Thanks George!!  Lot s to think about.


On 2024-07-04 14:23, George Toft wrote:
> <scroll>
> 
> Regards,
> 
> George Toft
> 
> On 7/4/2024 6:50 AM, techlists@phpcoderusa.com wrote:
>> Thank you so much George!!
>> 
>> Another Question.  I was a police officer in the 80's and 90's. During 
>> my tenure the bank was on the hook for any criminal acts as long as 
>> the customer was not negligent. I only dealt with this on a couple 
>> occasional.
>> 
>> So If someone gets access to my online banking and I report it in a 
>> timely manner, or if someone washes one of my checks and I report it 
>> in a timely manner, is the bank on the hook or am I?
> 
> There are a ton of rules with more acronyms than the IT world has. I 
> would love to tell you what I understand, but I'd be talking out my 
> ass.
> 
> 
>> BTW I thought going old school was the most secure.  I do not trust 
>> the Internet.  My daily driver is a Linux Box and I do not use my 
>> cellular phone for anything except to talk and read some news.  I am 
>> semiretired and have home officed for a long time.
> 
> Not sure there is any magic incantation that I can say that would put 
> you at ease, other than "Risk Analysis," "Government Regulation," 
> "Audit and Reviews," "Compliance," "Controls and Countermeasures," and 
> "Fines." We have to comply with a bazillion rules all designed to 
> protect you, the bank customer. Some regions are really strict and 
> their governments show they really care, like the EU - their rules are 
> so restrictive. Here's an example: You cannot log into a server that 
> serves the EU if Payment Card Information (PCI) is involved with the 
> same user ID that you used to log into your work station. This prevents 
> lateral movement from an insider attack should the attacker get an 
> employee's credentials or Kerberos TGT (Hey!!! It's now on-topic!!!) . 
> This is just an example. We have external inspectors and government 
> auditors on site almost every two weeks making us prove compliance with 
> all the rules, and the bigger we get, the more rules and more 
> regulatory auditors we get to talk to. We actually have two people on 
> my team of 27 whose job used to be project management, now is audit and 
> compliance. All of this to protect you.
> 
> Let's not forget about the Security Operations Center monitoring 
> employee activities. Refer to the GTFOBins email from yesterday. I 
> documented a chained attack to get root based on that page, and the SOC 
> came knocking saying "George, we noticed suspicious activity on this 
> server and this date. Whatcha doin'?" Fortunately, I documented 
> everything and emailed it to my manager, so all I had to do was forward 
> that back to the SOC.
> 
> Mail scares me. I had to send my LEA ID in recently via USPS. I'm 
> hoping they got it.
> 
> 
>> Any suggestions are appreciated.
>> 
>> 
>> 
>> On 2024-07-03 21:48, George Toft wrote:
>>> Sorry, Kieth, I have bad news for you. You took a 30+ year leap 
>>> backwards in security.
>>> 
>>> I can tell you for certain, from my bank fraud analyst friend (just 
>>> got promoted to financial crimes investigator), checks are the second 
>>> most insecure way of transferring money, first being putting the 
>>> money in the envelope. They helped the USPS bust a fraud ring who 
>>> worked in the Post Office - fraudsters were pulling checks out of 
>>> envelopes inside the local Post Office. My friend pulled out all the 
>>> details for the Postmaster General.
>>> 
>>> ACH is free (for you) and secure and guaranteed by the originator as 
>>> they are on the hook to prove the identity of who initiated the 
>>> transaction and they have to pay. It's all very complicated, and I'm 
>>> not going into details here.
>>> 
>>> I use ACH all the time. My physical devices have multi-layer physical 
>>> protection. Logical access control is in-place. Both have 
>>> multi-factor authentication. Password resets require multi-factor 
>>> authentication.
