Explanation for this with a better link: https://news.ycombinator.com/item?id=40615804
That goes right onto my 'convoluted explanations that make things more complicated than they really are' stack.
Feynman's Razor
Content Injection Attack on GitHub
31–40 of 52 posts
Re: Content Injection Attack on GitHub
#32Explanation for this with a better link: https://news.ycombinator.com/item?id=40615804
That goes right onto my 'convoluted explanations that make things more complicated than they really are' stack.
To understand monads, imagine you're in the middle of an infinite ocean. The ocean represents possibilities, and each wave represents a choice. Monads are invisible fish that you can't see but guide your boat. You don't know where you're going, and the fish don't either. Sometimes, they lead you to islands of coconuts, but other times they take you to whirlpools. You have a magical net that catches these fish, but the net has holes, so not all fish stay. Monads are these fish that might or might not help you navigate the infinite ocean, depending on whether they feel like it.
Re: Content Injection Attack on GitHub
#33Does this still work? Opened in Safari and don’t see anything out of place
You need to look into the webarchive linked above as it was fixed already
Re: Content Injection Attack on GitHub
#34You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec3... where the first PoC commit is pushed up. The thing I find interesting is that this wasn't a random discovered; like, you look at the first commit in the sequence and you'll see. > \ce{$\unicode[goombafont; color:red; pointer-events: none; ... ie. This isn't some random chance discovery. This is someone looking to use…
I don't think you can really trust commit history to deduce this: - the history can be rewritten, with push --force. The author might have iterated by force pushing one commit - The author could have discovered it by change in a private repository, or another repository that they deleted
Honestly, I doubt the author is playing the “deep game” of looking like they’re just messing around while secretly being a secret agent and (for some fathomless reason) making it look like it with an artificial git history.
So in general, yes, but in this case, I doubt it. I’m pretty sure this git history is a real and true log of them dicking about trying to get the exploit they saw on twitter working.
…but, I guess, you could be right. /shrug
Re: Content Injection Attack on GitHub
#35I don't get this. It shows some mangled text that looks like defaced CSS, accompanied by the error message “Extra open brace or missing close brace”. How is this content injection? But the rescue murloc is cute.
They fixed the issue but for a beautiful moment in time, it looked like this: https://archive.is/LPC5O
Re: Content Injection Attack on GitHub
#36Earlier quoted context omitted.
I don't think you can really trust commit history to deduce this: - the history can be rewritten, with push --force. The author might have iterated by force pushing one commit - The author could have discovered it by change in a private repository, or another repository that they deleted
Honestly, I doubt the author is playing the “deep game” of looking like they’re just messing around while secretly being a secret agent and (for some fathomless reason) making it look like it with an artificial git history. So in general, yes, but in this case, I doubt it. I’m pretty sure this git history is a real and true log of them dicking about trying to get the exploit they saw on twitter working. …but, I guess…
I do occasionally force push myself, mostly for making my history look clean, not really secretly hiding stuff.
And if I had to tweak / study a GitHub exploit, I would definitely force push to try stuff without leaving a trail for meaningless commits.
It actually didn't occur to me that the author would do this for messing around, but it could be indeed. :-)
Re: Content Injection Attack on GitHub
#37Funny at first, but this could have been exploited maliciously by let's displaying a message telling the user he has been disconnected and redirecting him to a phishing page.
That's the point, isn't it?
Re: Content Injection Attack on GitHub
#38Other than I love Samy, are many real-world examples of XSS being exploited for massive takeover of some service? I can't say I remember any news of a "website/service totally taken over due to XSS."
Powerful XSS vulnerabilities are found all the time, but they usually doesn't break the news because they aren't wormed. Samy was a worm, spreading from user to user exponentially, hence it being a very loud attack with news about it.
Re: Content Injection Attack on GitHub
#39Shame that either GitHub doesn’t have a bug bounty, or their program isn’t good enough to entice people to use it
Re: Content Injection Attack on GitHub
#40Funny at first, but this could have been exploited maliciously by let's displaying a message telling the user he has been disconnected and redirecting him to a phishing page.
If this was purely a CSS injection—as I understand it was—then I don't think it would be possible to redirect on any technical level the user anywhere (e.g. by providing a link).
But telling user to do something would still be on the table.