Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo Hacked

webcache.googleusercontent.com

Post reply on HN
Print view View original

211–220 of 258 posts

Re: Yahoo Hacked

#211

Post by secalex »

byerley wrote: post #199
somebugbounty wrote: post #183

Earlier quoted context omitted.

If you want hackers to report you vulnerabilities via Yahoo Bug Bounty Program, at least pay more than 50$ for a minimum bounty, 50$ is a joke https://hackerone.com/yahoo ...

I view bug bounties as more of a conscious nod towards responsible disclosure than anything else. I sincerely doubt anyone could make a competitive living off of bug bounty programs (even accounting for the legal grey area of selling vulnerabilities) so the economic incentive argument seems really silly to me. In contrast, if you've ever tried to responsibly disclose a vulnerability and gotten a threat from the legal…

We have several participants in our program who are making a pretty decent living, especially the ones for whom a US$5000 reward is comparable to their nation's per-capita GDP. We are hoping to highlight some of these people in a future talk.

I personally think that the opening created for those without the educational or economic opportunities available to developed world researchers is the best side effects of bug bounties.

Re: Yahoo Hacked

#212

Post by brianpgordon »

stevenh wrote: post #141
thefreeman wrote: post #118

Earlier quoted context omitted.

I think its important to mention the fact that he wasn't just looking for places to exploit shellshock. He was actively exploiting it by sending himself reverse shells from the computers. He wrote code to collect and exploit the reverse shells. He wrote code to spider sites to try to find more exploitable hosts. Then he was logging and exploring the infrastructure and servers he penetrated.

His actions enabled him to cause damage if he chose , but it would be disingenuous for us to avoid examining his intent. The only evidence we have of his intent is that he warned the hosts who were vulnerable, and also warned the customers whose personal information and private emails may no longer be safe. If he had malicious intent as you imply, then I believe he would not have disclosed anything, let alone under h…

Notwithstanding HN's very reasonable ideas about right and wrong in this case, getting an unauthorized shell on someone's server and cd'ing/ls'ing around is probably illegal in most jurisdictions.

Re: Yahoo Hacked

#213

Post by jessaustin »

tantalor wrote: post #80
madaxe_again wrote: post #12

Not mentioned in the title, but important: Winzip.com has been hacked as well. Do not trust their binaries. Either this will be headline news tomorrow, or it will be suppressed in its entirety. The OP will probably go to prison, unfortunately, as they will not differentiate between this and black hat intrusion - the case will be judged by someone who saw his nephew using a computer, once, and they will go after him,…

Contrary to his claim, OP is clearly not a white hat "ethical hacker", since he does not have consent from the owners of any of these systems. > they will not differentiate between this and black hat intrusion Should they? This reads like textbook unauthorized access to a computer system, > A quick `ps aux` on the box yielded... This isn't just poking at web servers to see what secrets they freely reveal, this is tre…

...this is trespass.

If you're not intending this metaphorically, I must disagree. Trespass is a fairly limited act involving a physical presence. Sending and receiving packets with another host that is configured to do that is really not anything like physically inhabiting a place.

Re: Yahoo Hacked

#215

Post by EpicEng »

brok3nmachine wrote: post #180
EpicEng wrote: post #125

Earlier quoted context omitted.

If you walk into my house through the backdoor you're trespassing. Your intentions are irrelevant.

Intention is relevant. What if I was mentally ill and mistaken your backdoor for my own? Or it was was the only feasible escape route from a murderer that was in pursuit of me? Of course this doesn't apply directly to the OP, because this house analogy doesn't hold water. BUT, intent is very relevant when it comes to law.

Well, no, intention is not relevant in the sense that these people are still trespassing. Ok though, you have a point; in some extremely rare circumstances it may make a difference. Of course, as you said, none of these apply here, so what's your point?

Re: Yahoo Hacked

#216

Post by cft »

secalex wrote: post #177

Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions. Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock. Three of our Sports API servers had malicious code executed on them this weekend by attackers…

While we are at it, let me go on a little tangent: I have Yahoo mail for android which i use as a dump of my emails, and I get perhaps 100 emails per day. After about 4-6 weeks, Yahoo mail app becomes so slow, that it is no longer possible to even scroll through emails (on Nexus 5). I have to clear Yahoo app's data cache, and reconfigure to make it fast again. Perhaps it's time to take a look at this: when you have things decaying and breaking like that, it encourages hackers to look extra hard for vulnerabilities, since it's a reasonable assumption that other things are neglected, too. I should note that Yahoo's android mail app is probably the most viable part of the whole Yahoo business now.

Re: Yahoo Hacked

#217

Post by csirac2 »

btown wrote: post #161
jlgaddis wrote: post #122

Earlier quoted context omitted.

What's the issue with Perl scripts on production web servers? Probably 90% of my (homegrown) scripts are written in Perl. What does Perl vs. PHP vs. Ruby vs. $languageoftheweek have to do with anything?

It's really just that Shellshock becomes viable only when HTTP headers are passed to your code as environment variables. For CGI, this is the way things are done, and most Perl scripts interact with the web server through CGI. On the other hand, Ruby and $languageoftheweek are usually called through a server framework like WSGI or Rack, which have their own ways of getting HTTP headers to the user code besides passin…

I spent four years mostly on perl 2009-2012, and again briefly last year. The performance of any non-trivial perl web app is laughably bad when you run as CGI. I've never run prod systems without psgi or mod_fcgid.

Re: Yahoo Hacked

#218

Post by jMyles »

barrkel wrote: post #172
bradleyjg wrote: post #145

Earlier quoted context omitted.

Trespass to land doesn't require damage, all it requires is the willful, unauthorized, entry onto land in another's exclusive possession. Vandalism requires that there by some property damage.

This isn't true. You're overestimating the strength of property rights to land. You should follow the link provided elsewhere in this branch of the discussion - http://www.shouselaw.com/trespass.html

It's amazing how many people think that traversing and trespassing are the same thing. Sadly, in many states, they are the same under the law.

I wish there were stronger free-to-roam laws. I don't think anybody has the right to tell another person they can't traverse land so long as they don't enter any structures, do any damage, take anything, disturb any wildlife, etc.

Re: Yahoo Hacked

#219

Post by ams6110 »

tptacek wrote: post #190
mbesto wrote: post #188

Earlier quoted context omitted.

This all sounds good - especially given your reputation for infosec. However, genuine question - how does the laymen (like myself) rate infosec specialists? Imagine for a second I'm a senior exec at Target and IBN (IBM's fake arch-competitor) comes to me and says "no worries about security, we use 256-bit encryption, bank grade security, etc etc". Do I believe him? I feel like infosec is a "I don't know what I don't…

If I knew, I'd be a lot wealthier. :|

How much are e.g. SANS certifications worth? I subscribe to their vulnerablity emails but they push the certification programs so hard it smells a little like University of Phoenix.

Re: Yahoo Hacked

#220

Post by andrewflnr »

dTal wrote: post #83
gopalv wrote: post #30

Frick. A .pl CGI script on a production box? All the yapache & yphp security fixes and is all undone by a a .pl with +ExeCGI. They used to run "crack days" where all of us used to get kicks out of breaking & entering prod, whatever means available. Was a fun way to weed through such low-hanging issues, by a highly motivated (i.e otherwise bored) crowd. I wonder if they still have them.

Golly. Who was this "they" and "all of us"?

I'm guessing GP once worked for Yahoo.
Post reply on HN