What can we learn from the matrix.org compromise?
1–10 of 75 posts
Re: What can we learn from the matrix.org compromise?
#2I have gone on some long verbal rants about the dark patterns (bordering on malicious behavior) exhibited by key agents such as SSH agent, GPG agent, Pageant, and the like.
What can you learn from the compromise? Never use an agent. Kill it with fire^H^H^H^H -9.
Re: What can we learn from the matrix.org compromise?
#3It's been a few years since I last used Saltstack but if you have access to the master you have instant root on all minions or did that somehow change? salt '*' cmd.run 'find / -delete' and game-over?
Re: What can we learn from the matrix.org compromise?
#4I have gone on some long verbal rants about the dark patterns (bordering on malicious behavior) exhibited by key agents such as SSH agent, GPG agent, Pageant, and the like. What can you learn from the compromise? Never use an agent. Kill it with fire^H^H^H^H -9.
The attacker still would have gotten their key in.
TBH if you kill the agent people are just going to copy their keys with no passphrases around. Ask me how I know...
Re: What can we learn from the matrix.org compromise?
#5I have gone on some long verbal rants about the dark patterns (bordering on malicious behavior) exhibited by key agents such as SSH agent, GPG agent, Pageant, and the like. What can you learn from the compromise? Never use an agent. Kill it with fire^H^H^H^H -9.
Okay, I'll bite. What are you calling a dark pattern in assorted agents? Especially given that dark pattern implies intent to harm. (And I say this as someone looking at using an agent: If there's a gotcha, I'd like to know about it)
Re: What can we learn from the matrix.org compromise?
#6That medium.com has a paywall and doesn't want to share content? (is what I learned)
Re: What can we learn from the matrix.org compromise?
#7It's been a few years since I last used Saltstack but if you have access to the master you have instant root on all minions or did that somehow change? salt '*' cmd.run 'find / -delete' and game-over?
Very true, however I'd rather have that problem than an ever multiplying number of user accounts on systems that can su/sudo.
Re: What can we learn from the matrix.org compromise?
#8That medium.com has a paywall and doesn't want to share content? (is what I learned)
This might work:
https://medium.com/@tomsparks/what-can-we-learn-from-the-mat...
Re: What can we learn from the matrix.org compromise?
#9I have gone on some long verbal rants about the dark patterns (bordering on malicious behavior) exhibited by key agents such as SSH agent, GPG agent, Pageant, and the like. What can you learn from the compromise? Never use an agent. Kill it with fire^H^H^H^H -9.
Okay, I'll bite. What are you calling a dark pattern in assorted agents? Especially given that dark pattern implies intent to harm. (And I say this as someone looking at using an agent: If there's a gotcha, I'd like to know about it)
If you use ssh-agent with default settings it's very easy to accidentally expose access to systems you would not expect via the agent.
This seems to be a good post about the problem: https://heipei.io/2015/02/26/SSH-Agent-Forwarding-considered...
The key takeaway is that using ssh -A with default settings allows root on the system you've connected to "to impersonate you to any host as long as you’re connected".
Re: What can we learn from the matrix.org compromise?
#10Earlier quoted context omitted.
Okay, I'll bite. What are you calling a dark pattern in assorted agents? Especially given that dark pattern implies intent to harm. (And I say this as someone looking at using an agent: If there's a gotcha, I'd like to know about it)
If you use ssh-agent with default settings it's very easy to accidentally expose access to systems you would not expect via the agent. This seems to be a good post about the problem: https://heipei.io/2015/02/26/SSH-Agent-Forwarding-considered... The key takeaway is that using ssh -A with default settings allows root on the system you've connected to "to impersonate you to any host as long as you’re connected".
Yep! Or worse if you're in a VM/Container...