(untitled)

Security fails at your workplace? I work at a large public company that's preparing for GDPR (General Data Protection Regulation). One team, responsible for hundreds of terabytes of analytics data containing private user information, encrypts their data with the same IV using a stream cipher (AES-CTR). I explained why this is a bad idea (reused key attack if the same key and IV is used), and I suggested they use a unique IV for every encrypted payload. The lead architect of that team appeared to understand my point, but called it 'overengineering' because it would apparently be a hassle to assign a unique IV for every ciphertext. Go figure. The discussion is not over yet, so hopefully I can convince them anyway. What have you encountered?

On a for profit it school, I found that the net admin used the same password for EVERYTHING. Everyone was so inept there, I pity their students.

Probably the funniest thing that I saw was when I was at a military installation, and a bunch of people were waiting around with all their guns and gear. they were hanging out in a break room, and left all of their weapons and backpacks lying around in a hallway, i'm talking full automatic assault rifles. After a "holy soykaf this cant be for real" moment, I notified one of them who walked out to smoke that he might want to tell his guys to watch his weapons, and he ran back and then the whole group scurried to take their weapons into the break room. Since I was in another branch of service (but still outranked him) the outcome was pretty positive. I just use it as a learning experience that guarding things is important.

I used to work at a medical device company that used windows on all their devices. After reading through a 2-year-old security audit and checking for still-existing vulns, I found that hundreds of dll files(including the dlls for the company's software) were writeable by anybody. The auditor had used this vuln 2 years ago to get an admin shell(our software runs as admin) and it had never been patched. It probably still isn't patched because it "might cause unforseen software bugs", which basically translates to their software being unstable buggy soykaf.

>>3475 >What have you encountered? Pairs of plaintext passwords and emails saved in a user table. If that DB were to leak we could be in deep soykaf since some people almost certainly reused their passwords.

>be me >working IT >one of the employees mention's how busy they are >ask him why >got a contract with the local hospital to digitize all of their medical records >tells me that why half the parking lot is full of shipping containers >mfw they just had decades of medical records sitting in the parking lot

>>3475 perhaps increase the size of each payload? that way there wont be the need of that many unique IVs

i have a side job doing IT for a small office. the boss insists that i keep everyone's passwords in an excel spreadsheet on the server (this is policy from before i started working there). his reasoning is "sometimes we need to log into people's accounts when they aren't here/don't work for us anymore". i told him i could just reset people's passwords if needed, and that i'd already given him admin permissions so he should be able to read anything he wants, but he still wanted the spreadsheet. now i'm working on moving it to a password manager at least... but he's reluctant. (it's worth mentioning that the "database" we use is actually 60% excel files and 40% some ancient proprietary crap that's extremely specific to the kind of work they do and costs hundreds of dollars to license). the lack of anything resembling "sudo" on windows is a massive pain in the ass, and just creates stupid security problems like this one. i know if you use active directory as microsoft intends, this wouldn't be an issue... but nobody wants to fuarrrking use it that way. just let me log in as somebody else and set up their email for them.

>>3502 excel files are encryptable, and you could write a program to change the passwords every once in awhile

Admin login and password "test" in internet filtering system. Metal-working production.

>>3520 Hasn't stuxnet taught people industrial systems arnt safe?

>>3528 >Hasn't stuxnet taught people industrial systems arnt safe? Stuxnet was sophisticated malware developed by 2 nation state actors and didn't really achieve its goal in the end. The only thing it taught people is that airgapped Windows machines are not secure if people keep plugging random USB drives in and out of them.

>>3528 This is Russia, not learning.

>>3531 >The only thing it taught people is that airgapped Windows machines are not secure if people keep plugging random USB drives in and out of them. and that you can't always trust tech support.

