#arpnetworks 2015-05-13,Wed

↑back Search ←Prev date Next date→ Show only urls(Click on time to select a line by its url)

WhoWhatWhen
***daca has quit IRC (Ping timeout: 272 seconds)
toddf has quit IRC (Ping timeout: 272 seconds)
trobotham has quit IRC (Ping timeout: 256 seconds)
toddf has joined #arpnetworks
ChanServ sets mode: +o toddf
Hien has quit IRC (Ping timeout: 272 seconds)
Hien has joined #arpnetworks
daca has joined #arpnetworks
daca has quit IRC (Client Quit)
NiTeMaRe has joined #arpnetworks
[03:28]
daca has joined #arpnetworks [03:43]
...................................... (idle for 3h6mn)
poulsen has joined #arpnetworks [06:49]
poulsen has quit IRC (Ping timeout: 240 seconds) [06:55]
poulsen has joined #arpnetworks [07:09]
poulsen has quit IRC (Quit: « Ë×Çü®§îöñX » Info~[v10B.1.1]~ Released~[Jul 31 2005]~ Channel~[#Excursion on EF.Net]~)
poulsen has joined #arpnetworks
poulsen has quit IRC (Client Quit)
poulsen has joined #arpnetworks
poulsen has quit IRC (Excess Flood)
poulsen has joined #arpnetworks
[07:21]
yoberi has joined #arpnetworks [07:35]
yoberi is now known as yoberi_
yoberi_ has quit IRC (Quit: Leaving)
yoberi has joined #arpnetworks
[07:47]
.......................... (idle for 2h8mn)
poulsen has quit IRC (Remote host closed the connection)
poulsen has joined #arpnetworks
[10:00]
.... (idle for 17mn)
m0undshttp://venom.crowdstrike.com/ vulnerability in virtual floppy stuff for KVM, Xen and QEMU [10:17]
***awyeah has quit IRC (Ping timeout: 265 seconds) [10:20]
brycecIf your web server can write to the floppy drive, you've already messed up big :P [10:28]
m0undshaha [10:29]
brycecOf course it's still a valid vulnerability.... Just don't be upset when a burglar uses a key you've left under your front doormat :p [10:30]
m0undssame could be said for nearly anything [10:31]
brycecOnly the ones that rely on a pre-existing privilege escalation [10:31]
m0undsuser opens hosting account with derphost, derphost emails root password, user never changes root password, user's mail acct is compromised and root password and ip address are grabbed [10:33]
reardencodeproblem is that another user on the same physical host can allow the host to be pwned and then we're all screwed [10:33]
m0unds(there are plenty of hosts who do that, and plenty of users who don't know what they're doing who are looking for cheap hosting and don't know not to change host configured pws)
yes, exactly
err, know to* change
[10:33]
***awyeah has joined #arpnetworks [10:39]
Hienhi
everyone know status of bcp38 deployments around the world?
i know that page http://spoofer.csail.mit.edu/summary.php providing status, but now it's almost broken
[10:53]
brycecm0unds: good point, I'd overlooked the obvious fact that this means we're all only as safe as the least-safe guest on the host.
