Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab servers are being exploited in DDoS attacks

therecord.media

Post reply on HN
Print view View original

81–90 of 177 posts

Re: Gitlab servers are being exploited in DDoS attacks

#81

Post by bink »

DelightOne wrote: post #13

How much effort is it for a company like Gitlab to add kill switches to certain features and to trigger them incase they are exploited in the wild? Has to be pretty fine-grained though to disable analysis or upload on certain files, right? What are alternatives to automatic immediate updates and kill switches besides not exposing the service to the internet?

Kill switches sound great in theory until you disable a service used to host a billion dollar company, a hospital admission network, or your biggest paying customer.

The solution here is to offer a security notification service, which GitLab does. It's up to the admins to maintain these systems. It's GitLab's job to give them the information they need to do so, which they have.

Re: Gitlab servers are being exploited in DDoS attacks

#84

Post by wheresmycraisin »

JoshTriplett wrote: post #33
surfer7837 wrote: post #15

How can you protect yourself from file upload threats? It's basically the worst possible threat model -- executing complex user input that conforms to a spec that was written 20 years ago by some proprietary company with no security. Executing everything on an isolated container with no permissions? Audit trial etc/good logging? If someone comes up with an RCE you're basically done for, you can only mitigate it but n…

If you have to process it at all, do it in a WebAssembly sandbox on the server. Or, alternatively, in a seccomp-secured sandbox that isn't allowed to make any system calls whatsoever, just read data from one file descriptor and write processed data to another.

.... why webassembly?

Re: Gitlab servers are being exploited in DDoS attacks

#85

Post by cozzyd »

xxpor wrote: post #68
Jach wrote: post #41

It's somewhat refreshing that the underlying bug isn't from some C or C++ utility, but instead a Perl program using eval: https://github.com/exiftool/exiftool/blob/11.70/lib/Image/Ex... Another instance of "avoid eval as much as possible" for languages that have it.

With dlopen() and libclang/libgccjit, you could argue C (on an OS that supports dynamic loading) has eval too ;)

You have system("gcc uploaded.c && ./a.out") too!

Re: Gitlab servers are being exploited in DDoS attacks

#86

Post by Spivak »

cozzyd wrote: post #85
xxpor wrote: post #68

Earlier quoted context omitted.

With dlopen() and libclang/libgccjit, you could argue C (on an OS that supports dynamic loading) has eval too ;)

You have system("gcc uploaded.c && ./a.out") too!

But that code doesn’t run in the memory space of the process.

Re: Gitlab servers are being exploited in DDoS attacks

#87

Post by marcosdumay »

surfer7837 wrote: post #15

How can you protect yourself from file upload threats? It's basically the worst possible threat model -- executing complex user input that conforms to a spec that was written 20 years ago by some proprietary company with no security. Executing everything on an isolated container with no permissions? Audit trial etc/good logging? If someone comes up with an RCE you're basically done for, you can only mitigate it but n…

You know, if you to it in a pure Haskell function, you can be assured that the worst it can do is to use too many resources so it kill its own process. If you do it in a Rust function, well, you have no formal guarantees, but you have to get really out of your way to put a vulnerability like that in the code.

What you don't do is pulling an ages old perl codebase to run over complex formats.

Re: Gitlab servers are being exploited in DDoS attacks

#88

Post by mxrlkn »

winrid wrote: post #54
Jach wrote: post #41

It's somewhat refreshing that the underlying bug isn't from some C or C++ utility, but instead a Perl program using eval: https://github.com/exiftool/exiftool/blob/11.70/lib/Image/Ex... Another instance of "avoid eval as much as possible" for languages that have it.

My personal career favorite use of eval was for an import system that "unrolled" the loop that went through the columns for each row, using eval. It was much faster, but obviously a huge security risk. Today with modern JIT compilers its probably not much faster...

I was once tasked with creating a new frontend on an old project that had an API endpoint return something like this:

  var array = ["foo", "bar"]
I was expecting xml or json (like the rest of the endpoints), but I realized that they just served this as text, and then eval'd it on the frontend...

Re: Gitlab servers are being exploited in DDoS attacks

#89

Post by iratewizard »

dylan604 wrote: post #78
jdc wrote: post #73

Earlier quoted context omitted.

How much longer did said dev continue working there?

Fire the dev, or educate the dev. Sure, eval is just a sure sign of a lot of lack of understanding, but I'd hope for something less vile as eval would be a little more understanding that everyone learns something sometime

It's gross negligence of the dev is only a Javascript dev, but maybe understandable if it's just one of the three languages he uses regularly. I probably wouldn't fire, but I also can't imagine any of my devs doing that.

Re: Gitlab servers are being exploited in DDoS attacks

#90

Post by justin_oaks »

djbusby wrote: post #64
jeffbee wrote: post #56

Earlier quoted context omitted.

It's a perl program that evaluates untrusted strings it finds in user files. What exactly is your standard for "is hackjob"? It appears to be a complete piece of shit.

It's clearly not complete shit, else it wouldn't be used by literally millions of people/systems. ExifTool is so far away from shit that in fact it was chosen by a highly respected company with a very good team. A hackjob usually has less deploys than my own stuff (which, outside of Windows 2000 components, is less than a few millions)

Just because something is useful doesn't mean it's not a hackjob.

Just looks at how PHP got so popular. Clearly it was useful and thus became popular. I think it's hard to argue that it wasn't a hackjob when it first started.

Post reply on HN