4 ms·

His argument makes sense to me as to why that was needed, however if they want to take that stance, thats understandable, as is people being less likely to run

His argument makes sense to me as to why that was needed, however if they want to take that stance, thats understandable, as is people being less likely to run things down for them.

detaro 10y ago
If a shell was necessary, a better-secured one (e.g. requiring a signed command) would have been a good approach.
- eridius 10y ago
  Or even better, don't actually evaluate anything at all, just return a response indicating that the script could have chosen to evaluate the input if it wanted to.
- duskwuff 10y ago
  Yes. The Uber representative implied that a secure web shell would have been, at the very least, less objectionable: > we noticed that you placed an unauthenticated web shell into our web root (emphasis mine) That being said, I imagine a phpinfo(); or passthru("whoami"); would have been preferred.
  - i336_ 10y ago
    An earlier comment said "Although the system() PHP function didn't directly work..." so it would probably have been phpinfo(). Authenticating something like this is an interesting question though. Maybe make the php script filename a sha256, then make the query string another sha256, and possibly add a few more sha256 query keys that have to match more sha256 strings. Or maybe that's overkill. (I keep wondering about cryptographic cipher-based solutions...) As an aside, an attacker would have needed to know about the name `bugb.php`, which isn't an intuitive or easily guessable filename IMO, so there was a reasonable level of security-by-obscurity.
    - iamjason89 10y ago
      Since system() PHP function didn't directly work, do you think he would have been able to gain full access as he suggested?
      - i336_ 10y ago
        It would probably have required a bit of thought, but PHP can access databases, (presumably) alter files, and the like; so while full UNIX shell access might not have been possible, practically speaking PHP could have done a lot of damage on its own.
    - lsaferite 10y ago
      I've seen a colleague use a SHA1 hash as a filename to a phpinfo() script for sites as part of deployment. It's auto-generated for each instance and recorded for later use. While adding some additional layer, like a query param, would be even better, for read-only nature of the script it was deemed acceptable.
- brbsix 10y ago
  > a shell ... requiring a signed command Assuming you aren't referring to a SSH-2 implementation like OpenSSH, do you have any examples of something like this?

His argument makes sense to me as to why that was needed, however if they want to take that stance, thats understandable, as is people being less likely to run things down for them.

detaro 10y ago

If a shell was necessary, a better-secured one (e.g. requiring a signed command) would have been a good approach.

eridius 10y ago
Or even better, don't actually evaluate anything at all, just return a response indicating that the script could have chosen to evaluate the input if it wanted to.
duskwuff 10y ago
Yes. The Uber representative implied that a secure web shell would have been, at the very least, less objectionable: > we noticed that you placed an unauthenticated web shell into our web root (emphasis mine) That being said, I imagine a phpinfo(); or passthru("whoami"); would have been preferred.
- i336_ 10y ago
  An earlier comment said "Although the system() PHP function didn't directly work..." so it would probably have been phpinfo(). Authenticating something like this is an interesting question though. Maybe make the php script filename a sha256, then make the query string another sha256, and possibly add a few more sha256 query keys that have to match more sha256 strings. Or maybe that's overkill. (I keep wondering about cryptographic cipher-based solutions...) As an aside, an attacker would have needed to know about the name `bugb.php`, which isn't an intuitive or easily guessable filename IMO, so there was a reasonable level of security-by-obscurity.
  - iamjason89 10y ago
    Since system() PHP function didn't directly work, do you think he would have been able to gain full access as he suggested?
    - i336_ 10y ago
      It would probably have required a bit of thought, but PHP can access databases, (presumably) alter files, and the like; so while full UNIX shell access might not have been possible, practically speaking PHP could have done a lot of damage on its own.
  - lsaferite 10y ago
    I've seen a colleague use a SHA1 hash as a filename to a phpinfo() script for sites as part of deployment. It's auto-generated for each instance and recorded for later use. While adding some additional layer, like a query param, would be even better, for read-only nature of the script it was deemed acceptable.
brbsix 10y ago
> a shell ... requiring a signed command Assuming you aren't referring to a SSH-2 implementation like OpenSSH, do you have any examples of something like this?