5 ms·

Snoonet people seem to be heavily involved with IRC.com stuff, which isn't very surprising considering Andrew bought snoonet. In the past there have been some v

Snoonet people seem to be heavily involved with IRC.com stuff, which isn't very surprising considering Andrew bought snoonet. In the past there have been some very credible accusations[1] from ex-snoonet operators claiming that snoonet operators spy on users messages. I don't know if I'd trust IRC.com. [1] https://bpaste.net/show/932b93fc2dce https://bpaste.net/show/932b93fc2dce <rdv[swag]> ENOUGH <rdv[swag]> THIS IS MY NETWORK AND I WILL RUN IT THE WAY I WANT TO RUN IT <rdv[swag]> YOU CAN ALL QUIT FOR ALL I CARE PIA decided to hire this person AFTER other network staff called him out for spying on users. Oh and PIAs support site and customer DB were compromised using a deserialization vulnerability in kayako. They never bothered to publicly acknowledge this, clearly a very "privacy oriented" business. Kayako seems to have taken down their page detailing this particular vulnerability. Their helpdesk product used to store users sessions as serialized objects in user-controlled cookies, allowing attackers to execute arbitrary code by just sticking an appropriate php object into their cookies. Any automated auditing tool would've immediately discovered this bug, so clearly PIA just didn't bother. The cookie looked like this, it's impossible to miss the serialized php object: Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Wed, 28-Dec-2016 23:24:13 GMT; path=/; httponly But hey, maybe their new CTO - Mark Karpeles - runs a tighter ship ;P

imode 8y ago
That's pretty damning. Glad I never went to Snoonet. Something seemed off about the network as a whole, and it appears that my assumptions were correct...
techaddict009 8y ago
MK the same man behind mt. gox?
- ryanlol 8y ago
  Yes.
deleted 8y ago
[deleted]
meowface 8y ago
Even if you removed every other part of this comment, Mark Karpeles as CTO is more than enough by itself to stay very far away from this. Might as well hire Bernie Madoff as CFO of your new investment startup.
- prawnsalad 8y ago
  As the CEO of IRC.com, I can say that Mark Karpeles has nothing to do with the project nor does he have access to any of the infrastructure IRC.com runs on. His work goes towards other projects that London Trust Media has running. I’ve been running the open source kiwiirc.com project for around 7 years and have always been very careful of who has access to what and so far has been clear of any issues. Hopefully I can now bring the same scrutiny and planning to IRC.com too!
  - meowface 8y ago
    Thanks for the information. I guess I just don't see how he's employable at all after what happened (even if you assume he had no malicious intent, which is still pretty unknown). I use kiwiirc.com regularly and love it, by the way. Great work.
SaberUK 8y ago
Full disclosure: i'm being paid to work on InspIRCd for use on the IRC.com network. This is my personal opinion not an official statement on behalf of my employer. The IRC server software used by Snoonet, InspIRCd, does not contain any functionality for message interception (it doesn't even tell server operators the contents of a message that has matched a spam filter) and at least on the infrastructure I have access to Snoonet does not have any message interception capability either.
- ryanlol 8y ago
  As an InspIRCd developer you must also be aware that it only takes minutes for anyone to patch an IRC daemon to log chats. I don't think the lack of such a feature in core inspircd indicates anything.
  - SaberUK 8y ago
    Whilst that is true as I have explicitly stated there is no intercept capability on the infrastructure that I have access to. If you're willing to believe some completely unverifiable logs dumped on a paste site over someone with access to IRC.com infrastructure then i'm not really sure what I can say to convince you otherwise. You can use OTR for private IRC chats and an IRCv3 contributor is currently working on an end-to-end encryption system suitable for use in IRC channels so if you're concerned about your privacy you are welcome to use those.
IaisonQ 8y ago
"Oh and PIAs support site and customer DB were compromised using a deserialization vulnerability in kayako." Can you please detail when this was? I would assume based on your example in December 2016, however PIA Support wasn't using Kayako in December 2016. For clarity, I run PIA Support and one of the first things I did when I joined the company was replace Kayako.
- ryanlol 8y ago
  That cookie isn’t from PIA. It was a random example of the really obviously vulnerable fusion cookies I pulled by googling the cookie name. Looking at some file timestamps on my laptop, I guess this was around feb or april 2015?

imode 8y ago

That's pretty damning. Glad I never went to Snoonet. Something seemed off about the network as a whole, and it appears that my assumptions were correct...

techaddict009 8y ago

MK the same man behind mt. gox?

ryanlol 8y ago
Yes.

deleted 8y ago

[deleted]

meowface 8y ago

Even if you removed every other part of this comment, Mark Karpeles as CTO is more than enough by itself to stay very far away from this. Might as well hire Bernie Madoff as CFO of your new investment startup.

prawnsalad 8y ago
As the CEO of IRC.com, I can say that Mark Karpeles has nothing to do with the project nor does he have access to any of the infrastructure IRC.com runs on. His work goes towards other projects that London Trust Media has running. I’ve been running the open source kiwiirc.com project for around 7 years and have always been very careful of who has access to what and so far has been clear of any issues. Hopefully I can now bring the same scrutiny and planning to IRC.com too!
- meowface 8y ago
  Thanks for the information. I guess I just don't see how he's employable at all after what happened (even if you assume he had no malicious intent, which is still pretty unknown). I use kiwiirc.com regularly and love it, by the way. Great work.

SaberUK 8y ago

Full disclosure: i'm being paid to work on InspIRCd for use on the IRC.com network. This is my personal opinion not an official statement on behalf of my employer. The IRC server software used by Snoonet, InspIRCd, does not contain any functionality for message interception (it doesn't even tell server operators the contents of a message that has matched a spam filter) and at least on the infrastructure I have access to Snoonet does not have any message interception capability either.

ryanlol 8y ago
As an InspIRCd developer you must also be aware that it only takes minutes for anyone to patch an IRC daemon to log chats. I don't think the lack of such a feature in core inspircd indicates anything.
- SaberUK 8y ago
  Whilst that is true as I have explicitly stated there is no intercept capability on the infrastructure that I have access to. If you're willing to believe some completely unverifiable logs dumped on a paste site over someone with access to IRC.com infrastructure then i'm not really sure what I can say to convince you otherwise. You can use OTR for private IRC chats and an IRCv3 contributor is currently working on an end-to-end encryption system suitable for use in IRC channels so if you're concerned about your privacy you are welcome to use those.

IaisonQ 8y ago

"Oh and PIAs support site and customer DB were compromised using a deserialization vulnerability in kayako." Can you please detail when this was? I would assume based on your example in December 2016, however PIA Support wasn't using Kayako in December 2016. For clarity, I run PIA Support and one of the first things I did when I joined the company was replace Kayako.

ryanlol 8y ago
That cookie isn’t from PIA. It was a random example of the really obviously vulnerable fusion cookies I pulled by googling the cookie name. Looking at some file timestamps on my laptop, I guess this was around feb or april 2015?