The DMZ - 2021-09-24

« first day (3935 days earlier) ← previous day next day → last day (937 days later) »

CaffeineAddiction

12:10 AM

@ThoriumBR nice

at the start I thought it was going to be about your ISP having admin/admin

that is the next one... and another is why backups aren't the ultimate defense against ransomware

when I saw that guy advising on memorizing a TOTP secret I had to write about it...

CaffeineAddiction

12:49 AM

lol, yah

3 hours later…

3:29 AM

@ThoriumBR I've already talked to a maintainer about the bug. I don't know what to do next for the disclosure.

4 hours later…

7:42 AM

Hi all, curious if maybe someone here knows a little bit more. I have been recently been receiving an influx of in spammed email-to-text messages to my Android.

Usually the text message originates from an email and many other numbers are recipients including mines. I'm wondering is there any chatter on cybersecurity/tech forums/sites for this variant of spam? I usually delete without opening but this is out of caution of iOS zero-click attacks. Given the rise of messages, are there any zero click attacks in Android? Curious...

3 hours later…

10:28 AM

@JohnZhau it depends on how and if the maintainers responded... if they are responsive, you can let them disclose the vuln... if they don't care, or don't respond after 45 days of repeated emails, you could send a mail to the full disclosure mailing list.

@LeanMan Yes, of course there are. There are zero-click exploits for practically everything. Nothing is 100% secure. See for example, CVE-2020-0022.

But spam usually doesn't contain zero days.

11:14 AM

It seems that the general consensus is that private keys should always be password protected
https://security.stackexchange.com/questions/199435/why-are-passphrases-protecting-gpg-ssh-private-keys-needed
https://security.stackexchange.com/questions/66839/how-to-decide-whether-to-password-protect-key-files-in-addition-to-full-disk-enc
https://security.stackexchange.com/questions/82291/realistically-how-much-added-security-does-having-a-passphrase-on-a-ssh-key-hav?noredirect=1&lq=1

And now I got a request from our IT admin that all our internal tools that work with certificates must refuse t…

OK, I get it, this is what people say, this is how security should be implemented, but I still fail to understand this completely

Grudgingly I am forced to agree that protecting a certificate with a password does add a layer of security (although this password will likely reside in a password manager whose database will be unlocked perpetually so perhaps it is not such a strong layer as it would seem)

But then what is the difference between a cert and, say, an .xlsx file that contains personal data of our clients? Both are 'sensitive', ie it would be a small tragedy if any if them leaked

So, by this logic, we will have to password protect everything that is 'sensitive' (of course using a different password for each file), menaing that one would have to enter a password every 2 mins if they wanted to do some work

this just seems to obstruct work! and security should avoid obstructing work, or else we're running afoul of AviD's rule of Usability: "*Security at the expense of usability comes at the expense of security. *"

Even going to the password manager every few mins, finding the appropriate password, copy-pasting it just to be able to, say, make a git commit is annoying. At this point I would really look for any ways to reduce the number of password prompts

something like a hardware key?

user gets a password prompt, user press a hardware button, done...

11:33 AM

I wonder why couldn't this be done by the OS? If the concern is that an unencrypted file might be read by malware or end up in an unencrypted pendrive or be uploaded to a cloud storage unencrypted... then why not integrate this with bitlocker, which already is quite seamless?

FDE + UAC prompt if a process tries to access this file. This would be annoying, but not as much annoying as having to enter this password

Or, a list of authorized processes that are allowed to access this file. UAC prompt only if a process that is not on this list tries to access this file

The file could be additionaly encrypted on top of FDE so that it could not be accidentally uploaded to the cloud or transferred to a pendrive unencrypted... but the user wouldn't have to care. and . would . be . able . to . work . in . peace . without . constant . password . prompts

@gaazkam the OS does not know if a file read request is coming from you, or from malware... you know.

if something tries to read secret-spreadsheet.xlsx, you get a prompt, you know if was you, or you clicked on a link on an email about a fedex package 5 seconds prior...

isn't UAC supposed to solve this?

