Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub bans security researcher who posted zero-day Windows exploits

tomshardware.com

Post reply on HN
Print view View original

141–150 of 274 posts

Re: GitHub bans security researcher who posted zero-day Windows exploits

#141

Post by [deleted] »

Dylan16807 wrote: post #130
somenameforme wrote: post #124

Earlier quoted context omitted.

Read the write up on YellowKey. [1] It sounds like, in at least some instances, he's publishing official Microsoft backdoors probably used by US intelligence agencies et al. It turns out that Bitlocker is insecure and backdoored. Something noooobody expected after TrueCrypt just mysteriously and suddenly shut their doors one day, removed all downloads, and recommended everybody move to Microsoft's BitLocker. lol. [1]…

If you were using bitlocker to replace truecrypt, you'd have a boot password and this would not affect you at all. I'm still far from thinking this is a backdoor. It tricks the boot environment into deleting a file and then it doesn't ask for a password. The exploit is nowhere near bitlocker, the problem is that bitlocker without a boot password requires the whole OS to preserve security from boot through the login s…

[deleted]

Re: GitHub bans security researcher who posted zero-day Windows exploits

#142

Post by snvzz »

rukshn wrote: post #131

I stopped reporting any security bugs I find in web apps because first time I did it I almost got arrested by the police. The second time I did it they contacted my employer directly without even getting back to me saying they were unhappy of me reporting it and wanted to write about it after they fixed the issue. Since then I decided it’s not worth all the hassle and I will let them be and I can also have a peaceful…

[flagged]

Re: GitHub bans security researcher who posted zero-day Windows exploits

#143

Post by SlightlyLeftPad »

p0w3n3d wrote: post #140
rukshn wrote: post #131

I stopped reporting any security bugs I find in web apps because first time I did it I almost got arrested by the police. The second time I did it they contacted my employer directly without even getting back to me saying they were unhappy of me reporting it and wanted to write about it after they fixed the issue. Since then I decided it’s not worth all the hassle and I will let them be and I can also have a peaceful…

That's really sad to hear, you must have felt really bad. Just because they do not know about the vulnerability, it won't disappear. And they won't fix it too. Ignorance is a bliss, but not in this case...

It should be obvious who the real criminals are in this case.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#144

Post by snvzz »

yieldcrv wrote: post #123
Aurornis wrote: post #97

Earlier quoted context omitted.

Sure, but GitHub and Gitlab aren’t the only two ways to share code on the Internet. The conspiracy theories about two unrelated companies shutting down his git accounts to prevent him from releasing these supposed exploits are reaching pretty deep into conspiracy theory nonsense. The conspiracy theories can’t even agree if he was banned for posting them or because he hadn’t posted them but might post them.

time to post on IPFS

Sadly, IPFS is compromised[0].

0. https://specs.ipfs.tech/ipips/ipip-0383/

Re: GitHub bans security researcher who posted zero-day Windows exploits

#145

Post by snvzz »

moepstar wrote: post #132
linkregister wrote: post #120

Earlier quoted context omitted.

I'm not sure if this is an unintentional mistake. Gitlab did not perform a ban. Github performed the ban. Github is fully-owned by Microsoft.

Yes they did: https://gitlab.com/nightmare-eclipse That git account was posted on their blogspot...

Awful.

I understand Microsoft's being petty, but why would GitLab do this?

Re: GitHub bans security researcher who posted zero-day Windows exploits

#146

Post by snvzz »

amusingimpala75 wrote: post #17
embedding-shape wrote: post #16

Is there any public word from Microsoft about what is going on here? Why would both Microsoft and Gitlab ban the user? I thought both platforms allowed hosting exploits and security research as long as everything is clearly marked up-front, I'm guessing some rules were broken?

Well if it’s a full disk encryption exploit that still requires hardware access I imagine it would have been made for a 3-letter govt org or something

FDE is meant to protect data at rest.

Hardware access is a given.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#147

Post by snvzz »

no-name-here wrote: post #78
keepupnow wrote: post #59

Earlier quoted context omitted.

Yes they definitely did that. Find evidence to the contrary.

Is this sarcasm? Or are you saying that the onus of providing proof is not on the those making the claim, but instead that the onus of proof is on those who did not make the claim?

Sure you can provide an alternative explanation?

Otherwise, that's the best we have.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#148

Post by subscribed »

rukshn wrote: post #131

I stopped reporting any security bugs I find in web apps because first time I did it I almost got arrested by the police. The second time I did it they contacted my employer directly without even getting back to me saying they were unhappy of me reporting it and wanted to write about it after they fixed the issue. Since then I decided it’s not worth all the hassle and I will let them be and I can also have a peaceful…

Do not bother.

I was wearing a white hat professionally for quite a while but I can't fault you - at this point trying to be honest and helpful is dangerous. If you decide to sell the vulnerabilities, so be it.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#149

Post by no-name-here »

xethos wrote: post #80
thaumasiotes wrote: post #57

Earlier quoted context omitted.

> and the response was flow chart tech support with a "buy a webcam" cherry on top I feel safe in saying that they don't want a video of you at your keyboard typing stuff. An exploit video is a recording of your screen, not of you.

Which, if any of the exploits require anything that isn't on-screen (USB or other HID, key combination), requires a reboot, or anything done before Windows has fully booted, means one must have an external camera Doesn't sound like it for these exploits specifically (except Yellow Key), but I could be wrong, and again: that's just for these exploits specifically

>>> flow chart tech support with a "buy a webcam" cherry on top

>> I feel safe in saying that they don't want a video of you at your keyboard typing stuff. An exploit video is a recording of your screen, not of you.

> if any of the exploits require anything that isn't on-screen (USB or other HID, key combination), requires a reboot, or anything done before Windows has fully booted, means one must have an external camera

That still wouldn't mean "buy a webcam" - if someone has had a mobile phone (smartphone or dumbphone) from recent decades, it likely had a camera included.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#150

Post by mook »

thaumasiotes wrote: post #104
xethos wrote: post #80

Earlier quoted context omitted.

Which, if any of the exploits require anything that isn't on-screen (USB or other HID, key combination), requires a reboot, or anything done before Windows has fully booted, means one must have an external camera Doesn't sound like it for these exploits specifically (except Yellow Key), but I could be wrong, and again: that's just for these exploits specifically

> (USB or other HID, key combination) I don't think you'd need an external camera for that. What you're doing would be mentioned in the accompanying report. I do agree with you about the boot process, though.

I believe Hyper-V supports emulating TPM these days, so doing things to a VM and recording the desktop with the VM window _may_ work. In this case though it'd look very boring because you couldn't tell from the recording that anything happened.
Post reply on HN