I left 4chin by the time it became impossible to dodge pedophiles, room temperature IQ and absolute lowest tier trash. It used to be fun to hunt for quality content, but it seems nobody of value visits that site anymore.
4chan Sharty Hack And Janitor Email Leak
681–690 of 1001 posts
Re: 4chan Sharty Hack And Janitor Email Leak
#682Earlier quoted context omitted.
> could give the attacker shell access. How do these exploits work? Does it open an SSH port somewhere or does it show up as a browser-based terminal?
Usually the attacker, on their own computer, or some other server they have root on, will open a port and expose it to the internet and listen. The exploit payload will then make an outbound connection to that port. Once it's connected, the exploit will give the attacker's computer shell access. Search terms include 'reverse shell'. It takes the normal client/server architecture and turns it inside out. If you rememb…
That's why it's a good idea to block connections of all protocols into address ranges where an attacker might be able to host a service. Even on internal networks, if you are a corporation.
But it gets better than tunneling over ICMP: DNS tunneling. Pretty much all systems can talk to a DNS resolver. If it resolves arbitrary host names, you can set up a DNS for a zone you control and requests will end up there. With tools like iodine (requires root and a binary on the target), you can tunnel your traffic conveniently (and slowly).
Re: 4chan Sharty Hack And Janitor Email Leak
#683I did some digging and the hacker posted which exploit he used. Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell ac…
This is such a common hole. One of my early hacks was a forum that allowed you to upload a pfp but didn't check it was actually an image. Just upload an ASP file which is coded to provide an explorer-like interface. Found the administrator password in a text file. It was "internet" just like that. RDP was open. This was a hosting provider for 4000+ companies. Sent them an email. No thank you for that one. Always chec…
These were fun times. I've been working as a pentester for the past ten years, and the job got a lot harder, with everything using frameworks and containerization.
We still get plenty of results, because the tooling also gets better, and finding just one vulnerability is enough to be devastating, which makes it kind of frustrating. There is tons of progress, but much of it is just not paying dividends.
Re: 4chan Sharty Hack And Janitor Email Leak
#684Earlier quoted context omitted.
OTA firmware updates are so insane. Does your insurance company understand what’s going on?
There was a hack to a Cherokee featured in Wire years and years back. It was attributed to “two hackers”… yea my ass, I met both guys they knew surface level at best, these guys didn’t discover a flaw in Sprint’s network on their own. It was three letter agencies embarrassing the mfgs into “taking security more seriously” but conveniently also giving gov access, backdoors, and data on vehicles. Play the game or they’…
So, i guess thanks to whoever in the NSA does the final quality control preventing mass incidents.
Re: 4chan Sharty Hack And Janitor Email Leak
#685Earlier quoted context omitted.
It's interesting to note the popularity of the website, and the massive traffic it handled, despite the lack of everything we assume necessary for a modern (social media) website - no modern web frameworks - no microservices/kubernetes clusters - no algorithmic curation/moderation/recommendation algoritmhs One wonders just how much of the modern engineering developed in the past decades, that cost a fortune to develo…
otoh the entire site is no longer running because they fell behind on updates
yeah but the 'social media needs hyper-complex and opaque curation algorithms to control what the users see, otherwise it'd become unusable' argument is provably false. Companies just want to control the narrative and/or push ads/influencers/opinions into peoples faces, while trying to maintain the illusion of organic discussion.
Re: 4chan Sharty Hack And Janitor Email Leak
#686Earlier quoted context omitted.
Speaking of the meta-realm, I've always wondered how messages in forum flamewars always seemed to gravitate toward a very specific pattern: You see this pattern all over the Internet. For example, from that bodybuilding.com thread: Are you retarded? [personal insult] Maybe you should look at a calander, I didn't double count sunday, my two weeks started and ended on sunday, exactly 14 days. [the point] What don't you…
There's a related, more polite version of "are you retarded" which is not uncommon even here on HN. It is "I'm confused" . I don't know whether it's a phrase that I'm over analysing, but it always comes across as disingenuous to me. The responder is never actually confused, they have a question that they should just ask.
"I really don't understand why people would think X"
is another example but I think there may be some expression of non-understanding. "So retarted it doesnt make sense."
Similar, "are you a n*zi" never seen here but as a simple but clever "Could you elaborate?" often as a reply to a polite but ambiguous comment. It's basically bait for the ambiguous commenter to confirm or deny the morality of their comment.
Re: 4chan Sharty Hack And Janitor Email Leak
#687Earlier quoted context omitted.
It's not what you think. Let me give you an example. /k/ is the weapons/military forum, and it's unironically run by US government authorities. Vulgar racial slurs are wholly permitted -- but if you question certain aspects of US military or foreign policy, or suggest that Russia/China/etc. aren't houses of cards that will topple the moment the US wills it, your comment will probably be deleted and you'll be hit with…
/k/ has been the U/k/raine board since that invasion started and you risk a ban for deviating from that topic.
/k/ has hated Russian milsurp slavshit far longer than they cared about Ukraine. For years Russiaboos would shit up the board that almighty AK superior firearm or that Russian magical remote turret tank best tank in the world or that new gen fighter plane best stealth plane in the world and all 1/10 of stupid american military budget bullshit.
turns out all that crap was just what everyone expected it to be: fabricated lies. And also Russians are really bad at conducting war and resorting to meat wave tactics. For a board that cares about firearms and military tactics, it didn't take too much of a far reach to dislike and laugh at Russia.
Re: 4chan Sharty Hack And Janitor Email Leak
#688Earlier quoted context omitted.
That checks out. Years ago I noticed a vulnerability through the photography board. You'd upload your pictures, and 4chan would display all the EXIF info next to the post. 4chan's PHP code would offload that task to a well-know, but old and not very actively maintained EXIF library. Of course the thing with EXIF is that each camera vendor has their own proprietary extensions that need to be supported to make users ha…
> Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt. This describes probably 95%+ of the entire software world, from enterprise, to SaaS to IoT to mobile to desktop to embedded... Everything seems to be hastily thrown together features that barely work and piles of debt that will never get fixed. It's a wonder anything actually even w…
Reminds me of Bill Gates & GM (apparently discredited though)
Re: 4chan Sharty Hack And Janitor Email Leak
#689I did some digging and the hacker posted which exploit he used. Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell ac…
So the article blaming out of date PHP was off base?
Re: 4chan Sharty Hack And Janitor Email Leak
#690Earlier quoted context omitted.
Speaking of the meta-realm, I've always wondered how messages in forum flamewars always seemed to gravitate toward a very specific pattern: You see this pattern all over the Internet. For example, from that bodybuilding.com thread: Are you retarded? [personal insult] Maybe you should look at a calander, I didn't double count sunday, my two weeks started and ended on sunday, exactly 14 days. [the point] What don't you…
There's a related, more polite version of "are you retarded" which is not uncommon even here on HN. It is "I'm confused" . I don't know whether it's a phrase that I'm over analysing, but it always comes across as disingenuous to me. The responder is never actually confused, they have a question that they should just ask.
The poster is likely confused at how anybody can be so r-slurred.