brycec pokes up_the_irons over email about VENOM
[11:02]
mkbhttp://marc.info/?l=openbsd-misc&m=119318909016582 [11:10]
BryceBotopenbsd-misc: "Re: About Xen: maybe a reiterative question but .." from Theo de Raadt <deraadt () cvs ! openbsd ! org> @ 2007-10-24 1:14:13 [11:10]
m0undslol
brycec: yeah, i was just thinking along the lines of securing belongings in an apartment building, but your upstairs neighbor falls sleep with a cigarette in hand and burns the building down
[11:11]
.... (idle for 15mn)
***yoberi is now known as yoberi_
yoberi_ has quit IRC (Quit: Leaving)
[11:30]
m0undsi like the custom element blocking in ublock
i use it to block comments on sites i visit who don't use discus or livefyre, since i block those with ghostery
[11:36]
brycec*disqus <.<
>.>
[11:38]
m0undsoh, whoops [11:39]
brycecI don't know why I even bother perusing comments on news articles and the like :( [11:39]
m0undsi just block them so i don't even think about it :) [11:39]
brycecI should think about that [11:39]
m0undsif i want to see them on a particular article, i just use the one-time load feature in ghostery
it'll reload the page so i can see it and then go back to blocking after
unfortunately, it only works with third party stuff like disqus***** and livefyre and the like
[11:39]
brycecWhat does ghostery do that uBlock can't/won't? Why a second extension? [11:40]
***poulsen has quit IRC (Remote host closed the connection) [11:41]
m0undsfocuses on privacy related stuff
and widgets
it can block ads, but i just opt out of that list because it's not as good
[11:41]
***poulsen has joined #arpnetworks [11:41]
brycecuBlock has privacy-lists though [11:41]
m0undsghostery also gives you the ability to selectively toggle seeing stuff or not, so it's convenient
without having to disable it for the whole site
trying to find a site w/disqus so i can take a screenshot
[11:41]
brycechttp://www.spokesman.com/stories/2015/may/13/spokane-adopts-new-rules-for-short-term-rentals/comments/
(Kudos to that site for burying comments under another link from the article)
[11:43]
m0undshttp://i.imgur.com/wfa52sf.png [11:44]
brycec("There are 44 comments on this story. Click here to view comments >>")
cute
[11:44]
m0undsthe other thing is that they control the list, so it can be updated whenever vs predefined intervals on some lists
i think all the easylists include a minimum update interval of like 5 days
and if you're using their lists, they expect you to respect that and not update more often
(not to say you /couldn't/ just update anyway)
[11:44]
***poulsen has quit IRC (Remote host closed the connection)
poulsen has joined #arpnetworks
[11:48]
m0undsthe other handy thing (imo) is that it blocks a lot of the junky media players that news sites use
and allows you to toggle them on/off if you want to see a video
our local news outlets are awful about autoplaying teaser videos for stories and stuff. i hate it.
[11:52]
mkbI can't go to a local news site because my computer isn't powerful enough [11:54]
m0undslol
"i had to upgrade my pc to read local news" - story at 11
[11:54]
***jlgaddis has quit IRC (Ping timeout: 244 seconds) [11:56]
brycecm0unds: I flashblock for that (hooray for Chrome having that builtin) [12:08]
m0undsah [12:18]
..... (idle for 24mn)
***poulsen has quit IRC (Remote host closed the connection)
poulsen has joined #arpnetworks
[12:42]
poulsen has quit IRC (Remote host closed the connection)
poulsen has joined #arpnetworks
[12:52]
mnathaniAnyone use The Great Suspender on chrome? [13:05]
............. (idle for 1h1mn)
mercutioi saw a suspending thing on firefox, it seemed annoying
m0unds: local news auutoplays videos here too, and they're terrible quality, and it gives you 5 seconds to cancel, but you can't say "always cancel", so have to cancel every time :(
[14:06]
***josephb_ has joined #arpnetworks
josephb has quit IRC (Ping timeout: 250 seconds)
[14:08]
brycecI was not aware of TGS but I may have to play with it. I semi-often go through task explorer and kill unused tabs once memory usage gets heavy, but this could automate that
thx
[14:12]
mercutioerk this venom thing souunuds disturbing
people really shouldn't need floppy support these days
[14:23]
brycecI don't mind fdc support in the emulator itself, because sometimes one needs that. But the fact that Venom is exploitable even without an FDC loaded in the guest is just silly. [14:24]
mercutiowhat it brings to mind for me isr that normal processes on linux need more securing
like once youu break into qemu/kvm it shouuld be more bounded.
buut i don't think apparmour does much on ubuntu for kvm?