>>> 
>>> And the DoD is worse - their systems have so many layers, it was 
>>> easier to just let my account get deleted from lack of use and 
>>> rebuilt it from scratch. I have notes that tell me screen-by-screen 
>>> what to put in each box and which ones to ignore. It's so secure, 
>>> legitimate users can't even get in... and this is just my health 
>>> insurance.
>>> 
>>> Where all of this can break down - getting on topic - is with the SSH 
>>> protocol and web proxies. When you connect to a website using HTTPS 
>>> using a web proxy, your web browser uses it's cert to set up the 
>>> connection, or so it thinks. What's really happening is the proxy is 
>>> responding to the request and decrypting the message, then it forms a 
>>> new request and sends it to the bank, which believes the proxy and 
>>> sends it back. Everything gets decrypted on the proxy, so whoever has 
>>> admin access to the proxy can see everything. Kinda like opening 
>>> envelopes in the mail room :) Disclaimer: This is what some 
>>> networking guys told me in a presentation about 10 years ago.
>>> 
>>> In summary, ACH is safe if you do it from home without a proxy. Of 
>>> course "safe" is relative, but it's safer than checks in the mail. 
>>> Drop into your bank and ask the branch manager, or call their 
>>> customer service and ask. They won't tell you checks are bad, but 
>>> they will steer you to ACH and tell you it's better. Break out the 
>>> Rosetta Stone and figure out what "better" means in corporate-speak. 
>>> Banks are in it to win it, and they don't offer something for free 
>>> unless they are saving money (cost avoidance) on the alternatives.
>>> 
>>> Regards,
>>> 
>>> George Toft
>>> 
>>> On 7/3/2024 6:21 AM, techlists@phpcoderusa.com wrote:
>>>> <scroll>
>>>> 
>>>> On 2024-07-02 18:20, George Toft via PLUG-discuss wrote:
>>>>> I work for a bank, and you would be amazed at how much security is 
>>>>> baked into the connecting your browser to their web servers. Makes 
>>>>> the NSA look like freshmen. And no, I'm not telling you who I work 
>>>>> for.
>>>>> 
>>>>> Regards,
>>>>> 
>>>>> George Toft
>>>> 
>>>> I'd like to hear more.  The world is a hostile place.  I recently 
>>>> went old school.  I asked the bank to disarm my online banking.  I 
>>>> now deal with paper statements and everything gets paid by check. 
>>>> Not as convenient as on-line banking, however I am hoping it makes 
>>>> my world a little bit more secure.
>>>> 
>>>> What are your thoughts?
>>>> 
>>>> Keith
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>>> 
>>>>> On 6/29/2024 5:19 PM, Keith Smith via PLUG-discuss wrote:
>>>>>> Mike,
>>>>>> 
>>>>>> The world is a hostile place.  The more precautions you take the 
>>>>>> better.  I cover the camera on my cellular phone while not in 
>>>>>> use.  I cover the camera that is built into my laptop while it is 
>>>>>> not in use.  I think on-line banking is dangerous.  At some point 
>>>>>> I want to turn off WIFI and go to wired only on my local net.
>>>>>> 
>>>>>> We lock our cars and houses for a reason.
>>>>>> 
>>>>>> I do not know as much security as I'd like, however it might be 
>>>>>> necessary at some point to to become more cyber.
>>>>>> 
>>>>>> About 24 years ago the members of the Tucson Free Unix Group 
>>>>>> (TFUG) helped me build a server that I ran out of my home.  We 
>>>>>> left the email relay open and I got exploited. About 10 years ago 
>>>>>> I became root and I accidentally overwrote my home directory. 
>>>>>> yikes... both were painful. The first example is a reason we must 
>>>>>> be more aware of what we are doing. The 2nd is an example why we 
>>>>>> should use sudo as much as we can instead of becoming root.
>>>>>> 
>>>>>> Keith
>>>>>> 
>>>>>> 
>>>>>> 
>>>>>> On 2024-06-29 08:55, Michael via PLUG-discuss wrote:
>>>>>>> I just realized, while 99% of the people on this list are honest 
>>>>>>> there
>>>>>>> is the diabolical 1%. So I guess I enter my password for the rest 
>>>>>>> of
>>>>>>> my life. Or do you think that it really matters considering this 
>>>>>>> is
>>>>>>> only a mailing list?
