Who makes their Jenkins instance world accessible!
so many companies
Infosec company pwned by 4chan user
131–140 of 234 posts
Re: Infosec company pwned by 4chan user
#132OptimEyes.ai wins Global Infosec Award 2022 OptimEyes.ai data leak - 2023 smh
Aren't these industry awards essentially participation trophies for whoever is willing to pay? Like the notorious "Who's Who Among American High School Students" in the US.
Yes. I started a security company and received tons of award emails and conference invites that were all bullshit.
Re: Infosec company pwned by 4chan user
#133Earlier quoted context omitted.
The older I get, the more systems I learn are only around because they've been around.
A lot of the time when old things are still around, it's not because through all the years nobody has had the idea to replace them, but because the benefit of replacing them hasn't at any point in history outweighed the hassle. This is true for X11 and this is true for the QWERTY layout. The benefit of switching must outweigh the enormous hassle of doing so. It's easy to find something that's a little bit better, but…
X11 is finally, finally on the way out. I have a lot of gripes with Wayland, but the day I stop needing to dive into xrandr and figure out why the screen is rotated but the mouse coordinates aren't or some other 1990s level problem will be a happy one.
QWERTY seems to be too embedded even for that, but I wonder if it gets closer to replacement the higher the percentage of software keyboards climbs vs physical ones.
Re: Infosec company pwned by 4chan user
#134Earlier quoted context omitted.
1. post link to jenkins job in a 4chan thread relating to something nefarious 2. see who clicks it 3. now you have IP addresses of possibly nefarious people without needing to subpoena 4chan Something like that.
>3. now you have IP addresses of possibly nefarious people without needing to subpoena 4chan ahahah 4chan is almost as mainstream as Reddit. ahahahahahahaaaaaaa you really think they would waste time like this for IP addresses to "keep track of"
Several people have been arrested based on 4chan posts recently, after 'threatening' a law enforcement official in florida.
So...yes. Yes I do.
Re: Infosec company pwned by 4chan user
#135I had to check the article to understand how it is notable for a 4chan user to also be a business owner. They're using "owned" in leet speak sense, infiltrated security.
yeah should probably be edited to "pwned" just to make it clear, even though "owned" is the original term for, well, getting owned/rekt/"hacked"/etc. I too thought it would be about a company who was a sole proprietor of an infosec corp lol
Ok, we've s/o/p/'d the title above. Thanks!
Edit: oops, I meant s/ow/pw/.
Re: Infosec company pwned by 4chan user
#136Earlier quoted context omitted.
Maia is very honest when she hacks a company, unsupported theories don't help anyone.
Their antics have been of questionable legality, and I would assume they'd try to avoid drawing too much attention, given that this is the 3rd US-based company they're trying to hack, and the US just might ask for an extradition. Further, the conclusion about Jenkins being the attack vector is drawn without much thought or explanation, and it is also interesting that they've used the same attack vector elsewhere.
> and I would assume they'd try to avoid drawing too much attention
I follow her on Tumblr and I assure you this is not the case. She's very ebullient and loves answering questions about her hacking.
Re: Infosec company pwned by 4chan user
#137"however, they made one of the most comedic mistakes you can still make while setting up jenkins (im actually not sure which misconfiguration leads to this): the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url. genius."
No, the most comedic mistake is to have a public-facing Jenkins running. I mean in general you wouldn't make your CI accessible from the outside, but especially not Jenkins. That software has probably more CVEs every year than all of our other tooling combined.
Re: Infosec company pwned by 4chan user
#138Earlier quoted context omitted.
1. post link to jenkins job in a 4chan thread relating to something nefarious 2. see who clicks it 3. now you have IP addresses of possibly nefarious people without needing to subpoena 4chan Something like that.
I think we're safe, anyone being half serious would be using a good vpn hopefully, it's likely to be a lot of false positives I would guess!
>anyone being half serious would be behind seven proxies
Re: Infosec company pwned by 4chan user
#139This page reminds me of the old web. I kind of miss it, auto-playing MIDI songs and custom cursors and all. I'll take that over having to wade through Reddit 12 times out of 10.
As the creator was born in 1999, it's interesting to me because she's nostalgic for a period she did not fully experience. It's something I did, and it's neat yet strange to see it being done to a part of my past.
I'm nostalgic for the Amiga despite being born in the late 90s!
Re: Infosec company pwned by 4chan user
#140Who makes their Jenkins instance world accessible!
Who still uses Jenkins? It's an abomination of an obsolete system that is just a pain to use, manage, maintain, setup, etc. while there are much better, more featured, easier to use and maintain alternatives out there. And it has been like this for close to ten years now . It should have been ripped out in favour of either the "native" CI/CD (e.g. GitLab CI if GitLab is used for VCS, GitHub Actions if GitHub, etc.) o…
Jenkins is one of those things you configure and forget about...until you need to do it again.
Over time, there's so much stuff that it does that replacing it is a ton of work. And by work I mean verification and communication. Many developers have no idea how stuff gets built, or how dependencies are managed in the build system. You forget one thing and the build is toast. Hunting this info down takes a ridiculous amount of time.
Now expand that to X number of projects, and you're looking at a year of work...and a delay while QA checks everything again.
For what?
Good luck getting that prioritized.