Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo Hacked

webcache.googleusercontent.com

Post reply on HN
Print view View original

201–210 of 258 posts

Re: Yahoo Hacked

#201

Post by [deleted] »

legohead wrote: post #184
secalex wrote: post #177

Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions. Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock. Three of our Sports API servers had malicious code executed on them this weekend by attackers…

Patched twice? There are 7 known shellshock exploits (and 30 patches) so far.. https://shellshocker.net/ Not knocking on you or anything, just more interested to know if all exploits have been patched against, more than the # of patches applied.

[deleted]

Re: Yahoo Hacked

#202

Post by JonathanDHall »

jms703 wrote: post #200
JonathanDHall wrote: post #198

Earlier quoted context omitted.

My opinionated answer to the statement released by Yahoo!: I won’t sit here and say that I think they are lying. To make such an accusation would only prove me to be a fool not having ammunition in the weapon before I fire it. I will, however, say that I believe – in my opinion – that this is a wordplay and a game of semantics. First off, there are several “shellshock” exploits. The term “shellshock” as the media has…

> Please issue out the UNTAMPERED and UNMODIFIED apache logs Who do you think you are? lol.

I'm a share holder, making me an "owner" of a publicly traded company. And, who are you?

Re: Yahoo Hacked

#203

Post by govindkabra31 »

dsrguru wrote: post #148
tantalor wrote: post #80

Earlier quoted context omitted.

Contrary to his claim, OP is clearly not a white hat "ethical hacker", since he does not have consent from the owners of any of these systems. > they will not differentiate between this and black hat intrusion Should they? This reads like textbook unauthorized access to a computer system, > A quick `ps aux` on the box yielded... This isn't just poking at web servers to see what secrets they freely reveal, this is tre…

If person A walked up to your window and fired shots through it, killing a family member of yours, and then person B walked up to your window out of curiosity (trespassing), saw a dead person, and called 911 (or whatever your country's emergency number is), should person B be prosecuted for murder? Edit: I thought this was an accurate analogy, but I'm assuming the downvoter either disagreed or felt I phrased this as…

That is NOT an accurate analogy.. to make it analogous, you need at least two fixes: a) the person needs not simply see from window, but to get into your basement from breaking a double-panned window, and go up into your bedroom. b) Also the charge needs to be for 'intrusion'

Plus, using 'murder' and 'family' and 'dead' etc. are too dramatic and personal and unnecessary to convey your point about internet security.

Re: Yahoo Hacked

#204

Post by praneshp »

JonathanDHall wrote: post #202
jms703 wrote: post #200

Earlier quoted context omitted.

> Please issue out the UNTAMPERED and UNMODIFIED apache logs Who do you think you are? lol.

I'm a share holder, making me an "owner" of a publicly traded company. And, who are you?

Then raise the issue at a shareholder meeting. Owning 2 shares (or 200) won't get you access to logs.

Re: Yahoo Hacked

#205

Post by btilly »

btown wrote: post #161
jlgaddis wrote: post #122

Earlier quoted context omitted.

What's the issue with Perl scripts on production web servers? Probably 90% of my (homegrown) scripts are written in Perl. What does Perl vs. PHP vs. Ruby vs. $languageoftheweek have to do with anything?

It's really just that Shellshock becomes viable only when HTTP headers are passed to your code as environment variables. For CGI, this is the way things are done, and most Perl scripts interact with the web server through CGI. On the other hand, Ruby and $languageoftheweek are usually called through a server framework like WSGI or Rack, which have their own ways of getting HTTP headers to the user code besides passin…

Perl has PSGI ( plackperl.org ) but it's more commonly used in CGI.

Citation needed.

I've been a serious Perl programmer since the 90s who has written public facing code at at least a half-dozen companies in the last decade. I've seen all kinds of combinations of things like mod_perl, fastcgi and Plack, but not once CGI.

I don't doubt that there are still some toy websites that run old CGI programs written in Perl. But I haven't seen them in the wild. And that niche has been replaced by PHP.

Re: Yahoo Hacked

#206

Post by tszming »

secalex wrote: post #177

Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions. Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock. Three of our Sports API servers had malicious code executed on them this weekend by attackers…

>> Yahoo takes external security reports seriously

Few weeks ago, I reported to your team that some of the yahoo servers' SSL cert were expired, acknowledged but no one want to fix it (until I post it here and finally get them updated...your site was showing security warning to your users for 2 weeks)

One of your awesome engineers replied the issue with expired SSL cert: "there do not appear to be any security implications as a direct result of this behavior"

Re: Yahoo Hacked

#207

Post by f- »

byerley wrote: post #199
somebugbounty wrote: post #183

Earlier quoted context omitted.

If you want hackers to report you vulnerabilities via Yahoo Bug Bounty Program, at least pay more than 50$ for a minimum bounty, 50$ is a joke https://hackerone.com/yahoo ...

I view bug bounties as more of a conscious nod towards responsible disclosure than anything else. I sincerely doubt anyone could make a competitive living off of bug bounty programs (even accounting for the legal grey area of selling vulnerabilities) so the economic incentive argument seems really silly to me. In contrast, if you've ever tried to responsibly disclose a vulnerability and gotten a threat from the legal…

I think there are quite a few people who do make a living by participating in vulnerability reward programs (well, not at $50 level, obviously).

Now, I have not seen too many people who would be doing it consistently for many years - simply because it gets tiresome. But it's the same thing for security consulting - at most consultancies, pentesters come and go.

Re: Yahoo Hacked

#208

Post by secalex »

legohead wrote: post #184
secalex wrote: post #177

Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions. Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock. Three of our Sports API servers had malicious code executed on them this weekend by attackers…

Patched twice? There are 7 known shellshock exploits (and 30 patches) so far.. https://shellshocker.net/ Not knocking on you or anything, just more interested to know if all exploits have been patched against, more than the # of patches applied.

Twice means once for the initial bug on Wednesday, the second time with one of the "nuke the attack surface from orbit, it's the only way to be sure" patches that became available that Thursday.

This is no guarantee, of course, which is why the pen-test team that Chris Rohlf runs has to stay abreast of and continuously test the latest available exploits as well as the attempts that we see in our logs.

Re: Yahoo Hacked

#209

Post by cpncrunch »

tszming wrote: post #206
secalex wrote: post #177

Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions. Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock. Three of our Sports API servers had malicious code executed on them this weekend by attackers…

>> Yahoo takes external security reports seriously Few weeks ago, I reported to your team that some of the yahoo servers' SSL cert were expired, acknowledged but no one want to fix it (until I post it here and finally get them updated...your site was showing security warning to your users for 2 weeks) One of your awesome engineers replied the issue with expired SSL cert: "there do not appear to be any security implic…

Admob.com also had an expired ssl cert for a few days recently.

Re: Yahoo Hacked

#210

Post by brianpgordon »

JonathanDHall wrote: post #202
jms703 wrote: post #200

Earlier quoted context omitted.

> Please issue out the UNTAMPERED and UNMODIFIED apache logs Who do you think you are? lol.

I'm a share holder, making me an "owner" of a publicly traded company. And, who are you?

That's not how it works. You're not privy to the internal operations of Yahoo simply because you own stock. And as regards your role as a security researcher, they're not obligated to disclose logs or, indeed, provide you any detail whatsoever about their security response. They say they've contained the problem, you (presumably) can't still perform the exploit, end of story, unless you have evidence that more servers were compromised than Stamos admits.
Post reply on HN