4 ms·
My main impression was that this site was blurring the line between professional "Bulletin" and scare-mongering. > Even if you didn't notice any unexpected sym
by alexandercrohde 6y ago
My main impression was that this site was blurring the line between professional "Bulletin" and scare-mongering.
> Even if you didn't notice any unexpected symptoms, please: nuke and restart.
If I were writing this, I'd probably write something like "On May x, a remote-code-execution in (all versions?) public salt-masters (not minions?), was unveiled. Shortly thereafter, actual exploitation in the wild is being used. If your salt installation uses a salt-master, and it's internet-reachable, it may already be compromised, along with much your infrastructure. Section 2 is how to see if you are infected, and Section 3 is how to remove the infection."
- TheDong 6y ago> Section 2 is how to see if you are infected and Section 3 is how to remove the infection That's much worse. That implies there is a reliable way to detect and remove the infection. That's not the case. This website included some known attacks and such. There's a high chance that there were attacks of this vulnerability with additional payloads. There's no way to know if you were hit with a rootkit that persists itself in the bootloader or other parts of your system. There's no way to know if you were infected or not. The only way to be sure is to nuke the machine, as they said. Security advice should always err on the right side for a naive reader.