First IT job I had at an MSP, we had our biggest client which was made up of a bunch of whiny assholes. One of our tasks was resetting locked out AD accounts or forgotten passwords. We tried to make them have to reset the password themselves after we gave them a temporary one but they whined and our boss told us we couldn't do that anymore so soon enough the entire company (Including the CEO) had $CompanyName + 123 as their passwords. Glad I got out of that job,

Not my workplace, but I saw this and I was flabbergasted; So, an insulating and cooling company has a very, extremely idiot way of watching for malfunctioning devices. First, there are several human monitoring the temperature levels log every ten, fifteen minutes. DEspite them having an automated alarm if the temperature rises above certain point. The employees access a remote computer via Remote Desktop. They all use the same login credentials. Then, under the remote desktop, they login locally (???) on a web platform, again using the same credentials. Oh, and the username is "Admin". The webpage platform shows the list of equipments overheating, in an excel-like grid. Oh, and they keep track of their own work via plain text logs written manually, and then uploaded to a shared folder, using date-operatorname as the file naming format. I know it makes no sense. All of this work could have been simplified if the people in charge of IT knew was a query was. Instead, it is the most obtuse, pointless system I've ever seen. Did I mention that the computer they all use remote desktop to access is using a pirate, not updated version of windows? I'm not busting the system because most of the operators are single mothers or divorced people with children that can't work outside home.

Seems like nobody really cares about others or their own security when it comes to computers. When it's abstracted by a screen it just seems less real to most people.

The problem is security is not a user feature. It only costs and limits the legitimite user. So nobody wants it. And you only know it's not enough after you detect a breakin wich means most feel they pay for nothing unless they already got attacked. Same happens with cheap locks - so it's not a unique digital problem.

Consulting firm. At my workplace, security is for peons only. If a Big Swinging Dick who brings in lots of money wants an exception they will get it.

At my previous job, everyone used a shared account among their coworkers. Each department's login was its name and the password was the department's phone number with extension. Example: Payroll's login would be "payroll" and the password would be "555.555.5555.123". I couldn't believe it until I tried it myself. All it would take is one disenfranchised staff member who was curious enough to connect the dots to exploit everything.

In a previous job working for the IT department's security team, I recognized that the organization had absolutely no security. To demonstrate this to the leadership team, I staged a red team exercise complete with phishing a user, getting remote control of their computer, compromising other computers, dumping credentials, and moving all the way up to Domain Admin in the Windows environment. The entire "attack" went undetected and there wasn't a single log to even prove it had happened, because the company didn't log anything. I put it all in a nice powerpoint presentation and showed it to certain people like the Senior VP of IT. The biggest reaction I got was one guy saying, "Wow, this is pretty depressing." then walking out of the room. To this day, I don't believe any of it has been fixed.

This thread is straight up sad.

I worked as maintenance at a healthcare facility. Nothing to do with IT, but was one day called upon by my direct supervisor to get him a replacement computer for his office and set everything up for him (older tech-lliterate gentlman). So, I went to the closet where the facility kept their old computers behind a dummy lock (you could open it with a screwdriver) and grabbed the most modern computer there which had been a HP running Windows XP. Everything went smoothly and booted up fine. I had a sigh of relief. Although, my boss and the CEO at the time became curious as to where this computer came from prior to being put in the closet. (CEO was a massive hoarder and lost track of the stuff she had fairly often). So, turns out after looking at the desktop for more than a few seconds this computer belonged to the medical records staff and had not been wiped/still had the data on deceased patients and current patients in long term care and was just sitting behind a door with a dummy lock that everyone has access to. The icing on the cake was when the CEO had told me to just put it back in the closet and order my supervisor a new one.

Passwords for the admin account in internet-facing production servers are routinely shared between members over Slack. Sad part is that we have a neat shared password vault but no one bothers using it.

>health insurance records intern >told to reformat customer data from CSV to XML >shouldn't be too hard >all customer data is in an CSV >it's some 200gb >excel can't open it >have to scour the internet for a program that can handle it >doubtful, but find one that works >it takes about 40 minutes to load >60 million rows >1300 columns >includes names, addresses, social security numbers, payment details, health conditions, doctors visiting, price adjustment, etc. >giant fuarrrking pit develops in my stomach >feel like I'm gonna get abducted for seeing this soykaf >plow through the feelings of despair and make a script to convert CSV to XML (I don't fuarrrking know why anyone would do this) >took about 17 days to convert on a 2.2ghz single core Wangblows machine >rest of internship was decent

>>3864 That's a huge HIPAA violation (if you're in the US) and you should totally snitch.

>>3864 >>3865 Seconded, blow the whistle on them.