>>>>>>> 
>>>>>>> On Sat, Jun 29, 2024, 10:22 AM Michael <bmike1@gmail.com> wrote:
>>>>>>> 
>>>>>>>> Thanks for saying this. I realized that I only needed to run apt 
>>>>>>>> as
>>>>>>>> root. I didn't know how to make it so I could do that..... but
>>>>>>>> chatgt did!
>>>>>>>> 
>>>>>>>> On Sat, Jun 29, 2024, 5:53 AM Eric Oyen via PLUG-discuss
>>>>>>>> <plug-discuss@lists.phxlinux.org> wrote:
>>>>>>>> 
>>>>>>>>> NO WORRIES FROM THIS END RUSTY.
>>>>>>>>> 
>>>>>>>>> As a general rule, I use sudo only for very specific tasks
>>>>>>>>> (usually updating my development package tree on OS X) and no
>>>>>>>>> where else will I run anything as root. I have seen what 
>>>>>>>>> happens
>>>>>>>>> to linux machines that run infected binaries as root and it can
>>>>>>>>> get ugly pretty fast. In one case, I couldn’t take the machine
>>>>>>>>> out of service because of other items I was involved with, so I
>>>>>>>>> simply made part of the dir tree immutable after replacing a 
>>>>>>>>> few
>>>>>>>>> files in /etc. That would fill up the system logs with an error
>>>>>>>>> message about a specific binary trying to replace a small 
>>>>>>>>> number
>>>>>>>>> of conf files. Once the offending binary was found, it made 
>>>>>>>>> things
>>>>>>>>> easier trying to disable it or get rid of it. However, after a
>>>>>>>>> while, I simply pulled the drive and ran it through a Dod 
>>>>>>>>> secure
>>>>>>>>> erase and installed a newer linux bistro on it. I did use the 
>>>>>>>>> same
>>>>>>>>> trick with chattr to make /bin, /sbin and /etc immutable. That
>>>>>>>>> last turned out to be handy as I caught someone trying to 
>>>>>>>>> rootkit
>>>>>>>>> my machine using a known exploit, only they couldn’t get it to
>>>>>>>>> run because the binaries they wanted to replace couldn’t be
>>>>>>>>> written to. :)Yes, this would be a bit excessive, but over the
>>>>>>>>> long run, proved far less inconvenient than having to wipe and
>>>>>>>>> reinstall an OS.
>>>>>>>>> 
>>>>>>>>> -Eric
>>>>>>>>> From the central Offices of the Technomage Guild, security
>>>>>>>>> Applications Dept.
>>>>>>>>> 
>>>>>>>>>> On Jun 28, 2024, at 6:43 PM, Rusty Carruth via PLUG-discuss
>>>>>>>>> <plug-discuss@lists.phxlinux.org> wrote:
>>>>>>>>>> 
>>>>>>>>>> (Deep breath.  Calm...)
>>>>>>>>>> 
>>>>>>>>>> I can't figure out how to respond rationally to the below, so
>>>>>>>>> all I'm going to say is - before you call troll, you might want
>>>>>>>>> to research the author, and read a bit more carefully what they
>>>>>>>>> wrote.  I don't believe I recommended any of the crazy things 
>>>>>>>>> you
>>>>>>>>> suggest.  And I certainly didn't intend to imply any of that.
>>>>>>>>>> 
>>>>>>>>>> On the other hand, it may not have  been clear, so I'll just 
>>>>>>>>>> say
>>>>>>>>> "Sorry that what I wrote wasn't clear, but english isn't my 
>>>>>>>>> first
>>>>>>>>> language.  Unfortunately its the only one I know".
>>>>>>>>>> 
>>>>>>>>>> And on that note, I'll shut up.
