4 ms·
Everyone's coming up with hollywood style explanations (it's encryption! it's AI!) but as a former pentester, one of the more likely explanations is that it's p
by sillysaurusx 4y ago
Everyone's coming up with hollywood style explanations (it's encryption! it's AI!) but as a former pentester, one of the more likely explanations is that it's probably just looking for vulnerabilities in an automated way. The first thing you do when you get an account somewhere as a pentester is to try to stuff as many strings as possible into weird places just to see what happens.
I don't think automated techniques are very effective (or weren't in 2016) but it seems more likely to be vuln hunting than choosing your Wordpress blog for encrypted comms vs established places like Twitter.
EDIT: faizshah https://news.ycombinator.com/item?id=34866169 https://news.ycombinator.com/item?id=34866169 points out that https://perishablepress.com/block-random-string-comment-spam/ https://perishablepress.com/block-random-string-comment-spam... observes the same phenomenon, and the author notes that all of the IP addresses come from Russia. This seems to lend credence to the idea that it's looking for vulns, since, well, lots of traffic from Russia is looking for vulns.
- manmal 4y agoI wouldn’t post encrypted comm to Twitter because I‘d suspect they keep tight logs on my IP. A random blog probably wouldn’t.
- krageon 4y agoIf you have to worry about that, then the encrypted communication is just theater.
- CommitSyn 4y agoWordPress logs all comment IP addresses forever. That's what proxies are for.
- manmal 4y agoI guess you‘d need a MITM SSL proxy to mask your originating IP? That seems to be a bit complicated for this usecase, if Twitter uses certificate pinning? EDIT: I see now that I had a misconception here. There's no need for a MITM proxy in this case.
- LeonM 4y agoYes, most vuln scanners/exploits will inject random strings, then scrape the website looking for those strings, to see if injection is successful.
- throw0101c 4y ago> I don't think automated techniques are very effective (or weren't in 2016) Aren't the things that Tenable/Rapid7/etc do when scanning the network automated testing (techniques)? They seem effective at finding stuff. Or Metasploit.
- bluedino 4y agoI know at least sometimes they just do a simple check of the version of a service and report off that. We've issued vendor-supplied hotfixes that don't update the version number, and even though the software is patched, scanning tools will still report that it's vulnerable.
- nibbleshifter 4y agoBack ported fixes in certain distros are a nightmare when doing vuln management. "Scanner says its a vulnerable version based on the version number" "Well, its up to date... Fix is back ported..." Imagine having this argument, over dozens of tickets, every $time_interval. Its no wonder actual critical issues go unfixed.
- a2tech 4y agoYes. RedHat/CentOS/other LTS OSes are a nightmare for vulnerability scanning. I should say it's a bonanza for the security contractors and a nightmare for those of us that actually deal with it. So many pencil pushers throwing fits when you reply to the hundreds of vulnerability tickets with 'vendor back ported fix'. Also see PCI compliance.
- the-mitr 4y agook, thanks for the explanation.
- nibbleshifter 4y agoAutomated vuln scanning seems to wax and wane in utility. I tend to use a lot of them to augment my work. Automated web app scanners tend to lag heavily behind the current "trends" in web development - for example, only recently did BurpSuite start properly supporting auditing single page apps, and it still misses loads of shit. Fuck, almost none of them can handle OpenAPI or Swagger specs properly, let alone WSDL files. Handling complex authentication flows is still a nightmare, and almost none of the commercial scanner offerings have ways to "hook" or "trace" the app under test.
- zenexer 4y agoWhile that’s possible, I don’t think that’s what’s happening here. This looks exactly like the behavior of an email burying attack (https://news.ycombinator.com/item?id=34868298 https://news.ycombinator.com/item?id=34868298). Notice that the email addresses appear legitimate. Vulnerability scanners don’t use email addresses like those. One of those emails shows up in HIBP, indicating that it probably belongs to a real person.
- _8j50 4y agoIt can't be what you say because there is no variance between posts.