I should be able to authorize myself because only I, not malware, have physical access to the keyboard & mouse

UAC bypasses are everywhere...

You should never use an Administrator account as your daily account on Windows. It's like using a root account on Linux.

UAC is not a security boundary.

@A.Hersean And then VisualStudio wants admin access because I need to debug a program that listens on a port.

11:43 AM

You can give discretionary admin access to a process using a normal user account, as long as you have the credentials for an admin account.

Same as using sudo under Linux.

@A.Hersean but sudo doesn't ask for the credentials of root, rather it asks for the credentials of my account

(Mostly the same, it's usually safer under windows because most of the time sudo is poorly configured or poorly used.)

@gaazkam QED

in my mind:
sudo ~= admin account in windows (a nominally non-privileged account that can escalate to arbitrary privileges on its own will)
root ~= the hidden administrator account on windows (a privileged account that can do anything without prompts)
su ~= unprivileged account on windows (an unprivileged account that needs to enter the credentails of the privileged account to elevate its privileges)

so UAC would be about equivalent to sudo?

equivalent to sudo without password for everything

also, doesn't having the password manager's database unlocked at all times diminish the usefulness to requiring passwords to access local files?

and the more local files are password protected (such as certs needed to make a git commit or send an email) the bigger incentive to have the password manager's database unlocked at all times instead of retyping the PM passphrase each time

11:51 AM

Once a attacker can access your account while in use, for example via a malware, you are pwed, whatever the precautions you use.

At this point it does not really matter if your keys are encrypted by a password or not.

Unless you are using an OS with a strong isolation of processes, like Android.

It's just that... I'm getting really exhausted by passwords. Password managers were supposed to be the solution of all password related problems, but this is not the case if password prompts are so ubiquitous and IT staff pressures for MOAR PASSWORDS MOAR ENCRYPTION!

Is there really no escape from non-stop prompts that obstruct work?

Poor security policies hurt security.

That's not new.

See AviD's Rule: security.stackexchange.com/a/6116/127837

@gaazkam a hardware key

@A.Hersean Poor security policies? But earlier it was said that it is a good thing to require passwords to access private keys needed to make a git commit or to send an email

@ThoriumBR Yeah, I was about to suggest it too.

@gaazkam Depends on who you are talking to, and it depends on the context.

11:58 AM

I got an office 365 email, and my password is very long... it's nice to try to login, press my finger on my phone, logged!

no password typing needed, no ctrl-c ctrl-v

now I want a hardware key

Putting a computer in a bunker, with 3 factors authentication and no access to internet can be a good security policy. But it depends on the context. Most of the time it's not usable.

@ThoriumBR We are forbidden from using work email on our phone. Android disregards privacy, sends arbitrary data home whenever it wishes to, therefore android is a threat to data confidentality. For the same reason we do not use Office 365 because Microsoft is, likewise, a threat to privacy and, by extension, to data confidentality.

(according to our IT staff)

the company phone is an iphone, enterprise-managed... my iphone usage is around 20-30 minutes per week on average, as I only use it for password prompts, 2fa things...

A hardware token can be something like a yubikey or nitrokey. Not a fancy internet connected smartphone.

well, my company thinks office 365 is better than the alternatives, and we are a company managing other companies infrastructure

12:04 PM

@ThoriumBR I wonder how to integrate a hardware key with an internal tool that needs to access a cert with a private key

you can even build your own hardware key with a microprocessor and some soldering... the U2F protocol is open

@gaazkam developers.yubico.com/U2F/Protocol_details/Key_generation.html

4 hours later…

4:28 PM

@A.Hersean I thought that the whole point of UAC was that elevation of privileges could only be granted by the user, and not by a script without the user's knowledge?

4:40 PM

@gaazkam devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105

The default is meh.