>>>>>>>>>> 
>>>>>>>>>> On 6/26/24 15:05, Ryan Petris wrote:
>>>>>>>>>>> I feel like you're trolling so I'm not going to spend very 
>>>>>>>>>>> much
>>>>>>>>> time on this.
>>>>>>>>>>> 
>>>>>>>>>>> It's been a generally good security practice for at least the
>>>>>>>>> last 25+ years to not regularly run as a privileged user,
>>>>>>>>> requiring some sort of escalation to do administrative-type 
>>>>>>>>> tasks.
>>>>>>>>> By using passwordless sudo, you're taking away that escalation.
>>>>>>>>> Why not just run as root? Then you don't need sudo at all. In
>>>>>>>>> fact, why even have a password at all? Why encrypt? Why don't 
>>>>>>>>> you
>>>>>>>>> just put all your data on a publicly accessible FTP server and
>>>>>>>>> just grab stuff when you need it? The NSA has all your data 
>>>>>>>>> anyway
>>>>>>>>> and you don't have anything to hide so why not just leave it 
>>>>>>>>> out
>>>>>>>>> there for the world to see?
>>>>>>>>>>> 
>>>>>>>>>>> As for something malicious needing to be written to use sudo,
>>>>>>>>> why wouldn't it? sudo is ubiquitous on unix systems; if it 
>>>>>>>>> didn't
>>>>>>>>> at least try then that seams like a pretty dumb malicious 
>>>>>>>>> script
>>>>>>>>> to me.
>>>>>>>>>>> 
>>>>>>>>>>> You also don't necessarily need to open/run something for it 
>>>>>>>>>>> to
>>>>>>>>> run. IIRC there was a recent image vulnerability in Gnome's
>>>>>>>>> tracker-miner application which indexes files in your home
>>>>>>>>> directory. And before you say that wouldn't happen in KDE, it 
>>>>>>>>> too
>>>>>>>>> has a similar program, I believe called Baloo.
>>>>>>>>>>> 
>>>>>>>>>>> There also exists the recent doas program and the systemd
>>>>>>>>> replacement run0 to do the same.
>>>>>>>>>>> 
>>>>>>>>>>> On Wed, Jun 26, 2024, at 12:23 PM, Rusty Carruth via
>>>>>>>>> PLUG-discuss wrote:
>>>>>>>>>>>> Actually, I'd like to start a bit of a discussion on this.
>>>>>>>>>>>> 
>>>>>>>>>>>> 
>>>>>>>>>>>> First, I know that for some reason RedHat seems to think 
>>>>>>>>>>>> that
>>>>>>>>> sudo is
>>>>>>>>>>>> bad/insecure.
>>>>>>>>>>>> 
>>>>>>>>>>>> I'd like to know the logic there, as I think the argument 
>>>>>>>>>>>> FOR
>>>>>>>>> using sudo
>>>>>>>>>>>> is MUCH stronger than any argument I've heard (which,
>>>>>>>>> admittedly, is
>>>>>>>>>>>> pretty close to zero) AGAINST it.   Here's my thinking:
>>>>>>>>>>>> 
>>>>>>>>>>>> Allowing users to become root via sudo gives you:
>>>>>>>>>>>> 
>>>>>>>>>>>> - VERY fine control over what programs a user can use as 
>>>>>>>>>>>> root
>>>>>>>>>>>> 
>>>>>>>>>>>> - The ability to remove admin privs (ability to run as root)
>>>>>>>>> from an
>>>>>>>>>>>> individual WITHOUT having to change root password 
>>>>>>>>>>>> everywhere.
>>>>>>>>>>>> 
>>>>>>>>>>>> Now, remember, RH is supposedly 'corporate friendly'. As a
>>>>>>>>> corporation,
>>>>>>>>>>>> that 2nd feature is well worth the price of admission, PLUS 
>>>>>>>>>>>> I
>>>>>>>>> can only
>>>>>>>>>>>> allow certain admins to run certain programs? Very nice.
