Shit's Borked

[randomhorn 1728]

I'm loving all the talk of rainbow tables, hashes, and MFA

[TOR 5528]

BUTT

 

Hello?  Is this thing on?

[Davis Lane 5580]

15 hours ago, hookemATL said:

I had to draw porno. Wasn’t great but I finished

[Davis Lane 5580]

2 hours ago, Upgrayedd said:

If I can’t remember my password should I ask the Inchworm guys?

This is where I am.

[TwiceHorn 31438]

24 minutes ago, farmersnotfighting said:

salting is literally to stop a rainbow attack lol. but nobody sits around with rainbow tables anymore since basically everything is salting by default now. invision community moved from md5 which is fucking awful (164,000,000,000 password guesses per second on a 4090) to blowfish (184,000,000 guesses/second) for the hashing algorithm.
if you use a shit password like Summer2024! or Password1! or something that's on a common password list (check here: https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases ) then consider your username/email address and password compromised. make sure you don't reuse that password for any other site. 

in general, use MFA where possible. and if you're too lazy to do that, make sure you have different passwords for every site that are randomly generated. no you aren't clever using "Password.Surly". if i see your email and "password.linkedin" or "password.gmail" or "password.facebook" in a breach, i'm damn sure gonna try "password.surly" if i'm targeting you. 

but use a password manager like lastpass or 1pass to generate and keep track of your passwords for different sites. they have browser addons and phone apps so you can auto fill shit too. 

Well, don't use LastPass, anyway.

[Blotto 23487]

1 hour ago, TreatyOak said:

Did it!

Can everyone please avoid using the password texasextralong#2024 

It's no longer available.   

No problem, I went with TexasTunaCan#2024. 

[immamac 42835]

Taking a nap. I'm exhausted so if your PII request is delayed that's why. 

[TOR 5528]

Wake you up at tree fiddy?

[Vegas64 673]

Who took the username InchWorm already as a sock?

[Incredulity 11650]

21 minutes ago, Davis Lane said:

Give’em the knee shooters

[Davis Lane 5580]

Mu!ED1cK2024

[Chopper 17230]

Having an issue logging in to Surly. When I first logged in this morning on mozilla, I saw the notice to change pw, and did so right away using 1password and a 24 character pw. Shortly thereafter I logged off my computer for about 90 minutes, came back, and now when I try to login to surly on the mozilla browser, I'm bounced to the main microsoft log in page to log in to my profile there. I checked if it was my own browser causing the issue, but I was able to login to both reddit and bluesky on mozilla without getting bounced to a microsoft sign in. 

I then opened Edge and was able to log in to Surly with my new pw, and without an attempt to force me to log in to my microsoft profile. For some reason the Surly login is bouncing me to the microsoft profile login, and it may be confined to the mozilla browser.

[thunderlounge 7813]

1 hour ago, immamac said:

They dropped the user table first. Then a few minutes later they dropped every table. 

Dropping a table makes the data delete in an irrecoverable manner. There is no undelete button on databases so the data poofed out of existence and the tables and their metadata were emptied out. 

It's really a bummer that the Invision folks knew about this and didn't disclose it in the updates and didn't put it in the release notes as a major security update. I always make sure to install those the day they are released. I hadn't installed this update because quite frankly the upgrade path for this software leaves a lot to be desired including mandatory downtime > 8 minutes and it being completely unable to rollback if it fails. It makes permantly borking the site a real possibility every upgrade. 

They are coming out with version 5 soon which is supposed to be a major rewrite. I'm hoping they fixed some pretty glaring architectural issues they have in the software. 

I'm still monitoring the situation closely, but the attack is confirmed to match the exact SQLi that was published in a POC for the CVE. This has been patched and outside of the actor reaching out via an account with the username "password" there hasn't been another successful attempt using the same method

 

Got damn. What a pain in the ass for you to have to fuck with.

