#computer security

[felixcloud6288]

The most audacious thing I ever did in my academic career happened in a computer security class. We were given an assignment to pull a phishing attack on our professor and then write up a report about our research on him, reason for our attack, etc.

I decided to send him an email claiming to be Advil offering a mail-in service for pain meds. I then stole the source code from Advil's front page, edited the code to remove links to other pages, created a section where he could put in his information, and sent the modified code to the professor.

In my writeup, I admitted to stealing a company's code and that I committed multiple acts that broke the school's academic integrity rules including plagiarism, copyright infringement, and trademark infringement. I also told him he should ignore this because the assignment's main goal was to commit a crime so why should I care about other felonies I commit along the way.

I got an A+.

[foone]

Have you heard about the Polish Train company, Newag, and the bullshit it turns out they got up to?

So, the regional rail operator Koleje Dolnośląskie bought some Newag Impuls back in 2016 . In late 2021, some of them need to have major maintenance done, as they've been in service a while. So the company SPS (Serwis Pojazdów Szynowych) gets the contract to fix them. They basically take the train apart, replace a bunch of it, following all the rules in the documentation Newag gave them, and... it won't move. The train says everything is fine, the brakes are off, there's plenty of power, but you push the throttle up and it won't move.

SPS spends a while trying to figure out what the fuck is wrong, with no luck. So they hire some hackers from the Polish security group Dragon Sector. Dragon Sector figures out how to get into the code of the computer system that runs the train, and OH MY GOD.

So it turns out there's a secret train-lock system. If it's on, the train won't move. This will be triggered in some situations you might think are normal: the clocks are wrong, the serial numbers of the various parts have changed, and a firmware mismatch between the main computer and the power system. Now, the fact that it makes sense to not run the train in these situations until someone can check it? that doesn't extend to the fact the train uses a SECRET lock system, rather than just popping up an error message telling you what's wrong. There's also the problem that while these are all potential error problems, they can't be cleared by anyone with the technical manuals, which are supposed to cover everything about how to run these trains. Only Newag themselves can reset this system.

Which, you know, keeps SPS from properly fixing them. Only Newag can fix them now, but not because SPS lacks any technical ability, but because Newag sabotaged their own trains. But don't worry: it gets worse.

So now that Dragon Sector knows what's happening, they get to look at other trains. It turns out the trains aren't all running the same software, and there are other tricks in there.

One of them is a "how long has the train been stopped?" check. If the train hasn't hit 60 km/h in 10 days, the train locks itself and won't move until Newag can clear it. So, like, if a train is ever out of service, like it's going to a repair place... it'll break itself. Unless the repair place is owned by Newag.

But two of the trains go further: See, these trains have GPS built in, right? You may be able to guess where this is going...

THEY JUST MAKE THE TRAIN CHECK IF IT IS PARKED AT THEIR COMPETITORS' REPAIR YARD AND BREAK ITSELF IF IT WAS.

The sheer audacity of this move. This is frighteningly bullshit anti-competition self-sabotage.

This has, obviously, made some parts of the Polish government to start investigating this. Newag may be (and hopefully will be) in a lot of trouble.

For more info, there's a great video of a presentation by the three people from Dragon Sector who did the hacking, which was presented at the 37th Chaos Communication Congress in Germany.

Ars Technica also has an article on it, but it predates the presentation so it doesn't have some of the later details.

Anyway, the good news is that in the end the hackers at Dragon Sector were able to unlock most of the trains: A few had additional trickery that they didn't want to hack around, because it might break the train's certification. For the others, they discovered undocumented "cheat codes" in the software that they could use to bypass the secret lockouts... presumably the same ones that Newag would have used when they "repaired" trains.

[frogliftcertified]

new winrar vulnerability, go update

if you use winrar, it's time to update to 6.23+ (link)

here, have a license key for winrar while you're at it, disables the "buy me" nag (link)

or get 7-zip if you want a free program that's just as good, no donation nag, integrates cleanly with windows (link)

[the-fab-fox]

Attention: There may be a new scam thing (might also not be new)

Okay so I just got a weird notification from drive telling me I got shared a folder. The name of the folder was suspicious as fuck and thank my gods it was but my guess is that if this is a scam it might not always be the case!

Mine was from someone I'd never heard of and I definitely have not recently asked anyone to share any Google Drive folders or documents or anything with me.

Still, had the folder been titled something more innocent or innocuous, I might have been more inclined to click it or look into it.

So, just a PSA/WARNING to be on the look out for something like this. If you get something unsolicited no matter if it's a folder or a Google doc or anything! If you did not ask someone to share something on Google drive with you, DO NOT OPEN IT.

Instead click the three dots on the folder/document/whatever that are to the right of the item. Find report or block. Make sure you click the first option (I think it's called "spam" or something like that as it includes anything from unsolicited things, to malware, viruses, and phishing attempts.

My guess is that this scam most assuredly falls into one of the last three categories and sometimes just opening the thing can cause the bad thing to take place (i.e. you get the virus or malware or it immediately directs you to the phishing scam). Point is, it doesn't matter. Don't tempt the fates. Just get rid of it and don't look back. Doing what I instructed above will clear it from your drive without you having to take any further steps and insures they won't try to send anything further, at just via that particular account. It's my hope that it also blocks IP addresses and not just the account but that's not a guarantee so stay vigilant as they may try multiple times. So just remember, if you're not expecting something, block and report immediately.

