Infosec company pwned by 4chan user

Uh, no, you just pick credentials from list in the repo config.

If you wanted to download additional repo in the jenkins script sure, but Jenkins Git plugin just accepts credential (whether its password or pub/priv key pair), just paste URL and select one from the list

“one out of N times” where N is < 2

Given the frequency with which I seem to update nokogiri on a rails instance, i assumed libxml2 would hold that award: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libxml2

But sure enough, jenkins FAR outweighs it: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jenkins

The most comedic mistake is to have a running jenking in 2023

Public facing AND without any sensible auth.

An externally accessible Jenkins instance is just asking to get pwned.

I worked for a company a couple years ago that had Jenkins running on a Windows EC2 with a bare public IP, no TLS, and a single set of admin credentials shared by everyone. Also, the host did double duty as some sort of DBA jump box and had every possible credential.

It was like in-defense in depth. I tried to explain how crazy it was. They weren’t interested in fixing it. I moved on.

Some companies just don’t care… soc 2 btw.

Why the heck would anyone create an externally accessible Jenkins?

Appears to be self-authored.

Perimeter security with firewalls didn't really come into vogue until the mid 1990s (post-Cheswick and Bellovin), so that seems like a pretty speedy adoption for a big agency.

Maybe because previous hacks have been of varying legality. The entrypoint for the airline hack was also Jenkins.

Maia also has enough going on with lawsuits from being honest in the past. Not taking credit for this one might be for the better...

Their antics have been of questionable legality, and I would assume they'd try to avoid drawing too much attention, given that this is the 3rd US-based company they're trying to hack, and the US just might ask for an extradition.

Further, the conclusion about Jenkins being the attack vector is drawn without much thought or explanation, and it is also interesting that they've used the same attack vector elsewhere.

>hello i am maia arson crimew (it/she) and i am gay, mostly for girls, and i'm a tiny kitten :3

Kind of seals it. I admire their brazenness.

Also this very submission https://crimew.gay/notice/AVWTkvCXna4Pca7OCm

(Unironically keep slaybossing, OP)

You cannot block Tor and VPNs. You can block known Tor and VPN ranges.

You can pay for 4chan and bypass the blocks: https://www.4channel.org/pass

Costs $20 per year and can be paid with various cryptocurrencies. Since 4chan keeps IP logs, this seems like a good deal for someone leaking company source code.

"Not as long as some musicals" - The Banner

A fitting domain for the famous B-29

But what's the trap here? Checking who downloads the file? I don't see how they can get any actionable info out of this

Do not attribute to NSA conspiracy what can more simply be explained by the company being fucking stupid and not caring about walking the walk of infosec

Or anyone else, such as aviation companies:

https://maia.crimew.gay/posts/how-to-hack-an-airline/

Previously discussed here:

https://news.ycombinator.com/item?id=34446673

“Who still uses Jenkins?”

I think you may have perhaps misjudged just how entrenched Jenkins is in corp/enterprise.

Oh they have come up with some new trash I have to learn? Great...

Say you were developing inn Angular and Python. Which one of these "alternatives" should I look in to? ie. Which is most requested by typical requiters?

People doing embedded testing use Jenkins still. Not that I would, but some people do.

jenkins is old and crusty, but it works and works well. if the UI for a build tool looks too fancy, my faith in it drops to 0 almost immediately.

What is a better alternative, if you want to self-host?

Why change something that mostly works fine? I don't like to change set of known issues for a set of unknowns.

Also those who want to avoid vendor lock in. Git repo might be moved around, do you like changing CI/CD scripts every time you change your git hosting service?

GHA work really well for simple stuff. For more complex in a larger organization there is no clear winner.

Is there an F/OSS alternative to Jenkins that I’m not aware of?

That's what you took away from the question?

Jenkins still lives in legacy, and probably will for some time.

Big companies with data restrictions that can't have anything so much as look at the cloud, and they don't have the skills or money to set up something nicer on prem.

Bitbucket is also a big part of this story.

That results in seeing Jenkins all over the ding-darn place at Boeing, LockMart, RC, L3, NGA, etc.

Of course, all that is thrown right out the window if you wire up the Jenkins instance to the goddamn internet.

People who have convinced their boss that GitHub downtime means they should create their own shoddy self-hosted CI platform.

Jenkins is one of those things you configure and forget about...until you need to do it again.

Over time, there's so much stuff that it does that replacing it is a ton of work. And by work I mean verification and communication. Many developers have no idea how stuff gets built, or how dependencies are managed in the build system. You forget one thing and the build is toast. Hunting this info down takes a ridiculous amount of time.

Now expand that to X number of projects, and you're looking at a year of work...and a delay while QA checks everything again.

For what?

Good luck getting that prioritized.

