Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

181–190 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#181

Post by MichaelZuo »

dgoldstein0 wrote: post #150
colmmacc wrote: post #40

Earlier quoted context omitted.

If you look at say 3G -> 4G -> 5G or Wifi, you see industry bodies of manufacturers, network providers, and middle vendors who both standardize and coordinate deployment schedules; at least at the high level of multi-year timelines. This is also backed by national and international RF spectrum regulators who want to ensure that there is the most efficient use of their scarce airwaves. Industry players who lag too muc…

IPv6 deployment is extra hard because we need almost every network in the world to get on board. Dnssec shouldn't be as bad, but for dns resolvers and software that build them in. I think it's a bit worse than TLS adoption in part just because of DNS allowing recursive resolution and in part DNS being applicable to a bit more than TLS was. But the big thing seems to be that there isn't a central authority like web br…

Plus IPv6 has significant downsides (more complex, harder to understand, more obscure failure modes, etc…), so the actual cost of moving is the transition cost + total downside costs + extra fears of unknown unknowns biting you in the future.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#182

Post by dustywusty »

donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

Couldn't agree more with this. In general, if you're writing eval you've already committed to doing something the wrong way.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#183

Post by michaelt »

iscoelho wrote: post #86
account42 wrote: post #77

Earlier quoted context omitted.

> 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) HTTP-based ACME verification also uses unencrypted port-80 HTTP. Similar for DNS-based verification.

100% - another for the BGP hijack!

The current CAB Forum Baseline Requirements call for "Multi-Perspective Issuance Corroboration" [1] i.e. make sure the DNS or HTTP challenge looks the same from several different data centres in different countries. By the end of 2026, CAs will validate from 5 different data centres.

This should make getting a cert via BGP hijack very difficult.

[1] https://github.com/cabforum/servercert/blob/main/docs/BR.md#...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#184

Post by larsnystrom »

xp84 wrote: post #121
donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

I mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild. It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of it…

I mean, in this case the developer really went out of their way to write bad code. TBH it kind of looks like they wanted to introduce an RCE vulnerability, since variable variable assignment is well-known even to novice PHP developers (who would also be the only ones using that feature), and "eval is bad" is just as well known.

A developer who has the aptitude to write a whois client, but knows neither of those things? It just seems very unlikely.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#185

Post by podunkPDX »

hinkley wrote: post #163
xp84 wrote: post #121

Earlier quoted context omitted.

I mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild. It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of it…

On a new job I stuck my foot in it because I argued something like this with a PHP fan who was adamant I was wrong. Mind you this was more than ten years ago when PHP was fixing exploits left and right. This dust up resolved itself within 24 hours though, as I came in the next morning to find he was too busy to work on something else because he was having to patch the PHP forum software he administered because it had…

PHP: an attack surface with a side effect of hosting blogs.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#186

Post by xyst »

hansjorg wrote: post #19

Why are tools using hardcoded lists of WHOIS servers? Seems there is a standard (?) way of registering this in DNS, but just from a quick test, a lot of TLDs are missing a record. Working example: dig _nicname._tcp.fr SRV +noall +answer _nicname._tcp.fr. 3588 IN SRV 0 0 43 whois.nic.fr. Edit: There's an expired Internet Draft for this: https://datatracker.ietf.org/doc/html/draft-sanz-whois-srv-0...

because people build these tools as part of one time need, publish it for others (or in case they need to reference it themselves). Other "engineers" copy and paste without hesitating. Then it gets into production and becomes a CVE like discussed.

Developer incompetence is one thing, but AI-hallucination will make this even worse.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#187

Post by cryptonector »

account42 wrote: post #89
XCSme wrote: post #67

Earlier quoted context omitted.

Wouldn't "eval" in any language result in RCE? Isn't that the point of eval, to execute the given string command?

Fully compiled languages don't even have an eval at all.

You can build an eval for a compiled language, absolutely. You can embed an interpreter, for example, or build one using closures. There's entire books on this, like LiSP in Small Pieces.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#188

Post by MajimasEyepatch »

btown wrote: post #134
dartos wrote: post #123

Earlier quoted context omitted.

JavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well… the way that php and js is…

The saving grace of JS is that the ecosystem had a reset when React came out; there's plenty of horrifying JQuery code littering the StackOverflow (and Experts Exchange!) landscape, but by the time React came around, Backbone and other projects had already started to shift the ecosystem away from "you're writing a script" to "you're writing an application," so someone searching "how do I do X react" was already a hug…

The other thing making JavaScript a little better in practice is that it very rarely was used on the back end until Node.js came along, and by then, we were fully in the AJAX world, where people were making AJAX requests using JavaScript in the browser to APIs on the back end. You were almost never directly querying a database with JavaScript, whereas SQL injection seems to be one of the most common issues with a lot of older PHP code written by inexperienced devs. Obviously SQL injection can and does happen in any language, but in WordPress-land, when your website designer who happens to be the owner's nephew writes garbage, they can cause a lot of damage. You probably would not give that person access to a Java back end.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#189

Post by MajimasEyepatch »

numb7rs wrote: post #161
dartos wrote: post #123

Earlier quoted context omitted.

JavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well… the way that php and js is…

I've heard it said that one of the reasons Fortran has a reputation for bad code is this combination: lots of people who haven't had any education in best practices; and it's really easy in Fortran to write bad code.

Code written by scientists is a sight to behold.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#190

Post by joelanman »

craftkiller wrote: post #162
declan_roberts wrote: post #102

Earlier quoted context omitted.

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/

interesting, why is this?
Post reply on HN