After reading through all your info discussed, I'm wondering if it wasn't exactly targeted at Surly, but because some kid in their parents basement googled for sites using Invision, and well, here we are.

Maybe get rid of the branding, both visible and in the output source?

Don't get me wrong, security by obscurity isn't a good practice on its own, but why give them a leg up when you don't have to? If there is a commonly named directory structure, could it be renamed generically? At least hiding what it's running on under the hood is something that may help down the road.

Of course that's a micro-tweak kind of thing, and obviously way back in the line behind proper security protocols. But just trying to think of some little things to help lessen the holed in the swiss cheese.

[Vertigo 20276]

You guys, I really think we should be taking this more seriously. I came in this morning and my rep points had been drained from my account. I had to do an emergerncy looch to get them all restored, but not before some asshole had spent them on a 55 gallon drum of lube. That's MY lube on a slowboat to Pyongyang and it probably won't even be used on the coed bowling slip and slide. It is going to take me some time to recover. 

[TOR 5528]

If this keeps up we'll all be flying cargo planes full of rubber dog shit out of Hong Kong.

[Buzzrock 14902]

1 hour ago, PvilleStang said:

This.  At least they're stuck with the Equifax identity monitoring bill.

For a whole year!

[farmersnotfighting 97]

pretty sure inchworm was an aggy. can someone photoshop the furk guy with an inchworm crawling out of his britches?

[Armybrat 40822]

What happened to my pants?

Has anyone seen my pants?

[atomheartbevo 89626]

1 hour ago, thunderlounge said:

Don't get me wrong, security by obscurity isn't a good practice on its own,

We should go with OS/2 running a Domino server.  None of these kids trying to hack shit were born when those were discontinued.  And I happen to still know a ton of OS/2 and Domino stuff, and I have several boxes full of the software and manuals and hundreds of OS/2 floppies.

[InkaUtexas 25859]

[Captain Ron 12866]

Had a pretty nonsensical password (use KeePassXC) - but I changed it anyway, because you never know. 

Thanks for everything you guys do here team. It's appreciated. 

[Vegas64 673]

2 minutes ago, Captain Ron said:

Had a pretty nonsensical password (use KeePassXC) - but I changed it anyway, because you never know. 

Thanks for everything you guys do here team. It's appreciated. 

Memories of PiHorn changing his password.

[markstanco 12571]

3 hours ago, farmersnotfighting said:

but use a password manager like lastpass or 1pass to generate and keep track of your passwords for different sites. 

What happens when lastpass and 1pass gets hacked?

[Rimbo 25911]

3 hours ago, farmersnotfighting said:

use a password manager like lastpass

please do not use lastpass

1password and bitwarden

[Rimbo 25911]

10 minutes ago, markstanco said:

What happens when lastpass and 1pass gets hacked?

that's why we don't use lastpass

[TexArcher 37762]

1 hour ago, TOR said:

If this keeps up we'll all be flying cargo planes full of rubber dog shit out of Hong Kong.

And that'll be a career upgrade for half of this place.

[farmersnotfighting 97]

9 minutes ago, Rimbo said:

please do not use lastpass

1password and bitwarden

yeah you can use whatever service you want. lastpass had the market share since they were the first mainstream service so they got targeted. i can assure you 1pass and bitwarden will be compromised in the future if they aren't already. for any of these services, you're going to have to trust that they're doing the right thing and you wont know until it's too late. you can use a local wallet type of thing like keepass, but then you loose the synching capabilities between your computer and mobile device. and idk if they have browser addons or anything so it will make your process of getting your password out even longer. and your computer is more likely to be compromised and have your keepass file stolen that one of the larger companies focusing on keeping it safe. so now you're looking at how strong is your local master keepass file once someone takes it? and if that's the main question, then you don't really have a difference between local keepass and a cloud based one like 1P or bitwarden, or even lastpass. if you remember the lastpass breach, they stole the encrypted key vaults, not cleartext passwords inside. so you still need to crack the hash to your vault either way. lastpass uses aes-256 (good), so does 1password, so does bitwarden. keepass uses aes256 too, so now the only real difference is features in what you want in a password manager and who you trust more. and making damn sure you have a strong password to your vault no matter what since that's the master key to the kingdom. 

