15 ms·

Yahoo Hacked

722 points by doctorshady 12y ago

rkrkrk21 12y ago
So when is Marissa Mayer's getting fired?
sz4kerto 12y ago
http://webcache.googleusercontent.com/search?q=cache:I8s8KmZhwXMJ:www.futuresouth.us/yahoo_hacked.html+&cd=1&hl=en&ct=clnk&client=firefox-a http://webcache.googleusercontent.com/search?q=cache:I8s8KmZ... futuresouth.us got Hacker News'd this morning.
seren 12y ago
This is a courageous disclosure since the OP risks to be in some trouble for his "ethical probing".
- thefreeman 12y ago
  I am pretty surprised he didn't disclose it anonymously to be honest.
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
- daveloyall 12y ago
  In the winzip email, he rambles about his mother. Which makes his signature line pretty interesting. :) > A fool learns only from himself. A wise man will learn from the fool. So he's got this 'honest fool' thing going for him. If he can marry that with meticulous record keeping, maybe he'll be OK. Of course, IANAL. But ffs, I'm sick of this world where the defense "Wait, you misunderstand--I'm the GOOD guy!" isn't good enough. Why isn't it?
  - antimagic 12y ago
    Well, mostly because if it was good enough, it would be the first thing out of the mouth of every blackhat that was caught... Or to put it in a slightly more nuanced fashion, as a blackhat I could compromise your system, and then turn around and inform you that your system was being compromised whilst at the same time profiting from any data I had already stolen. If the company being contacted does not personally know the person contacting them, it is not altogether unreasonable to treat the person with great suspicion. That said, people that do have a public reputation for white-hat work probably deserve to get a pass. This of course raises the question of how you go about getting a whitehat reputation, because most whitehats get their rep by doing the same things the blackhats do, without the profit motive.
    - daveloyall 12y ago
      Well, every time I've gone vigilante, I've logged the ever lovin' shit out of myself, just in case. Nothing interesting ever happened, though. There was one time when I used a CnC channel to issue uninstall commands against a couple hundred bots. That was only after trying to contact a user or two to suggest that they uninstall the malware themselves... Those conversations went SO poorly! :) Anyway, the only way to find a user's contact information via a piece of malware like that is arguably an invasion of privacy... Which brings us full circle. Could we establish a metric for Good Samaritanism? Could we design a metric that is restrictive enough to prevent misuse but inclusive enough to allow unrequested, benevolent cleaning and patching?
    - AnthonyMouse 12y ago
      > Or to put it in a slightly more nuanced fashion, as a blackhat I could compromise your system, and then turn around and inform you that your system was being compromised whilst at the same time profiting from any data I had already stolen. Which provides a perfectly reasonable way to distinguish the white hat from the black hat. The black hat is the one making fraudulent charges to stolen credit cards, or selling social security numbers, etc.
      - antimagic 12y ago
- alvarosm 12y ago
  courageous? ethical probing? lol. Obviously he just wants free publicity. Pretty stupid move overall, notifying the fbi and all... unbelievable. And his crappy web server where he brags about it all is down by now too, so much for the free publicity.
rdl 12y ago
I wonder what best practice is for consumer websites which have domains like yahoo.com which has mostly customers, and yahoo-inc.com for corporate, for things like security@ addresses. It's reasonable someone wouldn't know about yahoo-inc.com.
- toomuchtodo 12y ago
  BCP is for domains to have abuse@, which for Yahoo.com should be tied into their corporate security and intelligence group. https://www.ietf.org/rfc/rfc2142.txt https://www.ietf.org/rfc/rfc2142.txt
chaostheory 12y ago
Is this a new phenomenon? I always felt that Yahoo's systems weren't secure. Until I shut down my Yahoo accounts, it would be a semi-regular occurrence for both my Yahoo email and IM to send out spam to everyone in my Yahoo contacts list. Am I wrong? I've since shut down my account since I got sick of dealing with it.
- rll 12y ago
  That's not a Yahoo hack though. When that happens it is almost always your local machine that has been breached by a virus which simply reads the locally stored contact list. And to answer your question, no, it is not a regular occurrence for Yahoo, or any of the major players, to have their servers hacked.
  - chaostheory 12y ago
    To my knowledge, my machine is secure. It wasn't Windows and I had both anti-virus and a firewall active. For one thing, what made this strange was that I haven't even logged into Yahoo for months (probably close to a year) when this happened, repeatedly.
