Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

4chan Sharty Hack And Janitor Email Leak

knowyourmeme.com

Post reply on HN
Print view View original

551–560 of 1001 posts

Re: 4chan Sharty Hack And Janitor Email Leak

#551

Post by wnevets »

robotnikman wrote: post #397

I did some digging and the hacker posted which exploit he used. Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell ac…

> Ghostscript from 2012

Has there been a single year since 2012 that didn't include a new ghostscript RCE? Exposing ghostscript to the internet is dangerous.

Re: 4chan Sharty Hack And Janitor Email Leak

#552

Post by donnachangstein »

jrochkind1 wrote: post #493
robotnikman wrote: post #397

I did some digging and the hacker posted which exploit he used. Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell ac…

This is an old well known exploit. Don't run versions of ghostscript from 2012?

> Don't run versions of ghostscript from 2012?

Per Wikipedia:

In February 2013, with version 9.07, Ghostscript changed its license from GPLv3 to GNU AGPL.

With the AGPL license being legal kryptonite I wonder if license compatibility drove the decision (and how many other installations of Ghostscript share this concern)?

Re: 4chan Sharty Hack And Janitor Email Leak

#554

Post by bee_rider »

helaoban wrote: post #464
cwmma wrote: post #225

Earlier quoted context omitted.

For the record this is an example of the "Fencepost error" where the last item in a range gets double counted as the first item in the next range and is incredibly common in dyscalculia (the math version of dyslexia) as people will have "visual number lines" in their head that cover ranges of numbers but the ends get double counted, so there will be a 10-20 number line then a 20-30 number line. I suspect TheJosh had…

Can we pause and admire the sheer contagiousness of the debate? We are now extending it to the meta-realm, discussing the possible mental states that led to one or more of the original participants adopting certain lines of reasoning...

Actually the brain is part of the body, so it doesn’t extend into the meta realm, the debate is still about dates and body building just with a different organ.

Re: 4chan Sharty Hack And Janitor Email Leak

#555

Post by FiniteField »

tokai wrote: post #544
thih9 wrote: post #337

Earlier quoted context omitted.

Note, some of these are associated with the far right. > fren later came to prominence on sites such as 4chan and the subreddit /r/frenworld as a dog whistle used by far-right white nationalists and fascists to refer to each other https://en.m.wiktionary.org/wiki/fren

Should be noted that they have a history of trying to co-opt neutral terms and symbols. Like the frog and the ok gesture.

Pepe the frog became associated with the online far right because it was a commonly used memetic avatar in general 4chan culture, and became intertwined with the space's shift to the political right in a fairly organic way. The association was boosted by (IIRC) the 2016 Clinton campaign's assertion that it was a far-right symbol, which was obviously embraced by those people as a sort of irreverent statement. Likewise, there may have been some very thin, actually existing connection between the far right and the "ok" gesture, but it really came about as an association that was imposed by the media and subsequently embraced by that community. To say these terms were "co-opted" isn't really correct.

I think there's actually a better case to be made that the pipeline of "co-option" (if you want to call it that) is stronger in the reverse direction. I posted a sister comment to yours about that.

Re: 4chan Sharty Hack And Janitor Email Leak

#556

Post by ryandrake »

loves_mangoes wrote: post #417
robotnikman wrote: post #397

I did some digging and the hacker posted which exploit he used. Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell ac…

That checks out. Years ago I noticed a vulnerability through the photography board. You'd upload your pictures, and 4chan would display all the EXIF info next to the post. 4chan's PHP code would offload that task to a well-know, but old and not very actively maintained EXIF library. Of course the thing with EXIF is that each camera vendor has their own proprietary extensions that need to be supported to make users ha…

> Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt.

This describes probably 95%+ of the entire software world, from enterprise, to SaaS to IoT to mobile to desktop to embedded... Everything seems to be hastily thrown together features that barely work and piles of debt that will never get fixed. It's a wonder anything actually even works. If cars (the non-software parts) were made like this, there would be millions of them breaking down by the side of the road daily.

Re: 4chan Sharty Hack And Janitor Email Leak

#557

Post by ryandrake »

xattt wrote: post #550
robotnikman wrote: post #397

I did some digging and the hacker posted which exploit he used. Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell ac…

> could give the attacker shell access. How do these exploits work? Does it open an SSH port somewhere or does it show up as a browser-based terminal?

This is a great question, one I've always wondered. "Shell access" typically requires a terminal to, you know, type stuff in, right?

Re: 4chan Sharty Hack And Janitor Email Leak

#558

Post by canjobear »

ren_engineer wrote: post #400
Red_Tarsius wrote: post #88

I feel too many people conflate /pol/ with the whole website. I enjoyed browsing through sfw boards like /tg/ (tabletop media), /ck/ (cooking) and /fit/ (fitness). I had long discussions about the SW sequels on /tv/ back in 2015-19. The readership was surprisingly diverse and the anonymity lead users to provide more focused replies. With bodybuilding.com gone, the blue boards felt like the last bastion of the old int…

/g/ was the origin of Chain of Thought for AI, also where llama weights were first leaked

> /g/ was the origin of Chain of Thought for AI

Is this documented?

Re: 4chan Sharty Hack And Janitor Email Leak

#559

Post by blackhaj7 »

sgarland wrote: post #139
Red_Tarsius wrote: post #88

I feel too many people conflate /pol/ with the whole website. I enjoyed browsing through sfw boards like /tg/ (tabletop media), /ck/ (cooking) and /fit/ (fitness). I had long discussions about the SW sequels on /tv/ back in 2015-19. The readership was surprisingly diverse and the anonymity lead users to provide more focused replies. With bodybuilding.com gone, the blue boards felt like the last bastion of the old int…

> bodybuilding.com Obligatory post about the dumbest argument to ever be had online [0]. It’s so good, the Wikipedia entry [1] has a section devoted to it. [0]: https://web.archive.org/web/20240123134202/https://forum.bod... [1]: https://en.wikipedia.org/wiki/Bodybuilding.com

Laughing my head off reading through this. Thank you

Re: 4chan Sharty Hack And Janitor Email Leak

#560

Post by ryandrake »

helaoban wrote: post #464
cwmma wrote: post #225

Earlier quoted context omitted.

For the record this is an example of the "Fencepost error" where the last item in a range gets double counted as the first item in the next range and is incredibly common in dyscalculia (the math version of dyslexia) as people will have "visual number lines" in their head that cover ranges of numbers but the ends get double counted, so there will be a 10-20 number line then a 20-30 number line. I suspect TheJosh had…

Can we pause and admire the sheer contagiousness of the debate? We are now extending it to the meta-realm, discussing the possible mental states that led to one or more of the original participants adopting certain lines of reasoning...

Speaking of the meta-realm, I've always wondered how messages in forum flamewars always seemed to gravitate toward a very specific pattern:

You see this pattern all over the Internet. For example, from that bodybuilding.com thread:

    Are you retarded? [personal insult]

    Maybe you should look at a calander, I didn't double count sunday, my two weeks started and ended on sunday, exactly 14 days. [the point]

    What don't you understand? [bait to continue flaming]
Post reply on HN