S2E7: "Projecting Insecurities"

Posted 2017-05-22 03:59
Modified 2021-03-10 23:04
Comments 0

In this episode we talk about AIF-NG and other sideprojects we’ve all been working on.

• News
• Notes
• Sysbadministration Award
• Errata
• Music

News

• Wordpress core has had a known vuln for a year…
  • And the devs will “get to it eventually”.
• Tavis Ormandy and Natalie Silvanovich found a pretty serious bug in Windows.
  • CVE-2017-0290
  • Windows advisory
• ASUS routers have multiple vulnerabilities
• Border agents harass a man who refused to unlock his phone
• rpcbind can be DoS’d with only 60 bytes
• Microsoft and Oracle are being sued
• Amazon and RedHat have integrated openshift into their producs
• There’s a serious remote exploit in all Intel processors made after 2008.
• Firefox now offers you an option to open in a container
• In a special report from Captain Obvious, ransomware is the biggest threat to healthcare IT security
• Cloudflare has been served a subpoena to reveal the identity of a torrent tracker site operator
• There’s a serious case of Google Docs phishing floating around
• Canonical is opening for an IPO

Notes

Starts at 17m50s.

I was drinking water. Paden was drinking water as well. Jthan was drinking a Red Eire from Westminster Brewing Company.

• I talk about a project I just released, AIF-NG (which is basically Kickstart / preseed for Arch Linux).
  • Python 3 and XML driven
  • Has a configuration file generator
  • Works well with iPXE
  • Announced here and here
  • I mention this article and the python script that automates that is here.

• Other hosts’ projects rundown! (22m47s)
  • Jthan is working on a total rewrite of the (currently hideous) games.square-r00t.net
    • He’s also working on the hackathon
      • In which he discovers just how much of a PITA AWS is.
  • He also is doing a lot of freelance work
  • Paden is setting up his homelab and network testbed
    • There’s a lot here- too much to type up! I’d recommend listening to the episode and seeing just how many things are on Paden’s TODO.

• Planned projects (45m16s)
  • Jthan wants to redo his site in flask
    • He also wants to do a gallery for his pottery
    • And backups
  • Paden is working on what he mentioned before, and wants to implement high-availability
    • Also CISCO networking
  • I need to finish setting up the actual dedicated game server configs for the above-mentioned project
    • And I need to give square-r00t.net a facelift
    • And I need to clean up AIF-NG
    • AND I REALLY NEED TO SET UP THE SHOP FOR SYSADMINISTRIVIA

Sysbadministration Award

In this segment, we highlight system administration mistakes. Think of them as the IT equivalent of the Darwin Awards. (53m32s)

Handbrake was compromised (and there’s a personal account of someone that was hit).

Errata

• The config generator tool for AIF-NG is done and documented (but not documented upstream yet).
• Jthan mentions Matt; this is his twitter.
• I mention FreeNAS and pfSense as the only embedded BSDs I know of- I discovered that there’s also OPNsense (an alternative to pfSense) that is the sort of spiritual successor to m0n0wall.
• I was right. Jthan did, in fact, originally mention that FreeNAS is a storage appliance:

13:49:20< jthan> storage appliances are fucking trash
13:49:21< jthan> is what
13:49:29< jthan> this is why I don’t think I’d ever use FreeNAS

to which I replied: 14:18:55< r00t^2> jthan: then FreeNAS isn’t an appliance either

• Dang it, Jthan was right – I never gave him a login to the shop beta.

16:07:00 < r00t^2> jthan: what’s your paypal?

Music

Author r00t^2
Categories Season Two