    - nitrogen 12y ago
      Another possible explanation is password reuse on a site that was breached.
      - chaostheory 12y ago
        I don't reuse my passwords.
    - danielweber 12y ago
      Could also be password guessing; lots of people use the "common word + number" pattern for their Yahoo! passwords.
      - 12y ago
acostoss 12y ago
Server seems to be having trouble keeping up with all the requests, so in the meantime please use the Google's Cache[1] of the page [1]: http://webcache.googleusercontent.com/search?q=cache:http://www.futuresouth.us/yahoo_hacked.html http://webcache.googleusercontent.com/search?q=cache:http://...
Nyr 12y ago
Mirror of the response, since the site is loading really slow: http://cl.ly/image/2E3D2H2B2d2t http://cl.ly/image/2E3D2H2B2d2t
- pit 12y ago
  Classic. "Thanks for pointing out this insanely serious issue, which is unfortunately not eligible for our bug bounty program." Maybe they'll send him a free hat.
  - sdfghhasdf 12y ago
    lol, dudes going to prison. He ain't getting no hat...
  - icelancer 12y ago
    Embarrassing. People should just sell their zero-days on the black market for BTC until these companies wise up on paying out on "non-qualifying" bugs. Facebook has done this too.
- imaginenore 12y ago
  "Yeah, this major bug you told us about, not eligible." Fk Yahoo, they deserve what's happening to them.
- atmosx 12y ago
  Sorry but if this is not I wonder what is? A remote OpenSSH root exploitation technique or a CSS3 misconfiguration (smiley doesn't display on all browsers), can't believe this.
sauere 12y ago
They got owned by shellschock? Common Yahoo, really?
madaxe_again 12y ago
Not mentioned in the title, but important: Winzip.com has been hacked as well. Do not trust their binaries. Either this will be headline news tomorrow, or it will be suppressed in its entirety. The OP will probably go to prison, unfortunately, as they will not differentiate between this and black hat intrusion - the case will be judged by someone who saw his nephew using a computer, once, and they will go after him, because they know who he is, and will not have any joy identifying the actual intruders, and this will just go further to demonstrate that the spy agency dragnets are as useful as a chocolate teapot in preventing and acting against actual crime. I hope he contacted a great defence attorney and the ACLU at the same time as Yahoo and the FBI.
- philjohn 12y ago
  TIL - people still use WinZip
  - ssw1n 12y ago
    This ...
  - Someone1234 12y ago
    It is surprising how many 90s tools remain popular today: WinZip, WinRar, WinAmp, CCleaner, Icq, Real Player, etc. People just get into using something and simply never stop. Then there's the comfort barrier to switching (e.g. I know how to use WinZip but 7Zip is new and unfamiliar). CCleaner is still popular with low level tech support types, which is quite ironic as it damages the Windows Registry on later versions of the OS. There is also built in tools (Disk Cleaner, Recycling Bin maximum size, auto-Defrag/Trim, etc) which accomplish most of the same things. Teachers use Real Player. Several nationalities (Russia?) use ICQ.
    - sdegutis 12y ago
      To this day I can't figure out how ICQ ever became popular, but yes I can vouch that there are still people who use it and probably always will.
deleted 12y ago
[deleted]
- meritt 12y ago
  No. He CC'd them.
onewaystreet 12y ago
This guy works in the security industry and yet he couldn't google "yahoo security" to find their security contact email address (second result for me)? He was also unaware that Yahoo runs a Bug Bounty Program?
- RyanZAG 12y ago
  Well.. you didn't read the first couple lines? Notably: > I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration, but in my eyes, they really aren’t seeing the severity and danger of this situation, and really are not reacting quick enough. > This document is being released due to several high profile companies being infiltrated using the recent Shellshock vulnerability, and what I have deemed as an improper response, or lack thereof ... Seems pretty straight forward: hackers have already downloaded all the personal data out of these organizations and are probably using it in ways harmful to the general public already. This guy is forgoing his probable bug bounty payouts as this is, as he says, a really serious issue. Thank you to him!
  - onewaystreet 12y ago
    Looks like you only read the first couple lines. What I'm referring to: > I’ve also emailed Marissa Mayer and contacted her via twitter, both of which yielded zero results and no response. There are no publicly available contact methods for Yahoo! that have yielded any luck with trying to contact them regarding this.
    - panopticon 12y ago
      I think the "that have yielded any luck" part of that quote is pretty important.