>>3475 That's not even overengineering because the engineering has already been done for them, all they need to do is implement the spec. In order to implement an AES-CTR cryptosystem you need a random, unique, IV every time. If they haven't implemented this than they haven't implemented the required crypto. Also, since it's GDPR, just remind management that they're legally liable for breaches and the cost of properly implementing crypto will be far less than the "20 million euros or 4% annual turnover, whichever is larger" fine they'll be subject too.

We have an IP camera that's open to the internet, even the port is the default one. Sometimes I log in from home to see how many people are there before I leave home. Some people brought their desktops with WinXP and just connected them to the network. Most of them don't even have a password - which can actually be a good thing, since XP disables shares if you don't put a password on your box. I don't know how they haven't been hit to hell and back by stuff like Wannacry.

>>3896 The network is private NATed and router is not a Windows Server.

maybe a bit late to reply, but here's my story. >at school >school has a custom management site written in PHP, containing innocuous information such as lesson plans, syllabi etc. but also more sensitive soykaf like medical information, addresses, emails, telephone no.s etc. >this site allows coursework to be submitted via upload >upload a .php file >it executes >holysoykaf how could they have overlooked this >report to the guy who's managing it >"oh, that is a big problem lainon, we'll have a fix out next week xD" I could have made a fix for that in a few hours. >next week >the original exploit was fixed (made php files in /uploads non-executable) >but the site also allows students to make comments on lesson plans (don't ask me why, nobody uses it) >the text input is unsanitized, allows arbitrary JS execution (stolen passwords, anyone?) >report to admin >"yeah, that's a bit of a bug but it's just javascript lainon, it's not serious Present Day, Present Time! AHAHAHAHAHA!" >"we'll roll out a new Object Oriented (tm) system in a few months, that'll fix the problems :DDD" At that point I just gave up. fuarrrking incompetent.

my highschool had a proxy to stop us from watching pr0n, which makes sense. but they used plaintext www-authebticate headers. this was a non BYO device school, so they could have out a self signed cert on the machines and encrypted their proxy. used those accounts and read my file

>>3783 Yes. Sad, and also full of people who need to learn some CYA if they're not already doing so. Conversations in email, not just verbal, and said emails saved off-site.

>>3544 >I'm not busting the system because most of the operators are single mothers or divorced people with children that can't work outside home. geez that went right into the emotional process not workplace but I was at a remote corporate retreat team building thing in the woods and their wifi had defaults. showed the problem to the main guy he was like some sort of yogi told him anyone could just brick it and he was all "why would anyone do that" well "to fuarrk with your guests" which convinced him to change the pwd. small fry I know but it stuck with me. got to protect clueless but good ppl

>>4129 Beurocrats usually are, they are literally the weakest link in every chain. That is why some grey hats do it, simply to teach idiots a lesson.

>Be me at work, two years ago. >Local network has no means to detect any viruses/malware. >The e-equivalent of a multi-STD risk should one stick anything in the ports. >I install some basic AV so I can get some work done without having to wait constantly as the machine seizes up. >Have a somewhat productive day >Get yelled at by manager 'for making the computer slow' next day and some drivel about 'installing external software and wasting peoples' time'. >>Turns out manager cant read simple messages. >>Im_out.jpg >Pack up and leave. >Company goes belly up after generic ransomware locks up all their computers. Coolguycalmlywalkingawayfromexplosion.jpg

>>4336 The boss thinks you did the ransom job but is afraid to have you investigated.

>>4337 >thinks Subhuman trash. So blinded by ego, cannot think. If she couldn't comprehend a simple message from an AV software, she doesn't have the intellect necessary to create a scenario in her mind and pursue it.

>>4336 As a security professional it's your job to make management understand the risks and then do what you're told. (You failed on both). A company may or may not go out of business because bad security but definitely will if the people who actually make the money can't do their jobs. That wasn't your decision to make.

>>4342 Ha, true. Except there was no such thing as the 'position' of security professional when it came to that company. Let that sink in for a moment. They didn't hire any IT security specialists. And so, for their arrogance, they were judged unclean, existence unworthy of existence and humbled by the great machine framework. Their suffering is below my concern. It was my decision to walk away from a bunch of idiots who didn't know how computers worked - and it was one of the best decisions I ever made.

