Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

16 years of CVE-2008-0166 – Debian OpenSSL Bug

16years.secvuln.info

Post reply on HN
Print view View original

1–10 of 68 posts

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#2

Post by yjftsjthsd-h »

I enjoyed the... I guess "narrative Q&A" style would be a good enough way to describe it? Regardless, it's fun.

> The security team at Seznam - a Czech search engine and email provider - did not believe me when I reported this issue. They assume that as they are not actively using that key (beta._domainkey.seznam.cz), that means that it cannot be used to forge emails. This is, of course, not true.

Maybe consult a lawyer first, but the entertaining answer would surely be to tell them about the problem in an email from their own domain? (Though seriously, double-check that that's not illegal; funny isn't worth getting arrested.)

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#4

Post by Sebb767 »

yjftsjthsd-h wrote: post #2

I enjoyed the... I guess "narrative Q&A" style would be a good enough way to describe it? Regardless, it's fun. > The security team at Seznam - a Czech search engine and email provider - did not believe me when I reported this issue. They assume that as they are not actively using that key (beta._domainkey.seznam.cz), that means that it cannot be used to forge emails. This is, of course, not true. Maybe consult a law…

That's the IT sec version of placing your CV on their server to apply :)

That being said, a company which is that lax with reported vulnerabilities is not likely to handle "fun" well and even if what you are doing is legal, being involved in a lawsuit is no fun and probably not worth it, since, in the end, you are trying to help them.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#5

Post by aspenmayer »

Sebb767 wrote: post #4
yjftsjthsd-h wrote: post #2

I enjoyed the... I guess "narrative Q&A" style would be a good enough way to describe it? Regardless, it's fun. > The security team at Seznam - a Czech search engine and email provider - did not believe me when I reported this issue. They assume that as they are not actively using that key (beta._domainkey.seznam.cz), that means that it cannot be used to forge emails. This is, of course, not true. Maybe consult a law…

That's the IT sec version of placing your CV on their server to apply :) That being said, a company which is that lax with reported vulnerabilities is not likely to handle "fun" well and even if what you are doing is legal, being involved in a lawsuit is no fun and probably not worth it, since, in the end, you are trying to help them.

> That's the IT sec version of placing your CV on their server to apply :)

Has this actually ever happened or been solicited? That’s an interesting thought experiment.

https://en.wikipedia.org/wiki/Calling_card_(crime)

https://en.wikipedia.org/wiki/Website_defacement

https://attrition.org/mirror/

https://www.zone-h.org/archive

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#6

Post by westurner »

jmclnx wrote: post #3

So to check your keys, you are asked to grab a pip package. That is OK, but I heard there were lots of security issues with pips too. From one issue to maybe another ? If you are worried, I would just recreate your keys.

PyPI has only implemented the "server signs whatever's uploaded with that account" part of TUF; there are no Publisher Signatures for packages uploaded to pypi (because GPG ASC support was removed from PyPI, the ad-hoc signature support was removed from wheel, and only server signatures are yet implemented).

https://SLSA.dev/ recommends TUF and Sigstore.dev and trusted containers for build-signing.

Someday, Twine should prompt a PyPI package uploader to sign the package before uploading it, and download it to (prime the CDN cache and) check the Publisher and Package repo signature(s) at least once.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#8

Post by jsiepkes »

yjftsjthsd-h wrote: post #2

I enjoyed the... I guess "narrative Q&A" style would be a good enough way to describe it? Regardless, it's fun. > The security team at Seznam - a Czech search engine and email provider - did not believe me when I reported this issue. They assume that as they are not actively using that key (beta._domainkey.seznam.cz), that means that it cannot be used to forge emails. This is, of course, not true. Maybe consult a law…

While you can forge the DKIM signature there is a good chance there is also SPF configured. SPF tells which servers are allowed to send mail for the domain. So your email would likely still end up in the spam folder.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#9

Post by throwaway6272 »

aspenmayer wrote: post #5
Sebb767 wrote: post #4

Earlier quoted context omitted.

That's the IT sec version of placing your CV on their server to apply :) That being said, a company which is that lax with reported vulnerabilities is not likely to handle "fun" well and even if what you are doing is legal, being involved in a lawsuit is no fun and probably not worth it, since, in the end, you are trying to help them.

> That's the IT sec version of placing your CV on their server to apply :) Has this actually ever happened or been solicited? That’s an interesting thought experiment. https://en.wikipedia.org/wiki/Calling_card_(crime) https://en.wikipedia.org/wiki/Website_defacement https://attrition.org/mirror/ https://www.zone-h.org/archive

I did this, kind of. I was interviewing for a financial company that went to some effort to hide their location for operational security, met them at a local cafe where we talked about physical security, and then casually mentioned that I was staying at an airbnb across the road from their office and we could walk back together. It took a couple of calls to find someone who happily told me their registered address. They were creeped out but hired me anyway.
Post reply on HN