      - onewaystreet 12y ago
        The point I'm making is that he didn't do the obvious thing and search for their actual security report address which they have, respond to, and pay people money who report bugs to. He found the hacked servers by doing a search but couldn't do this?
r721 12y ago
"Though the FBI seemed intrigued by this, in my opinion, they aren’t moving with any form of haste." I am doubtful that FBI would share their plans and/or actions with OP.
- jlgaddis 12y ago
  Exactly. It's not like they're going to call up the OP to give him status updates.
- skeletonjelly 12y ago
  Maybe it's implied due to the lack of correspondence (follow up questions)
mukyu 12y ago
This writeup doesn't really get to the point so, the tl;dr He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did find had already been hit by someone using a perl script that made them join an irc channel that was being used as CnC. He also joined it and monitored it. A bunch of different yahoo boxes were in the channel and he saw some of them get rooted.
- deleted 12y ago
  [deleted]
- romanminkin 12y ago
  You can also use this resource http://www.globalshellshock.com http://www.globalshellshock.com to check if your IP address is vulnerable to ShellShock.
  - kbar13 12y ago
    IP addresses are not vulnerable to ShellShock
    - diminoten 12y ago
      The services running on the machine assigned your IP address? I knew what he meant...
    - jerf 12y ago
      More importantly, while a casual scan of a website that shows a "Yes" is bad, a "No" doesn't prove much. Update bash.
- devindotcom 12y ago
  The servers compromised were more like content servers though, not user data servers? Yahoo says no user data was accessed. But could the affected servers be used to more easily get at user databases from 'inside'?
  - 12y ago
deleted 12y ago
[deleted]
benmmurphy 12y ago
Mass scanning using ping back for shell shock was controversial. Starting a remote shell would seem to cross the line.
mrt0mat0 12y ago
Am I the only one that thinks this kind of thing would be cool to see? I've seen logs of attacks, but I've never watched a botnet irc live. that would be crazy for me. Not really moving the conversation forward, but is this so commonplace that I'm the odd man for marveling?
- tokenizerrr 12y ago
  To be honest, it's not that interesting. If it's a well configured irc host then you will not be seeing any of the other bots, and all you will occasionally see is a command coming by from a generically named operator. Some botnet irc's are lazily configured, and will let you see all of the other bots as part of the channel, but generally will not let you speak. The bots usually have nicknames built from the host's computer name, username, country, etc. It's interesting, but in itself is not that exciting in my opinion.
- daveloyall 12y ago
  :) You're not the only one. First, read this. Note the date. http://www.crime-research.org/library/grcdos.pdf http://www.crime-research.org/library/grcdos.pdf I read that shortly after it was originally published. And I thought to myself: COOL! I was seventeen. I had a spare Windows 95c (or was it 98se?) box laying around, and some experience with inctrl5, a linux box which could operate as a router, and some basic knowledge of tcpdump(1). Importantly, I could also script the behavior of an IRC client. At the time I was a channel operator in a relatively popular IRC channel on EFnet... "Don't ask to ask!" :) Users would come in and request assistance with malware all the time, so I was already roughly familiar with the mechanisms of infection and CnC. This is a long story that I must cut short: I ended up in the same CnC room as Gibson did. Not the same type--the same one. I met some of the people in the story. :D
  - na85 12y ago
    Do you still idle in that help channel?
    - daveloyall 12y ago
gopalv 12y ago
Frick. A .pl CGI script on a production box? All the yapache & yphp security fixes and is all undone by a a .pl with +ExeCGI. They used to run "crack days" where all of us used to get kicks out of breaking & entering prod, whatever means available. Was a fun way to weed through such low-hanging issues, by a highly motivated (i.e otherwise bored) crowd. I wonder if they still have them.
- discardorama 12y ago
  I think therein lies the problem: yapache. It's their own version of (modified) Apache. So when these bugs like shellshock come out, it's harder to patch your own home-grown version.
  - jmathai 12y ago
    Not sure that's the problem though. yapache and yphp solve a very important need and probably saved Yahoo!'s ass on multiple occasions with engineers making lazy or common mistakes. There might have been a better way to implement it but with a company the size of Yahoo! I think they'd have the resources to maintain/patch such critical flaws. So the idea of a home-grown (really it's more of a patched version of apache / php than anything else) isn't entirely crazy. Just looks like this one slipped through the cracks.
