Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

201–210 of 277 posts

Re: Matrix.org hacked

#201

Post by zinid »

joepie91_ wrote: post #165
tannhaeuser wrote: post #69

Earlier quoted context omitted.

> myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix Good luck with that. Right now there's only the centralized matrix.org server, or actually there isn't because it's down. If you want open standards and multiple servers (or your own) use XMPP period. It's not so much a technical question as it is the attitude of "hey we're implementing our own chat proto…

> It doesn't help either that scarce development resources are needlessly fragmented between XMPP and matrix. In my experience, there's virtually no overlap between the two groups, and therefore no fragmentation. And for good reason: XMPP is a nightmare to implement, so there's a significant group of developers that just won't touch it, but that might be interested in working on Matrix. And yes, part of the blame for…

> This problem doesn't exist for JSON, because pretty much every language directly supports arrays, objects/maps and primitives

No, JSON will not map directly to a language with advanced type system (with tuples, variants, etc). Even in Elm it's recommended to write a decoder to convert incoming JSON into an internal structure. So in fact the mapping is very poor. And I see no difference in this regard: both XML and JSON is crap.

Re: Matrix.org hacked

#202

Post by ipoopatwork »

_red wrote: post #175
majewsky wrote: post #129

Earlier quoted context omitted.

To avoid perverse incentives, you should also build in some reward for the developers/operators. As in: If the server gets hacked, the money goes to the whitehat. If the server does not get hacked for $TIMEFRAME, the money goes to the people responsible for its security.

Also, there is a requirement for the hacker to actually publish the results of how they did it. Otherwise, you run the risk of the hacker just walking away with the funds or giving a bogus reason (after they've already spent the wallet). Therefore, the wallets should be stored GPG encrypted in some published location. After the hacker has successfully penetrated and retrieved the file, they need to publish a "how I d…

Unless I'm missing the joke, this is a bug bounty with extra steps.

Re: Matrix.org hacked

#203

Post by comboy »

ipoopatwork wrote: post #202
_red wrote: post #175

Earlier quoted context omitted.

Also, there is a requirement for the hacker to actually publish the results of how they did it. Otherwise, you run the risk of the hacker just walking away with the funds or giving a bogus reason (after they've already spent the wallet). Therefore, the wallets should be stored GPG encrypted in some published location. After the hacker has successfully penetrated and retrieved the file, they need to publish a "how I d…

Unless I'm missing the joke, this is a bug bounty with extra steps.

My idea was to not require any explanations, so that blackhat could grab that wallet too. It's just about being able to say "this server is $1k secure". I think it's fantastic that we have a technology to do that.

You still need some trust that private keys to given wallet are on the server, but apart from that, when you know there's $10,000 dollars on the server for anybody who can access it, it says something about how secure this machine is.

Plus you get instant notification when the server is compromised. Not every hacker is kind enough to let you know.

Re: Matrix.org hacked

#204

Post by e12e »

DblPlusUngood wrote: post #116
aidos wrote: post #99

Earlier quoted context omitted.

I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply be prompted before it’s allowed.

OpenSSH does have confirmation: use the '-c' switch to ssh-add. https://man.openbsd.org/ssh-add

Hm, anything similar for gpg agent (both for gpg, and as a stand-in for ssh-agent)?

Ed: looks like I need to edit my sshcontrol-file

https://www.gnupg.org/documentation/manuals/gnupg/Agent-Conf...

Re: Matrix.org hacked

#205

Post by snvzz »

snvzz wrote: post #66

4chan is circulating this picture. It shows the defaced website frontpage. https://i.4cdn.org/g/1555048975736.png I have a hard time with the idea that they run the webserver and the matrix server on the same computer. (Regarding users.txt) It seems they do urgently need to hire capable infrastructure people.

Correction: Not on the same server. They just managed to repoint DNS. See 2019-04-12 update on the incident article[0].

[0]: https://matrix.org/blog/2019/04/11/security-incident/index.h...

Re: Matrix.org hacked

#206

Post by e12e »

Arathorn wrote: post #53

Project lead for Matrix.org here - you can see our initial statement on this at http://matrix.org/blog/2019/04/11/security-incident/ . It will be updated shortly to reflect the DNS defacement linked here (which was because we failed to rotate a leaked cloudflare API token; we aimed to rotate the master API token but rotated a personal one instead). To our knowledge the rebuilt production infrastructure itself is secu…

Any more information on how the Jenkins server was compromised? From a cursory read of the CVEs it looks like an attacker must be able to push code in order to exploit? Was the server completely public, or was the attacker able to submit code via pull request or similar for running on ci/Jenkins?

Re: Matrix.org hacked

#207

Post by metafunctor »

Xylakant wrote: post #171
metafunctor wrote: post #160

Earlier quoted context omitted.

I know exactly how agent forwarding and ProxyJump work, but I'm having a hard time understanding what you mean. ProxyJump proxies your ssh connection, so connecting from A to B via proxy X the connections go A->X and X->B. You can use AgentForwarding with ProxyJump, in which case agent connections go B->X->A. I cannot see how ProxyJump would somehow be an alternative to AgentForwarding. You can use both independently…

> ProxyJump proxies your ssh connection, so connecting from A to B via proxy X the connections go A->X and X->B. No, it rather works like this: A -> B via X establishes A->X and then, through that connection tunnels a new ssh-connection from A->B. A->X, then X->B would require forwarding the Agent from A to X, so that the connection from X->B can authenticate using that agent. Proxying the connection does not require…

Hehe, I think I figured out the source of the confusion.

I was thinking that the threat is that a compromised B gives access to your keys via agent forwarding. Presumably if you make keys available on B, you need them there. There's nothing ProxyCommand does to help there.

But you're talking about using ProxyCommand as an alternative for connecting A->X and then X->B, so keys are not available on X. That's of course an improvement.

Re: Matrix.org hacked

#208

Post by trw999 »

As someone running a Matrix homeserver I take this incident as an example of the benefits of decentralization. Unlike in more centralized services, the security lapses of Matrix.org have had no affect on my homeserver.

Re: Matrix.org hacked

#209

Post by aquabeagle »

DblPlusUngood wrote: post #116
aidos wrote: post #99

Earlier quoted context omitted.

I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply be prompted before it’s allowed.

OpenSSH does have confirmation: use the '-c' switch to ssh-add. https://man.openbsd.org/ssh-add

Or "AddKeysToAgent confirm" in ~/.ssh/config

Re: Matrix.org hacked

#210

Post by rwmj »

DBFFD990 wrote: post #194
rwmj wrote: post #111

Earlier quoted context omitted.

Some ssh agent implementations do this, notably the one built into Android ConnectBot can be configured to request confirmation each time it is asked to authenticate. Unfortunately ssh-agent (from OpenSSH) does not as far as I know. It's happy to authenticate as many times as requested without any notification.

It can, and it's determined per key when added to the agent. Look for -c here: https://man.openbsd.org/ssh-add

Indeed it is - I even checked the man page before posting the comment and completely missed that option.
Post reply on HN