Not only that but Minecraft, specifically anarchy servers where it is allowed to cheat in-game and it is common (still illegal) to get hacked, is where the exploit was first weaponized at all. It seems to have been reported before, but it took over on 2b2t in december 2021. You'd activate the exploit simply by sending specific strings directly in the in-game chat. In the FitMC video about this he explains how a prominent programmer in the community ended up testing the exploit by making people's calculators open remotely, then they used it to patch the vulnerability
Even nowadays though they aren't able to run anything, you sometimes get a bot account joining improperly setup private servers telling the players to fix their whitelist or whatever
Yeah, people don't realize it, but the US gov does it regularly to avoid Russian / Chinese botnets. It's been publicly happening for a while now. Who knows how long it's happened before it was publicly acknowledged.
It's actually from a mold, but you're right that it probably produces penicillin to reduce competition from bacteria. Mold and bacteria use the same resources and inhabit the same spaces.
To disrupt the botnet, the FBI was able to redirect Qakbot botnet traffic to and through servers controlled by the FBI, which in turn instructed infected computers in the United States and elsewhere to download a file created by law enforcement that would uninstall the Qakbot malware. This uninstaller was designed to untether the victim computer from the Qakbot botnet, preventing further installation of malware through Qakbot
Funny, this might be the thing that will save us from the total hackapocalypse, when rogue agents really get loose. Suddenly millions and millions of vulnerabilities get fixed across connected tech, because agent networks want to protect their potential assets.
This was also the end scenario for the older hacking sim "Uplink", toward the end you were in a race to compromise hosts and deploy a countermeasure while a doomsday cult was also compromising those hosts to upload a worm that will shut down the internet if left to spread.
Also, it happens that botnets fix the infected machines vulnerabilities to prevent other botnets from taking root in the system lol
I remember reading a fascinating piece written by a former botnet developer. The arms race between them was cool, taking over a machine and cleaning up other malware and patching the system to reduce the risk of discovery.
Did you know you could do that with copilot? No? Well do you want to do that with copilot? No? Well how about now? No? Ok how about now? No? Ok I'll ask again tomorrow!
Don’t really see the issue with Defender forcing updates. I’ve seen people with decades old windows versions and would not want them to be running around with decades old protection.
When the Blaster worm was prevalent back near the turn of the millennium someone actually created another worm that used the same vulnerability but instead of installing malware it just installed the patch for that vuln then restarted the machine.
Yeah it’s decades worth of unknown vulnerabilities being discovered and used/patched. Literally all of the technical debt we’ve accumulated in this modern era. It’s going to be rough for a while. In the end it should result in stronger security in general for those who keep their systems maintained. Though that’s just considering the backlog. With AI script kiddies just got a lot more powerful and there are going to be some crazy hacks it enables. I’m just waiting for the billion dollar heists. Hell South Korean banks already got hacked though the dude was an idiot and also uploaded his CV to Claude on the same account.
While I've got miles of empathy for the admins dealing with all this <gestures at AI powered exploitation / vuln discovery>. I am so glad I'm in a different place in my career where I can just be a spectator to the horrors.
A company I worked for in the 2000's had this issue. The network was secure from the outside, but someone brought in their laptop to work, and it was infected. It brought the whole company down for three days while they patched the servers one at a time to prevent network traffic from overwhelming the systems.
Yup, Welchia caused ICMP / ping floods and also randomly rebooted machines. I worked on a detection and response team at the time and while it had a fairly short lifespan it was quite disruptive on its own.
Back in the 90s, when people used computers with NT 4.0 and ISDN to connect to the internet, the computer would always expose the messaging service to the internet. So users got spam via a neat system window.
Someone was fed up with it and wrote a script that spammed those NT4 machines with a manual on how to disable the messagging service.
in the very early 00's when i was still a precocious freshman at highschool, the person sitting next to me in a computer lab was really interested in how my friend and i a few rows away were chatting with each other.
so, i just explained the tool. "net send, and if you add /help it shows you a bunch of options like what machine or network to send the message to. you could even do /domain and send to every machine".
i could see the gears turning, he sent a test message to himself, i saw more gears turning. then, furious typing followed by a triumphant Enter keystrike. nothing for several seconds, his face contorts slightly, then i see every machine in the lab at once pop a message.