    - monokrome 12y ago
      The idea of still using Apache / PHP nowadays is pretty crazy if you ask me.
      - sudowhodoido 12y ago
        I could say the same about most of the supposed superior replacements. Everything is dangerous in the hands of idiots. The technology is almost entirely irrelevant to the discussion.
      - jmulho 12y ago
        Half the world must be crazy. What is better and why?
markbnj 12y ago
A pretty interesting read, despite the occasionally challenging style. If the email to Mayer had been a little more focused then perhaps it might have punched through. But in any case, kudos to the author for doing the work and writing it up. I learned a few things. But at the same time, no kudos for using what might be the most unfortunate metaphor ever. I suggest avoiding any future attempts at picturesque description.
abjorn 12y ago
Wow, Lycos is still around?
milankragujevic 12y ago
Here's a much shorter version that explains things in a less technical way... http://milankragujevic.com/post/65 http://milankragujevic.com/post/65
deleted 12y ago
[deleted]
personjerry 12y ago
Why is this a link to a cached version of the website?
- personjerry 12y ago
  Ah nevermind, found the answer below. The site had problems handling HN traffic earlier.
  - JonathanDHall 12y ago
    Actually, the site was DDoS'ed profusely, and also slammed with attempts testing it for the Shellshock vulnerabilities.
primitivesuave 12y ago
Why didn't he use Shellshock to update bash on the vulnerable servers?
- eyeareque 12y ago
  That would be illegal, unfortunately. If we could do that the internet would be a much cleaner place for sure.
  - alvarosm 12y ago
    What he's been doing is illegal too anyway...
secalex 12y ago
Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions. Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock. Three of our Sports API servers had malicious code executed on them this weekend by attackers looking for vulnerable Shellshock servers. These attackers had mutated their exploit, likely with the goal of bypassing IDS/IDP or WAF filters. This mutation happened to exactly fit a command injection bug in a monitoring script our Sports team was using at that moment to parse and debug their web logs. Regardless of the cause our course of action remained the same: to isolate the servers at risk and protect our users' data. The affected API servers are used to provide live game streaming data to our Sports front-end and do not store user data. At this time we have found no evidence that the attackers compromised any other machines or that any user data was affected. This flaw was specific to a small number of machines and has been fixed, and we have added this pattern to our CI/CD code scanners to catch future issues. As you can imagine this episode caused some confusion in our team, since the servers in question had been successfully patched (twice!!) immediately after the Bash issue became public. Once we ensured that the impacted servers were isolated from the network, we conducted a comprehensive trace of the attack code through our entire stack which revealed the root cause: not Shellshock. Let this be a lesson to defenders and attackers alike: just because exploit code works doesn’t mean it triggered the bug you expected! I also want to address another issue: Yahoo takes external security reports seriously and we strive to respond immediately to credible tips. We monitor our Bug Bounty (bugbounty.yahoo.com) and security aliases (security@yahoo.com) 24x7, and our records show no attempt by this researcher to contact us using those means. Within an hour of our CEO being emailed directly we had isolated these systems and begun our investigation. We run one of the most successful Bug Bounty programs in the world and I hope everybody here will participate and help us keep our users safe. We’re always looking for people who want to keep nearly a billion users safe at scale. paranoids-hiring@yahoo-inc.com
- robertgraham 12y ago
  I've long had experience with: exploits working for the wrong reason, and also the reverse, failing for the wrong reason. For example, way back in the day before ISS bought my company, somebody claimed their IDS was vulnerable to an IMAP evasion. They actually weren't, but that specific test triggered a wholly separate (and much worse) bug that made it look like it was evadable. I laughed and laughed.
deleted 12y ago
[deleted]
JonathanDHall 12y ago
I urge you all to please take the following in to consideration: http://www.futuresouth.us/wordpress/?p=25 http://www.futuresouth.us/wordpress/?p=25 However unorthodox my method may be of getting my point across, you can't deny that everything there makes sense. Cheers, Alex.