[14:26]
brycecI thought you were limited to the whatever privs the qemu process has? [14:27]
mercutiodoesn't kvm split into two processes
i think it normally runs as an intermediate user though
so you won't have root, but will have access to other vm's
[14:27]
BryceBotThat's what she said!! [14:28]
mercutioso like root/secondary user split process model [14:28]
brycecI imagine that paravirtualisation makes anything like apparmour rather difficult since you've moved the IO out of the host kernel's view [14:29]
mercutioactually i think it's single process setuid to user, and kernel modules give it more root-like functionality
you still open a normal file for read/write
but how can they know what file the vm is associated with
or files
you really need to double-step that kind of thing
like libvirt could create a second template for the vm itself and both usued together?
i haven't looked into it, i duno if you can even do that
this packet of death thing seems to need some obscure driver loaded.
maybe i need a better place than phoronix to read about this stuff :)
[14:29]
brycecWhat POD is that? I didn't see anything mentioned about a POD vector for Venom
lol phoronix...
[14:31]
mercutiohttp://www.phoronix.com/scan.php?page=news_item&px=OZWPWN-4-PoD-Linux
i hate phoronix's benchmarking
but really there isn't muuch benchmarking available for linux :(
and they did make a test suite. it's just that there's no good tests for the test suite to execute.
i suppose the "graphics" side of things isn't too bad.
but the disk stuff is terrible.
[14:32]
bryceclooks like the POD affects a wireless USB device/stack. Not many people have those...
(Looking at https://www.kernel.org/doc/readme/drivers-staging-ozwpan-README)
[14:33]
mercutioyeah exactly [14:33]
brycecSo... fear mongering rather than bug reporting. *sigh* [14:34]
mercutioa lot of linux vulnerabilities are in (obscure) drivers [14:34]
brycecNo surprise there. [14:34]
BryceBotThat's what she said!! [14:34]
mercutioyou read about scary vulnerabilitles
then realise it's fine because you don't have usb enabled
or wireless drivers or whatever it is :)
i have usb enabled these days.
but just like disk/keyboard/mouse
[14:34]
brycecI really disagree with the use of "vulnerability" in this case, at least the way it's used. This is really more bug than vuln. [14:35]
mercutioi'm not sure how i feel about that. [14:35]
brycecFor a vuln to be a vuln, it should affect a large userbase and probably go back awhile too. [14:35]
mercutioin some ways marking all buugs as vulnerabilities sounds like a "nice" idea. [14:36]
brycecI feel like "vuln" is more "intentional" than just an uncaught bug on an obscure driver. [14:36]
mercutiotrue not for patching
ie from not being prudent?
i don't think most vulnerabiltiies are intentional. i think they're oversight, from people not being prudent enough to check all input sizes etc.
like we normally don't get packets > 1.5k so we'll assign 2k buffer, but we don't check if there's more data, and we'll send as much data as is in packet
[14:36]
brycecYeah probably. There's plenty of grey-area here. [14:38]
mercutioso someone uses 9k mtu on their network, and people send more than 2k of data and do an overrun. [14:38]
brycecReally not sure these bugs warrant CVEs though. https://lkml.org/lkml/2015/5/13/739 [14:38]
mercutiooh wow
that guuy seems to really putting himself ouut there, jusut looking at how many messages in the thread are his
i think he's probably trying to get a job or something :/
[14:38]
bryceclkml is craaaawling [14:39]
mercutioit's fast for me
1.28 seconds load time on page speed tracker
[14:39]
brycec(back to normal now) [14:39]
mercutioAny reason you didn't cc: the maintainer who could actually apply these
to the kernel tree?
hahaha
[14:39]
brycec"You missed me, and the driverdev mailing list. netdev could care less"
about this.
[14:39]
mercutiogreg kh seems cool. [14:40]
brycec(I'd clicked a couple of messages and it was just "waiting...") [14:40]
mercutio1.26 seconds now [14:40]
BryceBotThat's what she said!! [14:40]
mercutioyeh it's probably packet loss
what! it's hosted on digitalocean.
