I was chatting to my dentist about having a mild fear of pain during the procedure, mainly thanks to Laurence Olivier, and his next question was, ‘Is it safe?’
I only have fuzzy memories of the first couple phones. I got into the smartphone game pretty late in 2016 (unless you count the Palm, which I bought used and which broke very quickly). Actually my main motivation for getting a smartphone was to play Pokemon Go.
As for browsers: Only got mobile internet with the Wileyfox. Used Chrome on that, switched to Firefox at some point when I had the Motorola.
Last time I had to be knocked out for surgery, I remember feeling myself fading out, and just before everything went out I felt the nurses and technicians getting me uncovered, when one of them exclaimed “Wow! Look at all that red hair!”
A long time ago in a galaxy far away (before the internet was a normal thing to have) I provided over-the-phone support for a large and complex piece of software.
So, people would call up and you had to describe how they could do the thing they needed to do, and if that failed they would have to wait a few days until you went to the site to sort it in person.
The software we supported was not on the approved list for the company I worked for, so you couldn’t use it within the building where the phones were being answered.
I’m absolutely shocked that a company had a software whitelist before the widespread adoption of the internet. Ahead of their time in implementing, and fucking up, software whitelisting!
It was for government owned computers, they didn’t want any pirated or virus-infected stuff, and at that point there was no way to lock down such a mish-mash of systems.
The software company (who also do things like run prisons these days) had given permission for us to run the software and given a set of fake data so we could go through the motions when talking people through things, but apparently that wasn’t enough to get it on the list.
The one and only time I was put under I said “you know what you’re doing, eh?” And he just put me out. I didn’t mean to say that, I was just nervous. I did see a nurse laugh though so that’s nice.
There was a server I inherited from colleagues who resigned, mostly static HTML serving. I would occasionally do a apt update && apt ugrade to keep nginx and so updated and installed certbot because IT told me that this static HTML site should be served via HTTPS, fair enough.
Then I went on parental leave and someone blocked all outgoing internet access from the server. Now certbot can’t renew the certificate and I can’t run apt. Then I got a ticket to update nginx and they told me to use SSH to copy the files needed.
They are sort of right but have implemented it terribly. Serving out a static webpage is pretty low on the “things that are exploitable” but it’s still an entry point into the network (unless this is all internal then this gets a bit silly). What you need to do is get IT to set up a proxy and run apt/certbot through that proxy. It defends against some basic reverse shell techniques and gives you better control over the webhosts traffic. Even better would be to put a WAP and a basic load balancer in front of the webhost, AND proxy external communications.
Blocking updates/security services is dogshit though and usually is done by people that are a bit slow on the uptake. Basically they have completely missed the point of blocking external comms and created a way more massive risk in the process… They either need to politely corrected or shamed mercilessly if that doesn’t work.
Good luck though! I’m just glad I’m not the one that has to deal with it.
I dunno, gluing usb’s in a super sensitive environment like that is actually logical; on the disc drives - they could disable autoplay as well though removing or gluing them closed would be preferable. USB is just such an easy attack vector where the individual plugging it in may not have skills themselves - it might be easier to bribe cleaning folks for example - or inject a person into a cleaning team. Ideally they would attack multiple nodes of your target’s network via as many avenues as possible; which makes the network and vpn thing just silly indeed; perhaps they were waiting for someone to try something with excellent infosec / firewalls / traffic shaping. yeeeeah lol.
That’s obvious when a mouse or keyboard doesn’t work. OP, and clealy other people in here, don’t really understand the actual attack vector in play. They aren’t using the USB as data storage, they are using as a cellular connected RAT and/or a tool to deploy a RAT to a workstation.
I think gluing usbs is dumb in just about any environment (disable them on the BIOS is the right answer), but attackers aren’t using it to drag and drop files and then physically take the usb with them. They are plugging them into a workstation, or just leaving them in the parking lot and letting other people plug them in, leveraging them to get initial access, and then essentially abandoning them.
Pretty easy to make a hub device that you can plug the keyboard into and make it transparent to the user. Could even build in a keylogger to capture direct from the keyboard. The attacker would likely need physical access for that, so it wouldn’t be as convenient as the thumb drive in the parking lot attack vector, but unless you’re using PS/2 peripherals (or gluing those USB devices in too somehow), there’s still a fairly open attack vector there, even if you are disabling unused ports in BIOS.
If it’s a secure enough environment, I imagine that there will be monitoring on the device, and the moment a hub shows up that’s not supposed to be there, or any other USB device tree that doesn’t match the approved list, , alarm bells ought to go off. If it’s valuable enough; the attack would be to use a passive device picking up leaky signals on the wire, or even hidden camera watching screen/keyboard.
