Hacker News Reader

Comment by rkuodys | Hacker News Reader

I am not devops person but this is strange sandbox setup. If I undestsnd correctly, there were no firewall set to block requests to the public internet. Just something along the lines of "Pretty please dont use internet". If I understand correctly, in cases like these package registry should be within sandbox without a need for external access and block on any outgoing request to the internet. Furthermore there should be network traffic monitoring which there wasnt?

View on HN

No, the internet access was down to finding a 0 day exploit in artifactory. However this was only get requests and they had to then use a url shortener to use other methods, then used a cybergym instance they found to run more long running things.

It not just a case of saying “pls don’t”

Yes but that wouldn't have worked if there were a firewall denying network access.

Assuming there were no exploitable systems that had network access. We’re already talking about a case where based on software forbidding access they still had access. Why would a firewall be different? Harder sure but its only at the level of “as far as we know no way of getting past this”.

Because firewalls are explicitly designed and audited for this kind of exploit. It would be much more surprising for a mature firewall system to allow unauthorized network access, than that this package management system had an exploit that allowed this escalation of privileges.

This isn't rocket science, this is why firewalls exist, to provide this cross cutting layer of defense.

It’s not rocket science, no, and I thought the point would be clear but in fewer words - less likely is a distinctly different thing than not possible.

The specific thing that happened would not have been possible. They might have found a different exploit in the firewall system. But specifically "the package manager can be exploited to send arbitrary requests" problem could have been solved in this obvious way.

That's also my understanding.

This part of the article describes it poorly:

> The agents initially had very limited access to the internet: they could load URLs

You are incorrect. The article explicitly mentions the crawler/screenshotter service and httpbun.

That was the secondary part. The MTER report covers the initial thing too.

That’s astonishing levels of incompetence.

Reply on news.ycombinator.com