722 points by doctorshady 12y ago

So when is Marissa Mayer's getting fired?

http://webcache.googleusercontent.com/search?q=cache:I8s8KmZhwXMJ:www.futuresouth.us/yahoo_hacked.html+&cd=1&hl=en&ct=clnk&client=firefox-a http://webcache.googleusercontent.com/search?q=cache:I8s8KmZ... futuresouth.us got Hacker News'd this morning.

seren 12y ago

This is a courageous disclosure since the OP risks to be in some trouble for his "ethical probing".

thefreeman 12y ago
I am pretty surprised he didn't disclose it anonymously to be honest.
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
daveloyall 12y ago
In the winzip email, he rambles about his mother. Which makes his signature line pretty interesting. :) > A fool learns only from himself. A wise man will learn from the fool. So he's got this 'honest fool' thing going for him. If he can marry that with meticulous record keeping, maybe he'll be OK. Of course, IANAL. But ffs, I'm sick of this world where the defense "Wait, you misunderstand--I'm the GOOD guy!" isn't good enough. Why isn't it?
- antimagic 12y ago
  Well, mostly because if it was good enough, it would be the first thing out of the mouth of every blackhat that was caught... Or to put it in a slightly more nuanced fashion, as a blackhat I could compromise your system, and then turn around and inform you that your system was being compromised whilst at the same time profiting from any data I had already stolen. If the company being contacted does not personally know the person contacting them, it is not altogether unreasonable to treat the person with great suspicion. That said, people that do have a public reputation for white-hat work probably deserve to get a pass. This of course raises the question of how you go about getting a whitehat reputation, because most whitehats get their rep by doing the same things the blackhats do, without the profit motive.
  - daveloyall 12y ago
    Well, every time I've gone vigilante, I've logged the ever lovin' shit out of myself, just in case. Nothing interesting ever happened, though. There was one time when I used a CnC channel to issue uninstall commands against a couple hundred bots. That was only after trying to contact a user or two to suggest that they uninstall the malware themselves... Those conversations went SO poorly! :) Anyway, the only way to find a user's contact information via a piece of malware like that is arguably an invasion of privacy... Which brings us full circle. Could we establish a metric for Good Samaritanism? Could we design a metric that is restrictive enough to prevent misuse but inclusive enough to allow unrequested, benevolent cleaning and patching?
  - AnthonyMouse 12y ago
    > Or to put it in a slightly more nuanced fashion, as a blackhat I could compromise your system, and then turn around and inform you that your system was being compromised whilst at the same time profiting from any data I had already stolen. Which provides a perfectly reasonable way to distinguish the white hat from the black hat. The black hat is the one making fraudulent charges to stolen credit cards, or selling social security numbers, etc.
    - antimagic 12y ago
alvarosm 12y ago
courageous? ethical probing? lol. Obviously he just wants free publicity. Pretty stupid move overall, notifying the fbi and all... unbelievable. And his crappy web server where he brags about it all is down by now too, so much for the free publicity.

rdl 12y ago

I wonder what best practice is for consumer websites which have domains like yahoo.com which has mostly customers, and yahoo-inc.com for corporate, for things like security@ addresses. It's reasonable someone wouldn't know about yahoo-inc.com.

toomuchtodo 12y ago
BCP is for domains to have abuse@, which for Yahoo.com should be tied into their corporate security and intelligence group. https://www.ietf.org/rfc/rfc2142.txt https://www.ietf.org/rfc/rfc2142.txt

chaostheory 12y ago

Is this a new phenomenon? I always felt that Yahoo's systems weren't secure. Until I shut down my Yahoo accounts, it would be a semi-regular occurrence for both my Yahoo email and IM to send out spam to everyone in my Yahoo contacts list. Am I wrong? I've since shut down my account since I got sick of dealing with it.

