard / expensive, and even then rarely fruitful.

So, superficial scans, hardening, checking for obvious mistakes is really all you can do. Making hard rules is unproductive, but then again, migrating from md5 to crc32 hopefully isn't very expensive.

IMO, crc32 is a better choice for testing for changes, and has the benefit of removing any doubt that the hash has any security properties.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#475
post #14

Someone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21

I think we will see new "Edward Snowden" soon !... Cool

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#476
post #460

Earlier quoted context omitted.

My understanding is that the DOD has access to machines with ME disabled. What is the capability that is disabled there, I wonder and how is that different than ME cleaner? Are they doing basically the same thing?

Yes, they seem to be very similar. https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...

In what sense?
Post reply on HN