7 ms·

Who makes their Jenkins instance world accessible!

by philipwhiuk 3y ago

albatross13 3y ago
Anyone setting up a honey pot. Half of 4chan posts are 3 letter agencies trying to bait people into violence.
- dmbche 3y ago
  But what's the trap here? Checking who downloads the file? I don't see how they can get any actionable info out of this
  - albatross13 3y ago
    1. post link to jenkins job in a 4chan thread relating to something nefarious 2. see who clicks it 3. now you have IP addresses of possibly nefarious people without needing to subpoena 4chan Something like that.
    - unethical_ban 3y ago
      Or any and every security researcher / infosec company?
    - ikiris 3y ago
      How to waste your time tracking down 20000 wanna be script kiddies?
      - malux85 3y ago
        No, but having a list of easy targets to pull from when your performance quotas get low could be useful (I wish I was joking)
      - imtringued 3y ago
        Here is how lawyers in Germany do it. They ask ISPs for the person behind the IPs (cough, cough, carrier grade NAT) and then they send cease and desist letters demanding 800€. If you sign their letter you are considered guilty but avoid further consequences, similar to a plea bargain. It only takes a dozen people having money and fearing court for this to be profitable. The lawyer doesn't want to go to court because that costs money, he just wants you to confess and get paid.
    - dmbche 3y ago
      I think we're safe, anyone being half serious would be using a good vpn hopefully, it's likely to be a lot of false positives I would guess!
      - revolvingocelot 3y ago
        >anyone being half serious would be behind seven proxies
    - rejectfinite 3y ago
      >3. now you have IP addresses of possibly nefarious people without needing to subpoena 4chan ahahah 4chan is almost as mainstream as Reddit. ahahahahahahaaaaaaa you really think they would waste time like this for IP addresses to "keep track of"
      - albatross13 3y ago
        Several people have been arrested based on 4chan posts recently, after 'threatening' a law enforcement official in florida. So...yes. Yes I do.
        rovolo 3y ago
        The "bait" this comment is referring to is that a Sheriff publicly denounced in a press conference a bunch of neo-nazi messaging spread around his town during a racecar event. https://www.jta.org/2023/04/27/united-states/a-florida-sheriff-is-on-the-warpath-against-neo-nazi-scumbags-who-want-him-dead https://www.jta.org/2023/04/27/united-states/a-florida-sheri... The sheriff's parents' house was swatted. These are the 4chan posts which were included in the various news articles. https://sports.yahoo.com/4chan-2-men-used-online-170958670.html https://sports.yahoo.com/4chan-2-men-used-online-170958670.h... > "It's too bad Mike Chitwood isn’t safe now that I'm planning to kill him. I'm going to shoot Mike Chitwood. I'm going to kill him by shooting him to death." > "Just shoot Chitwood in the head and he stops being a problem. They have to find a new guy to be the problem. But shooting Chitwood in the head solves an immediate problem permanently. Just shoot Chitwood in the head and murder him." https://www.clickorlando.com/news/local/2023/04/20/3rd-4chan-user-accused-of-threatening-to-kill-volusia-sheriff-mike-chitwood/ https://www.clickorlando.com/news/local/2023/04/20/3rd-4chan... > “I WILL KILL CHITWOOD, MARK MY WORDS.”
        rejectfinite 3y ago
        Yes for specific threatening posts. You cannot see a difference, I guess?
        3y ago
    - deleted 3y ago
      [deleted]
- henning 3y ago
  Do not attribute to NSA conspiracy what can more simply be explained by the company being fucking stupid and not caring about walking the walk of infosec
  - albatross13 3y ago
    [flagged]
    - b800h 3y ago
      Odd, what was particularly boomerish about that comment?
- doodlesdev 3y ago
  Or anyone else, such as aviation companies: https://maia.crimew.gay/posts/how-to-hack-an-airline/ https://maia.crimew.gay/posts/how-to-hack-an-airline/ Previously discussed here: https://news.ycombinator.com/item?id=34446673 https://news.ycombinator.com/item?id=34446673
sofixa 3y ago
Who still uses Jenkins? It's an abomination of an obsolete system that is just a pain to use, manage, maintain, setup, etc. while there are much better, more featured, easier to use and maintain alternatives out there. And it has been like this for close to ten years now. It should have been ripped out in favour of either the "native" CI/CD (e.g. GitLab CI if GitLab is used for VCS, GitHub Actions if GitHub, etc.) or a modern one like Drone/Concoure/etc. years ago in any place that isn't ~two decades behind (so legacy airlines and banks?).
- indigodaddy 3y ago
  “Who still uses Jenkins?” I think you may have perhaps misjudged just how entrenched Jenkins is in corp/enterprise.
  - x86_64Ubuntu 3y ago
    The older I get, the more systems I learn are only around because they've been around.
    - marginalia_nu 3y ago
      A lot of the time when old things are still around, it's not because through all the years nobody has had the idea to replace them, but because the benefit of replacing them hasn't at any point in history outweighed the hassle. This is true for X11 and this is true for the QWERTY layout. The benefit of switching must outweigh the enormous hassle of doing so. It's easy to find something that's a little bit better, but that's simply not good enough to merit a switch. Often they're around because when it comes around, they do a such a decent job and it's difficult to actually produce something that has that sort of advantage.
      - Miraste 3y ago
        X11 is finally, finally on the way out. I have a lot of gripes with Wayland, but the day I stop needing to dive into xrandr and figure out why the screen is rotated but the mouse coordinates aren't or some other 1990s level problem will be a happy one. QWERTY seems to be too embedded even for that, but I wonder if it gets closer to replacement the higher the percentage of software keyboards climbs vs physical ones.
insanitybit 3y ago
so many companies