[Rimbo 25911]

1 minute ago, farmersnotfighting said:

yeah you can use whatever service you want. lastpass had the market share since they were the first mainstream service so they got targeted. i can assure you 1pass and bitwarden will be compromised in the future if they aren't already. for any of these services, you're going to have to trust that they're doing the right thing and you wont know until it's too late. you can use a local wallet type of thing like keepass, but then you loose the synching capabilities between your computer and mobile device. and idk if they have browser addons or anything so it will make your process of getting your password out even longer. and your computer is more likely to be compromised and have your keepass file stolen that one of the larger companies focusing on keeping it safe. so now you're looking at how strong is your local master keepass file once someone takes it? and if that's the main question, then you don't really have a difference between local keepass and a cloud based one like 1P or bitwarden, or even lastpass. if you remember the lastpass breach, they stole the encrypted key vaults, not cleartext passwords inside. so you still need to crack the hash to your vault either way. lastpass uses aes-256 (good), so does 1password, so does bitwarden. keepass uses aes256 too, so now the only real difference is features in what you want in a password manager and who you trust more. and making damn sure you have a strong password to your vault no matter what since that's the master key to the kingdom. 

No. Lastpass got lazy and stupid.

[atomheartbevo 89626]

2 minutes ago, farmersnotfighting said:

yeah you can use whatever service you want.

This kind of stuff is pushing people to go back to the days of writing shit down on Post-It notes.

[Rimbo 25911]

10 minutes ago, atomheartbevo said:

This kind of stuff is pushing people to go back to the days of writing shit down on Post-It notes.

What farmersnotfighting is saying is simply wrong, though.

LastPass was terribly stupid. For example, there was no requirement on your master password length; it SUGGESTED 12 characters, but nothing stopped you from making it shorter.

They also allowed those master passwords to be stored. Not one-way hashes, but the passwords themselves.

From the perspective of anyone with even a basic understanding of security, it's dumb; what launches it into the abyssal depths of stupidity is that they were supposedly a security company, to store all your secure things.

It's like a bank vault built out of cardboard, LastPass is.

They weren't even trying, and they were known to be insecure well before the breaches. Multiple breaches.

 

[Leeroy Jenkins 2397]

Zero Trust!

[farmersnotfighting 97]

7 minutes ago, Rimbo said:

No. Lastpass got lazy and stupid.

lazy with their monitoring and didn't notice someone walking out with everything. And lazy about separating prod and dev environments. as someone who breaks in to network for a living, i can assure you this is not unique to lastpass lol. 

as far as i know, lastpass breach was decently done. the dev was running a plex server at home. someone threw a 0day RCE at it from the outside and used that to pivot into his network. i dont think they ever disclosed how the attacker went from network access to actually owning the dev's box. but from there, they waited until he already logged in to the vpn (after he put in his MFA), and rode the connection in that way back to the lastpass network. 

so far so good. lastpass did everything right and the attack took a lot of resources to carry out. 

but where they fucked up was the dev having access to the prod data. i'm guessing they did the right thing and had all the data in multiple accounts (separate AWS account for prod, different one for dev, different one for staging). no access to each other. cool. but the dev probably had access to both (or all?) of the accounts, so the attackers could just ride in to the prod account as the developer. again, i haven't seen any details on this part of the breach, but i've seen (and done) this exact thing (well... similar -- SE  to get code execution on developer company workstations while they work from home - not attacking personal devices. that's illegal) many times.
 