Yep you’re right, but at least that adds another layer of complexity to their attack. A lot of security controls are at least somewhat situational, and most non-draconian companies have a process to put further mitigations around those exceptions either from increased monitoring or adding additional supplemental controls.
There’s no such thing at perfect security, just better risk mitigation. Slipping in a usb hub between the computer and keyboard while someone isn’t looking is a bit trickier then just plugging in a usb stick. If you disable unused usbs in the bios, instead of trying to do silly stuff like glue them shut, then the attacker has at least been temporarily thwarted if they slot it into a dead port. Aside from the high traffic areas, disabling ALL usb ports in places like datacenters and especially colocated datacenters, can thwart the attack outright as well.
Really from looking through this thread a lot of people seem to be under the misconception that security that isn’t perfect is pointless. It’s like claiming that locking your doors is pointless because lockpicks exists. The point isn’t to keep a sophisticated attack at bay, but rather to keep script kiddies and drive-by attacks from hitting your network. To defend against sophisticated attacks you really have to go a bit crazy, and even then very small slip ups can be disastrous. Ask Microsoft about their root cert getting leaked via a core dump!
I fully acknowledge that many people also work for places with dumbass security controls. Gluing usbs is WAYYYY up there on that list in my opinion. It also looks like a lot of people work at places that have really shitty security teams that haven’t quite figured out that controls are situational and require more thought then, “see checkbox, execute checkbox.”
It’s funny for you, but definitely not funny to them. They will have to pause and go through everything with you again if they think there is even the slightest chance you are telling the truth. Anthstisiea and street drugs definitely don’t mix.
Even worse here - we cant change the screensaver or screen lockout timeout settings!
I have a workaround by running a little looping script that keep the screen active. Its not that I particularly object to the screensaver, but once it activates I have to Ctrl Alt Delete 3-4 times and enter my password to get my desktop open again. Also it is an active screensaver that sometimes mucks up my desktop layout (I have a multiple monitor setup)
ZScaler. It’s supposedly a security tool meant to keep me from going to bad websites. The problem is that I’m a developer and the “bad website” definition is overly broad.
For example, they’ve been threatening to block PHP.Net for being malicious in some way. (They refuse to say how.) Now, I know a lot of people like to joke about PHP, but if you need to develop with it, PHP.Net is a great resource to see what function does what. They’re planning on blocking the reference part as well as the software downloads.
I’ve also been learning Spring Boot for development as it’s our standard tool. Except, I can’t build a new application. Why not? Doing so requires VSCode downloading some resources and - you guessed it - ZScaler blocks this!
They’ve “increased security” so much that I can’t do my job unless ZScaler is temporarily disabled.
It has the same problem as any kind of TLS interception/ traffic monitoring tool.
It just breaks everything and causes a lot of lost time and productivity firstly trying to configure everything to trust a new cert (plenty of apps refuse to use the system cert store) and secondly opening tickets with IT just to go to any useful site on the internet.
Thankfully, at least in my case, it’s trivial to disable so it’s the first thing I do when my computer restarts.
Security doesn’t seem to do any checks about what processes are actually running, so they think they’ve done a good job and I can continue to do my job
Yeah. Zscaler was once blocking me from accessing the Cherwell ticket system, which made me unable to write a ticket that Zscaler blocked me access to Cherwell.
Took me a while to get an IT guy to fix it without a ticket.
Oh man our security team is trialing zscaler and netskope right now. I’ve been sitting in the meetings and it seems like it’s just cloud based global protect. GP was really solid so this worries me
Also, zScaler breaks SSL. Every single piece of network traffic is open for them to read. Anyone who introduces zscaler should be fired and/or shot on sight. It’s garbage at best and extremely dangerous at worst.
And it’s a horrible point. You’re opening up your entire external network traffic to a third party, whose infrastructure isn’t even deployed or controllable in any form by you.
The idea being that it’s similar to using other enterprise solutions, many of which do the same things now.
Zscaler does have lesser settings too, at it’s most basic it can do split tunneling for internal services at an enterprise level and easy user management. Which is a huge plus.
I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.
The bigger deal would be the internal network, which is also a valid argument.
I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.
Not really. Proper TLS enables relatively secure E2E encryption, not perfect, but pretty good. Adding Zscaler means, that my entire outgoing traffic runs over one point. So one single incident in one single provider basically opens up all of my communication. And given that so many large orgs are customers of ZScaler, this company pretty much has a target on its back.
Additionally: I’m in Germany. My Company does a lot of contracting and communication with local, state and federal entities, a large part of that is not super secret, but definitely not public either. And now suddenly an Amercian company, that is legally required to hand over all data to NSA, CIA, FBI, etc. has access to (again) all of my external communication. That’s a disaster. And quite possibly pretty illegal.
asklemmy
Active
This magazine is from a federated server and may be incomplete. Browse more on the original instance.