111–120 of 258 posts
This writeup doesn't really get to the point so, the tl;dr He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did find had already been hit by someone using a perl script that made them join an irc channel that was being used as CnC. He also joined it and monitored it. A bunch of different yahoo boxes were in the channel and he saw some of them get rooted.
Thanks. This guy writes a lot of text but it takes him forever to get to the point.
Earlier quoted context omitted.
Before anything else, I should mention that I haven't worked help desk in over 5 years. Back when I worked help desk, the most common reason for a completely FUBAR and need a re-install was that the user ran CCleaner on it.
Your organization likely did something unconventional with the registry that made systems break when touched by CCleaner (perhaps a groupware tool, or perhaps the broken systems had already been FUBAR'd by intrusive software and CCleaner's attempt to fix that FUBAR triple-FUBAR'd it). That doesn't mean CCleaner's behavior is correct, but it's probably a situation the developers haven't been able to test against. For…
So reading between the lines, you're saying that CCleaner is a bad idea simply because they cannot possibly understand the registry well enough to make the changes that they're making.
We agree completely.
Honestly if people want to use CCleaner to do jump lists, file history, and caches (although that last one is misguided) then I'm all for it. There's very little chance anything will break with those (it is hard to screw up!).
I just warn against the registry cleaner primarily, and just feel like with Disk Cleaner and Windows' automatic cleaning that has been integrated for a while you could live without using CCleaner (unless you still have a Windows 9x box).
Not mentioned in the title, but important: Winzip.com has been hacked as well. Do not trust their binaries. Either this will be headline news tomorrow, or it will be suppressed in its entirety. The OP will probably go to prison, unfortunately, as they will not differentiate between this and black hat intrusion - the case will be judged by someone who saw his nephew using a computer, once, and they will go after him,…
Earlier quoted context omitted.
That would imply OP had malicious intentions, which he apparently did not.
Malice is in the eye of the beholder. He logged into a server he didn't own and ran commands without authorization. That is malicious from the perspective of the law.
Why is this a link to a cached version of the website?
Earlier quoted context omitted.
TIL - people still use WinZip
It is surprising how many 90s tools remain popular today: WinZip, WinRar, WinAmp, CCleaner, Icq, Real Player, etc. People just get into using something and simply never stop. Then there's the comfort barrier to switching (e.g. I know how to use WinZip but 7Zip is new and unfamiliar). CCleaner is still popular with low level tech support types, which is quite ironic as it damages the Windows Registry on later versions…
CCleaner has two main use-cases: a performance tool (allegedly) and a privacy tool.
You assume that CCleaner is popular because people think that it boosts performance. This was never my use-case and anyone that I've seen actually uses it as a privacy tool, i.e., to clean up browser history, delete caches, wipe free space, etc., to not expose what they've been looking at, searching for, and downloading.
With respect to privacy, if I see someone using CCleaner, I recommend that they switch over to BleachBit[1] which is open source and which even Bruce Schneier swears by. I used both simultaneously for awhile on my Windows systems and found that BleachBit found many more privacy-sensitive files to erase than CCleaner.
This writeup doesn't really get to the point so, the tl;dr He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did find had already been hit by someone using a perl script that made them join an irc channel that was being used as CnC. He also joined it and monitored it. A bunch of different yahoo boxes were in the channel and he saw some of them get rooted.
He was actively exploiting it by sending himself reverse shells from the computers. He wrote code to collect and exploit the reverse shells. He wrote code to spider sites to try to find more exploitable hosts. Then he was logging and exploring the infrastructure and servers he penetrated.
Earlier quoted context omitted.
Malice is in the eye of the beholder. He logged into a server he didn't own and ran commands without authorization. That is malicious from the perspective of the law.
Out of curiosity, wouldn't this also apply to the security researcher at erratasec.com that did an earlier survey? That scan logged into peoples boxes and executed a ping going out. Now obviously there isn't any damage, but what legal theory is protecting these legit security researchers?
Earlier quoted context omitted.
Your organization likely did something unconventional with the registry that made systems break when touched by CCleaner (perhaps a groupware tool, or perhaps the broken systems had already been FUBAR'd by intrusive software and CCleaner's attempt to fix that FUBAR triple-FUBAR'd it). That doesn't mean CCleaner's behavior is correct, but it's probably a situation the developers haven't been able to test against. For…
> That doesn't mean CCleaner's behavior is correct, but it's probably a situation the developers haven't been able to test against. So reading between the lines, you're saying that CCleaner is a bad idea simply because they cannot possibly understand the registry well enough to make the changes that they're making. We agree completely. Honestly if people want to use CCleaner to do jump lists, file history, and caches…
It sounds more like, "the software vendor is doing incorrect or incomplete things with the registry and CCleaner cannot possibly know that."
As a long-time Windows software developer, I've been stunned at how sloppy desktop programs and installers are, even today. People ignore Microsoft guidelines, somehow get the software to the "works for me" stage, and deploy it.