Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

161–170 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#161

Post by numb7rs »

dartos wrote: post #123
xp84 wrote: post #121

Earlier quoted context omitted.

I mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild. It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of it…

JavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well… the way that php and js is…

I've heard it said that one of the reasons Fortran has a reputation for bad code is this combination: lots of people who haven't had any education in best practices; and it's really easy in Fortran to write bad code.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#162

Post by craftkiller »

declan_roberts wrote: post #102
post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com.

https://github.blog/engineering/githubs-csp-journey/

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#163

Post by hinkley »

xp84 wrote: post #121
donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

I mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild. It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of it…

On a new job I stuck my foot in it because I argued something like this with a PHP fan who was adamant I was wrong.

Mind you this was more than ten years ago when PHP was fixing exploits left and right.

This dust up resolved itself within 24 hours though, as I came in the next morning to find he was too busy to work on something else because he was having to patch the PHP forum software he administered because it had been hacked overnight.

I did not gloat but I had trouble keeping my face entirely neutral.

Now I can’t read PHP for shit but I tried to read the patch notes that closed the hole. As near as I could tell, the exact same anti pattern appeared in several other places in the code.

I can’t touch PHP. I never could before and that cemented it.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#164

Post by wwweston »

brookst wrote: post #153
wwweston wrote: post #130

Earlier quoted context omitted.

> > Our industry argues about code style (: > Our industry does not argue about code style. QED

Our industry does not argue about arguing about code style.

Our industry doesn't always make Raymond Carver title references, but when it does, what we talk about when we talk about Raymond Carver title references usually is an oblique way of bringing up the thin and ultimately porous line between metadiscourse and discourse.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#165

Post by hinkley »

dartos wrote: post #123
xp84 wrote: post #121

Earlier quoted context omitted.

I mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild. It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of it…

JavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well… the way that php and js is…

At least the node community is mostly allergic to using eval().

The main use I know of goes away with workers.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#166

Post by swiftcoder »

post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

Even Google managed to (briefly) fuck that one up.

https://money.cnn.com/2016/01/29/technology/google-domain-pu...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#167

Post by hinkley »

numb7rs wrote: post #161
dartos wrote: post #123

Earlier quoted context omitted.

JavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well… the way that php and js is…

I've heard it said that one of the reasons Fortran has a reputation for bad code is this combination: lots of people who haven't had any education in best practices; and it's really easy in Fortran to write bad code.

Which is why that “you can write Fortran in any language” is such an epithet.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#168

Post by graemep »

iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

Its used for verification because its cheap, not because its good. Why would you expect anyone to care enough to fix it.

If we really wanted verification we would still be manually verifying the owners of domains. Highly effective but expensive.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#169

Post by hinkley »

NovemberWhiskey wrote: post #114
zoover2020 wrote: post #108

Earlier quoted context omitted.

This is why PHP is mostly banned at bigCo

To paraphrase: you can write PHP in any language. PHP is a negative bias for bigCo mostly because of the folkloric history of bad security practices by some PHP software developers.

> folkloric

I think the word you’re looking for is “epic” or “legendary”

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#170

Post by johnisgood »

joeframbach wrote: post #159
dr_kretyn wrote: post #138

Earlier quoted context omitted.

Pretty sure there's plenty of PHP at Amazon and Facebook (just with slightly different names)

I can *assure* you that php is expressly prohibited for use at Amazon.

Really? How come? What is the history with regarding to that? What are their reasoning? Does it apply to PHP >=8?
Post reply on HN