4 ms·

"This code is such a bad idea, I’ve intentionally introduced errors so it won’t even compile." I am stealing this line.

qahaz 5y ago
This was common back in the day with ezines. They would include codes to exploit security bugs in common software but they would have intentional errors so script kiddies couldn't compile them.
- commandlinefan 5y ago
  Seems like running it through a compiler and fixing the errors would address that for you, though…
  - behringer 5y ago
    Script kiddies can't debug.
    - DoctorDabadedoo 5y ago
      What is this mysterious art you speak of? /s
    - t-3 5y ago
      Really? Compiler error messages are downright friendly compared to networking tools and concepts. When I was 12, I certainly found them to be much easier, even though I completely failed to learn C, Perl, C++, or any of the other popular languages of the time.
  - thecupisblue 5y ago
    Exactly the idea. If you're a skiddie, you'll copy/paste, look for a minute, say it doesn't work. If you dive in, you gotta learn about the language, debugging it, the exploit itself and suddenly you're not a script kiddy anymore. It's like a leap of faith.
  - pgwhalen 5y ago
    The point is that script kiddies do not have the ability to do that.
- koofdoof 5y ago
  Are there any good ezines with content like this you could reccomend to read?
howdydoo 5y ago
Raymond Chen is a great writer. He writes about the driest topics on earth, but still manages to make it entertaining. Definitely one of my favorite blogs.
- shaklee3 5y ago
  he really is one of the best technical bloggers out there. I've learned a ton from his c++ articles.
- rightbyte 5y ago
  And he seems to be one of the few who bothers to keep up writing at MS devblogs. I wonder how it looks internally. Like, can anyone write there. Apart from a university I worked at management would never let me write any "blogs" about work related stuff.
raverbashing 5y ago
It will be interesting if this snippet lands on GitHub Autopilot (though it has important parts missing, even with the minor errors added)
jiggawatts 5y ago
I once replied to a flippant comment about the inherent reliability of the cloud with a two-line PowerShell script that would end any 100% cloud-hosted business if executed in the context of an admin account. As in: pack up everything, turn the lights off, lock the doors, and go home because the game is over. I deliberately obfuscated the script by replacing characters with various Unicode confusables, both the letters and the symbols. I still felt bad and ended up deleting the post. Hopefully nobody tried to type it in manually instead of cut & pasting just to see what would happen...
- stavros 5y ago
  What, like rm -rf?
  - jiggawatts 5y ago
    There are cloud-era equivalents that will do a heck of a lot more damage. Think bulk account/subscription deletion with a sprinkling of -force and -purge. Delete locks and the like will stop this… unless you bulk delete them first. The admins will get warning emails that they will finish reading in abject terror some time after their entire cloud tenant has gone to heaven. The modern equivalent of “Operating system not found” is “Click the guides below to get started with your new cloud account.”
  - justsomehnguy 5y ago
    https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Instance.html https://docs.aws.amazon.com/powershell/latest/reference/item... # this would wipe all EC2 instances, assuming you are authenticated and there is nothing else need to get a list of them Get-EC2Instance | Remove-EC2Instance -Force If there is a way to enumerate objects without explicitly specifying some properties then PS makes it very easy to pipe that output to remove or disable cmdlets. I never worked with AWS but if I needed to write such killer script I would kill instances (as in above example), remove all S3 objects (quite similar, Get-S3Object | Remove-S3Object) and finally wipe out all IAM roles and users (similar Get/Remove-IAMGroup, ..IAMUser etc). And thesubscription/account things, as @jiggawatts says, I'm just not familiar with the AWS lingo. And secrets/creds, of course. By the time a human starts to investigate why the monitoring gone mad (assuming it wasn't hosted with all other infra on same account, lol) there would be nothing to do, too many thing are gone already, too many things are on the way to be purged and even if they could be restored there would be too many things to tie it again to something resembling a functioning system.

This was common back in the day with ezines. They would include codes to exploit security bugs in common software but they would have intentional errors so script kiddies couldn't compile them.

commandlinefan 5y ago
Seems like running it through a compiler and fixing the errors would address that for you, though…
- behringer 5y ago
  Script kiddies can't debug.
  - DoctorDabadedoo 5y ago
    What is this mysterious art you speak of? /s
  - t-3 5y ago
    Really? Compiler error messages are downright friendly compared to networking tools and concepts. When I was 12, I certainly found them to be much easier, even though I completely failed to learn C, Perl, C++, or any of the other popular languages of the time.
- thecupisblue 5y ago
  Exactly the idea. If you're a skiddie, you'll copy/paste, look for a minute, say it doesn't work. If you dive in, you gotta learn about the language, debugging it, the exploit itself and suddenly you're not a script kiddy anymore. It's like a leap of faith.
- pgwhalen 5y ago
  The point is that script kiddies do not have the ability to do that.
koofdoof 5y ago
Are there any good ezines with content like this you could reccomend to read?

howdydoo 5y ago

Raymond Chen is a great writer. He writes about the driest topics on earth, but still manages to make it entertaining. Definitely one of my favorite blogs.

shaklee3 5y ago
he really is one of the best technical bloggers out there. I've learned a ton from his c++ articles.
rightbyte 5y ago
And he seems to be one of the few who bothers to keep up writing at MS devblogs. I wonder how it looks internally. Like, can anyone write there. Apart from a university I worked at management would never let me write any "blogs" about work related stuff.

raverbashing 5y ago

It will be interesting if this snippet lands on GitHub Autopilot (though it has important parts missing, even with the minor errors added)

jiggawatts 5y ago

I once replied to a flippant comment about the inherent reliability of the cloud with a two-line PowerShell script that would end any 100% cloud-hosted business if executed in the context of an admin account. As in: pack up everything, turn the lights off, lock the doors, and go home because the game is over. I deliberately obfuscated the script by replacing characters with various Unicode confusables, both the letters and the symbols. I still felt bad and ended up deleting the post. Hopefully nobody tried to type it in manually instead of cut & pasting just to see what would happen...

stavros 5y ago
What, like rm -rf?
- jiggawatts 5y ago
  There are cloud-era equivalents that will do a heck of a lot more damage. Think bulk account/subscription deletion with a sprinkling of -force and -purge. Delete locks and the like will stop this… unless you bulk delete them first. The admins will get warning emails that they will finish reading in abject terror some time after their entire cloud tenant has gone to heaven. The modern equivalent of “Operating system not found” is “Click the guides below to get started with your new cloud account.”
- justsomehnguy 5y ago
  https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Instance.html https://docs.aws.amazon.com/powershell/latest/reference/item... # this would wipe all EC2 instances, assuming you are authenticated and there is nothing else need to get a list of them Get-EC2Instance | Remove-EC2Instance -Force If there is a way to enumerate objects without explicitly specifying some properties then PS makes it very easy to pipe that output to remove or disable cmdlets. I never worked with AWS but if I needed to write such killer script I would kill instances (as in above example), remove all S3 objects (quite similar, Get-S3Object | Remove-S3Object) and finally wipe out all IAM roles and users (similar Get/Remove-IAMGroup, ..IAMUser etc). And thesubscription/account things, as @jiggawatts says, I'm just not familiar with the AWS lingo. And secrets/creds, of course. By the time a human starts to investigate why the monitoring gone mad (assuming it wasn't hosted with all other infra on same account, lol) there would be nothing to do, too many thing are gone already, too many things are on the way to be purged and even if they could be restored there would be too many things to tie it again to something resembling a functioning system.