Matasano hacked. A humbling lesson, even the pros are vulnerable.
1–10 of 33 posts
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#2Who cares? It's not like they wrote or consulted on whatever was hacked, and there isn't enough time in the day to write every piece of software you use from scratch. This is what you get for writing your OS in high-level assembly.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#3I disagree with the summary line completely...
What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real).
Also they're "hacking" the frontend web server. Is that post really interesting in any way? They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done. (otherwise they would brag about it even more)
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#4Who says it was a 0-day attack? Looking at the output,it seems they brute force the password of user adam...
So yes, even the pros sometimes can make mistake.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#5Since they are against disclosing vulnerabilities, it seems more likely that these intruders did not gain access through an unknown SSH exploit, but some other way. Once obtaining root, they could paste some proof of being on the system, and simply combine that with the top portion of their log which may be completely fabricated to appear as a 0-day exploit.
Again, if there really is a SSH 0-day, why is an anti-disclosure group revealing one exists?
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#6Who says it was a 0-day attack? Looking at the output,it seems they brute force the password of user adam... So yes, even the pros sometimes can make mistake.
They made it appear that the exploit somehow was able to determine that a user-level account with the name of adam existed. SSH shouldn't do this.
Then they made it appear that they were able to log in as adam, and the logs don't make it look like a brute force.
Then they made it appear that somehow privileges were elevated from adam to root, but did not provide any supposed log of how this was done.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#7I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way?…
What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real).
The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest possible attack surface is exactly how you defend against an unknown problem, and there's literally no good reason (besides laziness) to leave sshd exposed to the public internet.
Also they're "hacking" the frontend web server. Is that post really interesting in any way? They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done. (otherwise they would brag about it even more)
Or, they simply didn't bother going further -- owning the front-end web server is fairly embarassing for a company like Matasano.
Quite a few individuals store their credentials on front-end web servers, or even SSH to other servers from the front-end servers. Owning -any- server is often a very big deal.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#8I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way?…
What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest p…
"there's literally no good reason (besides laziness) to leave sshd exposed to the public internet."
Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine.
But yeah, for a "security" business .. it's pretty surprising they let it hang out like that. And on port 22 and the www domain, too .. tsk tsk.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#9Who says it was a 0-day attack? Looking at the output,it seems they brute force the password of user adam... So yes, even the pros sometimes can make mistake.
They made it appear that the exploit somehow was able to determine that a user-level account with the name of adam existed. SSH shouldn't do this. Then they made it appear that they were able to log in as adam, and the logs don't make it look like a brute force. Then they made it appear that somehow privileges were elevated from adam to root, but did not provide any supposed log of how this was done.
Well, the posted log, could be a complete fabrication. It certainly doesn't contain anything useful and may in fact be deliberately misleading.
I'm hoping that Thomas and the rest of the crew do perform an intensive and public analysis of the exploit. It wouldn't surprise me if the break was in Wordpress or one of the other application level programs.
Re: Matasano hacked. A humbling lesson, even the pros are vulnerable.
#10I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way?…
I'd agree that this is mostly a PR problem; but for a security company, having your public site hacked is somewhat embarrassing.
But it is humbling, since this was probably set up much better than the average linux webserver. If these guys can still be vulnerable then noone can be confident. When it comes to computer security we are for the most part working with very poor tools and even less understanding when it comes to building systems that are both tractable and secure.