rll 12y ago
That's not a Yahoo hack though. When that happens it is almost always your local machine that has been breached by a virus which simply reads the locally stored contact list. And to answer your question, no, it is not a regular occurrence for Yahoo, or any of the major players, to have their servers hacked.
- chaostheory 12y ago
  To my knowledge, my machine is secure. It wasn't Windows and I had both anti-virus and a firewall active. For one thing, what made this strange was that I haven't even logged into Yahoo for months (probably close to a year) when this happened, repeatedly.
  - nitrogen 12y ago
    Another possible explanation is password reuse on a site that was breached.
    - chaostheory 12y ago
      I don't reuse my passwords.
  - danielweber 12y ago
    Could also be password guessing; lots of people use the "common word + number" pattern for their Yahoo! passwords.
    - 12y ago

acostoss 12y ago

Server seems to be having trouble keeping up with all the requests, so in the meantime please use the Google's Cache[1] of the page [1]: http://webcache.googleusercontent.com/search?q=cache:http://www.futuresouth.us/yahoo_hacked.html http://webcache.googleusercontent.com/search?q=cache:http://...

Nyr 12y ago

Mirror of the response, since the site is loading really slow: http://cl.ly/image/2E3D2H2B2d2t http://cl.ly/image/2E3D2H2B2d2t

pit 12y ago
Classic. "Thanks for pointing out this insanely serious issue, which is unfortunately not eligible for our bug bounty program." Maybe they'll send him a free hat.
- sdfghhasdf 12y ago
  lol, dudes going to prison. He ain't getting no hat...
- icelancer 12y ago
  Embarrassing. People should just sell their zero-days on the black market for BTC until these companies wise up on paying out on "non-qualifying" bugs. Facebook has done this too.
imaginenore 12y ago
"Yeah, this major bug you told us about, not eligible." Fk Yahoo, they deserve what's happening to them.
atmosx 12y ago
Sorry but if this is not I wonder what is? A remote OpenSSH root exploitation technique or a CSS3 misconfiguration (smiley doesn't display on all browsers), can't believe this.

sauere 12y ago

They got owned by shellschock? Common Yahoo, really?

madaxe_again 12y ago

Not mentioned in the title, but important: Winzip.com has been hacked as well. Do not trust their binaries. Either this will be headline news tomorrow, or it will be suppressed in its entirety. The OP will probably go to prison, unfortunately, as they will not differentiate between this and black hat intrusion - the case will be judged by someone who saw his nephew using a computer, once, and they will go after him, because they know who he is, and will not have any joy identifying the actual intruders, and this will just go further to demonstrate that the spy agency dragnets are as useful as a chocolate teapot in preventing and acting against actual crime. I hope he contacted a great defence attorney and the ACLU at the same time as Yahoo and the FBI.

philjohn 12y ago
TIL - people still use WinZip
- ssw1n 12y ago
  This ...
- Someone1234 12y ago
  It is surprising how many 90s tools remain popular today: WinZip, WinRar, WinAmp, CCleaner, Icq, Real Player, etc. People just get into using something and simply never stop. Then there's the comfort barrier to switching (e.g. I know how to use WinZip but 7Zip is new and unfamiliar). CCleaner is still popular with low level tech support types, which is quite ironic as it damages the Windows Registry on later versions of the OS. There is also built in tools (Disk Cleaner, Recycling Bin maximum size, auto-Defrag/Trim, etc) which accomplish most of the same things. Teachers use Real Player. Several nationalities (Russia?) use ICQ.
  - sdegutis 12y ago
    To this day I can't figure out how ICQ ever became popular, but yes I can vouch that there are still people who use it and probably always will.

deleted 12y ago

[deleted]

meritt 12y ago
No. He CC'd them.

onewaystreet 12y ago

This guy works in the security industry and yet he couldn't google "yahoo security" to find their security contact email address (second result for me)? He was also unaware that Yahoo runs a Bug Bounty Program?

RyanZAG 12y ago
Well.. you didn't read the first couple lines? Notably: > I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration, but in my eyes, they really aren’t seeing the severity and danger of this situation, and really are not reacting quick enough. > This document is being released due to several high profile companies being infiltrated using the recent Shellshock vulnerability, and what I have deemed as an improper response, or lack thereof ... Seems pretty straight forward: hackers have already downloaded all the personal data out of these organizations and are probably using it in ways harmful to the general public already. This guy is forgoing his probable bug bounty payouts as this is, as he says, a really serious issue. Thank you to him!
- onewaystreet 12y ago
  Looks like you only read the first couple lines. What I'm referring to: > I’ve also emailed Marissa Mayer and contacted her via twitter, both of which yielded zero results and no response. There are no publicly available contact methods for Yahoo! that have yielded any luck with trying to contact them regarding this.
  - panopticon 12y ago
    I think the "that have yielded any luck" part of that quote is pretty important.
    - onewaystreet 12y ago
      The point I'm making is that he didn't do the obvious thing and search for their actual security report address which they have, respond to, and pay people money who report bugs to. He found the hacked servers by doing a search but couldn't do this?