>>>>>>>>>>>> 
>>>>>>>>>>>> So, for example, at my last place I allowed the 'tester' 
>>>>>>>>>>>> user
>>>>>>>>> to run
>>>>>>>>>>>> fdisk as root, because they needed to partition the disk 
>>>>>>>>>>>> under
>>>>>>>>> test.  In
>>>>>>>>>>>> my case, and since the network that we ran on was totally
>>>>>>>>> isolated from
>>>>>>>>>>>> the corporate network, I let fdisk be run without needing a
>>>>>>>>> password.
>>>>>>>>>>>> Oh, and if they messed up and fdisk'ed the boot partition, 
>>>>>>>>>>>> it
>>>>>>>>> was no big
>>>>>>>>>>>> deal - I could recreate the machine from scratch (minus
>>>>>>>>> whatever data
>>>>>>>>>>>> hadn't been copied off yet - which would only be their most
>>>>>>>>> recent run),
>>>>>>>>>>>> in 10 minutes (which was about 2 minutes of my time, and 8
>>>>>>>>> minutes of
>>>>>>>>>>>> scripted 'dd' ;-) However, if the test user wanted to become
>>>>>>>>> root using
>>>>>>>>>>>> su, they had to enter the test user password.
>>>>>>>>>>>> 
>>>>>>>>>>>> So, back to the original question - setting sudo to not
>>>>>>>>> require a
>>>>>>>>>>>> password.  We should have asked, what program do you want to
>>>>>>>>> run as root
>>>>>>>>>>>> without requiring a password? How secure is your system? 
>>>>>>>>>>>> What
>>>>>>>>> else do
>>>>>>>>>>>> you use it for?  Who has access?  etc, etc, etc.
>>>>>>>>>>>> 
>>>>>>>>>>>> There's one other minor objection I have to the 'zero 
>>>>>>>>>>>> defense'
>>>>>>>>> statement
>>>>>>>>>>>> below - the malicious thing you downloaded (and, I assume 
>>>>>>>>>>>> ran)
>>>>>>>>> has to be
>>>>>>>>>>>> written to USE sudo in its attempt to break in, I believe, 
>>>>>>>>>>>> or
>>>>>>>>> it
>>>>>>>>>>>> wouldn't matter HOW open your sudo was. (simply saying 'su -
>>>>>>>>> myscript'
>>>>>>>>>>>> won't do it).
>>>>>>>>>>>> 
>>>>>>>>>>>> And, if you're truly paranoid about stuff you download, you
>>>>>>>>> should:
>>>>>>>>>>>> 
>>>>>>>>>>>> 1 - NEVER download something you don't have an excellent
>>>>>>>>> reason to
>>>>>>>>>>>> believe is 'safe', and ALWAYS make sure you actually
>>>>>>>>> downloaded it from
>>>>>>>>>>>> where you thought you did.
>>>>>>>>>>>> 
>>>>>>>>>>>> 2 - For the TRULY paranoid, have a machine you use to 
>>>>>>>>>>>> download
>>>>>>>>> and test
>>>>>>>>>>>> software on, which you can totally disconnect from your
>>>>>>>>> network (not
>>>>>>>>>>>> JUST the internet), and which has NO confidential info, and
>>>>>>>>> which you
>>>>>>>>>>>> can erase and rebuild without caring.  Run the downloaded
>>>>>>>>> stuff there,
>>>>>>>>>>>> for a long time, until you're pretty sure it won't bite you.
>>>>>>>>>>>> 
>>>>>>>>>>>> 3 - For the REALLY REALLY paranoid, don't download anything
>>>>>>>>> from
>>>>>>>>>>>> anywhere, disconnect from the internet permanently, get
>>>>>>>>> high-tech locks
>>>>>>>>>>>> for your doors, and wrap your house in a faraday cage!
>>>>>>>>>>>> 
>>>>>>>>>>>> And probably don't leave the house....