Wow. In this case I understand that having UAC is equivalent to not having it, so... why bother having it?

Also, more importantly

If, as this blog post says, any app can inject arbitrary code into Explorer

Then pretty much no setting can save me?

> As Larry Osterman noted, UAC is not a security feature. It’s a convenience feature that acts as a forcing function to get software developers to get their act together.

And

> Because people wanted them.

In the best case a malicious code gets elevated permissions the moment I need to copy a file to a protected location

And how often is that?

More often than never

4:54 PM

Again, that's why you shouldn't be running as administrator

What's the difference though? Not running as administrator will only make UAC display a password prompt if elevation is needed. So if UAC can be bypassed by injecting arbitrary code into explorer.exe then this arbitrary code will get elevated permissions the moment explorer.exe gets elevated permissions...

...whether automatically (in default settings), the first time I need to modify file permissions or copy files to a protected location (admin account, highest UAC protection) or the first time I need to modify the permissions or copy files to a protected location and enter a password (no…

Am I incorrect in my belief that using non-admin account and authenticating with the admin account whenever I need elevated permissions is, effectively, the same scenario, with the only difference being that UAC asks for a password?

@gaazkam Interesting question. I don't know enough to answer that. But I guess it depends on how explorer works. If the main explorer process itself is elevated when you need to copy to a protected location, then I guess you've got a point.

If however, a separate process/thread is used to perform the action that needs elevation, then no the malware won't get elevated permissions since it can't inject into the elevated thread.

Maybe you should ask on the main site?

5:09 PM

"If however, a separate process/thread is used to perform the action that needs elevation, then no the malware won't get elevated permissions since it can't inject into the elevated thread." - which would render using a non-admin account no different from using an admin account with the UAC slider set to highest?

Maybe I will ask on the main site :)

@gaazkam From some googling, I think you're right, but again don't know enough to say definitively.

> It’s a convenience feature that acts as a forcing function to get software developers to get their act together.
I couldn't understand this until I did some Googling. I found: https://news.ycombinator.com/item?id=16138708 And there:
> I remember UAC was way too intrusive (sometimes you would see 4 or 5 alerts in a row that would monopolize your screen)
> Just about any application you cared to launch required permission dialogs to be clicked through - irritating to everybody, scary to most users, and quickly ineffective as everybody stopped reading and just reflexively went for the OK b…

And the gem

> I would see some users run a program and automatically move their mouse to the place the UAC prompt would appear, seconds before the prompt ever came up.

So I guess that the point of UAC was to force developers to stop requiring elevated rights for tasks for which elevated rights are not necessary?

@gaazkam Reading docs.microsoft.com/en-us/windows/security/identity-protection/…, it looks like elevation does indeed result in a new process.

6:00 PM

someone spamming a question about HTTPS vs S-HTTP, and put this jewel there: "Xhamstervideodownloader apk for windows 10 pc"
apk for windows 10? I bet it is a .exe.apk...

6:21 PM

0

Q: How is using the standard Windows account more secure than using the administrator Windows account with highest UAC settings?

If someone uses the administrator Windows account for everyday work while having the default UAC settings they will be prompted by UAC whenever an application other than certain predefined system apps requires elevated permissions. From the security point of view this is equivalent to no protecti...

windows privileged-account uac

1 hour later…

7:24 PM

55

Q: Would it be inappropriate to leave anonymous letters of encouragement around my workplace?

Being the type of person I am, little notes of encouragement are always a nice surprise whenever I find them. So, I was wondering if it would be weird or inappropriate to leave anonymous notes or letters of encouragement around my workplace. Could you get in trouble for that sort of thing? I know...

professionalism colleagues ethics company-policy

I don't know about appropriate, but watching people speculate about the source of the letters would definitely be interesting

« first day (3935 days earlier) ← previous day next day → last day (937 days later) »

Transcript for

Sep '2124

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile