Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

copahost.com

Post reply on HN
Print view View original

51–60 of 83 posts

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#51

Post by rstupek »

dylan604 wrote: post #38
omnimus wrote: post #16

Earlier quoted context omitted.

These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.

Every time I venture in the the web server's error log, I see all of the skiddie's attempts at accessing the most common things with most of them being .php files. Lots of /wp/admin.php and /phpadmin/ type requests. Of course, none of those are available which is why the requests are in the error log. I've never paid attention, but I wonder how long (as in how little time) for a new server to come online before it st…

If you get a letsencrypt certificate it will get probed within a minute

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#52

Post by diek »

Meekro wrote: post #27
omnimus wrote: post #16

Earlier quoted context omitted.

These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.

I've done PHP development for over 20 years, including some pretty large projects. I've never had a situation where a security flaw in PHP itself forced me to scramble to patch something before it got hacked. On the other hand, for my Linux servers, I had to do that twice in the last month with CopyFail and DirtyFrag.

CVE-2021-21703 [0] is a similar class of bug in the PHP interpreter itself that was pretty recent

https://www.sentinelone.com/vulnerability-database/cve-2021-...

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#53

Post by doublerabbit »

zuzululu wrote: post #7

Ages ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain

Php-nuke was the hacking testing ground. Nuke was atrocious for exploitation.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#54

Post by doublerabbit »

dylan604 wrote: post #38
omnimus wrote: post #16

Earlier quoted context omitted.

These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.

Every time I venture in the the web server's error log, I see all of the skiddie's attempts at accessing the most common things with most of them being .php files. Lots of /wp/admin.php and /phpadmin/ type requests. Of course, none of those are available which is why the requests are in the error log. I've never paid attention, but I wonder how long (as in how little time) for a new server to come online before it st…

22 minutes. I got my new ISP with fibre. Placed my web server online. 22 minutes my honey pot got stung.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#55

Post by ipaddr »

diek wrote: post #52
Meekro wrote: post #27

Earlier quoted context omitted.

I've done PHP development for over 20 years, including some pretty large projects. I've never had a situation where a security flaw in PHP itself forced me to scramble to patch something before it got hacked. On the other hand, for my Linux servers, I had to do that twice in the last month with CopyFail and DirtyFrag.

CVE-2021-21703 [0] is a similar class of bug in the PHP interpreter itself that was pretty recent https://www.sentinelone.com/vulnerability-database/cve-2021-...

This is not a PHP language interpreter bug this is a PHP FPM bug.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#56

Post by bsder »

omnimus wrote: post #16
pixl97 wrote: post #15

Earlier quoted context omitted.

I mostly disagree on your disagreement unless the entire project was based on top security practices and good code in the first place. The vast majority of these web panels are a security nightmare.

These PHP systems be it cPanel, wordpress or PHP itself are most likely the biggest target besides windows. It's incredibly uncool stack especially here but it is running most of the "independent" small web. They cannot be that bad if they are managing to be ductape of the internet.

> They cannot be that bad if they are managing to be ductape of the internet.

Oh, it very much can be that bad. Most "security" relies on the Hungry Tiger Theory of Security(tm).

My system doesn't need to be "secure". My system simply needs to be more secure than yours. As long as there is an easier and/or more valuable target somewhere, I'm "secure". I don't need to outrun the hungry tiger; I only need to outrun you outrunning the hungry tiger.

That theory, of course, doesn't hold anymore when there are enough tigers to simply eat everybody. And that's what AI did; it multiplied the tigers enough that they can just gorge on everything.

Now, people are going to have to put in "actual security" or lose real money over and over and over. And since everybody has outsourced everything, nobody knows how to fix it quickly. The lawyers are going to have a field day.

At the end, however, we'll have real security on our internet facing systems. But man, it's going to be painful for a while.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#57

Post by jszymborski »

doublerabbit wrote: post #53
zuzululu wrote: post #7

Ages ago I used php-nuke to manage my forum and it got hacked and I thought it would get taken seriously Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain

Php-nuke was the hacking testing ground. Nuke was atrocious for exploitation.

I was thinking about php-nuke I while back and it's terrible security rep. I figured it was just the regular PHP foot guns of the era, but I took a look at the code recently and boy howdy that was some truly atrocious code. I'm not security person (although perhaps security minded) and I found a million problems after a cursory glance.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#58

Post by smallerize »

ilia-a wrote: post #14
kiritanpo wrote: post #3

Earlier quoted context omitted.

Most shared hosting plans use cpanel. It's still widely used yes for a lot of smaller websites.

I wonder how much shared hosting is there really left, I imagine much of it move to VPS or cheap cloud boxes.

But you have to keep a VPS updated yourself, right? A hosted site doesn't require any action from the customer to stay up to date.

Re: CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers

#60

Post by mappu »

walrus01 wrote: post #31
TZubiri wrote: post #12

Earlier quoted context omitted.

[flagged]

Remember 'webmin'? As someone who pretty much exclusively uses debian, freebsd and openbsd for server OS work, I was also rather surprised recently to see the default web gui that comes on a new fedora install. https://cockpit-project.org/

I was pleasantly surprised to learn the architecture for this - a minimal backend that does a PAM auth and gives you a shell over websocket, with only your own Linux user credentials - and then everything else (from managing files to apache to VMs) is done in frontend javascript.

Keeps the server-side backend minimal and auditable.

Post reply on HN