PLEASE REBLOG AND SHARE TO GET THE WORD OUT.

[logorrhea5mip]

So, and correct me if I'm wrong, this is the only completely secure way to communicate over the internet:

1. Get a second computer which you will from now on never connect to the internet nor in any way allow to talk with any other computer, including flash drives, cables, Bluetooth, whatever.

2. Get it inside a Faraday cage that has an airlock type door so that you can always keep it closed.

This is because even of you rip out the antennas on a device, all modern motherboards have a backdoor which allows any government agents with proper equipment to compromise it via short range radio.

For good measure, get that computer its own power supply separate from the grid, to truly air gap it from the internet.

3. Anything which ever appears on any computer or phone can immediately be considered known to every security agency in the world, since all modern devices have backdoors put there for that reason.

Therefore, install on the other computer an encryption program(best if you make it yourself), whose resulting meaningless jumble of digits you by hand copy over to send to whoever needs it, presuming you gave them the key to decrypt it irl scribbled on a note or via the usual public private key method.

If any of this could be made simpler, please tell me, but I'm pretty sure that it can't.

[kirbyfigure]

hi!! can you make some virus/computer related usernames? or anything connected to software programs, coding programs etc!! i would enjoy if they were a play on words but they dont have to be!

/nf

I love this ask Ty

@codequre

@putergirl

@linuxluv

@downloed

@softwearz

@creatorcoml

@htmlfreaked

@vairusgirl

@vairusboy

@vaivirus

@illestvirus

@infectedvir

[autolenaphilia]

Speaking of computer security, this is kinda what I have learned about after doing some research.

Really the best way to secure your computer is to use Linux, not Windows with an anti-virus. Part of it is that far less malware is developed for Linux, but more so that Linux systems are more securely designed than Windows in various ways.

You don't need an anti-virus in Linux, and at this point I don't think there are any commercial anti-viruses that sell Linux desktop antiviruses, although there used to be (ESET and Sophos apparently had Linux desktop versions that are now discontinued).

Still there are additional steps on Linux to make yourself safe, like configuring a firewall. I think most distros come with a built-in firewall, although not always with it turned on by default or with a GUI. For example, Ubuntu and its many derivatives (which account for a lot of popular distros) use a "uncomplicated fire wall" or ufw and you can install a gui for it called gufw. Linux Mint, which I use came with a GUI firewall settings by default and recommendations for which settings to use.

To stay safe while using the internet, use Firefox, it has some built-in adblocking and malware blocking by default, but you really should install the ublock origin extension, which blocks not just ads but also malware, and a lot of online ads of course contain malware. The version on Chrome is nerfed at best.

There are malware scanners for Linux, chiefly the free and opensource Clamav, it's command line by default, but the clamtk wrapper can provide it with a gui. Do a quick scan of stuff you pirate for example.

The rest is common sense, be sensible about what programs you download and install, prefer your distro's package manager over stuff you find online, and you should be fine.

[fuzzyghost]

[greatrunner]

I started using Ad Blockers after a mere visit to places like a Livejournal graphics community back in the 2000s would result in dozens of Internet Explorer windows popping up quicker than you could close them, and crashing the browser.

Then there was the fact that the original Norton Anti-Virus kept notifying me about malware intrusions after visiting a multimedia (entertainment/news) website lined with sound ads playing at random, that looked relatively harmless.

The increase of ads on Wikia (now FANDOM), and FanFiction (dot) net getting rid of their "block ads for a day/week" option. The moment I started using AdBlock, and experienced an internet with fewer to no intrusive ads, loud noises, and an easier experience on my computer, I was never going back to early 2000s ad free-for-all.

And I say this as someone who initially didn't see the utility of ad blockers at all, and was gonna brave the 'net without one like:

Stay safe, dummies.

[axelshooter]

Hey guys heads up on a risk for links on X (née Twitter). They seem to have recently added text replacement for twitter.com, replacimg it with x.com for the iOS app.

So netflitwitter.com would be displayed as netflix.com, hiding the potentially dangerous site. I haven't been able to confirm this for myself, but the obvious redirects for this seem to have been already been taken by some nice people who are warning about this issue.

[raskies456]

I lost my old writeup but reminder not to use Telegram for secure messaging

I’ll add sources in the rb but as a quick summary the end to end encryption it brags about has to be manually turned on, is not an option for group chats or channels, and probably isn’t that securely encrypted,* plus telegram stores personal information (including IP, phone number, any group messages) which can be requested by authorities

*telegram uses an unknown, custom encryption protocol instead of known protocols that have been thoroughly tested and are secure even if people know how the encryption works. Creating a new protocol is essentially trying to reinvent the wheel, and keeping it secret suggests that it only works because people don’t know how it works (which means that anyone who knows how it works can potentially break it) and may even have intentional backdoors for telegram or government agencies

[daltongraham]

Every day now I spend at least an hour resetting passwords from the lastpass breach.

It's pretty tedious.

[fishstickmonkey]

If you're using LastPass you really should stop and change all your passwords.

[daemonhxckergrrl]

while the idea of sticking your pc in another room and running kvm over thunderbolt sounds great re: noise, heat and space, i hate the idea that i'm not guarding its physical access

and physical access is the #1 thing to protect re: computer security