 

7 minutes ago, atomheartbevo said:

This kind of stuff is pushing people to go back to the days of writing shit down on Post-It notes.

you absolutely could physically write down a long password on paper for person use at home (as long as you can keep it secure). you are infinitely more likely to get your box randomly hacked than a fucking thief breaking in to your house, finding your password paper, and getting away with it. if they did that shit, you have way more problems to worry about than losing passwords. 

this is basically a discussion in threat modeling. who is mostly likely to attack you? how will they do it? is writing a password on paper perfect or great? no. is it less likely to be stolen than a file on your computer? yes... or probably. as long as you have a safe place for it that your wife/kids/dog can't get to it or damage it. 

[markstanco 12571]

[Foosters 17828]

so i went and put the $3000 in the bitcoin machine at my neighborhood Valero, per the instructions in immamac's email. Will i get a receipt or confirmation or something?

[ztejas 43411]

I use Google for all my browser passwords and a good amount of those are the same for the respective apps.

I know it's effective because everytime I forget my Google password or have to validate a new device it's like being put through the fucking Nuremberg trials.

[Evil Bill Obrien 3258]

33 minutes ago, atomheartbevo said:

This kind of stuff is pushing people to go back to the days of writing shit down on Post-It notes.

Can confirm I ain't ever seen a post-it note hacked by anyone...especially one calling themselves "Inchworm"

[farmersnotfighting 97]

8 minutes ago, Rimbo said:

What farmersnotfighting is saying is simply wrong, though.

LastPass was terribly stupid. For example, there was no requirement on your master password length; it SUGGESTED 12 characters, but nothing stopped you from making it shorter.

 -> cool. lastpass should have forced a stronger minimum, but still, that's on a user to not fuck up. 

They also allowed those master passwords to be stored. Not one-way hashes, but the passwords themselves.

 -> stored in plaintext? where? this is the first i've seen that. i only saw encrypted password vaults were taken.

From the perspective of anyone with even a basic understanding of security, it's dumb; what launches it into the abyssal depths of stupidity is that they were supposedly a security company, to store all your secure things.

 -> security companies are not immune from anything. 

It's like a bank vault built out of cardboard, LastPass is.

 -> ...no?

They weren't even trying, and they were known to be insecure well before the breaches. Multiple breaches.

 -> meh. perspective. 

 

[Rimbo 25911]

25 minutes ago, farmersnotfighting said:

lastpass did everything right

No.

[Chooky 13307]

What do the inchworm guys think about Terry Joseph and Blake Gideon?

[farmersnotfighting 97]

1 minute ago, Rimbo said:

No.

lol i was talking chronologically through the attack. they were fine up until that point. they forced MFA on VPN usage. good for them. that puts them ahead of most orgs and is a huuuuge barrier to an attacker trying to gain initial access. having a low attack surface that's hardened, implementing MFA... forcing an attacker to pwn a dev's home network is very very good. 

oh and i was wrong about plex. it wasn't a 0day. apparently it was a known vuln. but still. identifying the target developer, finding his home network range, exploiting plex, that's a very time consuming attack. so kudos to the attacker there. the million dollar question still is how did they go from home network access to dev workstation access. 

[markstanco 12571]

34 minutes ago, ztejas said:

I use Google for all my browser passwords and a good amount of those are the same for the respective apps.

I know it's effective because everytime I forget my Google password or have to validate a new device it's like being put through the fucking Nuremberg trials.

Make sure your gmail account has a VERY strong password if so.  

[ztejas 43411]

1 minute ago, markstanco said:

Make sure your gmail account has a VERY strong password if so.  

Google password doesn't mean shit. You need 2fa.

[The Ace of Aces 5175]

Can we get 2FA without having to use Google? I am deep into 2FAS and won’t use one app for one site 

[thunderlounge 7813]

21 minutes ago, farmersnotfighting said:

oh and i was wrong about plex. it wasn't a 0day. apparently it was a known vuln. but still. identifying the target developer, finding his home network range, exploiting plex, that's a very time consuming attack. so kudos to the attacker there. the million dollar question still is how did they go from home network access to dev workstation access. 

