Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacked: commit to rails master on GitHub

github.com

Post reply on HN
Print view View original

31–40 of 240 posts

Re: Hacked: commit to rails master on GitHub

#31

Post by cmelbye »

pyre wrote: post #21
phillmv wrote: post #9

Earlier quoted context omitted.

He registered a commit using his own account - so he either got the password of a rails admin or he must've found a way to add his keys to the rails github account directly. The comments on the commit mention he just raised an issue that few people protect the attributes on their models from mass assignment, which… is one way this could happen. Kind of a dick move, though. Responsible disclosure, doing it on a Sunday…

> Responsible disclosure If you look at the bug report, the core Rails Dev Team basically said that they like the defaults the way that they are. They have/had no intention of changing the defaults, and are trying to push responsibility on to the developers using Rails to use sane config settings. Looks like the guy did report it and the response was: "Not our problem" / "Not an issue." He got frustrated and decided…

The Rails team essentially argued that it isn't on them to secure sites built with Rails. Rails provides tools to avoid this, and GitHub chose to not use them, so this is a vulnerability in GitHub. They should be using attr_accessible, and they're not.

Re: Hacked: commit to rails master on GitHub

#34

Post by rplnt »

apl wrote: post #20

It's unfortunate that the guy stumbling upon this apparently noteworthy vulnerability happens to be so utterly immature . [EDIT: Unsurprisingly, the dude's 18. See http://homakov.blogspot.com/p/about-me.html for reference.]

Well...

> Why I do this? Since guys in rails issues ingored me

But I guess I agree.

Re: Hacked: commit to rails master on GitHub

#35

Post by Scriptor »

martingordon wrote: post #19
arturadib wrote: post #2

I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.

It's a vulnerability in Rails, which is what GitHub is built on. The vulnerability was demonstrated by adding a commit to the Rails project on GitHub, indicating that GitHub suffers from the vulnerability. Here's the relevant issue. It might clarify things a bit better: https://github.com/rails/rails/issues/5228

The issue seems to be a result of an entire hash of the parameters passed in the request being sent to the new method for models.

Is this really common practice in Rails code? Sure you can specify in the model that certain attributes can't be changed. But shouldn't this stuff be checked when validating form input? Normally I'd have a hash of filters, with the field/column name mapped to the appropriate set of rules for that field. Anything that's not specified in the filters doesn't go to the model's new method.

In this case, it's like the equivalent of PHP code where you santizie the data in $_POST and just send that whole variable to the database.

Choosing which fields are accepted shouldn't just be a model security issue, it's a form validation issue. This makes choosing whether an admin can change a field or not trivial as well. If a request is made as an admin, (maybe through a form that's only accessible by someone with an admin role) then you just apply the validation rules for an admin. Otherwise you apply the rules for a user.

Re: Hacked: commit to rails master on GitHub

#37

Post by arturadib »

zyfo wrote: post #5

Here's the guy's blog post about the hack: http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.htm... "Today I can pull/commit/push in any repository on github. Jack pot."

Regardless of the 'hacker's motives/personality, I think this is yet another testimony to the power of open source.

When you have this many eyeballs looking at your code, the odds of a good-intentioned (however playful/immature) coder to discover a vulnerability is much greater than those of a real ill-intentioned hacker simply due to the sheer number of the former. The issue will quickly get fixed by the community, the kid will get the attention he wants, and life will go on.

Re: Hacked: commit to rails master on GitHub

#38

Post by Jach »

klodolph wrote: post #8

If this is a GitHub exploit, and I were GitHub, I would be talking to law enforcement. This is not how adults disclose software vulnerabilities.

Looks like he's in Russia. Good luck. It wasn't that long ago where it was mass belief that this stunt is what got you white-hat jobs. It still seems the sensible option is to rescue someone into the legal security analysis field before one of the person's targets overreacts to a financially harmless taunt by destroying someone's life.

Re: Hacked: commit to rails master on GitHub

#40

Post by rplnt »

cmelbye wrote: post #23
StavrosK wrote: post #17

Earlier quoted context omitted.

I don't think adults react to harmless (if public) disclosure by tattling to law enforcement either, though.

If we're discussing how adults act, then I definitely would not refer to reporting a crime as "tattling" (I might expect that from a child in Elementary school, though). Zero-day attacks are extremely irresponsible, and this is probably against the law.

Against what law? Remember that Internet does not necessarily equal USA.
Post reply on HN