r721 12y ago

"Though the FBI seemed intrigued by this, in my opinion, they aren’t moving with any form of haste." I am doubtful that FBI would share their plans and/or actions with OP.

jlgaddis 12y ago
Exactly. It's not like they're going to call up the OP to give him status updates.
skeletonjelly 12y ago
Maybe it's implied due to the lack of correspondence (follow up questions)

mukyu 12y ago

This writeup doesn't really get to the point so, the tl;dr He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did find had already been hit by someone using a perl script that made them join an irc channel that was being used as CnC. He also joined it and monitored it. A bunch of different yahoo boxes were in the channel and he saw some of them get rooted.

deleted 12y ago
[deleted]
romanminkin 12y ago
You can also use this resource http://www.globalshellshock.com http://www.globalshellshock.com to check if your IP address is vulnerable to ShellShock.
- kbar13 12y ago
  IP addresses are not vulnerable to ShellShock
  - diminoten 12y ago
    The services running on the machine assigned your IP address? I knew what he meant...
  - jerf 12y ago
    More importantly, while a casual scan of a website that shows a "Yes" is bad, a "No" doesn't prove much. Update bash.
devindotcom 12y ago
The servers compromised were more like content servers though, not user data servers? Yahoo says no user data was accessed. But could the affected servers be used to more easily get at user databases from 'inside'?
- 12y ago

deleted 12y ago

[deleted]

benmmurphy 12y ago

Mass scanning using ping back for shell shock was controversial. Starting a remote shell would seem to cross the line.

mrt0mat0 12y ago

Am I the only one that thinks this kind of thing would be cool to see? I've seen logs of attacks, but I've never watched a botnet irc live. that would be crazy for me. Not really moving the conversation forward, but is this so commonplace that I'm the odd man for marveling?

tokenizerrr 12y ago
To be honest, it's not that interesting. If it's a well configured irc host then you will not be seeing any of the other bots, and all you will occasionally see is a command coming by from a generically named operator. Some botnet irc's are lazily configured, and will let you see all of the other bots as part of the channel, but generally will not let you speak. The bots usually have nicknames built from the host's computer name, username, country, etc. It's interesting, but in itself is not that exciting in my opinion.
daveloyall 12y ago
:) You're not the only one. First, read this. Note the date. http://www.crime-research.org/library/grcdos.pdf http://www.crime-research.org/library/grcdos.pdf I read that shortly after it was originally published. And I thought to myself: COOL! I was seventeen. I had a spare Windows 95c (or was it 98se?) box laying around, and some experience with inctrl5, a linux box which could operate as a router, and some basic knowledge of tcpdump(1). Importantly, I could also script the behavior of an IRC client. At the time I was a channel operator in a relatively popular IRC channel on EFnet... "Don't ask to ask!" :) Users would come in and request assistance with malware all the time, so I was already roughly familiar with the mechanisms of infection and CnC. This is a long story that I must cut short: I ended up in the same CnC room as Gibson did. Not the same type--the same one. I met some of the people in the story. :D
- na85 12y ago
  Do you still idle in that help channel?
  - daveloyall 12y ago

gopalv 12y ago

Frick. A .pl CGI script on a production box? All the yapache & yphp security fixes and is all undone by a a .pl with +ExeCGI. They used to run "crack days" where all of us used to get kicks out of breaking & entering prod, whatever means available. Was a fun way to weed through such low-hanging issues, by a highly motivated (i.e otherwise bored) crowd. I wonder if they still have them.