[14:40]
brycecI'm not really familiar with Linux's layout, but a directory called "staging" strikes me as "super-beta" type stuff. Definitely not worth a CVE let alone Phoronix's hype. [14:40]
mercutioin europe
sigh
ok i need a better news site
with as much news as phoronix is good :)
so i check news.arpnetworks.com even though i know it's just hosting news rather than what i'm looking for..
http://www.itworld.com/article/2920349/security/for-containers-security-is-problem-1.html
and find this
[14:40]
brycec"staging" is defined as "This option allows you to select a number of drivers that are not of the "normal" Linux kernel quality level. These drivers are placed here in order to get a wider audience to make use of them. Please note that these drivers are under heavy development, may or may not work, and may contain userspace interfaces that most likely will be changed in the near future."
And it recommends disabling staging drivers "If in doubt, say N here."
http://cateee.net/lkddb/web-lkddb/STAGING.html
[14:43]
mercutioyeah, i don't enable staging normally
i think i did once over 10 years ago
[14:44]
brycec(Apparently Arch goes against the grain and has it enabled in their default kernel with ozwpan compiled as a module.)
And if you're curious about the whole Ozmo thing, here's a decent description from the Linux perspective http://fabiobaltieri.com/2013/02/14/hp-wi-fi-direct-mouse-on-linux/
Apparently the idea is to have wireless peripherals connect over WiFi instead of Bluetooth or RF dongles.
And broadly only supported under Winders. Except for this driver.
brycec found it interesting
[14:44]
mercutioahh
i really have to get away from the arch kernels
all ubuntu systems are using custom kernels.
[14:47]
..... (idle for 21mn)
***Hien has quit IRC (Ping timeout: 265 seconds) [15:08]
mercutiohmm, so i don't have floppy enabled on kernel for my xen stuff
and i don't have it in the config for vm's, so i think that means i'm not vulnerable?
also there's no known exploit yet
[15:16]
***jcv has quit IRC (Quit: leaving)
jcv has joined #arpnetworks
[15:25]
brycecAccording to what I read, you're vulnerable so long as FDC is supported in qemu, whether or not it's enabled anywhere else. [15:31]
mercutioyeah so if it's not in the config it's fine
vultr took 3 hours to apply patch whilst giving downtime it seems
i have another vm with some cheap place that's got downtime right now
[15:31]
brycecmercutio: still affected "And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers."
http://venom.crowdstrike.com/
[15:32]
mercutioyeh that sounds like disabling it insside the vm
rather than in the external vm config
err hangon did i disable it extenrakll
[15:32]
brycecI read it as even if it's disabled in the config, you're still vuln. [15:33]
mercutiooh
da,m
maybe i do have to patch
and i'm compiling from source for xen ...
but don't have random users with root
redhat seems to think that people not having root means you're "reasonably safe"
[15:35]
brycecWell that IS the biggest thing you can do right :p [15:36]
mercutioyeah
sweet vultr gave me an account credit
[15:38]
brycecnice
I have a hard time taking this patch seriously. "+Signed-off-by: John Snow <jsnow at redhat.com>"
[15:39]
mercutiohahaha [15:39]
brycec(Because "John Snow" is a character on Game of Thrones) [15:39]
mercutioyeh i know that, i don't watch it, but i still know it :) [15:39]
brycec(for anyone that doesn't get it)
I didn't watch it at first, but recently started (and caught up) and I quite enjoy it
[15:39]
mercutioi did try watching it, i just found it boring.
there's no good tv atm :(
i might have to watch mediocre stuff
[15:39]
....... (idle for 31mn)
venom's getting a lot of news about it
hmm i wonder if amazon is vulnerable.
[16:12]
brycecProbably
then again, maybe not. Hmm. They have customized Xen pretty much, wouldn't be too surprised if they ripped out FDC entirely.
