erros

Joined 3 years ago

Karma

Submissions

Member since

Dec 25

Recent submissions

Don't stress it. It's clear someone in the know did not respect or communicate the embargo and were sharing information with people who weren't in the need to know. The problem is less with you and more with the entire process. Case in point, we saw ZDI drop some zerodays on the kernel mailing list this week.

It is clear as day that this industry is fucked, and has no clue on how to deal with operational security for sensitive information. It is what it is at this point. The days of full disclosure are back.

Comment · 1 month ago

So true!

Comment · 1 month ago

Money. They make so much money from malvertisement that it doesn't make sense to remediate them. It's corporate greed and they've known about this since the 2010s, various campaigns have sprung up and have caused untold X amount of dollars in damages in breaches, and nothing changes. I've heard at least one FBI agent who had investigated cases related to malvertisement put Google up there with some of the worst ad networks.

Comment · 2 years ago

Ladies and gentlemen, this person solves problems. Let it be known.

Comment · 2 years ago

You may want to update this post to disable password authentication, and thus you'll no longer need to install fail2ban. An important goal is to tighten your attack surface, not expand it. At this point you will still have an exposed SSHd server, so I'd recommend throwing the server under tailscale. You can setup the SSHd listener to use your tailscale IP or setup tailscale for SSH via ACLs (https://tailscale.com/tailscale-ssh).

Additionally you can further tighten controls of incoming logins with the use of AllowGroups to tighten your controls on which groups can log into the system. This would mitigate a scenario where an adversary is able to escalate enough privileges to write an .authorized_keys file to a non-privileged user which may have a shell still configured.

Finally, unless you're treating this server as a bastion host of sorts, you probably should disable forwarding for agents or X11 etc. We've seen a lot of adversaries move laterally due to this agent forwarding.

Comment · 2 years ago

I'm sure we all could appreciate Mega for what it was, and we could also debate the charges and go back and forth on extradition laws. The reality is that according to the DoJ, US citizens were victimized by a service that used US assets (servers) within its territory. That opens the doors for litigation. This happens literally in every country that can enforce it.

Like Reddit, HN has a crowd of anti-US folks with terrible sentiment until, you know, when they need the US or need a job in the U.S. The hypocrisy is astounding.

Comment · 2 years ago

It is my opinion. What else? I mean, what was the point of your response? You didn't even offer an opinion on the topic. You offered an observation and lazily concluded whatever-it-was with a rhetorical question?

Is that normal for people like you?

Comment · 3 years ago

Used vast.ai for this setup: $5.875/hr. Using their API you can likely find better deals and launch a series of different setups and optimize your spending. Hope that helps.

Comment · 3 years ago

Just out of curiosity I booted up a box with 10x RTX A6000 @ 451.6 TFLOPS

    Speed.#1.........:    38789 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#2.........:    39017 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#3.........:    38894 H/s (11.16ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#4.........:    39254 H/s (11.02ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#5.........:    38626 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#6.........:    39448 H/s (10.94ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#7.........:    39256 H/s (11.06ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#8.........:    38966 H/s (11.14ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#9.........:    38870 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#10.........:    39259 H/s (11.01ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#\*.........:   390.0 kH/s

Used the same example as the author with 100500 iterations. I think with some good wordlists, I'd wager a ton of low hanging fruits will be wiped within a reasonable time. If we're talking a threat actor with $$, they'd do some serious damage on this dump.

*edit: just wanted to clarify that I think bruteforcing this dump wouldn't be as useful. It would still take a crapload of resources to be effective or useful in that scenario.