Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

81–90 of 277 posts

Re: Matrix.org hacked

#81

Post by comboy »

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

> The matrix.org homeserver has been rebuilt and is running securely;

We should have more bounties. Let users donate and put wallets on servers. Attacker will be able to take these funds. It's a reasonable measure of an infrastructure security.

Re: Matrix.org hacked

#82

Post by chme »

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

I would like for matrix protocol and implementation to be better prepared for such cases.

While I didn't loose access to the encrypted messages, since I used the 'Encrypted Messages Recovery' function of Riot.im, I guess a lot of people have. Maybe allow to store more information on the client side?

Re: Matrix.org hacked

#83

Post by BartBoch »

m_b wrote: post #11
m_b wrote: post #2

For a bit of context: Matrix.org infrastructure has been hacked a second time in 24h, after restoring everything they went down again, story developing here: https://twitter.com/matrixdotorg/status/1116304867683905537

The hacker is now doing a post-mortem in the GitHub issues of the project: https://github.com/matrix-org/matrix.org/issues

I have just checked quickly the comments and post-mortem, and I start wondering - it seems that the attack itself would be not really possible if Matrix would not be open source (as this would restrict access to the sensitive data)? Is that right?

Re: Matrix.org hacked

#84

Post by simias »

henvic wrote: post #56
paavoova wrote: post #33

Earlier quoted context omitted.

Why would they do this? It's pure negligence. I don't even sign anything important and still worry about my keys.

I have been asked twice or more why I insisted on not using a Continuous Integration environment for publishing some software releases that are installed by third-parties. My team was automating the infrastructure to build internal software and naturally they wanted to be able to simplify things. The idea that was proposed to me was the following: once I push a new version tag to GitHub, the deployment CI server is g…

Depending on your threat model I think that signing packages directly from your CI is acceptable, assuming that your CI runs is a reasonably isolated environment (e.g. on your company's LAN) and people who are able to trigger a release are correctly vetted.

If I understand the parent comment correctly they were somehow shipping the release signing key on their production environment which is a whole other level of bad.

Re: Matrix.org hacked

#85

Post by tarruda »

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

On the first issue opened by the hacker:

> Complete compromise could have been avoided if developers were prohibited from using ForwardAgent yes or not using -A in their SSH commands. The flaws with agent forwarding are well documented.

I use agent forwarding daily and had no idea it contained well known security holes. If that's the case, why is the feature available by default?

Re: Matrix.org hacked

#86

Post by raverbashing »

laumars wrote: post #60
raverbashing wrote: post #51

Earlier quoted context omitted.

Yeah, but there are several reasons 1 - you want to add more filtering/processing before the grep 2 - grep's command line options are confusing (+ globbing + whatever), easier to just use it to grep stdin 3 - It works. Sure 'grep pattern file' works, but here that is inconsequential. I'm not in an 80s machine to worry if I'm opening one more process or pipe than needed, especially in simple cases like this

I have no issue with people who want to prefix grep (nor any other command for that matter) with cat. However I do completely disagree with your 2nd point. It's literally just: grep [flags] search_pattern [filename] In GNU grep (eg Linux) it's even easier because your flags can appear wherever in the command you want (even at the end). Though I'd recommend sticking to the habit of having them after the executable nam…

It's easy, once you get it

Take a look at the man page (linux)

    grep [OPTIONS] PATTERN [FILE...]

    grep [OPTIONS] -e PATTERN ... [FILE...]

    grep [OPTIONS] -f FILE ... [FILE...]
Now -f does not specify the file to grep, it specifies a file where to read patterns from (and they have the same "variable" name there, confusing)

Not to mention globbing and other shell escapes (which is not grep's fault, of course, but you might end up hitting in some situations)

Re: Matrix.org hacked

#87

Post by couterSpell »

josephmx wrote: post #79
snvzz wrote: post #66

4chan is circulating this picture. It shows the defaced website frontpage. https://i.4cdn.org/g/1555048975736.png I have a hard time with the idea that they run the webserver and the matrix server on the same computer. (Regarding users.txt) It seems they do urgently need to hire capable infrastructure people.

I can't access that image on my corporate network, any chance of an imgur mirror?

It's just a screenshot of the same info shown on the archive.org page linked by the title.

https://web.archive.org/web/20190412060115/http://matrix.org...

If you can't get to archive.org, just respond and I'll imgur it.

Re: Matrix.org hacked

#88

Post by gtirloni »

proboscis wrote: post #73
m_b wrote: post #2

For a bit of context: Matrix.org infrastructure has been hacked a second time in 24h, after restoring everything they went down again, story developing here: https://twitter.com/matrixdotorg/status/1116304867683905537

They closed the threads and deleted all the comments, but luckily the issues page was archived beforehand: https://web.archive.org/web/20190412090123/https://github.co...

Luckily yeah. So much wisdom in those comments. /s

Re: Matrix.org hacked

#89

Post by vbrandl »

snvzz wrote: post #66

4chan is circulating this picture. It shows the defaced website frontpage. https://i.4cdn.org/g/1555048975736.png I have a hard time with the idea that they run the webserver and the matrix server on the same computer. (Regarding users.txt) It seems they do urgently need to hire capable infrastructure people.

They didn't host production and the website on the same server. The attacker had access to the whole network. After that was detected and cleared, the attacker was still able to change DNS records. The domain was redirected to an attacker controlled site (https://github.com/matrixnotorg/matrixnotorg.github.io) where some logs of the production servers where posted.

Re: Matrix.org hacked

#90

Post by XMPPwocky »

tarruda wrote: post #85
dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

On the first issue opened by the hacker: > Complete compromise could have been avoided if developers were prohibited from using ForwardAgent yes or not using -A in their SSH commands. The flaws with agent forwarding are well documented. I use agent forwarding daily and had no idea it contained well known security holes. If that's the case, why is the feature available by default?

SSH agent forwarding makes your ssh-agent available to (possibly some subset of) hosts you SSH into. This is its purpose. Unfortunately, it also makes your ssh-agent available to (possibly some subset of) hosts you SSH into.
Post reply on HN