discardorama 12y ago
I think therein lies the problem: yapache. It's their own version of (modified) Apache. So when these bugs like shellshock come out, it's harder to patch your own home-grown version.
- jmathai 12y ago
  Not sure that's the problem though. yapache and yphp solve a very important need and probably saved Yahoo!'s ass on multiple occasions with engineers making lazy or common mistakes. There might have been a better way to implement it but with a company the size of Yahoo! I think they'd have the resources to maintain/patch such critical flaws. So the idea of a home-grown (really it's more of a patched version of apache / php than anything else) isn't entirely crazy. Just looks like this one slipped through the cracks.
  - monokrome 12y ago
    The idea of still using Apache / PHP nowadays is pretty crazy if you ask me.
    - sudowhodoido 12y ago
      I could say the same about most of the supposed superior replacements. Everything is dangerous in the hands of idiots. The technology is almost entirely irrelevant to the discussion.
    - jmulho 12y ago
      Half the world must be crazy. What is better and why?

markbnj 12y ago

A pretty interesting read, despite the occasionally challenging style. If the email to Mayer had been a little more focused then perhaps it might have punched through. But in any case, kudos to the author for doing the work and writing it up. I learned a few things. But at the same time, no kudos for using what might be the most unfortunate metaphor ever. I suggest avoiding any future attempts at picturesque description.

abjorn 12y ago

Wow, Lycos is still around?

milankragujevic 12y ago

Here's a much shorter version that explains things in a less technical way... http://milankragujevic.com/post/65 http://milankragujevic.com/post/65

deleted 12y ago

[deleted]

personjerry 12y ago

Why is this a link to a cached version of the website?

personjerry 12y ago
Ah nevermind, found the answer below. The site had problems handling HN traffic earlier.
- JonathanDHall 12y ago
  Actually, the site was DDoS'ed profusely, and also slammed with attempts testing it for the Shellshock vulnerabilities.

primitivesuave 12y ago

Why didn't he use Shellshock to update bash on the vulnerable servers?

eyeareque 12y ago
That would be illegal, unfortunately. If we could do that the internet would be a much cleaner place for sure.
- alvarosm 12y ago
  What he's been doing is illegal too anyway...

secalex 12y ago

Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions. Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock. Three of our Sports API servers had malicious code executed on them this weekend by attackers looking for vulnerable Shellshock servers. These attackers had mutated their exploit, likely with the goal of bypassing IDS/IDP or WAF filters. This mutation happened to exactly fit a command injection bug in a monitoring script our Sports team was using at that moment to parse and debug their web logs. Regardless of the cause our course of action remained the same: to isolate the servers at risk and protect our users' data. The affected API servers are used to provide live game streaming data to our Sports front-end and do not store user data. At this time we have found no evidence that the attackers compromised any other machines or that any user data was affected. This flaw was specific to a small number of machines and has been fixed, and we have added this pattern to our CI/CD code scanners to catch future issues. As you can imagine this episode caused some confusion in our team, since the servers in question had been successfully patched (twice!!) immediately after the Bash issue became public. Once we ensured that the impacted servers were isolated from the network, we conducted a comprehensive trace of the attack code through our entire stack which revealed the root cause: not Shellshock. Let this be a lesson to defenders and attackers alike: just because exploit code works doesn’t mean it triggered the bug you expected! I also want to address another issue: Yahoo takes external security reports seriously and we strive to respond immediately to credible tips. We monitor our Bug Bounty (bugbounty.yahoo.com) and security aliases (security@yahoo.com) 24x7, and our records show no attempt by this researcher to contact us using those means. Within an hour of our CEO being emailed directly we had isolated these systems and begun our investigation. We run one of the most successful Bug Bounty programs in the world and I hope everybody here will participate and help us keep our users safe. We’re always looking for people who want to keep nearly a billion users safe at scale. paranoids-hiring@yahoo-inc.com

robertgraham 12y ago
I've long had experience with: exploits working for the wrong reason, and also the reverse, failing for the wrong reason. For example, way back in the day before ISS bought my company, somebody claimed their IDS was vulnerable to an IMAP evasion. They actually weren't, but that specific test triggered a wholly separate (and much worse) bug that made it look like it was evadable. I laughed and laughed.

deleted 12y ago

[deleted]

JonathanDHall 12y ago

I urge you all to please take the following in to consideration: http://www.futuresouth.us/wordpress/?p=25 http://www.futuresouth.us/wordpress/?p=25 However unorthodox my method may be of getting my point across, you can't deny that everything there makes sense. Cheers, Alex.