Who makes their Jenkins instance world accessible!

albatross13 3y ago

Anyone setting up a honey pot. Half of 4chan posts are 3 letter agencies trying to bait people into violence.

dmbche 3y ago
But what's the trap here? Checking who downloads the file? I don't see how they can get any actionable info out of this
- albatross13 3y ago
  1. post link to jenkins job in a 4chan thread relating to something nefarious 2. see who clicks it 3. now you have IP addresses of possibly nefarious people without needing to subpoena 4chan Something like that.
  - unethical_ban 3y ago
    Or any and every security researcher / infosec company?
  - ikiris 3y ago
    How to waste your time tracking down 20000 wanna be script kiddies?
    - malux85 3y ago
      No, but having a list of easy targets to pull from when your performance quotas get low could be useful (I wish I was joking)
    - imtringued 3y ago
      Here is how lawyers in Germany do it. They ask ISPs for the person behind the IPs (cough, cough, carrier grade NAT) and then they send cease and desist letters demanding 800€. If you sign their letter you are considered guilty but avoid further consequences, similar to a plea bargain. It only takes a dozen people having money and fearing court for this to be profitable. The lawyer doesn't want to go to court because that costs money, he just wants you to confess and get paid.
  - dmbche 3y ago
    I think we're safe, anyone being half serious would be using a good vpn hopefully, it's likely to be a lot of false positives I would guess!
    - revolvingocelot 3y ago
      >anyone being half serious would be behind seven proxies
  - rejectfinite 3y ago
    >3. now you have IP addresses of possibly nefarious people without needing to subpoena 4chan ahahah 4chan is almost as mainstream as Reddit. ahahahahahahaaaaaaa you really think they would waste time like this for IP addresses to "keep track of"
    - albatross13 3y ago
      Several people have been arrested based on 4chan posts recently, after 'threatening' a law enforcement official in florida. So...yes. Yes I do.
      - rovolo 3y ago
        The "bait" this comment is referring to is that a Sheriff publicly denounced in a press conference a bunch of neo-nazi messaging spread around his town during a racecar event. https://www.jta.org/2023/04/27/united-states/a-florida-sheriff-is-on-the-warpath-against-neo-nazi-scumbags-who-want-him-dead https://www.jta.org/2023/04/27/united-states/a-florida-sheri... The sheriff's parents' house was swatted. These are the 4chan posts which were included in the various news articles. https://sports.yahoo.com/4chan-2-men-used-online-170958670.html https://sports.yahoo.com/4chan-2-men-used-online-170958670.h... > "It's too bad Mike Chitwood isn’t safe now that I'm planning to kill him. I'm going to shoot Mike Chitwood. I'm going to kill him by shooting him to death." > "Just shoot Chitwood in the head and he stops being a problem. They have to find a new guy to be the problem. But shooting Chitwood in the head solves an immediate problem permanently. Just shoot Chitwood in the head and murder him." https://www.clickorlando.com/news/local/2023/04/20/3rd-4chan-user-accused-of-threatening-to-kill-volusia-sheriff-mike-chitwood/ https://www.clickorlando.com/news/local/2023/04/20/3rd-4chan... > “I WILL KILL CHITWOOD, MARK MY WORDS.”
        rejectfinite 3y ago
        Yes for specific threatening posts. You cannot see a difference, I guess?
        3y ago
  - deleted 3y ago
    [deleted]
henning 3y ago
Do not attribute to NSA conspiracy what can more simply be explained by the company being fucking stupid and not caring about walking the walk of infosec
- albatross13 3y ago
  [flagged]
  - b800h 3y ago
    Odd, what was particularly boomerish about that comment?
doodlesdev 3y ago
Or anyone else, such as aviation companies: https://maia.crimew.gay/posts/how-to-hack-an-airline/ https://maia.crimew.gay/posts/how-to-hack-an-airline/ Previously discussed here: https://news.ycombinator.com/item?id=34446673 https://news.ycombinator.com/item?id=34446673

sofixa 3y ago

Who still uses Jenkins? It's an abomination of an obsolete system that is just a pain to use, manage, maintain, setup, etc. while there are much better, more featured, easier to use and maintain alternatives out there. And it has been like this for close to ten years now. It should have been ripped out in favour of either the "native" CI/CD (e.g. GitLab CI if GitLab is used for VCS, GitHub Actions if GitHub, etc.) or a modern one like Drone/Concoure/etc. years ago in any place that isn't ~two decades behind (so legacy airlines and banks?).

indigodaddy 3y ago
“Who still uses Jenkins?” I think you may have perhaps misjudged just how entrenched Jenkins is in corp/enterprise.
- x86_64Ubuntu 3y ago
  The older I get, the more systems I learn are only around because they've been around.
  - marginalia_nu 3y ago
    A lot of the time when old things are still around, it's not because through all the years nobody has had the idea to replace them, but because the benefit of replacing them hasn't at any point in history outweighed the hassle. This is true for X11 and this is true for the QWERTY layout. The benefit of switching must outweigh the enormous hassle of doing so. It's easy to find something that's a little bit better, but that's simply not good enough to merit a switch. Often they're around because when it comes around, they do a such a decent job and it's difficult to actually produce something that has that sort of advantage.
    - Miraste 3y ago
      X11 is finally, finally on the way out. I have a lot of gripes with Wayland, but the day I stop needing to dive into xrandr and figure out why the screen is rotated but the mouse coordinates aren't or some other 1990s level problem will be a happy one. QWERTY seems to be too embedded even for that, but I wonder if it gets closer to replacement the higher the percentage of software keyboards climbs vs physical ones.

insanitybit 3y ago

so many companies