Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo Hacked

webcache.googleusercontent.com

Post reply on HN
Print view View original

121–130 of 258 posts

Re: Yahoo Hacked

#121

Post by thefreeman »

devindotcom wrote: post #86
mukyu wrote: post #21

This writeup doesn't really get to the point so, the tl;dr He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did find had already been hit by someone using a perl script that made them join an irc channel that was being used as CnC. He also joined it and monitored it. A bunch of different yahoo boxes were in the channel and he saw some of them get rooted.

The servers compromised were more like content servers though, not user data servers? Yahoo says no user data was accessed. But could the affected servers be used to more easily get at user databases from 'inside'?

> But could the affected servers be used to more easily get at user databases from 'inside'?

short answer: yes, definitely.

Re: Yahoo Hacked

#122

Post by jlgaddis »

gopalv wrote: post #30

Frick. A .pl CGI script on a production box? All the yapache & yphp security fixes and is all undone by a a .pl with +ExeCGI. They used to run "crack days" where all of us used to get kicks out of breaking & entering prod, whatever means available. Was a fun way to weed through such low-hanging issues, by a highly motivated (i.e otherwise bored) crowd. I wonder if they still have them.

What's the issue with Perl scripts on production web servers? Probably 90% of my (homegrown) scripts are written in Perl. What does Perl vs. PHP vs. Ruby vs. $languageoftheweek have to do with anything?

Re: Yahoo Hacked

#123

Post by jlgaddis »

r721 wrote: post #20

"Though the FBI seemed intrigued by this, in my opinion, they aren’t moving with any form of haste." I am doubtful that FBI would share their plans and/or actions with OP.

Exactly. It's not like they're going to call up the OP to give him status updates.

Re: Yahoo Hacked

#125

Post by EpicEng »

Mikushi wrote: post #99
rbobby wrote: post #92

Earlier quoted context omitted.

Bank robber calling the cops to report the safe has already been cleaned out...

That would imply OP had malicious intentions, which he apparently did not.

If you walk into my house through the backdoor you're trespassing. Your intentions are irrelevant.

Re: Yahoo Hacked

#126

Post by rbobby »

derekp7 wrote: post #114
nilved wrote: post #102

Earlier quoted context omitted.

Malice is in the eye of the beholder. He logged into a server he didn't own and ran commands without authorization. That is malicious from the perspective of the law.

Out of curiosity, wouldn't this also apply to the security researcher at erratasec.com that did an earlier survey? That scan logged into peoples boxes and executed a ping going out. Now obviously there isn't any damage, but what legal theory is protecting these legit security researchers?

Really this a question that can only be answered by a judge.

The CFAA in the US might apply, section a.2.c bit is pretty broad: information from any protected computer). The wikipedia article is full of interesting bits and bobs: http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Though whether or not a DA would be bothered with investigating and building a case is a different story (probably not, unless there were lots of complaints and/or "serious" complaints).

I strongly doubt anyone, even at the FBI, is tasked with finding hackers independent of any complaints.

Re: Yahoo Hacked

#127

Post by chavesn »

tantalor wrote: post #80
madaxe_again wrote: post #12

Not mentioned in the title, but important: Winzip.com has been hacked as well. Do not trust their binaries. Either this will be headline news tomorrow, or it will be suppressed in its entirety. The OP will probably go to prison, unfortunately, as they will not differentiate between this and black hat intrusion - the case will be judged by someone who saw his nephew using a computer, once, and they will go after him,…

Contrary to his claim, OP is clearly not a white hat "ethical hacker", since he does not have consent from the owners of any of these systems. > they will not differentiate between this and black hat intrusion Should they? This reads like textbook unauthorized access to a computer system, > A quick `ps aux` on the box yielded... This isn't just poking at web servers to see what secrets they freely reveal, this is tre…

Trespassing is a good analogy. Neither all laws or violations of laws are equal.

On one hand, there are the vandals, or outright criminals, who are using and abusing my property for their gain to my detriment.

On the other hand, there's a passerby who knows about the criminals in the area, knows no one else is looking for them, and trespasses my property because the trail led him onto it.

Now that guy willingly alerts me to the criminals, offers an explanation of what he did on my property and how he found the criminals -- what should my response be?

I know that technically he broke the law, and there are those who want to see anyone and everyone pay for their deeds, but in this situation, wouldn't a reasonable person possibly consider tracking down the criminals first before crying "trespassing!"

Re: Yahoo Hacked

#128

Post by Someone1234 »

computator wrote: post #117
Someone1234 wrote: post #88

Earlier quoted context omitted.

It is surprising how many 90s tools remain popular today: WinZip, WinRar, WinAmp, CCleaner, Icq, Real Player, etc. People just get into using something and simply never stop. Then there's the comfort barrier to switching (e.g. I know how to use WinZip but 7Zip is new and unfamiliar). CCleaner is still popular with low level tech support types, which is quite ironic as it damages the Windows Registry on later versions…

> CCleaner is still popular... which is quite ironic as it damages the Windows Registry CCleaner has two main use-cases: a performance tool (allegedly) and a privacy tool. You assume that CCleaner is popular because people think that it boosts performance. This was never my use-case and anyone that I've seen actually uses it as a privacy tool, i.e., to clean up browser history, delete caches, wipe free space, etc., t…

If you're interested in privacy and have Windows 8 Pro, you can use Client Hyper-V and Differencing Disks to make what is effectively a "read only" system. You boot into the VM, do whatever it is you have to do, then shred the differential [0].

Alternatively just encrypt the VM[1].

Alternatively again just run a Linux "Live OS" from a DVD and pull the power to "wipe."

Alternatively ad-infinitum make a Windows To Go Thumb Drive and smash it with a brick when you're done.

[0] http://technet.microsoft.com/en-us/library/cc720381(v=WS.10)...

[1] http://www.virtualizationadmin.com/kbase/VirtualizationTips/...

Re: Yahoo Hacked

#129

Post by [deleted] »

thefreeman wrote: post #121
devindotcom wrote: post #86

Earlier quoted context omitted.

The servers compromised were more like content servers though, not user data servers? Yahoo says no user data was accessed. But could the affected servers be used to more easily get at user databases from 'inside'?

> But could the affected servers be used to more easily get at user databases from 'inside'? short answer: yes, definitely.

[deleted]

Re: Yahoo Hacked

#130

Post by jerf »

kbar13 wrote: post #105
romanminkin wrote: post #77

Earlier quoted context omitted.

You can also use this resource http://www.globalshellshock.com to check if your IP address is vulnerable to ShellShock.

IP addresses are not vulnerable to ShellShock

More importantly, while a casual scan of a website that shows a "Yes" is bad, a "No" doesn't prove much. Update bash.
Post reply on HN