bshipp

The people who are crashing their 600HP Linux systems are, unfortunately, not the ones who are reading CVE listings in their spare time. Canonical and other distros are probably going to have to patch that default setting.

Likely no good reason. But he seemed to have identified many many systems that were, inexplicably, exposing port 631 to the internet. There is some reason people are doing it and, given the number of target systems, it must be some sort of default configuration.

  > "This thing is packaged for anything, in some cases it’s enabled by default, in others it’s not, go figure . Full disclosure, I’ve been scanning the entire public internet IPv4 ranges several times a day for weeks, sending the UDP packet and logging whatever connected back. And I’ve got back connections from hundreds of thousands of devices, with peaks of 200-300K concurrent devices. This file contains a list of the unique Linux systems affected. Note that everything that is not Linux has been filtered out. That is why I was getting increasingly alarmed during the last few weeks."

This is the worry. It seems like a really unnecessary privilege escalation.

I guess the important question is whether or not these things are blocked by default or require user intervention to disable cups? Sure, many of us block all ports by default and either route everything behind a reverse proxy or punch very specific holes in the firewall that we know are there and can monitor, but someone firing up an ubuntu distribution for their first foray into linux is probably not thinking that way.

I don't know if I would say it's a nothing burger, but i don't see how it affects important servers. It might impact a number of linux desktops and, if they are linked to important servers, provide a backdoor access into important services.

Being able to run arbitrary code in a root account with no authentication would seem to be a pretty important security breach, although I don't think it's quite the level of danger it was built up to be.

This is entertaining reading. Although I don't know how pervasive this issue is, from the chunk i have read so far I can see why he was concerned that it was relatively trivial to have a target system accept anything identifying itself as a printer and being able to inject malicious code into the machine.

I was going to make fun of him wasting his sabbatical on hacking a printer service but I gotta admit I'd have fallen down the same rabbit hole if I stumbled on it. It's a cool hack.

How does an attacker exploit this vulnerability?

  - An attacker can exploit this vulnerability if it can connect to the host via UDP port 631, which is by default bound to INADDR_ANY, in which case the attack can be entirely remote, or if it's on the same network of the target, by using mDNS advertisements.

What does an attacker gain by exploiting this vulnerability?

  - Remote execution of arbitrary commands when a print job is sent to the system printer.

How was the vulnerability discovered?

  - A lot of curiosity (when I noticed the \*:631 UDP bind I was like "wtf is this?!" and went down a rabbit hole ...) and good old source code auditing.

Is this vulnerability publicly known?

  - No, the bugs are not known and the FoomaticRIPCommandLine vulnerability is known to be already patched (it isn't).

Is there evidence that this vulnerability is being actively exploited?

  - Not to the best of my knowledge.

https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840e...

Original report

Affected Vendor:

  - OpenPrinting 

Affected Product

  - Several components of the CUPS printing system: cups-browsed, libppd, libcupsfilters and cups-filters.

Affected Version

  - All versions <= 2.0.1 (latest release) and master.

Significant ICS/OT impact?

  - no

Reporter

  - Simone Margaritelli [evilsocket@gmail.com]

Vendor contacted?

  - yes The vendor has been notified trough Github Advisories and all bugs have been confirmed:

- https://github.com/OpenPrinting/cups-browsed/security/adviso...

- https://github.com/OpenPrinting/libcupsfilters/security/advi...

- https://github.com/OpenPrinting/libppd/security/advisories/G...

- https://github.com/OpenPrinting/cups-filters/security/adviso...

I'm also in contact with the Canonical security team about these issues.

Description

  - The vulnerability affects many GNU/Linux distributions:

[https://pkgs.org/download/cups-browsed]

Google ChromeOS:

https://chromium.googlesource.com/chromiumos/overlays/chromi...

Most BSDs:

https://man.freebsd.org/cgi/man.cgi?query=cups-browsed.conf&...

And possibly more.

<snip>

From an eating-popcorn perspective, I would find it truly entertaining that a printer package could somehow result in a 9.9 security vulnerability that is somehow worse than heartbleed. How many linux systems actually have cups installed and active?

Ukraine is (and will continue to be for decades) a fascinating case study for multiple reasons, but most impressively regarding NATO support. Although headlines detail billions upon billions in spending, the vast majority of those expenditures from the NATO side were for the notional values of stuff that was already just sitting around. This has got to be one if the cheapest conflicts--from a taxpayer perspective--they've ever supported, which is amazing considering the success Ukraine has experienced in bringing Russia's military to its metaphorical knees.