>>>>>>>>>>>> 
>>>>>>>>>>>> The point of number 3 is that there is always a risk, even
>>>>>>>>> with
>>>>>>>>>>>> 'well-known' software, and as someone else said - they're
>>>>>>>>> watching you
>>>>>>>>>>>> anyway.  The question is how 'safe' do you want to be? And 
>>>>>>>>>>>> how
>>>>>>>>> paranoid
>>>>>>>>>>>> are you, really?
>>>>>>>>>>>> 
>>>>>>>>>>>> Wow, talk about rabbit hole! ;-)
>>>>>>>>>>>> 
>>>>>>>>>>>> 'Let the flames begin!' :-)
>>>>>>>>>>>> 
>>>>>>>>>>>> 
>>>>>>>>>>>> On 6/25/24 18:50, Ryan Petris via PLUG-discuss wrote:
>>>>>>>>>>>>>> wanted sudo not to require a password.
>>>>>>>>>>>>> Please reconsider this... This is VERY BAD security 
>>>>>>>>>>>>> practice.
>>>>>>>>> There's basically zero defense if you happen to download/run
>>>>>>>>> something malicious.
>>>>>>>>>>>>> 
>>>>>>>>>>>>> On Tue, Jun 25, 2024, at 6:01 PM, Michael via PLUG-discuss
>>>>>>>>> wrote:
>>>>>>>>>>>>>> then I remember that a PLUG member mentioned ChatGPT being
>>>>>>>>> good at troubleshooting so I figured I'd give it a go. I sprint
>>>>>>>>> about half an hour asking it the wrong question but after that 
>>>>>>>>> it
>>>>>>>>> took 2 minutes. I wanted sudo not to require a password. it is
>>>>>>>>> wonderful! now I don't have to bug you guys. so it looks like 
>>>>>>>>> this
>>>>>>>>> is the end of the user group unless you want to talk about OT
>>>>>>>>> stuff.
>>>>>>>>>>>>>> 
>>>>>>>>>>>>>> -- :-)~MIKE~(-:
>>>>>>>>>>>>>> ---------------------------------------------------
>>>>>>>>>>>>>> PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
>>>>>>>>>>>>>> To subscribe, unsubscribe, or to change your mail 
>>>>>>>>>>>>>> settings:
>>>>>>>>>>>>>> https://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>>>>>>>>>>>> 
>>>>>>>>>>>>> ---------------------------------------------------
>>>>>>>>>>>>> PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
>>>>>>>>>>>>> To subscribe, unsubscribe, or to change your mail settings:
>>>>>>>>>>>>> https://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>>>>>>>>>> ---------------------------------------------------
>>>>>>>>>>>> PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
>>>>>>>>>>>> To subscribe, unsubscribe, or to change your mail settings:
>>>>>>>>>>>> https://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>>>>>>>>>> 
>>>>>>>>>> ---------------------------------------------------
>>>>>>>>>> PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
>>>>>>>>>> To subscribe, unsubscribe, or to change your mail settings:
>>>>>>>>>> https://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>>>>>>> 
>>>>>>>>> ---------------------------------------------------
>>>>>>>>> PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
>>>>>>>>> To subscribe, unsubscribe, or to change your mail settings:
>>>>>>>>> https://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>>>>> ---------------------------------------------------
>>>>>>> PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
>>>>>>> To subscribe, unsubscribe, or to change your mail settings:
>>>>>>> https://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>>>> ---------------------------------------------------
>>>>>> PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
>>>>>> To subscribe, unsubscribe, or to change your mail settings:
>>>>>> https://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>>> ---------------------------------------------------
>>>>> PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
>>>>> To subscribe, unsubscribe, or to change your mail settings:
>>>>> https://lists.phxlinux.org/mailman/listinfo/plug-discuss
---------------------------------------------------
PLUG-discuss mailing list: PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
https://lists.phxlinux.org/mailman/listinfo/plug-discuss