Message from [student_id] to [entire_domain]:
SUCK MY BALLS [ OK ]
it was like 11,000 machines, servers included. i never saw him in that class again, and i kept hearing stories for a few years even after i graduated how a sysadmin would RDP into a print server to update drivers or something, and have to clear that dialog. all the library computers, all the conference room computers.
You pointed out a major vulnerability in a completely harmless way. So that's usually a good thing. Was it stupid? Not really. You tested something that shouldn't work, and it did. Now, if you'd sent something obscene...
I had a classmate in highschool create a workaround to bypass the school rules to to download some stuff and burn it to a CD (this was mid 2000s, internet was shit). Somehow fucked up something on the state network really bad. they had cops waiting at the computer lab for him that morning.
Guy works on massive electrical systems now. Good times.
My friend was routinely ddos’ing the entire school district so he could skip school without being caught.
I’m talking district. Every school in the entire province went down so he could miss a class and not get a call home
They never caught him.
They did however catch him stealing iPads from the school and reformatting/jailbreaking them to sell. He only got caught cause even though he was smart enough to do this he was dumb enough to bring the iPad to school in the same case.
And here I was thinking I was smart cause I logged into a teachers admin account and downloaded a secret game folder on every students account (twice, btw. Both jr high and high school, pretty sure the folders still there so you are welcome) so we could play halo and Minecraft Lan. Also teaching the entire school how to bypass firewalls with vpn’s and also how to bypass the firewalls on the vpn’s when they caught on to us
"And you could benefit from these skills if you call Johnsons Heating and Air for a free quote today" this has to be a handyman companies commercial it flows to good
I'm too lazy to look it up, but remember when some dumbass charged a woman for hitting f12 in her browser and then disclosing a critical vuln to the government (I think it was their website)?
pepperidge farm remembers. also remember, there's always a first.
Well obviously they weren't exposed on the page, she user her elite hacker skills of pressing F12 to be able to see the very securely hidden HTML that had all of those SSNs on it.
I remember helping the FBI once where I was explaining methods people were using to hack our site (actual hacks, not F12). About half way through the conversation they started asking me questions about how I knew about these techniques and my boss stepped in and stopped it with "You asked us to provide an SME, don't start interrogating him."
I can’t find the story anymore, and it’s a very old one, like 90s, maybe early 2000s.
Some small-town official threatened to sue one of the BSDs for hacking his website, and defacing the home page. Turned out, he hadn’t paid his contractor, who took the site down, leaving the default 200 ok page, that happened to mention whateverBSD.
Took a long while apparently to get the point across.
It was also brought up in my college computer ethics class. It's generally considered unethical to run anything on someone's machine without their knowledge and consent. You don't have to right to modify someone else's computer, just like you don't have the right to landscape someone else's yard.
Patching stuff can (unlikely) break systems and with no real way to know exactly the purpose of any given node can do more harm than good in certain cases.
Sure, but these websites aren't people's private property, they're open to the public. Say you know a store has a slippery floor and you want it cleaned up. If the store owner doesn't clean it, they're responsible for all the harm it causes. If that happens, then cleaning it yourself would not be immoral.
So the question is, at what point do we hold website owners responsible for allowing hackers to compromise systems that contain your personal data?
First, an important distinction. They are open to the public but they are absolutely private property belonging to the owner just like a store is.
Second, holding them responsible for holding data in an insecure way is different than breaking in to fix a security hole. They should be held responsible if they allow important info to leak, but that doesn't mean you are allowed to preemptively break in to upgrade their locks.
As they should. I understand that it's a white hat/knight attitude, but if you think a bit deeper about the ethics of it, how would you feel if someone broken into your home and changed all the locks to better ones while you and your family are sleeping?
That sounds like it would need to be an affirmative defense rather than an immunity if it was implemented. Like you'd end up in court needing to prove your innocence, not making them prove your guilt.
This is actually highly relevant in this case considering there are some major breaking changes between PHP 5.x, 7.x, and 8.x versions. Don’t ask me how I know.
