4 ms·

Matasano hacked. A humbling lesson, even the pros are vulnerable.

52 points by olefoo 17y ago

jrockway 17y ago
Who cares? It's not like they wrote or consulted on whatever was hacked, and there isn't enough time in the day to write every piece of software you use from scratch. This is what you get for writing your OS in high-level assembly.
- jpierce420 17y ago
  Um...I assume you're speaking of Linux? Every major OS is written in C with a little asm. I think like one subsystem in Windows is in C++, but most of the code in every major OS is written in C. Which means your claim suggests that every major OS vendor is wrong, which is a very broad claim, my friend. Obviously C is best for the job.
viraptor 17y ago
I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way? They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done. (otherwise they would brag about it even more)
- ankp 17y ago
  What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest possible attack surface is exactly how you defend against an unknown problem, and there's literally no good reason (besides laziness) to leave sshd exposed to the public internet. Also they're "hacking" the frontend web server. Is that post really interesting in any way? They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done. (otherwise they would brag about it even more) Or, they simply didn't bother going further -- owning the front-end web server is fairly embarassing for a company like Matasano. Quite a few individuals store their credentials on front-end web servers, or even SSH to other servers from the front-end servers. Owning -any- server is often a very big deal.
  - sailormoon 17y ago
    "there's literally no good reason (besides laziness) to leave sshd exposed to the public internet." Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine. But yeah, for a "security" business .. it's pretty surprising they let it hang out like that. And on port 22 and the www domain, too .. tsk tsk.
    - pavs 17y ago
      Security is not supposed to be convenient. If there is an option between a convenient way to do something and an inconvenient (but much secure) way to do the same thing. You should do it the inconvenient way, specially if you make a living in security.
      - gchpaco 17y ago
        So I'm guessing you mail hard drives around, rather than use the net 'cause somebody might have cracked sshd or OpenSSL? Wait, you don't? Gee.
        jimmybot 17y ago
        I agree with your point, but I do want to point out that mail theft (by postal workers, errant receivers, and malicious thieves) is not so uncommon. I have had a few things mailed without tracking numbers that I strongly suspect were stolen (mailed from post offices with complaints of theft or undelivered mail).
      - khafra 17y ago
        If you're at home, running OpenBSD on your own computer, then security can be inconvenient as you want it. But if you run security for a business, you have to balance confidentiality and integrity with availability (and sometimes some other concerns). Shell access from the internet could be important to availability--obviously, this was the wrong way to do it, but it wasn't a wrong objective.
- olefoo 17y ago
  I'd agree that this is mostly a PR problem; but for a security company, having your public site hacked is somewhat embarrassing. But it is humbling, since this was probably set up much better than the average linux webserver. If these guys can still be vulnerable then noone can be confident. When it comes to computer security we are for the most part working with very poor tools and even less understanding when it comes to building systems that are both tractable and secure.
  - ahlatimer 17y ago
    No one should be confident. Given enough time and resources, practically any system will fall, typically due to human error (bad passwords being the biggest problem). I'd imagine more resources would be required to hack into a web server set up by a security company, but the rewards, in the form of publicity, for anti-sec are much greater. Anyone who believes they can have a "secure" system connected to the internet is largely kidding themselves. There are ways to minimize this risk, but there really isn't any way (as far as I'm aware) to completely eradicate it.
- there 17y ago
  If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). matasano isn't a firewall or antivirus company, their main business is code auditing and penetration testing. they are paid to find bugs in their customers' code before the "bad guys" do to minimize the risk of 0-day vulnerabilities. i know it's not practical for them to audit every line of code in every piece of software that their web server runs, but this type of attack looks much worse for this type of company than it probably would for any other. They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done. in the output posted on the site, one user has a bunch of zip files in his home directory with "playbook" in the name (playbook is their firewall revision control product). some "real harm" could come from this attacker distributing the source code to their product, if that is indeed what was in those files.
ddbb 17y ago
Who says it was a 0-day attack? Looking at the output,it seems they brute force the password of user adam... So yes, even the pros sometimes can make mistake.
- hachiya 17y ago
  They made it appear that the exploit somehow was able to determine that a user-level account with the name of adam existed. SSH shouldn't do this. Then they made it appear that they were able to log in as adam, and the logs don't make it look like a brute force. Then they made it appear that somehow privileges were elevated from adam to root, but did not provide any supposed log of how this was done.
  - olefoo 17y ago
    Well, the posted log, could be a complete fabrication. It certainly doesn't contain anything useful and may in fact be deliberately misleading. I'm hoping that Thomas and the rest of the crew do perform an intensive and public analysis of the exploit. It wouldn't surprise me if the break was in Wordpress or one of the other application level programs.
hachiya 17y ago
Since they are against disclosing vulnerabilities, it seems more likely that these intruders did not gain access through an unknown SSH exploit, but some other way. Once obtaining root, they could paste some proof of being on the system, and simply combine that with the top portion of their log which may be completely fabricated to appear as a 0-day exploit. Again, if there really is a SSH 0-day, why is an anti-disclosure group revealing one exists?
- devicenull 17y ago
  Saying that there is a vulnerability is nowhere close to revealing it. For example, I can say that Windows has a vulnerability allowing me to crash the system. If you are a Microsoft developer, does that information help you track down the issue? Not in the least, as you don't have any idea where to look
mcbarry 17y ago
That hurt to read.
deno 17y ago
My servers' SSH isn't publicly accessible, you first need to be logged in to VPN (OpenVPN). I don't why Matasano couldn't secure their system like this, especially that some "0-day SSH exploit" is circulating around web. And if you're paranoid (or security expert on war-path with whaddyacallthem anti-sec movement) you have even more simple ways to secure yourself - port knocking for example? Your system's security weakest link should be human not software.
- sfk 17y ago
  I don't quite understand. What if there is an exploit for OpenVPN?
  - khafra 17y ago
    First, a VPN would best be used as an additional layer of security for the whole network, not as a shell for one particular box. Second, a group very publically announced, by hacking imageshack, that they were going after full-disclosure security blogs. A little later, they warned that they had an ssh 0-day. The prudent thing for a full-disclosure security blog to do would be to put some additional security around their internet-facing ssh.
  - deno 17y ago
    It depends. If it's the same box and you can get root from exploiting OpenVPN than nothing. But if you are doing this correct - running OpenVPN on non-critical server that serves as entry point for the rest of the network than you just got yourself extra layer of security. It's like probability that there are two bombs on the plane. Well, my point is, why anyone would leave SSH open like that on critical server. Don't want to set up whole VPN or using things like port-knocking? Just configure your damn firewall to accept only connections from your IP. Wow, I mean, there's million things I can think of to minimize your risk from single ssh 0-day exploit and I'm not even sys admin.
kevingadd 17y ago
Why do people insist on giving these idiots the attention they want? There's nothing valuable or productive about their inane, impossible-to-read 'hack logs' and they're not encouraging any sort of useful discussion. It's just dick-waving, and it's stupid for people to continually post links to their latest escapades on sites like HN and reddit. I mean seriously. How can you feel good about linking to a thread that has tripe like this in it? "Death to the Jews, death to the whitehats. All parasites must be destroyed in kind!"