[16:23]
mercutioyeah they might have [16:24]
m0undsthey're not
they have a CVS advisory on their site
xen-pv isn't vulnerable either
[16:25]
mercutiooh xen pv is what i use, sweet. [16:26]
m0undshttp://aws.amazon.com/security/security-bulletins/XSA_Security_Advisory_CVE_2015_3456/
^
[16:26]
mercutiois amazon xen-pv?
i wondeer if pvhvm is vulnerable
i imagine probably not too
[16:26]
m0undsif it uses qemu, it's likely vulnerable [16:27]
mercutiohmm i dunno if it does or not
it's just using the ept stuff with pv
ie the performance of hvm, but still need special kernels
[16:27]
.... (idle for 15mn)
***poulsen has quit IRC (Ping timeout: 256 seconds) [16:42]
poulsen has joined #arpnetworks [16:50]
mnathani_mercutio: what did Vultr give you credit for?
skimming scrollback
[16:51]
mercutiomnathani_: 3 hours downtime to apply patch to kvm
it's not the first time i've had downtime with vultr, or that vm.
i haven't really got anything important on it, but to me 3 hours downtime seems like a long time.
i don't think i've had 3 hours total downtime on arp
[16:53]
***poulsen has quit IRC (Ping timeout: 256 seconds) [16:56]
mercutiothere was one planned outage iirc [16:58]
brycecs/CVS/CVE [17:05]
BryceBot<m0unds> they have a CVE advisory on their site [17:05]
brycecand kudos to m0unds for the info [17:06]
mercutiooh apparently apparmor is likely to block it on ubuntu
http://www.ubuntu.com/usn/usn-2608-1/
judging from that
[17:11]
m0undserr, ye
a
i'm the typo kid
[17:21]
up_the_irons"The guest operating system communicates with the FDC by sending commands such as seek, read, write, format, etc. to the FDC’s input/output port"
^^ so what if the guest OS doesn't have a floppy drive?
[17:22]
mercutioapparently you can't disable it in qemu properly. [17:23]
up_the_ironsi see: "even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers"
but that's confusing...
[17:23]
mercutioyeah i don't know if that means in bios, or the libvirt config. [17:23]
up_the_ironsyaeh
yeah
[17:23]
m0undsyea, administrator is kind of vague in this case
is it host admin or guest admin
haha
[17:24]
up_the_ironsyeah [17:24]
m0undshttps://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ up_the_irons
It is also exposed regardless of presence of any floppy related QEMU command line options so even guests without floppy disk explicitly enabled in the libvirt or Xen configuration files are affected.
[17:28]
up_the_ironsah ok thanks [17:28]
mercutioi wonder if the long term fix is to allow to disable more devices in qemuu [17:29]
brycecbrycec hates thanking Red Hat for something [17:29]
mercutiohaha brycec
i'm surprised the redhat bug tracker is visible
half the time redhat bug tracking seems to be closed
[17:29]
........... (idle for 53mn)
up_the_ironsregarding venom, Ubuntu advisory states:
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
but no mention of 10.04, which I believe is not EOL'd just yet. anyone know if 10.04 isn't affected?
[18:23]
m0undsEOL 4/30
2015
https://lists.ubuntu.com/archives/ubuntu-announce/2015-April/000196.html
[18:25]
mhoranYeah, EOL'd. [18:25]
up_the_ironsoh fuck, just got EOL'd...
up_the_irons cries
[18:26]
m0undsoh, is that the release you were just upgrading stuff to? [18:28]
up_the_ironsno, but what a PITA anyway... [18:29]
m0undsfreebsd released an update for freebsd-update today too
errata, errata everywhere
[18:30]
BryceBotThat's what she said!! [18:30]
up_the_ironsLOL [18:31]
m0undshaha, BryceBot you're a goon [18:31]
mhoranSigh. [18:35]
mercutiofreebsd apparently has resolved the reboot bug now too :) [18:44]
.......... (idle for 49mn)
***awyeah has quit IRC (Quit: ZNC - http://znc.in)
awyeah has joined #arpnetworks
[19:33]
........ (idle for 35mn)
dwarren has quit IRC (Quit: leaving)
toddf has quit IRC (Remote host closed the connection)
dwarren has joined #arpnetworks
[20:10]
.... (idle for 16mn)
mercutiois there anywhere that provides free wildcard certificaters?