 

A dev that doesn’t have segregated vlans at home is asking for it.

 

[immamac 42835]

6 minutes ago, The Ace of Aces said:

Can we get 2FA without having to use Google? I am deep into 2FAS and won’t use one app for one site 

you don't have to use google authenticator you can use any authenticator it's just a rotating key thing. the QR code will work with any authenticator app.

[Rimbo 25911]

33 minutes ago, farmersnotfighting said:

lol i was talking chronologically through the attack. they were fine up until that point. they forced MFA on VPN usage. good for them. that puts them ahead of most orgs and is a huuuuge barrier to an attacker trying to gain initial access. having a low attack surface that's hardened, implementing MFA... forcing an attacker to pwn a dev's home network is very very good. 

oh and i was wrong about plex. it wasn't a 0day. apparently it was a known vuln. but still. identifying the target developer, finding his home network range, exploiting plex, that's a very time consuming attack. so kudos to the attacker there. the million dollar question still is how did they go from home network access to dev workstation access. 

"Being ahead of most orgs" is not the bar here. They are a security company selling a security product that doesn't follow basic security best practices.

That's like going to a butcher to have surgery done; sure, he knows more about cutting things open and anatomy than MOST people, but he's not a trained, licensed physician, either.

Their problems were known, and security orgs were yelling about them, well in advance of the breaches.

[Wally Fairway 5541]

What we really need to know is if the wreath fund has been hacked?

[farmersnotfighting 97]

12 minutes ago, Rimbo said:

"Being ahead of most orgs" is not the bar here. They are a security company selling a security product that doesn't follow basic security best practices.

That's like going to a butcher to have surgery done; sure, he knows more about cutting things open and anatomy than MOST people, but he's not a trained, licensed physician, either.

Their problems were known, and security orgs were yelling about them, well in advance of the breaches.

lol. neither did fireeye/mandiant when they got hacked. neither did RSA. neither did solarwinds. neither did FUCKING MICROSOFT. i'm not saying they're good. i'm saying they're not dog shit like you're suggesting. 
and again, at every org, security is understaffed, always screaming for changes and being ignored by management. every single company. that's not unique to lastpass. 
i do this for a living. i have seen a lot of organizations. fortune 10 and small orgs. including other security companies. i can count on one hand the number of orgs i've done engagements for where i never said "what the fuck are you doing here" and none of them were the security companies. you would be horrified to see how shitty some networks are only held up by gum and rubber bands, including major companies. the real world isn't a security+/cissp textbook.

[Rimbo 25911]

30 minutes ago, farmersnotfighting said:

lol. neither did fireeye/mandiant when they got hacked. neither did RSA. neither did solarwinds. neither did FUCKING MICROSOFT. i'm not saying they're good. i'm saying they're not dog shit like you're suggesting. 
and again, at every org, security is understaffed, always screaming for changes and being ignored by management. every single company. that's not unique to lastpass. 
i do this for a living. i have seen a lot of organizations. fortune 10 and small orgs. including other security companies. i can count on one hand the number of orgs i've done engagements for where i never said "what the fuck are you doing here" and none of them were the security companies. you would be horrified to see how shitty some networks are only held up by gum and rubber bands, including major companies. the real world isn't a security+/cissp textbook.

I do this for a living, too. And LastPass had a poor reputation before they got hacked. Security researchers were warning people about them BEFORE they were hacked.

LastPass was to password vaults what OceanGate was to submarines; don't yell to me about Ran sinking in the Antarctic and try to make some bullshit equivalence there.

Subs and Security products are naturally swimming in dangerous waters; don't try telling me that a company failing to do basic due diligence is in any way like the companies that do and suffer failures as well.

[markstanco 12571]

1 hour ago, ztejas said:

Google password doesn't mean shit. You need 2fa.

I use 2fafo.