Comment by technion
12 hours ago
There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.
It clearly isnt happening.
Yeah, AI seems like a good shift in "narrative making." It's easy to ask AI "give me an efficient way to "confirm or deny this narrative" and have something like this go viral. This is good because it makes narratives more truthful
Because only a fraction of people would double check (AI or otherwise), AI making it easier to flood the zone with fine tuned spam actuallu has the opposite effect. We're seeing this at play at a large scale anywhere an election is happening right now. The narratives are even less truthful than before.
Wow we have lost it. You really need AI to come up with something like this… let’s just end it at this point honestly.
[flagged]
right: either it’s so hard to exploit that $1,000 isn’t enough to risk “giving away” your exploit chain or actual exploitation of this bug is impractical, either way the CVEpocalypse is overblown
The value proposition isn't there.
If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'
That's pennies for something like this.
Add two zeros and it might get nabbed.
Edit: others have pointed out it's not really a 0-day anymore, they're right, so it's likely more a matter of time.
So you are therefore arguing for the author's point.
The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.
In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.
The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.
My favourite actively unreleased 0 day exploits are the ones that are released, 5 days old, and allegedly so trivial to exploit it costs $5 in tokens.
No, I will not spend $5 in tokens to claim your $1000 bounty. My $5 exploit is worth more than $1000. Thank you very much.
I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?
This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.
That's always the case for a novel exploit. There isn't a lot of value in popping somebody's PHP blog, so people who've invested time and money into a zero-day exploit have little incentive to use it for that purpose.
The white hats want to extend the time before an exploit is in the hands of the masses who might do so just for the fun of it, and the black hats want to use it on high-value targets.
1 reply →
random sites generally don't log carefully, or watch their logs if they do. so the risk to hacking them is low. this site almost certainly logs very aggressively. so the risk to hacking it is high.
based on differential risk, attackers will choose targets differently. they might reason that the risk/reward on this obvious trap is not worth it. but on joe shmo's php emporium, the reward is less, but so is the risk, and it might pencil out.
3 replies →
You would have a point if it was still a 0 day. The patch is out, and open source. Anyone who cares has a bunch of the pieces for putting together their own exploit.
Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.
I never mentioned unreleased private exploits, I mentioned what every thought leader and popular creative wants us to believe right now.
The whole point was someone could throws some cents and hack the site.
This logic doesn't work here, because it relies on the premise that you alone potentially have an unreleased zero-day exploit, which is not the case.
If prompting an AI could exploit this for less than $500 in token spend, then you should immediately do so, since if you don't, in a few minutes' time someone else will.
It’s not a 0day it’s now 5 days and counting since disclosure. Nobody is gaining value sitting on an exploit for a vulnerability which is being actively patched.
> The value proposition isn't there.
That's part of the point. $500 or $1000 is a trivial amount. Since the money is still there, there's currently no trivial exploit.
> requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done
Depending on the exploit, and the visibility stack on the server, one may or may not be able to determine how the rabbit got in the hat.
exactly. the pros are not going to reveal their hand for $1k
Why not? Those pros have their opportunity to use this exploit dwindling by the hour as news of this and pressure to patch grows and grows. All the major managed hosting companies had this patched in the first 24 hours.
That is sort of the point I thought? There’s no low skill exploit for the script kiddies to use even with AI, otherwise they’d happily use it
The pros have RCEs, but won’t burn it for something this small.
It’s a real vulnerability, but a complex one
Wallet address is there, you can donate
What point is an anonymous online post proving? Can anyone verify that the private key actually exists? Or which version of PHP the site is running? Or if it is running PHP at all?
If someone was able to gain access to the server and there was no key, they would report it here with proof. If someone had a working PHP exploit and it didn't work on this server, they would be able to post it here with proof.
I just hacked the site and wasn't able to find any key. Do you believe me? Why not? I posted exactly as much proof as the person who posted the challenge.
2 replies →
It seems like the server got DDoS’d before anyone got to the bitcoin.
> There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view.
Clearly people aren't cynical enough.
I find it strange no one in this thread has even considered the possibility that the private key of the wallet isn't on the machine.
OP gets their working exploit neatly logged (or even multiple approaches), keeps the money, strengthens the illusion the exploit isn't that bad, and gets a free $500 on top from someone who added to the wallet.
no it doesn't . absence of evidence is not evidence of absence
This is evidence of absence, though. Unexploited PHP servers are evidence of absence of exploits, and exploited PHP servers are evidence of presence of exploits. “Absence of evidence” would be if there were no PHP servers.
An unexploited PHP server means "there exists a configuration that is not exploitable".
Which is how hundreds of previous exploits have had people publish information on what to temporarily tweak/disable/block, such that the exploit wouldn't work.
What is novel about this case, and for which i do not know the explanation, is that nobody in-the-know was willing to confirm them before the CVE dropped.
You can see the commenters arguing with me about ASLR in the old thread. Half the commenters here, including quite a few "thought leaders" (not gonna name names or ad hominems but everybody knows who they are), insist that there are ways to implement this exploit at scale without having to do rowhammer-style spam brute forcing. I am still waiting. There's a lot of FUD and hearsay in the tech circles grapevine but very little evidence of actual working exploits against a modern Linux server outside of "attempts".
https://news.ycombinator.com/item?id=50188948
I am still waiting for them to put their money where their mouth is.
Maybe link to the argument? I can only find two comments from you on that post and only one person replied. That one reply isn’t from a “thought leader” either.
Except, it’s the top entry in HN right now. It could have gone down to the hug 20 minutes after it was posted, so nobody much has had a chance to have a go at it.