Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infosec company pwned by 4chan user

maia.crimew.gay

Post reply on HN
Print view View original

141–150 of 234 posts

Re: Infosec company pwned by 4chan user

#141

Post by supermatt »

deng wrote: post #137
dmbche wrote: post #2

"however, they made one of the most comedic mistakes you can still make while setting up jenkins (im actually not sure which misconfiguration leads to this): the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url. genius."

No, the most comedic mistake is to have a public-facing Jenkins running. I mean in general you wouldn't make your CI accessible from the outside, but especially not Jenkins. That software has probably more CVEs every year than all of our other tooling combined.

Given the frequency with which I seem to update nokogiri on a rails instance, i assumed libxml2 would hold that award: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libxml2

But sure enough, jenkins FAR outweighs it: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jenkins

Re: Infosec company pwned by 4chan user

#142

Post by deng »

sofixa wrote: post #5
philipwhiuk wrote: post #3

Who makes their Jenkins instance world accessible!

Who still uses Jenkins? It's an abomination of an obsolete system that is just a pain to use, manage, maintain, setup, etc. while there are much better, more featured, easier to use and maintain alternatives out there. And it has been like this for close to ten years now . It should have been ripped out in favour of either the "native" CI/CD (e.g. GitLab CI if GitLab is used for VCS, GitHub Actions if GitHub, etc.) o…

Switched from a company using Jenkins to one using GitLab CI, and while GitLab CI is obviously "better" in the sense that it has less historical baggage, there are actually quite a few things I'm missing. Jenkins has a plugin for pretty much every obscure thing you can imagine, which is a blessing for the user and a curse for the administrator, as Jenkins quickly becomes Frankenstein's monster. But every time I have to wade through tons of log ouput on GitLab I miss Jenkins' warnings plugin, every time no runner is picking up my job I miss the nice runner overview of Jenkins which quickly showed you what runners are actually busy with, and every time that old slow runner is grabbing all the jobs I miss the runner prioritization... I could go on here, but really, there's a lot of things that Jenkins could do through nifty plugins that GitLab CI cannot do yet. I even wrote one plugin myself for supporting our in-house Linter, really wasn't that difficult and you could hook into pretty much every little detail (which, again, can also be a curse because every plugin had the power to simply crash your Jenkins...).

EDIT: So to be clear, I'm not saying "Jenkins is better than GitLab". I would say GitLab CI is better designed, more robust and stable, but Jenkins is more configurable, extendable and has more features through it's plugin ecosystem. So personally, I wouldn't go back to Jenkins, but I also don't find it ridiculous that people still use it.

Re: Infosec company pwned by 4chan user

#143

Post by _23sd »

RamblingCTO wrote: post #97

> which makes it all so much more ironic how completely they have been hacked. Nope, not really. It just takes one mistake and you're pwned. Imagine giving the intern a small project, you're losing your head due to your main project, no time to supervise. Boom. /e: Or imagine an update in one of your libs/apps. In order to not to be hacked you need to make everything right. In order to hack you just need to find one…

It only takes one mistake, but this was a pretty easy one to prevent. At a mature company with a decent security program, creating an internet facing Jenkins instance wouldn't have been approved by IT, doesn't matter if it was an intern with an overworked manager trying to set it up. So it is pretty bad that a security company failed at something as basic as minimizing their attack surface (and possibly not sufficient segmentation between the dev environment and customer data, but the post is not very detailed on that part). Not surprising, though.

Re: Infosec company pwned by 4chan user

#144

Post by deng »

supermatt wrote: post #141
deng wrote: post #137

Earlier quoted context omitted.

No, the most comedic mistake is to have a public-facing Jenkins running. I mean in general you wouldn't make your CI accessible from the outside, but especially not Jenkins. That software has probably more CVEs every year than all of our other tooling combined.

Given the frequency with which I seem to update nokogiri on a rails instance, i assumed libxml2 would hold that award: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libxml2 But sure enough, jenkins FAR outweighs it: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jenkins

And that's just the ones that get reported. Since core Jenkins is pretty bare-bones, most instances also have many plugins installed, and most of those aren't properly reviewed at all.

Re: Infosec company pwned by 4chan user

#145

Post by uoaei »

jimmies wrote: post #78
brodouevencode wrote: post #49

Earlier quoted context omitted.

Appears to be self-authored.

A quick glance to the history of the article, I see it was edited by multiple usernames and IP address at different times. How did you come to the conclusion that it was self authored?

I don't think it's a stretch to assume that infosec experts/hackers have ways to falsify their online identities.

Re: Infosec company pwned by 4chan user

#146

Post by JackSlateur »

deng wrote: post #137
dmbche wrote: post #2

"however, they made one of the most comedic mistakes you can still make while setting up jenkins (im actually not sure which misconfiguration leads to this): the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url. genius."

No, the most comedic mistake is to have a public-facing Jenkins running. I mean in general you wouldn't make your CI accessible from the outside, but especially not Jenkins. That software has probably more CVEs every year than all of our other tooling combined.

The most comedic mistake is to have a running jenking in 2023

Re: Infosec company pwned by 4chan user

#147

Post by alpaca128 »

hezralig wrote: post #68
morkalork wrote: post #38

Earlier quoted context omitted.

They were born in 1999, so it's more like what a new generation's impression of what the old web was like.

Was the author the girl that owned the TSA in the past year?

Iirc it wasn't the TSA directly but an airline and their copy of the nofly list.

Re: Infosec company pwned by 4chan user

#148

Post by JackSlateur »

rejectfinite wrote: post #111
x86_64Ubuntu wrote: post #21

Earlier quoted context omitted.

The older I get, the more systems I learn are only around because they've been around.

Yes? do you know the cost of moving big systems?

Do you know the cost of maintening big old systems ?

There are hundreds of people here for that I'm not in HR, but I guess that's a lot of money spent each year, just to get the same issues we had last year

It takes a lot of money to not improve the situation

Re: Infosec company pwned by 4chan user

#149

Post by shp0ngle »

brodouevencode wrote: post #49
yccs27 wrote: post #15

Earlier quoted context omitted.

She has a pretty comprehensive wikipedia entry: https://en.wikipedia.org/wiki/Maia_arson_crimew

Appears to be self-authored.

It does seem weirdly detailed about someone I would mark as not really encyclopedically significant; but it has the citations and quotes so what do I know. It's one of the better Wikipedia articles in general

However, it is not self-authored as can be seen in the history of the article.

Post reply on HN