Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

131–140 of 277 posts

Re: Matrix.org hacked

#131

Post by notyourday »

syntonym wrote: post #126
notyourday wrote: post #106

Earlier quoted context omitted.

Have you implemented hole punching?

What is hole punching and how would it have helped against the attack? I only know the term for UDP firewall transversal.

The lame version of port knocking that solves 99.9% of issues.

1. Default policy for access to all of the development environment is deny all.

2. A developer triggers a temporary addition of developers current address to the allow list with an idle timer, punching a hole for developer's edge IP to access the infrastructure.

3. When the idle timer expires or when the developer says "i'm done", the allow rule is removed.

Obviously, a full blown port knocking with keys and policies would be better for a large organization with hundreds of developers and hundreds of hosts but it is the case where 99.9% of the issues can be solved using a very simple system as in order to get to the vulnerable entry point the attacker would need to do it from an IP address used by a developer at that specific time.

Re: Matrix.org hacked

#132

Post by beagle3 »

perttir wrote: post #3

They had root account activated in hebe? Am i reading this right? He got an passlist of 5 million users?

But even if they didn't, "sudo -u root /bin/bash" or similar gives it to you unless sudo is extremely locked down (which, from audits I have done, is "rarely if ever").

There are hundreds of ways to get root prompt even with the root account nominally deactivated.

Re: Matrix.org hacked

#133

Post by chatmasta »

azhenley wrote: post #31

The hacker seems nice: “Anyways, that's all for now. I hope this series of issues has given you some good ideas for how to prevent this level of compromise in the future. Security doesn't work retroactively, but I believe in you and I think you'll come back from this even stronger than before. Or at least, I hope so -- My own information is in this user table.” https://github.com/matrix-org/matrix.org/issues/365

I wonder if he searched for his own credentials on the production server, and if so, is there a log of it?

Re: Matrix.org hacked

#134

Post by maxidorius »

rglullis wrote: post #70

The interesting thing for me here is that none of the other homeservers were affected. Despite the weak security on the largest servers, the ecosystem stays alive. Antifragility at its finest.

... or is it? https://github.com/matrix-org/matrix-doc/issues/1194 and https://github.com/matrix-org/matrix-doc/pull/1915 and https://github.com/matrix-org/synapse/issues/4540 would tell a different story: Potentially deleting data on remote server just because being matrix.org (or anyone with an access)

Re: Matrix.org hacked

#135

Post by erikbye »

azhenley wrote: post #31

The hacker seems nice: “Anyways, that's all for now. I hope this series of issues has given you some good ideas for how to prevent this level of compromise in the future. Security doesn't work retroactively, but I believe in you and I think you'll come back from this even stronger than before. Or at least, I hope so -- My own information is in this user table.” https://github.com/matrix-org/matrix.org/issues/365

"Or at least, I hope so -- My own information is in this user table... jk, I use EFNet."

Re: Matrix.org hacked

#136

Post by majewsky »

kzcqt wrote: post #24
james_s_tayler wrote: post #21

Earlier quoted context omitted.

but but but... what about the single responsibility principle??? Grep can't both load the file and pattern match against it's contents! Sacrilege.

I know you're being facetious, but every utility is supposed to be able to open and read a FILE handle, even if it's just stdin.

Well technically you're not opening stdin. It's handed to you by your parent.

Re: Matrix.org hacked

#138

Post by syntonym »

metafunctor wrote: post #124
syntonym wrote: post #119

Earlier quoted context omitted.

ProxyJump uses the keys from the original host, not the proxy host.

I know. That's why I asked. Chained agent forwarding will serve your keys just the same, so ProxyJump is not "a secure alternative that achieves the same outcome".

Are you disagreeing with the "secure alternative" or the "same outcome"? I thought the difference between ProxyJump and agent forwarding is the following:

Agent forwarding forwards the agent socket to the proxy server. Thus any ssh connection originating from the proxy server can reuse the agent, and with that has the same access to the agent as the originating host.

ProxyJump routes the ssh connection through the proxy host. The crypto takes place between originating host and target host, not between proxy host and target host. ssh connections originating from the proxy host can not access keys from the originating host.

But maybe my understanding of ProxyJump is incorrect?

Re: Matrix.org hacked

#139

Post by maxidorius »

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

One of the swift steps should be to address https://github.com/matrix-org/matrix-doc/issues/1194 and https://github.com/matrix-org/matrix-doc/pull/1915 and https://github.com/matrix-org/synapse/issues/4540 properly, so others servers cannot be impacted in any way.

Re: Matrix.org hacked

#140

Post by DyslexicAtheist »

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

there are quite a couple of so called guides (opsec playbooks for crime) that I found specifically on Wall Street Market (a darknet market place like the now defunct Silkroad), available for purchase.

Some of them go beyond just instruction booklets but promise access to their chat systems via invitation (upon purchase of the pdf) and offer some kind of limited coaching. It is essentially the recruiting mechanism to bring in lower ranking soldiers starting out as mules, handlers, or basically move up from re-selling goods.

A couple of these guides point out how much Telegram sucks etc, and that they now have moved to p2p based systems. One praised Matrix heavily for it's good security feature.

The tech-savvy-ness of many vendors has picked up considerably since I first started watching. There is a strong push to re-think and refactor both tools and their processes (yes yes - this happens constantly otherwise they get caught, but never as fast or aggressive than these past months).

It's likely that this is just a (s)kiddy enjoying the attention. Though quite a lot of players have more than just an "academic" desire to ensure these (their) systems can withstand an attack by LE. When I browsed the matrix issues on github I couldn't help but immediately recall the strange emphasis on "we have switched to matrix". It's far fetched but I'd say somebody may have a strong interest in seeing these issues resolved (->or has gotten genuinely fed up and wanted to do something, as opposed to this being just a skid that only did it for the attention)

for a good analysis on how some of these tutorials and the philosophy behind them see: "Discovering credit card fraud methods in online tutorials"

https://www.researchgate.net/publication/303418684_Discoveri...

Post reply on HN