or at least really cheap
[20:30]
staticsafehttp://www.garrisonhost.com/ssl-certificates/alphassl.html alphassl resellers are usually your best bet [20:31]
mercutiohmm $45
let's encrypt will be around soon i'm hoping
i assume resellers are probably still more than 420
$20
myabe should just use cacert
just want it for testing :)
[20:31]
NiTeMaRemercutio: i can do them pretty cheap
wildcards
[20:36]
mercutioless than $20? [20:36]
NiTeMaReno but i can do it cheaper then anyone likely advertises @ $35
the more years obviously the cheaper per year
[20:37]
mercutioyeah i want like 3 months [20:38]
NiTeMaRei can do a free 3 month ssl cert
but it won't be wildcard
[20:38]
BryceBotThat's what she said!! [20:38]
mercutiocacert should be fine i think
you can ruin an installer to install it at least
[20:38]
brycecstartssl should work too and at least they're in everybody's cert chain
"ruin an installer" eh?
[20:42]
mercutiostartssl don't do wildcard.
s/ruin/run/
[20:44]
BryceBot<brycec> "run an installer" eh? [20:44]
mercutiooh
i wanted to fix my one :)
i have one now :)
[20:44]
brycecmercutio: not for free, no. neither does cacert. [20:44]
NiTeMaRe:P [20:45]
mercutiooh cacert isn't for free?
http://wiki.cacert.org/WildcardCertificates
[20:46]
brycecLast I knew Cacert didn't offer wildcards
Evidently that seems to have changed in the last 10 years
Actually this wiki just talks about wildcards in general, but doesn't state whether Cacert offers them.
"we provide host and wild card certificates which you can issue almost immediately"
(From http://wiki.cacert.org/FAQ/AboutUs)
[20:54]
mercutiohmm
i could try it in nginx
[20:57]
brycecmnathani_: Biggest down-side to The Great Suspender is that in Chrome Sync, all my remote tabs just show as "Suspended Tab" [20:57]
mercutioit's being annoying in trafficserver and not working but i don't know if it's my config
yeah seems to work fine
[20:57]
hazardouswiki.cacert.org uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown.
lol
[21:10]
mercutioyeah [21:10]
hazardouswhat are they included in by default? [21:10]
mercutiogo to root [21:10]
hazardouslike.. a few linuxes? [21:10]
mercutioand install their root cert
i dunno
[21:10]
hazardousi mean startssl is usable ebcause it's pre-installed root
i can't feasibly use cacert
[21:11]
mercutioyou can use it for servers etc [21:11]
hazardousbecause if i was making my clients install root certs i'd just use my own ca at that point [21:11]
brycecExactly my points, hazardous [21:11]
mercutiotrue, but just having a standard one seems good in some ways
mercutio checks curl
[21:11]
hazardousif i'm using it for servers [21:12]
gizmoguywosign let you shove a few names in your free cert [21:12]
mercutioyeah curl seems fine with it [21:12]
gizmoguyI don't know about wildcards [21:12]
hazardousi'd use my CA too
no wildcards gizmoguy
assuming you mean the free ssl
[21:12]
gizmoguywosign give you 100 alternative names
hacky way of getting a half-wildcard cert
https://buy.wosign.com/free/
[21:13]
mercutioheh yes hacky
i have a wildcard tinydns domain name :/
*cough*
look up <anything>.ambitio.nz
[21:14]
..................... (idle for 1h43mn)
woot, got http2 going. [22:57]
.... (idle for 18mn)
***toddf has joined #arpnetworks
ChanServ sets mode: +o toddf
[23:15]

↑back Search ←Prev date Next date→ Show only urls(Click on time to select a line by its url)