Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab servers are being exploited in DDoS attacks

therecord.media

Post reply on HN
Print view View original

71–80 of 177 posts

Re: Gitlab servers are being exploited in DDoS attacks

#71

Post by pm90 »

Gigachad wrote: post #65
Someone1234 wrote: post #38

Earlier quoted context omitted.

> But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host. If an organization is too overloaded to patch for six months, maybe they should re-evaluate if self-hosting is the best course of action. Seems like this is a foot-gun of your own creation.

There is very little reason to even self host Gitlab unless you are insanely paranoid or for philosophy reasons like debian/gnome.

Compliance often forces the hand.

Re: Gitlab servers are being exploited in DDoS attacks

#72

Post by jeffbee »

djbusby wrote: post #64
jeffbee wrote: post #56

Earlier quoted context omitted.

It's a perl program that evaluates untrusted strings it finds in user files. What exactly is your standard for "is hackjob"? It appears to be a complete piece of shit.

It's clearly not complete shit, else it wouldn't be used by literally millions of people/systems. ExifTool is so far away from shit that in fact it was chosen by a highly respected company with a very good team. A hackjob usually has less deploys than my own stuff (which, outside of Windows 2000 components, is less than a few millions)

By this reasoning "Baywatch" was a great TV show because lots of people saw it.

Re: Gitlab servers are being exploited in DDoS attacks

#73

Post by jdc »

rsj_hn wrote: post #57
winrid wrote: post #54

Earlier quoted context omitted.

My personal career favorite use of eval was for an import system that "unrolled" the loop that went through the columns for each row, using eval. It was much faster, but obviously a huge security risk. Today with modern JIT compilers its probably not much faster...

I saw a very similar thing with eval. There was an evaluation of a nested JSON object x["a"]["b"]["c"] And the developer decided that this was best evaluated by eval. During the code review phase I talked to them and asked why they were using eval, and they didn't know it could be evaluated directly as they were a little unclear if javascript supported that syntax.

How much longer did said dev continue working there?

Re: Gitlab servers are being exploited in DDoS attacks

#74

Post by yjftsjthsd-h »

djbusby wrote: post #67
wswope wrote: post #39

Earlier quoted context omitted.

I’ve had a really hard time finding good guides for hardening VMs for malware analysis or processing untrusted inputs as you suggest - any guidance on learning resources?

I learned the hard way. But for these restricted jails I'd start by making a VM that is not allowed out at all, like DROP on iptavles OUTPUT chain.

At that point, why not just boot the virtual machine with no network interface attached?

Re: Gitlab servers are being exploited in DDoS attacks

#75

Post by sslalready »

Gigachad wrote: post #65
Someone1234 wrote: post #38

Earlier quoted context omitted.

> But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host. If an organization is too overloaded to patch for six months, maybe they should re-evaluate if self-hosting is the best course of action. Seems like this is a foot-gun of your own creation.

There is very little reason to even self host Gitlab unless you are insanely paranoid or for philosophy reasons like debian/gnome.

Reasons for self-hosting: GitLab.com's not-so-great availability [1], slow code searches (compared to self-hosted with GitLab Advanced Search) and the fact that you can keep your code and resources off the public Internet.

The fact that you do need to upgrade it yourself regularly is indeed a drawback. On the other hand, an Omnibus upgrade has only failed me twice in the last five years or so, so there's little reason to not do automatic upgrades at night and fire off an alert in case something doesn't work as expected afterwards. Their releases are typically solid, so kudos to the team.

[1] https://status.gitlab.com/pages/history/5b36dc6502d06804c083...

Re: Gitlab servers are being exploited in DDoS attacks

#76

Post by rsj_hn »

jdc wrote: post #73
rsj_hn wrote: post #57

Earlier quoted context omitted.

I saw a very similar thing with eval. There was an evaluation of a nested JSON object x["a"]["b"]["c"] And the developer decided that this was best evaluated by eval. During the code review phase I talked to them and asked why they were using eval, and they didn't know it could be evaluated directly as they were a little unclear if javascript supported that syntax.

How much longer did said dev continue working there?

err, no comment

Re: Gitlab servers are being exploited in DDoS attacks

#77

Post by kibwen »

majou wrote: post #69
Gigachad wrote: post #63

Earlier quoted context omitted.

The line existed in the 2014 commit which migrated the repo to git. It wasn't designed in the current era of mass automated abuse and internet connected everything.

2014 was very much that era, I'd accept this excuse maybe for 2007

The line wasn't written in 2014, that's just the earliest that the history goes back. Presumably it's no newer than the early 2000s.

Re: Gitlab servers are being exploited in DDoS attacks

#78

Post by dylan604 »

jdc wrote: post #73
rsj_hn wrote: post #57

Earlier quoted context omitted.

I saw a very similar thing with eval. There was an evaluation of a nested JSON object x["a"]["b"]["c"] And the developer decided that this was best evaluated by eval. During the code review phase I talked to them and asked why they were using eval, and they didn't know it could be evaluated directly as they were a little unclear if javascript supported that syntax.

How much longer did said dev continue working there?

Fire the dev, or educate the dev. Sure, eval is just a sure sign of a lot of lack of understanding, but I'd hope for something less vile as eval would be a little more understanding that everyone learns something sometime

Re: Gitlab servers are being exploited in DDoS attacks

#80

Post by dmw_ng »

ignoramous wrote: post #24
codegeek wrote: post #3

"..Bowling said he discovered a way to abuse how ExifTool handles uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server" Ah, the good old "File upload vulnerability". File uploads remain one of the hardest problems to solve when it comes to security.

> uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server A usecase for WASM's nanoprocesses (capability-based security) perhaps? Of course, until such a time someone exploits the WASM runtime itself.

Retrofitting seccomp or a custom Apparmor policy are both much lower hanging fruit. The problem is folk tend to link these things directly into their web servers
Post reply on HN