>>4342 >(you failed on both) That's not always the case at all. Sometimes execs and IT managers just don't want to hear about it. I had an experience a while ago where an employer I was working for was the most insecure mess I've seen in a long time. "Our infrastructure is too critical to go down for upgrades" They just absolutely wouldn't budge even though I tried and tried to convey the severity of the vulnerabilities. Even when I mentioned someone could steal their PI, they just didn't give a soykaf. They got popped like two weeks after I quit. We're not babysitters. If you soykaf on me over and over when I'm trying to help you, fuarrrk you not me.

>>4352 >We're not babysitters. If you soykaf on me over and over when I'm trying to help you, fuarrrk you not me. Companies exist to make money. Security is about risk management, not making everything 100% unhackable. If you told them there's a problem and they said they accept the risk then that's fine. You think you're trying to help but from the other perspective you're being a dick. That's why they soykaf on you. >They got popped like two weeks after I quit. And? Did they go out of business? Or did nothing change just like basically every other company that's been breached?

I briefly worked for one of the biggest web dev companies in my country. We mostly did e-commerce and stored access tokens for services that stored credit card numbers, very different legally to storing credit card numbers, but still potentially nasty. They didn't hash their passwords. This is something I managed to get fixed before I left but it's just staggering the level of incompetence. >>4351 >Except there was no such thing as the 'position' of security professional when it came to that company. I don't think this is unreasonable depending on the company. Some places are just too small to hire someone full time. The place I work has <10 technical people. I'm technically the security person, because I happen to know more about it than the other devs, but really we just hire some pentesters once a year. >>4352 >"Our infrastructure is too critical to go down for upgrades" That's the dumbest thing I've ever heard. What sort of idiot designs an infrastructure that can't be upgraded? >>4355 >And? Did they go out of business? Or did nothing change just like basically every other company that's been breached? That's the big problem here. There shouldn't be such a big divide between the way to make money and the way to not screw over tons of people. "Oh well, we just compromised all of our customers data. No skin off our nose!" Fortunately that's changing in the EU at least with GDPR. Big fines and mandatory disclosure to affected customers.

>>4355 >>4352 See? That is why grey hat hackers exist. To put fear in idiots who don't use the noggin.

>>4356 >That's the dumbest thing I've ever heard. What sort of idiot designs an infrastructure that can't be upgraded? the US government apparently, 'member the time OPM got hacked?

>>4356 >There shouldn't be such a big divide between the way to make money and the way to not screw over tons of people. That's called an externality and is a soykafty artifact of our capitalist society that should be fixed. What I mean is more like how banks lose money every day but it's ok because the (lets say) 0.1% of attacks that succeed cost the bank an amount of money. Fixing things so that only 0.01 attacks succeed will cost much more money. So it's more optimal for banks to take the hit than to upgrade security. If you're that security guy constantly nagging about how they need to stop that 0.1% attack without understanding the big picture then yes, expect management to treat you like a soykaf because you are one.

At my former job as a technician for maritime equipment and installation, I had full access to blueprints, CAD files, manuals, network documentation, and spec sheets for hundreds of ships, as well as some big shot contractors everyone would recognise the name off of, from day one. They have upped their security since then, but you could literally just walk in, copy files form a open file server on the network and leave

I do compliance audits. On an audit, got root, brought it up with company and they pulled the "Out of Scope"move. When I replied that it clearly was not, they responded with: We have not taken that vulnerability into account, and so it is considered out of scope. Further more, any vulnerability related to general device/network security is out of scope. That only leaves compliance. which is soykaf. pretty funny.

My former school got some used PC's donated from the hospital, with the harddrives gone, they were destroyed. But some machines had SSD's, and they were still there not wiped

>>4394 That's brilliant. They probably had a checklist of things to do before throwing away equipment and nobody updated it to include SSDs.

>>4392 Couldn't you point out that once you had root, you can extract business-critical documents/patient information/whatever else would be noncompliance? These people have no idea what the word "root" even means, you have to explain it in business terms.

>>4398 Lol. Thanks for the sentiment. It was written in an observation report with the risk and affected systems. It was then explained in layman terms twice (once by myself and again by my boss). The companies we work with do government work. Getting root on a box on the network (anywhere) was pushed out of scope because all files are stored encrypted and access is restricted to need to know. However, we explained that the box(es) we had root on could be used to do much more. Because the compliance boxes are checked, they don't give a fuarrrk.