I think China would be far more aggressive with Taiwan if the West hadn't frozen Russia's central bank assets. That single move likely had the biggest impact in curtailing any expansionist dreams.

I think the Chinese perspectives of how a war against Taiwan might proceed was dramatically altered after watching Russia get slapped around by Ukraine. I'm convinced it delayed any aggressive move by China against Taiwan by a decade, if not more.

Indeed, although because I heavily utilized Docker I also ended up using UFW-Docker. It was fairly straightforward to incorporate into my startup scripts.

https://github.com/chaifeng/ufw-docker

I was brand new to managing an Ubuntu Hetzner server and the moment I saw how many port 22 scans the server received i decided to try changing the port number, followed by key-only passwordless logins. My logs immediately shrank in size. I have never once had an issue having moved to non standard ports and, moreso, feel almost naked logging into port 22.

I know security through obscurity is not an answer, but judging by the reduction in port scanning i've seen after moving as many standard ports as possible to new addresses above 20000 I have to believe its a reasonable first step. How many script kiddies are scanning all 65500 ports for each IP address?

You're a legend, thanks for posting that.

Just opened the Play store and there are numerous Harmony apps. Could you provide a link, please?

Judging by the declaration of war against Ukraine by Russia, it appears an underappreciated aspect of the equation is equal measures of senility and insanity.

This kind of reminds me of when the Concorde first started flying and technically could cancel IFR flight and proceed under visual flight rules over the atlantic because it was above 60,000 feet. An interesting legal possibility but likely not a practical consideration until driverless cars are afforded the same legal status as a human driver. As it currently stands, an AI would be considered a driving aid under the command of a licensed human driver, no different than cruise control.

In many ways its no different than electronic musicians building songs based on short samples of older songs. I have no doubt there will be rulings supporting the sort of creativity you're discussing at some point in the not so distant future.

Some people obviously prefer the old days when security problems were hidden within proprietary code so the only people who knew about them were the ones who found the exploit.

If water was priced appropriately it would incentivize hydroponics that captures and recirculates waste water to minimize usage.

As a simple example, Threading in Python works good for i/o-bound operations like scraping a website, whereas Multiprocessing works best for CPU-bound operations like result hashing/transforming the data you just scraped.

I understand everyone wants concurrency because that's the way everything else in programming works these days, but SQlite in memory or on an SSD (in WAL mode) writes so fast that it makes infinitely more sense to dedicate a single database "write" worker that deals with the dB itself while allowing multiple "read" workers to access the database concurrently. Other workers are spawned to process their data and shovel their writes into a queue to feed that single worker.

In my experience, the CPU utilization of process workers preparing data into SQL statements is generally the chokepoint in most/script programs instead of SQlite write speeds themselves. Of course, this is dependent on numerous factors such as the existence of indices, compexity of write operation, etc., but--as a rule--SQlite is much more efficient if I dedicate one process to handle all writes and optimize that process for speed (i.e. batch writes, etc.).

I think Musks turning point was when he randomly accused the Thai boyscout guide of being a pedophile. Since then his image has been continuously circling the toilet.

I don't know if it's wise to place such a challenge in front of all of us.

I can't imagine .io would ever be removed. if anything, it'll be categorized like .org or .com if it loses its geographic justification.

What is it then?

Agreed, or only render the bags at full zoom and have them dematerialize as you move in for a closer look. That way you can easily find the airships on an overview map by their large sphere but still be able to micromanage the infrastructure as you zoom in.

The....Gerber Baby? Is there a story there? She seems pretty normal and pleasant from her Wikipedia.

https://en.wikipedia.org/wiki/Ann_Turner_Cook

I understood the justification and necessity for lockdowns but not only were they too late but they were also infested with political exemptions and even if they had helped they were only ever a temporary solution.

Full lockdowns certainly wouldn't have been allowed to last long enough for the vaccine to be produced, especially if that research, development and production had taken as long as it was initially expected to take.

The western covid public health response was a bit of a disorganized mess, but even there it ended up being remarkably effective. I was amazed that we had almost two years with virtually zero flu infections, which showed the vast difference between the infectiousness of normal influenza and covid. Unfortunately, covid was such a stubbornly infectious little bugger that it only slowed the progression.

Mastery of Python, in my opinion, is mastering "Pythonic" code, which incorporates readability as a fundamental tenet. In addition, the gigantic universe of not only the standard library but also numerous external libraries and tools, of which a master can leverage to undertake tasks both rapidly and efficiently.

So, to me, a Python zen master would not write incomprehensible code, but instead write readable code very quickly that effectively and efficiently solved the problem they are facing due to their comfort working inside the Python ecosystem.