Lawrence’s List 072216
ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques.
The list this week is a little shorter, I didn’t include a tool or POC link as I usually do. No particular reason, just didn’t run across one I felt like I could talk about directly. Among the articles this week we see legal actions, leaked data, an openssh user enumeration, and finally a goofy but serious look at a common security fear, open wireless networks.
The EFF have announced a lawsuit against the United States Government which challenges section 1201 of the Digital Millennium Copyright Act. Section 1201 is titled “Circumvention of copyright protection systems” and was ostensibly originally designed to protect copyrighted media like movies and music. The reality of section 1201 is that it takes from consumers their rights to fair use of the media, software, and hardware which they’ve purchased. For those of you who do not wish to read 1201 (though I recommend you do) there’s a good example of how this is stifling innovation in the EFFs article linked below.
Canonical reported on the 15th of this month that its forums were again compromised. The attacker had access to over two million usernames, email address, and IP addresses. Canonical maintains that due to its use of single sign on the attackers did not obtain any passwords.
http://insights.ubuntu.com/2016/07/15/notice-of-security-breach-on-ubuntu-forums/
A user enumeration was released for opensshd which allows user enumeration via an interesting sort of timing attack. Long passwords (> 10k) are sent to the server and the time that it takes the server to respond to these passwords is then observed. For existing users the password will take longer to hash so long as the server is configured to use SHA256/SHA512 for password hashing. Also of interest, the root user will not appear to be a valid user if root login is not permitted on the server.
http://seclists.org/fulldisclosure/2016/Jul/51
Voting with your insecure wifi. I like theregister.co.uk for snark, and this is research that is best reported on with some snarkiness. Really I’m posting this because I feel like it’s a good indicator for how educated (or uneducated as the case may be) Americans are about the risks associated with open wifi networks.
http://www.theregister.co.uk/2016/07/21/gop_wifi_privacy_fail/
Ready to learn more?
Level up your skills with affordable classes from Antisyphon!
Available live/virtual and on-demand