Switched from a company using Jenkins to one using GitLab CI, and while GitLab CI is obviously "better" in the sense that it has less historical baggage, there are actually quite a few things I'm missing. Jenkins has a plugin for pretty much every obscure thing you can imagine, which is a blessing for the user and a curse for the administrator, as Jenkins quickly becomes Frankenstein's monster. But every time I have to wade through tons of log ouput on GitLab I miss Jenkins' warnings plugin, every time no runner is picking up my job I miss the nice runner overview of Jenkins which quickly showed you what runners are actually busy with, and every time that old slow runner is grabbing all the jobs I miss the runner prioritization... I could go on here, but really, there's a lot of things that Jenkins could do through nifty plugins that GitLab CI cannot do yet. I even wrote one plugin myself for supporting our in-house Linter, really wasn't that difficult and you could hook into pretty much every little detail (which, again, can also be a curse because every plugin had the power to simply crash your Jenkins...).

EDIT: So to be clear, I'm not saying "Jenkins is better than GitLab". I would say GitLab CI is better designed, more robust and stable, but Jenkins is more configurable, extendable and has more features through it's plugin ecosystem. So personally, I wouldn't go back to Jenkins, but I also don't find it ridiculous that people still use it.

I like that with Jenkins you can use groovy, which gives you some extra power as far as writing commands is considered. You don't have to do everything via shell. Equivalent shell commands can be a bit messy sometimes.

It was a bit painful to write the same stuff in GitHub actions. Jira's groovy script made loops, storing variables very easy compared to GitHub actions' YAML.

Jenkins is still inherently more full-featured than anything that just runs random docker images and commands. Any replacement would need to do the hard work of actually integrating with a bunch of different language build tools in a deep way, and so far no-one's stepped up.

Builtin code coverage and test display (not just "your build failed") is still not a thing in Gitlab/Github CI

And that's like the fucking basic feature every CI/CD should have.

github has had service issues at least for the last 3 days.

Fun times.

Yes. I started a security company and received tons of award emails and conference invites that were all bullshit.

So ... same attack vector, you implying crimew might be this anonymous 4chinz user? Intriguing...

You would not have enjoyed the late 90s.

Oh man, never visit Tumblr

Oh my, assaulted? By that single blinking icon? I hope you're ok.

Have you tried Firefox Reader Mode? It renders this website (and a lot of others) without a lot of distractions.

I am in a similar age range and I am drifting towards this aesthetic. I think it's the counterculture of the increasingly sleek websites, with their overcomplicated 3D animations. Not saying either is better than the other, just it is the opposite end of the spectrum and way of still having fun when creating a website while making it feel personal.

it reminds me of the phenomena of parodying 'I Love Lucy!'. Even though it hasn't seen new episodes since 1957 it is included or mentioned in some way in nearly every popular media.

The constant revitalization of the parody through new works ensures that the future will also include some mention. I think 90s aesthetic/internet-culture is a bit like that -- the projects that include those themes beget new similar projects in the future as long as they have some level of audience exposure.

This is common among the younger people joining the internet. An the creator of SpaceHey.com was nostalgic for the days of old social media that happened when he was too young to experience it.

Add me if you have a SpaceHey account! https://spacehey.com/josh

>It's something I did, and it's neat yet strange to see it being done to a part of my past.

Agree. I read recently that digital cameras have been taking off among younger people in the way vinyl took off among millennials. I'm excited to see how people that grew up with excessive, toxic social media manage to find better solutions for dealing with the internet

I'm not a lot older than her and have a similar fondness for that æsthetic. While it's true I didn't fully experience it, a lot of late 90's sites were still online, more or less untouched, in the late 2000's, so they were there to be appreciated even though they were a relic by then. At that time, IE stagnation was still a thing, and MIDI playback was still in browsers, so the 2008 experience of a 1998 site was probably fairly authentic.

I feel this. It seems like somewhere I would have thrived and immensely enjoyed, and I hear people's nostalgia for it, but it's something I never got to experience myself. (~18yo).

I'm nostalgic for the Amiga despite being born in the late 90s!

You don't really have to know what specific year they were born in, the refusal to capitalize is a dead giveaway they did not experience that time at all. Anybody of that time period would be embarrassed to do so on a public site.

Kind of funny how we carry these different meanings to mostly meaningless things.

Was the author the girl that owned the TSA in the past year?

Live journal-esque.

FYI, the author uses it/she pronouns.

Until they flipped Sabu

I've seen owned plenty of times. "Owned a box" like that

pwn is a typo'd version of own, but since it's unambiguous it would have been better here

> The correct spelling in that case is pwned isn’t it? I got it from context, but those always felt like subtly different words to me.

For me owned was as in "CIA owned Crypto AG" not "netrunner owned the Chrome"

not that Chrome

Native speaker, and title confused me even being familiar with the whole owned/pwned thing. I clicked on the article simply because I was curious why being a 4chan-using sole proprietor would be at all interesting.

Ok, we've s/o/p/'d the title above. Thanks!

Edit: oops, I meant s/ow/pw/.