Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

191–200 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#191

Post by trhway »

candiddevmike wrote: post #28
iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

Our industry needs to finish what it starts. Between IPv6, DNSSEC, SMTP TLS, SCTP/QUIC, etc all of these bedrock technologies feel like they're permanently stuck in a half completed implementation/migration. Like someone at your work had all these great ideas, started implementing them, then quit when they realized it would be too difficult to complete.

IPv6 instead of being branded as a new implementation should probably have been presented as an extension of IPv4, like some previously reserved IPv4 address would mean that it is really IPv6 with the value in the previously reserved fields, etc. That would be a kludge, harder to implement, yet much easier for the wide Internet to embrace. Like it is easier to feed oatmeal to a toddler by presenting it as some magic food :)

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#192

Post by [deleted] »

joelanman wrote: post #190
craftkiller wrote: post #162

Earlier quoted context omitted.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/

interesting, why is this?

[deleted]

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#193

Post by [deleted] »

donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

[deleted]

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#194

Post by [deleted] »

sebstefan wrote: post #8

>The first bug that our retrospective found was CVE-2015-5243. This is a monster of a bug, in which the prolific phpWhois library simply executes data obtained from the WHOIS server via the PHP ‘eval’ function, allowing instant RCE from any malicious WHOIS server. I don't want to live on this planet anymore

[deleted]

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#195

Post by xrisk »

mdaniel wrote: post #146
lambda wrote: post #100

Earlier quoted context omitted.

No, but they have system or the like, which is effectively the same, just being evaluated by the shell. https://man7.org/linux/man-pages/man3/system.3.html

And thanks to the magic of "shoving strings from the Internet into a command line", poof, RCE! It bit GitLab twice

What incident are you referring to?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#196

Post by [deleted] »

iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

[deleted]

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#197

Post by craigmoliver »

MajimasEyepatch wrote: post #189
numb7rs wrote: post #161

Earlier quoted context omitted.

I've heard it said that one of the reasons Fortran has a reputation for bad code is this combination: lots of people who haven't had any education in best practices; and it's really easy in Fortran to write bad code.

Code written by scientists is a sight to behold.

and they think cause they're scientists they can just do it because they're scientists and stuff. Very pragmatic to be sure...but horrifying.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#198

Post by immibis »

trhway wrote: post #191
candiddevmike wrote: post #28

Earlier quoted context omitted.

Our industry needs to finish what it starts. Between IPv6, DNSSEC, SMTP TLS, SCTP/QUIC, etc all of these bedrock technologies feel like they're permanently stuck in a half completed implementation/migration. Like someone at your work had all these great ideas, started implementing them, then quit when they realized it would be too difficult to complete.

IPv6 instead of being branded as a new implementation should probably have been presented as an extension of IPv4, like some previously reserved IPv4 address would mean that it is really IPv6 with the value in the previously reserved fields, etc. That would be a kludge, harder to implement, yet much easier for the wide Internet to embrace. Like it is easier to feed oatmeal to a toddler by presenting it as some magic…

It would have exactly the same deployment problems, but waste more bytes in every packet header. Proposals like this have been considered and rejected.

How is checking if, say, the source address is 255.255.255.255 to trigger special processing, any easier than checking if the version number is 6? If you're thinking about passing IPv6 packets through an IPv4 section of the network, that can already be achieved easily with tunneling. Note that ISPs already do, and always have done, transparent tunneling to pass IPv6 packets through IPv4-only sections of their network, and vice versa, at no cost to you.

Edit: And if you want to put the addresses of translation gateways into the IPv4 source and destination fields, that is literally just tunneling.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#199

Post by varun_ch »

joelanman wrote: post #190
craftkiller wrote: post #162

Earlier quoted context omitted.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/

interesting, why is this?

I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf.

2. if a user uploaded something like an html file, you wouldn't want it to be able to run javascript on google.com (because then you can steal cookies and do bad stuff), csp rules exist, but it's a lot easier to sandbox users content entirely like this.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#200

Post by [deleted] »

joelanman wrote: post #190
craftkiller wrote: post #162

Earlier quoted context omitted.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/

interesting, why is this?

[deleted]
Post reply on HN