Secure government facility. Like the kind they have turnstiles and badges, and visitor escorts and stuff. Supposed to be creating a little CTF for soldiers. Need to bring malware in for the defense part. Problem is, that is never getting past security (who scans external media). Download some python PDF libraries. Base64-encode the malware and name them <python-PDFlib>.pyc. My external media gets the greenlight at security, my buddy, who was bringing in Star Wars material (because the CTF was Star Wars themed) gets hassled because he is bringing in "copyright-protected data" I listen to his trials as I infect several machines in their lab with a rootkit and a keylogger.

I'll pitch in, I worked in a govt. institution as an admin/helpdesk. >employees are given laptops with no BIOS password, no FDE, all of them have a local admin account with no password >each employee has his own directory on a network drive but there's no protection or authentication in place so anyone can access everyone else's directories >have disks full of email dumps, over a terabyte of emails, and none of them are password protected >everyone can log in to the print server via remote desktop and see every document ever printed or scanned, including confidential >admin passwords to pretty much everything are either "test" or default, so you can just look them up in the manual and get full access >logging is worthless, some logs only last 3 days so Fridays are the best time to fuarrrk something up, on Monday they're gone >no virtual IP addresses so you can't even tell who did what since they all log in to a single server and show up in logs as a single entity At least none of the network stuff is accessible from the outside.

>>3475 password default set to 123456 password change on first use not enforced people using default password for their account for months because: "but I won't forget it will I, you silly!"

Electrical engineering and computer science college >oooh look, an open wifi for internal network >lemme look at the router >default admin pass people dont learn how hot the fire is until they got burnt playing with it

I work at a large grocery store(Walmart like-knock off). I know, what a prestigious job for an autistic person like myself. Every computer runs Windows 7 on a default, unpassworded account. My assumption is that it is an Administrator privileged account simply because the user often needs access to a bunch of useless third party applications and downloading of files(pdfs, etc). I have not bothered with USB spreading, or trojans at all, since 2012 but in the past setting up a trojan on a USB to autospread when plugged in pretty easily. Even in a worst case scenario one could manually just run a binary from the USB. If I were a social engineer I would just get an easily bootlegabble stupid corporate t-shirt, hide somewhere in the store until it closes at night and hit every computer in the store and be out in a few minutes. Most would be useless computers that just deal with receiving dates, etc, but a couple of them are for "book keeping" of employees so that alone would be worth it(SSNs). Just ideas that went through my head: "You know, if I were a dedicated hobbiest social engineer, I could get access to every computer her and potentially the POS/self checkout computers if they are on the same line(granted that last part is certainly questionable)" They actually post stupid posters about the dangers/potential dangers of carders using skimmed cards for checkouts(Is that even possible with chipcards? I do not think so?)... yet they do nothing to secure the store itself. Very concerning, but it also makes me want to get into social engineering and hit every huge corporate big box store using that same method I described above. I will not of course since I am not a criminal, and I am too depressed to even write a line of code anymore.

>>4846 >Very concerning, but it also makes me want to get into social engineering and hit every huge corporate big box store using that same method I described above. I will not of course since I am not a criminal, and I am too depressed to even write a line of code anymore. the walmart near me was running some of their sample for sale computers on the wifi network in store that they also used for their company work stations and they had file sharing enabled on all of them for god knows what reason, I left a bunch of windows open including displaying their plaintext password (free wifi anybody?) and walked away, the next time I went there, all of the computers had their chargers removed in an apparent attempt to render them unusable im assuming my fuarrrkery caused them to wise up

my boss is finally upgrading the old server running Windows 2003... one month before I leave. which is to say i have to figure out a way to migrate that clusterfuck to a new OS/hardware in the next two weeks. spent the day chatting on and off with a dell salesman that typed slower than i even thought possible, but at least now we should have a poweredge in the mail. wish me luck lains.

>>4856 This reminds me of when I once wrote a joke "virus" that'd set the wallpaper to a porn pic while constantly minimizing focused windows and sounding the PC speaker, which I devilishly placed on library computers in high school and named it "Counter-Strike", the PCs all ran Windows XP so it was trivial. A week later they installed an anti-virus and would have everyone sign a list if they wanted to use the computers, no doubt as a result of my prank. Good times.

>>4863 Good luck lain