Keep in mind we are talking about a protocol from 1987. How many protocols from 1987 is google currently using?
Keep in mind that google is primarily a cloud business. That means that they take on a lot more of a risk, as when they are hacked its a them problem vs traditional software where its much more the customer's problem. Security is very much about incentives, and the incentives line up better for google to do the right thing.
I feel like web browser and website standards are one of the main areas Google has a lot more control of policies. Is there somewhere else they have much control of for standards?
What browser do you use?
Because I've definitely run into this but s/ie/chrome/ but with no helpful message. You just have to guess that that's why it's broken
At least now nobody can pretend.
I for one hope that this hastens the demise of every remaining use.
It turns out when nerds get a billion dollars they like being bullies too.
Great, so someone with half a motherboard can break this hash
This stuff was out at least 10-15 years ago. It’s different from the ancient local ntlm hash cracking everyone used to get admin in high school, yes, but it’s not a novel technique.
on cursory google, https://github.com/NotMedic/NetNTLMtoSilverTicket/blob/maste... is 6 years old and was old news when it was committed, and https://crack.sh/netntlm/ has been around online for at least 10 and I think more like 15+ years.
https://support.microsoft.com/en-us/topic/upcoming-changes-t...
Windows 11 is probably the last version that will contain NTLM (and hopefully NTLMv2). Going forward everything will be Kerberos or Oauth based.
At some point the line must be drawn.
If you're using it on something that doesn't matter, then it also doesn't matter that rainbow tables any attacker could have already had for a decade are slightly more available.
However, it's most likely to be used by governments, with legacy servers that are finicky, with filesharing set up that's impacted other computers configured for compatibility, or legacy ancient network gear or printers.
I wonder who they're pushing around, and what the motivation is?
What releases like this do is give IT ops people the ammunition they need to convince their leadership to actually spend some money on fixing systemic security problems.
Consulting business? I was under the impression (from Google Reader) that if users aren’t in the millions, then they’ll kill the project. How could they also run a high-touch consultancy?!
> they're probably sick of going to the same old engagements
Hmm… consultancies love this type of recurring revenue - it’s easy money
Google also has the Project Zero which doesn't fit into Google business culture either. I wonder if Mandiant is paying for their payroll.
Google Cloud is basically an entirely different company than Search or Maps. Cloud will happily sell you $10m in compute a year and a value add $400k of security consulting.
Torrents would be a perfectly valid way for Google to distribute this dataset, but the key difference would be that Google is providing it for this purpose and presumably didn't do anything underhanded to collect or generate it, and tells you explicitly how you're allowed to use it via the license.
That sort of legal and compliance homework is good practice for any business to some extent (don't use random p2p discoveries for sensitive business purposes), but is probably critical to remain employed in the sorts of giant enterprises where an internal security engineer needs to build a compelling case for spending money to upgrade an outdated protocol.
It would completely not surprise me if there are automagic attacks on net-ntlmv1 at this point against some cloud hosted storage. This has been doable by anyone since like 2016 if you had the space and weren't prevented from using that protocol version.
But we are in two-thousand-twenty-FUCKING-six.
It's unbelievable. Just plain unbelievable.
https://www.lesswrong.com/posts/koGbEwgbfst2wCbzG/i-don-t-kn...
That's the most likely use case for anyone. You want the one-offs when cracking, and not a compressed 2GB blob of data that may or may not have your answer.
B. The king of search has held the goal of organizing and making information useful and searchable since dinosaurs roamed the WWW.
https://www.google.com/intl/en_us/search/howsearchworks/our-...
C. It's just lazy and shows that they don't actually care anymore. Making a custom search has been their bread and butter for decades. The last step is the easiest but they could not be bothered.
Was it a success? Is Mandiant a cash cow or was it basically an acquihire?
The big "contact mandiant" button next to the post feels a bit like trying to stay relevant and acquire more customers.
Is there any business that does NOT try to do this? Why wouldn't they?
They decided to not fix the vulns (either directly by not patching, or indirectly by not investing in cybersecurity). So exploiting them is somehow an act of mercy. They may not know they have a problem and they have an opportunity to learn.
Let's just hope they will have white or gray-ish hats teaching the lesson
Amazing that this is still around and causing someone enough of a headache to justify spending money on.
Also amazing what a teenager with lots of free time and a bootable Linux usb can get up to.
But fair enough, I don't recall which exact version I was mucking with that long ago.
No! Not this time, at least. In hindsight everything was named and organized terribly and it hasn't improved much since.
https://home.treasury.gov/policy-issues/financial-markets-fi...
> Thanks to the President’s decisive leadership in the face of radical left-wing obstructionism, the Department of the Treasury has now resumed normal operations.
"We're releasing hacking tools to allow others to break into poorly secured computer systems... But we are doing it with good intentions so it won't be illegal right??"
(The bane of my existence thanks to everyone and their mother releasing ESP32 Wi-Fi/Bluetooth/etc deauther 'tools'...)
802.11w exists
As a bonus, even wireshark won't detect anything for debugging, because the RTS+CTS handshake typically can't be sent to the linux kernel+higher layers.
An ESP32 is capable of doing that on all wifi channels 'simultaneously' (ie. round robin, but getting back to the start channel within the timeout), effectively blocking all wifi.
I didn't expect Google (Mandiant) to release rainbow tables ever. Curious what changed internally to make that acceptable now.
I couldn't immediately figure out here whether we're talking
0. Microsoft's supported products default enable this worthless "authentication" feature
1. Microsoft's supported products provide such a feature behind a UI that's not clearly marked "Danger: Do not stare into laser with remaining eye"
2: Microsoft does still support this, behind some Registry nonsense most users do not understand and once enabled it doesn't turn on the "I am a toxic waste dump, leave by nearest exit" warning signs on affected machines
3: Microsoft doesn't support this at all but some 3rd party commercial stuff does and customers really do love their crusty archaic 3rd party garbage
4: But this long abandoned SCO machine we've kept on life support for twenty years!
5: What does "supported" mean? Windows NT is scary, we're still on Windows 98 here.
Microsoft needs to make this forcibly change the UI so that users can see "Oh! I'm using crap low security Windows". That lights a fire under people to actually get it fixed.
Even today the only reason to use samba 2 in 90% of companies where it's enabled are old appliances.
At some point device X isn't working, employees complain, IT say they need to buy a new very expensive replacement and after much argumentation they come to the agreement to enable that legacy horror support until the purchase can be made. Which is then never made.
500 Internal Server Error