4 ms·

I was thinking the same thing. Would it be feasible to hide dozens or even hundreds of small pieces of code that, when deployed enough times, operate together a

I was thinking the same thing. Would it be feasible to hide dozens or even hundreds of small pieces of code that, when deployed enough times, operate together as one large piece of malware. Say a few lines of code here that cause some memory to leak in a server context. A few over there that cause the server to occasionally reach out to some public destination and a few others that, if they should so happen to be reached out to will know the origin is poisoned and set in motion some sort of attack…it would be the opposite approach to highly targeted attacks. But, if we have tools that offer up code snippets then surely we’re going to have people blindly using them just through inexperience. So it seems plausible at least that it could act as an attack vector.

rnhmjoj 5y ago
Consider that a bunch of bad patches[1] introducing vulnerabilities have passed a strict reviewing process and made their way into the Linux kernel. I'd say there's a far more simple and effective way: just answer questions on StackOverflow by giving code with vulnerabilities (something that most novices aren't likely to notice) and look for them later in the wild. [1]: https://lore.kernel.org/lkml/YIV+pLR0nt94q0xQ@kroah.com/#r https://lore.kernel.org/lkml/YIV+pLR0nt94q0xQ@kroah.com/#r
- bostik 5y ago
  Considering StackOverflow rewards speed, and that most common questions fall into category of "how do I make thing X work?" - a good proportion of highly voted answers already come pre-loaded with vulnerabilities. And no, I'm not being snarky. I wish I was.
  - _notathrowaway 5y ago
    Please, post some examples.
    - bostik 5y ago
      -cracks knuckles- Coming from Google, top answer to inserting data with python+psycopg2: https://stackoverflow.com/questions/61861310/how-to-use-psycopg2-to-insert-data-into-a-postgres-database https://stackoverflow.com/questions/61861310/how-to-use-psyc... (no bound variables, straight up format string) Same route, this time asking about allowing requests between subdomains: https://stackoverflow.com/questions/11161526/cross-subdomain-requests https://stackoverflow.com/questions/11161526/cross-subdomain... (question specifies they "already use CORS: <star>" and nobody even comments on that) And let's not forget, PHP is still a thing: https://stackoverflow.com/questions/43497587/how-to-display-postgresql-search-results-using-php https://stackoverflow.com/questions/43497587/how-to-display-... (yep, user supplied input goes straight to SQL query string) --- All of the above were results of about 10 seconds of searching. Each one came from the first page of Google results - because let's be honest, that's what almost everyone cares about. To be fair, at least these days I can't find the "just use CORS=<star>" answers. They were bountiful two years ago, but maybe, just maybe, have been flagged as cataclysmically insecure since then. (EDIT: remove asterisks in CORS gripes)

rnhmjoj 5y ago

Consider that a bunch of bad patches[1] introducing vulnerabilities have passed a strict reviewing process and made their way into the Linux kernel. I'd say there's a far more simple and effective way: just answer questions on StackOverflow by giving code with vulnerabilities (something that most novices aren't likely to notice) and look for them later in the wild. [1]: https://lore.kernel.org/lkml/YIV+pLR0nt94q0xQ@kroah.com/#r https://lore.kernel.org/lkml/YIV+pLR0nt94q0xQ@kroah.com/#r

bostik 5y ago
Considering StackOverflow rewards speed, and that most common questions fall into category of "how do I make thing X work?" - a good proportion of highly voted answers already come pre-loaded with vulnerabilities. And no, I'm not being snarky. I wish I was.
- _notathrowaway 5y ago
  Please, post some examples.
  - bostik 5y ago
    -cracks knuckles- Coming from Google, top answer to inserting data with python+psycopg2: https://stackoverflow.com/questions/61861310/how-to-use-psycopg2-to-insert-data-into-a-postgres-database https://stackoverflow.com/questions/61861310/how-to-use-psyc... (no bound variables, straight up format string) Same route, this time asking about allowing requests between subdomains: https://stackoverflow.com/questions/11161526/cross-subdomain-requests https://stackoverflow.com/questions/11161526/cross-subdomain... (question specifies they "already use CORS: <star>" and nobody even comments on that) And let's not forget, PHP is still a thing: https://stackoverflow.com/questions/43497587/how-to-display-postgresql-search-results-using-php https://stackoverflow.com/questions/43497587/how-to-display-... (yep, user supplied input goes straight to SQL query string) --- All of the above were results of about 10 seconds of searching. Each one came from the first page of Google results - because let's be honest, that's what almost everyone cares about. To be fair, at least these days I can't find the "just use CORS=<star>" answers. They were bountiful two years ago, but maybe, just maybe, have been flagged as cataclysmically insecure since then. (EDIT: remove asterisks in CORS gripes)