5 ms·
This writeup doesn't really get to the point so, the tl;dr He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did
by mukyu 12y ago
This writeup doesn't really get to the point so, the tl;dr
He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did find had already been hit by someone using a perl script that made them join an irc channel that was being used as CnC. He also joined it and monitored it. A bunch of different yahoo boxes were in the channel and he saw some of them get rooted.
- deleted 12y ago[deleted]
- romanminkin 12y agoYou can also use this resource http://www.globalshellshock.com http://www.globalshellshock.com to check if your IP address is vulnerable to ShellShock.
- devindotcom 12y agoThe servers compromised were more like content servers though, not user data servers? Yahoo says no user data was accessed. But could the affected servers be used to more easily get at user databases from 'inside'?
- mathrawka 12y agoYahoo! keeps their user information mainly in a DB called 'UDB'... User Database. It is a key, value store and clients are only allowed to access permitted keys. So the encrypted user password, plain-text answers to 'secret questions' (for password rests), etc. were not accessed unless a login server was compromised. For the user's data for each property (games, mail, etc) they have their own data stores, and those would have been compromised for sure.
- thefreeman 12y ago> But could the affected servers be used to more easily get at user databases from 'inside'? short answer: yes, definitely.
- deleted 12y ago[deleted]
- maximumoverload 12y agoThanks. This guy writes a lot of text but it takes him forever to get to the point.
- deleted 12y ago[deleted]
- Gigablah 12y agoThe point was already in the article title and opening line.
- thefreeman 12y agoI think its important to mention the fact that he wasn't just looking for places to exploit shellshock. He was actively exploiting it by sending himself reverse shells from the computers. He wrote code to collect and exploit the reverse shells. He wrote code to spider sites to try to find more exploitable hosts. Then he was logging and exploring the infrastructure and servers he penetrated.
- stevenh 12y agoHis actions enabled him to cause damage if he chose, but it would be disingenuous for us to avoid examining his intent. The only evidence we have of his intent is that he warned the hosts who were vulnerable, and also warned the customers whose personal information and private emails may no longer be safe. If he had malicious intent as you imply, then I believe he would not have disclosed anything, let alone under his real name. He seems honest to a fault, loquacious to the point of legally endangering himself just to spread awareness of some horrible things he witnessed. In my opinion, spinning his actions as anything other than heroic is itself an order of magnitude more malicious than what you're claiming, because it contributes to a false narrative in which the end goal is to completely destroy another human being's life when he was just trying to help.
- pdabbadabba 12y agoI have mixed feelings about this. I think you're probably right that he did this with altruistic intent (or, at worst, just to satisfy his curiosity), and I hope he hasn't gotten himself into serious trouble. (Though I fear he may have.) But I hasten to add that intent is clearly not dispositive of whether it was OK for him to infiltrate someone else's system. Certainly ordinary physical property law makes is an offense to trespass regardless of whether you are trespassing with malicious intent. Certainly it is worse to break into a house intending to steal something than to walk into someone else's house out of curiosity, but neither is legal or, in my view, morally acceptable. So I say: good for him for making these breaches known, but he definitely should not have been in there poking around in the first place.
- 12y ago