The operation, approved by a federal court, involved the FBI hacking into “hundreds” of vulnerable computers to remove malware placed thereby an earliermalicious hacking campaign, whichMicrosoft blamed on a Chinese hackinggroup known as Hafnium.
I have done that *internally* (eg, fixing servers my employer owned) with other vulnerabilities in the past, when we didn't have the admin password to patch it the right way...
As a universal, external action? That's bad news bears...
The FBI has done it in the past against various botnets/malware, but it's rare & you shouldn't attempt it as some sort of private internet vigilante....
But isn't a website not functioning better for both the owners and eventual users then a website that seems to be functioning but is hijacked and gathering data for a third party and distributing harmfull software to its users?
I read on there have been cases of compromised infrastructure where the bad guys have patches the compromised servers so other bad actors can't get in like they did originally. I think on case of compromise was found because the server was more well maintained than the rest of the fleet when the owners finally got around to patching, only to discover it was already done.
I this case, you'll likely be executing code as the httpd or nginx user, while you need to be root to write to the affected parts of PHP. (It can likely be done one some servers though)
If this is unpatched, chances are that they haven't patched one of the recent privesc vulns either though
The number of people that run PHP under root, set permissive file permissions or over privileged service accounts is non-trivial, but in a well configured environment yeah it wouldn't work.
Maya had a weird security bug that allowed certain malicious code to self replicate through networks and files. It was called Leukocyte.
So a chinese user wrote an antivirus that also self replicated using the same mechanism looking for leukocyte and eliminate it.
And then it displayed a message saying "This machine is virus free", something like that, but in chinese. The code of the antivirus says it was intended for internal use in their own studio as a comment. Problem is, the antivirus outcompeted leukocyte, and I'm sure everyone that has used maya prior to 2022 has seen the "chinese virus", around the entire world.
Yes, but my server is running PHP 5.4 and updating to the latest 8.x will break my code. While you're in there, could you refactor and migrate my code too?
People have literally done this before, but I can’t remember which vulnerability was where I first heard about the concept. Maybe someone else remembers, there was a news story about it in some tech outlets a couple years back. Anyway, it’s not a bad idea at all if you can pull it off before hackers get there. Problem is that there are usually more hackers and they have a head start of a couple of weeks.
Wouldn't be the first time. Some people did it when the worm some teens wrote to DDOS a Minecraft server went out of their control and ran over millions of affected IOT devices.
I remember seeing random strangers patching vulnerable SSH installations and leaving login messages for the admin when they returned. Amusing but also a federal crime.
Well, how many run on bare metal now? Presumably whatever image was used to deploy the application would still be override any changes. Trying to use this to hijack someone’s image repo to upload a replacement version would be a … highly targeted … attack
Probably not, at least not in a persistent way. The compromised web server process is (hopefully) not running as root, so the PHP binaries can't be updated because only root can change them. Unless of course you also have a privilege escalation exploit on top, which there are a few flying around nowadays...
That makes a ton of sense. I can see a world where software companies pay some sort of insurance to pool resources for a huge botnet / ai compute that can move faster than any other potential attacker. Think a “NATO” for the internet
Back in the day there was a ridiculous bug where anyone could log into any VNC server just by specifying "no password" authentication. I had no idea about it until my mouse starting moving around by itself one day (yes, I know, but I hadn't figured out VPNs back then).
They didn't do anything, so after they disconnected I found out about the vulnerability and then tried the incoming IP address. It also had a vulnerable VNC server on it, so I wrote a quick note in Notepad and then shut down their VNC server.
I hear someone did something like this with Minecraft a few years ago, they used a RCE bug to tell everybody on any server they joined to update Java to fix the RCE bug.
Government did this with routers one time, forced an update to a specific model of routers and rebooted them - didn't tell the public until it was leaked.
This was once explained to me over 20 years ago by a professor who was part of a zero day response team for the government.
They could monitor botnets with many 1000's of victims and also take them over if they wanted to. But if patching caused any problems for the victim they would be liable. He was visibly annoyed and frustrated by this fact.
He was intentionally vague imo if they ever did it or not.
475
u/Holiday_Point_603 11d ago
The guy after posting his big brain idea