5 ms·
That last paragraph is hard to argue with: Maybe this is our version of the "infinite monkeys" thing: given enough software people, enough computers, and eno
by mr-wendel 5y ago
That last paragraph is hard to argue with:
Maybe this is our version of the "infinite monkeys" thing: given enough software people, enough computers, and enough time, someone at a company will eventually grant universal remote root access to anyone who knows how to read some source code.
At one job, way back in the day, I had a dream that a shared web-hosting installer framework could give you root on whatever server hosted your stuff. Went to work the next day and indeed... it was true and trivially easy to exploit.
Sadly, it was a custom wallpaper upload feature that ended up being the actual source of shenanigans. You get 3 guesses on what happened and probably need just one.
- chucky_z 5y agotimthumb?
- mr-wendel 5y agoNope... a small almost mom'n'pop web hosting company.
- mewse 5y ago> You get 3 guesses on what happened and probably need just one. You.. quickly found the issue and patched it, and then balloons and streamers fell from the ceiling as the CEO strode over to shake your hand and pat you on the back and crack open a bottle of champagne to celebrate your promotion and give you a hefty performance bonus for saving the company and Dave Matthews played on the company’s sound system while everyone cheered for you and then when you finally left the celebration and went home you were tired and happy and newly wealthy and had become best friends with literally everyone at the company. …right?
- eecc 5y agoOr your boss’s secretary was pissed at you because they liked that background very much.
- teitoklien 5y agoExtra points if boss liked it too
- mr-wendel 5y agoPretty close, actually. It was Def Leppard playing "Pour Some Sugar On Me" though.
- lccarrasco 5y ago> You get 3 guesses on what happened and probably need just one. They had no validation on file type and you could upload & access a script that executed commands server-side?
- mr-wendel 5y agoBingo. It's really not pretty what can happen when you have a juicy target, plenty of time, and a perfect idea of how you can use it to your advantage. Fortunately they weren't at all malicious... just looking for ways to grow their little empire to play their war games and hopefully make some cash.
- ufo 5y agoI'm convinced that I'll eventually need a name for this inevitability. Rachel's Law of Root Exploits?
- dredmorbius 5y agoZawinski's law of software: "Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can." The corresponding law of enterprise software: "Every program expands to provide root access to any arbitrary entity."