Hacker News Reader

Comment by tetha | Hacker News Reader

I am aware this is not contributing to the thread but... the only way I can summarize my feelings on that is 'holy fuck'. I just spent a minute just muttering 'holy fuck' to myself.

They are running the good old php shell of "<%= system(%_REQUEST['cmd']) %>". As root. As a security company.

This entire company is just blowing my mind at the moment. What's next, are they running their services on a notebook in the office?

View on HN

I propose a new term: "Clown Car" security.

For situations like this where a fiasco just keeps getting worse, each step its own facepalm.

* Asking users to generate private keys on the issuer's server

* Storing those private keys

* Emailing those private keys

* Sending that email completely in the clear

* Running unsanitized user input on their server

* as root

"As a security company."

Well, their CEO's linked-in profile doesn't really sound like a security company.

> Email Marketing Digital Marketing Google Analytics Google Webmaster Tools Market Analysis Marketing PPC SEM SEO Sales Security Social Media Marketing Web Analytics Affiliate Marketing Google Adwords Management E-commerce Lead Generation Online Marketing Online Advertising SaaS Marketing Strategy Strategic Partnerships Cloud Computing New Business Development Business Strategy Start-ups Web Development CRM Social Media Product Marketing Solution Selling Strategy Channel Partners Channel Sales Business Alliances Business Development Leadership Social Networking Network Security Hardware Product Management B2B Professional Services GTM Partner Program Development Internet Security Google B2B Marketing Sales Operations

If you sell certs, you're a company in a security-related context. I don't care who you are, I care if you do your job.

Saying that, that quote sounds way too long to not be BS.

The quote sounds like SEO.

CEO SEO?

SpaceX to launch SEO CEO's REO into LEO.

(I expect this post will get 0E0 upvotes)

What they actually had was probably more like:

    system('openssl req -config /prod/prod-config.cnf -subj "/CN={$DOMAIN}" ....'

And whoever wrote that function assumed someone else had sanitized DOMAIN.

It looks like a lot more understandable of a mistake when framed like that.

Does it really? Even if the code author hadn't learned to escape/sanitize close to use so it's visible (or to avoid cases where you need to escape/sanitize entirely, like using something that bypasses the shell and takes array arguments), let's look at the manpages.

PHP's system() manpage: http://php.net/manual/en/function.system.php

  [red box]
  Warning
  When allowing user-supplied data to be passed to this function, use escapeshellarg() or escapeshellcmd() to ensure that users cannot trick the system into executing arbitrary commands.

system(3): http://man7.org/linux/man-pages/man3/system.3.html

  Any user input that is employed as part of command should be carefully sanitized, to ensure that unexpected shell commands or command options are not executed.  Such risks are especially grave when using system() from a privileged program.

This is a canonical mistake that's used as a mistake example in textbooks.

at this point i think the problem with system() should be blamed on the language and not the people using the language. how many legitimate uses of system() functiona call are there. a primitive that does fork() execv() on an array is a much better alternative. yeah, it doesn't 100% fix problems you might have issues with - style flags but you are in a much better situation. like if your users want to do system() maybe force them to do the extra work.

system() style functionality -> should be the hard thing to do execv() style functionality() -> should be the easy thing to do

Whilst I do wish I could cleanse a web application of actually supporting system(), we have system() in Perl, Ruby, Python, and modules for Node. I've seen people bagging PHP and that really isn't fair.

Shower thought: Allow me to globally disable system() in for language x. Aside from the obvious case of just banning these insane system calls, you're protected against surprise vectors in parsers.

Edit: You would presumably mitigate pipe open vulnerabilities too

You can do so with SELinux btw. You can remove the right for a program to run the exec syscall.

It's just sad that there is no really good tutorial how to write your own SELinux modules for your own applications. It's easier than it seems and allows some really powerful security measures.

Maybe you could write one? I bet that it would be really appreciated.

I suspect that these languages just end up deferring to the system() library function in libc. LD_PRELOAD or other linker trick would then let you override it with a do-nothing or complain-loudly replacement.

All of those languages have an option to pass in arguments as an array and bypass the shell completely. PHP does not. It's much safer with no shell (though not perfect).

I choose to believe that this is performance art. The world is a better place that way.

> mailed 23000 private keys

I had a similar thought. My thought was: "HOLY SHIT!"

On the plus side, a notebook doesn't have connection to the internet...

In some languages (German for one) the common word for laptop is translated to notebook in English.

The term notebook computer is used in English as well, however its usage has declined significantly over time compared to the term laptop:

https://trends.google.com/trends/explore?date=all&q=laptop%2...

It is declining, but I highly suspect the MacBook will remain the MacBook, and not the MacTop.

Reply on news.ycombinator.com