52 points by olefoo 17y ago

Who cares? It's not like they wrote or consulted on whatever was hacked, and there isn't enough time in the day to write every piece of software you use from scratch. This is what you get for writing your OS in high-level assembly.

jpierce420 17y ago
Um...I assume you're speaking of Linux? Every major OS is written in C with a little asm. I think like one subsystem in Windows is in C++, but most of the code in every major OS is written in C. Which means your claim suggests that every major OS vendor is wrong, which is a very broad claim, my friend. Obviously C is best for the job.

viraptor 17y ago

I disagree with the summary line completely... What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). Also they're "hacking" the frontend web server. Is that post really interesting in any way? They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done. (otherwise they would brag about it even more)

ankp 17y ago
What do you mean by "humbling lesson"? If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). The experts at Matasano should know better than to leave sshd internet-accessible. That's what is humbling, because exposing the smallest possible attack surface is exactly how you defend against an unknown problem, and there's literally no good reason (besides laziness) to leave sshd exposed to the public internet. Also they're "hacking" the frontend web server. Is that post really interesting in any way? They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done. (otherwise they would brag about it even more) Or, they simply didn't bother going further -- owning the front-end web server is fairly embarassing for a company like Matasano. Quite a few individuals store their credentials on front-end web servers, or even SSH to other servers from the front-end servers. Owning -any- server is often a very big deal.
- sailormoon 17y ago
  "there's literally no good reason (besides laziness) to leave sshd exposed to the public internet." Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine. But yeah, for a "security" business .. it's pretty surprising they let it hang out like that. And on port 22 and the www domain, too .. tsk tsk.
  - pavs 17y ago
    Security is not supposed to be convenient. If there is an option between a convenient way to do something and an inconvenient (but much secure) way to do the same thing. You should do it the inconvenient way, specially if you make a living in security.
    - gchpaco 17y ago
      So I'm guessing you mail hard drives around, rather than use the net 'cause somebody might have cracked sshd or OpenSSL? Wait, you don't? Gee.
      - jimmybot 17y ago
        I agree with your point, but I do want to point out that mail theft (by postal workers, errant receivers, and malicious thieves) is not so uncommon. I have had a few things mailed without tracking numbers that I strongly suspect were stolen (mailed from post offices with complaints of theft or undelivered mail).
    - khafra 17y ago
      If you're at home, running OpenBSD on your own computer, then security can be inconvenient as you want it. But if you run security for a business, you have to balance confidentiality and integrity with availability (and sometimes some other concerns). Shell access from the internet could be important to availability--obviously, this was the wrong way to do it, but it wasn't a wrong objective.
olefoo 17y ago
I'd agree that this is mostly a PR problem; but for a security company, having your public site hacked is somewhat embarrassing. But it is humbling, since this was probably set up much better than the average linux webserver. If these guys can still be vulnerable then noone can be confident. When it comes to computer security we are for the most part working with very poor tools and even less understanding when it comes to building systems that are both tractable and secure.
- ahlatimer 17y ago
  No one should be confident. Given enough time and resources, practically any system will fall, typically due to human error (bad passwords being the biggest problem). I'd imagine more resources would be required to hack into a web server set up by a security company, but the rewards, in the form of publicity, for anti-sec are much greater. Anyone who believes they can have a "secure" system connected to the internet is largely kidding themselves. There are ways to minimize this risk, but there really isn't any way (as far as I'm aware) to completely eradicate it.
there 17y ago
If anyone finds an unpatched flaw and uses it to exploit some servers, then it doesn't matter who takes care of the servers. It doesn't matter if it's ptacek or a random admin. It's a new, unknown problem (if the claim about a 0day is real). matasano isn't a firewall or antivirus company, their main business is code auditing and penetration testing. they are paid to find bugs in their customers' code before the "bad guys" do to minimize the risk of 0-day vulnerabilities. i know it's not practical for them to audit every line of code in every piece of software that their web server runs, but this type of attack looks much worse for this type of company than it probably would for any other. They didn't get to any sensitive information (or didn't publish it). They also didn't get into any personal system, so I doubt there was any real harm done. in the output posted on the site, one user has a bunch of zip files in his home directory with "playbook" in the name (playbook is their firewall revision control product). some "real harm" could come from this attacker distributing the source code to their product, if that is indeed what was in those files.

