Hacker News Reader

Comment by IanCal | Hacker News Reader

No, the internet access was down to finding a 0 day exploit in artifactory. However this was only get requests and they had to then use a url shortener to use other methods, then used a cybergym instance they found to run more long running things.

It not just a case of saying “pls don’t”

View on HN

Yes but that wouldn't have worked if there were a firewall denying network access.

Assuming there were no exploitable systems that had network access. We’re already talking about a case where based on software forbidding access they still had access. Why would a firewall be different? Harder sure but its only at the level of “as far as we know no way of getting past this”.

Because firewalls are explicitly designed and audited for this kind of exploit. It would be much more surprising for a mature firewall system to allow unauthorized network access, than that this package management system had an exploit that allowed this escalation of privileges.

This isn't rocket science, this is why firewalls exist, to provide this cross cutting layer of defense.

It’s not rocket science, no, and I thought the point would be clear but in fewer words - less likely is a distinctly different thing than not possible.

The specific thing that happened would not have been possible. They might have found a different exploit in the firewall system. But specifically "the package manager can be exploited to send arbitrary requests" problem could have been solved in this obvious way.

That's also my understanding.

This part of the article describes it poorly:

> The agents initially had very limited access to the internet: they could load URLs

You are incorrect. The article explicitly mentions the crawler/screenshotter service and httpbun.

That was the secondary part. The MTER report covers the initial thing too.

Reply on news.ycombinator.com