ddbb 17y ago

Who says it was a 0-day attack? Looking at the output,it seems they brute force the password of user adam... So yes, even the pros sometimes can make mistake.

hachiya 17y ago
They made it appear that the exploit somehow was able to determine that a user-level account with the name of adam existed. SSH shouldn't do this. Then they made it appear that they were able to log in as adam, and the logs don't make it look like a brute force. Then they made it appear that somehow privileges were elevated from adam to root, but did not provide any supposed log of how this was done.
- olefoo 17y ago
  Well, the posted log, could be a complete fabrication. It certainly doesn't contain anything useful and may in fact be deliberately misleading. I'm hoping that Thomas and the rest of the crew do perform an intensive and public analysis of the exploit. It wouldn't surprise me if the break was in Wordpress or one of the other application level programs.

hachiya 17y ago

Since they are against disclosing vulnerabilities, it seems more likely that these intruders did not gain access through an unknown SSH exploit, but some other way. Once obtaining root, they could paste some proof of being on the system, and simply combine that with the top portion of their log which may be completely fabricated to appear as a 0-day exploit. Again, if there really is a SSH 0-day, why is an anti-disclosure group revealing one exists?

devicenull 17y ago
Saying that there is a vulnerability is nowhere close to revealing it. For example, I can say that Windows has a vulnerability allowing me to crash the system. If you are a Microsoft developer, does that information help you track down the issue? Not in the least, as you don't have any idea where to look

mcbarry 17y ago

That hurt to read.

deno 17y ago

My servers' SSH isn't publicly accessible, you first need to be logged in to VPN (OpenVPN). I don't why Matasano couldn't secure their system like this, especially that some "0-day SSH exploit" is circulating around web. And if you're paranoid (or security expert on war-path with whaddyacallthem anti-sec movement) you have even more simple ways to secure yourself - port knocking for example? Your system's security weakest link should be human not software.

sfk 17y ago
I don't quite understand. What if there is an exploit for OpenVPN?
- khafra 17y ago
  First, a VPN would best be used as an additional layer of security for the whole network, not as a shell for one particular box. Second, a group very publically announced, by hacking imageshack, that they were going after full-disclosure security blogs. A little later, they warned that they had an ssh 0-day. The prudent thing for a full-disclosure security blog to do would be to put some additional security around their internet-facing ssh.
- deno 17y ago
  It depends. If it's the same box and you can get root from exploiting OpenVPN than nothing. But if you are doing this correct - running OpenVPN on non-critical server that serves as entry point for the rest of the network than you just got yourself extra layer of security. It's like probability that there are two bombs on the plane. Well, my point is, why anyone would leave SSH open like that on critical server. Don't want to set up whole VPN or using things like port-knocking? Just configure your damn firewall to accept only connections from your IP. Wow, I mean, there's million things I can think of to minimize your risk from single ssh 0-day exploit and I'm not even sys admin.

kevingadd 17y ago

Why do people insist on giving these idiots the attention they want? There's nothing valuable or productive about their inane, impossible-to-read 'hack logs' and they're not encouraging any sort of useful discussion. It's just dick-waving, and it's stupid for people to continually post links to their latest escapades on sites like HN and reddit. I mean seriously. How can you feel good about linking to a thread that has tripe like this in it? "Death to the Jews, death to the whitehats. All parasites must be destroyed in kind!"