Tuesday, April 23, 2013

Being a good internet citizen

A large percentage of breaches are discovered by having a third party mention to you that you're insecure. I would estimate it to be well over 50%.
Because of that, when I come across things that are vulnerable I typically try to let the company know so they can fix it. Most of these are simple things that are indexed by google that were not meant to be public (see this post on google hacking).

I sometimes get responses, but typically do not. The most common response is a simple thank you email. I've had less nice responses as well, such as people angrily demanding to know what my intentions were. No good deed goes unpunished.


Recently I sent an email to a company to let them know they had a misconfiguration that makes every file on their box viewable (with the permissions of the httpd user) by the entire world. Looked kind of like this:



Plus, everything on their box had been indexed by google. Imagine your backups and config files being freely down-loadable and searchable on google!


Even worse, there wasn't just one domain hosted on this vulnerable box...a reverse lookup of the IP showed that the server was hosting 576 domains!


So I sent them a simple email:

Attention Information Security,
I saw this site on google, and happened to notice that you appear to have a sym link in your document root that points back to / allowing access to your entire system through the webserver.
For example, your passwd file SHOULD NOT be publicly viewable.
http://XXXXXXXXX.com/x.txt/etc/passwd

Please let me know if you have any questions.
Thank you,

I received a response from them, which included this:
It's worth noting that /etc/passwd does not contain any sensitive information, and that although we do not widely publish our configuration, we do not generally consider it to be sensitive as it is relatively trivial to reverse-engineer by experimentation and observation. We conduct regular reviews of our platform's security and take extensive measures to ensure that our servers stay secure.

Huh. Okay.


Note: Names have been redacted to protect the ignorant.

99 comments:

  1. pretty disappointing, in fact when I informed some administrators about public axfr in their dns zones, I got reply like this:
    "The vast majority of information in the DNS can be obtained by enumerating the reverse zones or using Google. Services named in the DNS are intended to be publicly accessible or are protected in various ways".
    different situation, but same question - WTF? :)

    ReplyDelete
  2. Found that site you found a symlink on... After doing some further research, it seems that this site simply copied\stole everything from a different site: Sha*************** @ ap********* (Not sure if I should post this information...) and they've actually done a pretty bad job replacing that logo (by simply covering it with their own).
    Anyways, I'm assuming that's why they don't care for that information being public... It actually doesn't even belong to them in the first place.
    Also, tried the same simple symlink backdoor with the original site and I didn't manage to gain access (I haven't actually pentested the site, simply tried the exact same application that was used previously).

    ReplyDelete
  3. Using a simple Goole dork (inurl) can tell us which sites have this issue: https://www.google.com/search?q=inurl%3A%2Fproducts%2Fmanual%2Fdb

    ReplyDelete
  4. This is totally new.hacking I am definitely enjoying your website. You definitely have some great insight. I am impressed by the quality of information on this website. There are a lot of good resources here. I am sure I will visit this site soon.
    Thanks
    Susanne Green
    medical assistant

    ReplyDelete
  5. Collections from the design labels such as pas cher trx and other beauty are released after every six months.
    With every new launch, a new penny skateboards cheap online technology is developed.
    This had led to making TRX For Sale remain competitive in the International market.
    The entire pas cher trx packaging process is paid into detail to enhance the collections quality and appearance.
    Now everyone can own high-end designer trx france.
    TRX Suspension Training Sale being one of the largest and most prominent fashion company in the world, it has an obligation of beating the standards set by others.
    The fashion world, with a higher concentration on Discount TRX Sale, needs to provide the best packaging services that the modern world has ever seen.
    TRX Suspension Training On Sale plays a major role in creating a brand name that fashion lovers want to identify with.

    ReplyDelete
  6. Thank you for sharing such a nice and detail article.I am waiting for another wonderful articles.

    regards,

    Melbourne web developer

    ReplyDelete
  7. DreamHost is ultimately one of the best website hosting provider with plans for all of your hosting needs.

    ReplyDelete
  8. This comment has been removed by the author.

    ReplyDelete
  9. Nice post i really like it.Call us at 0800-090-3240 Adobe Support Number UK and Adobe Helpline Number UK to get quick and satisfied solution.

    ReplyDelete
  10. That was an educative article on being a good internet citizen and I have learned a few techniques that will help be a better internet users. I hope that this article will reach out to all online users so that they can learn how to utilize the internet effectively. Kindly find time and read my article by clicking on Online Professional Essay Writing Providers.

    ReplyDelete
  11. Nice Blog! Thanks for sharing nice information with us. This Blog is very helpful for Software customer. If you are getting any technical issues…Read More

    ReplyDelete
  12. Adobe is a famous operating system across the population of UK. It is an advanced platform to suit your projects to build with. For any technical related errors, you an call our skilled technicians at Adobe Help Number UK & Adobe Helpline Number UK

    ReplyDelete
  13. getting printer connectivity issue, please follow here Xerox Printer Support

    ReplyDelete
  14. I read this article. I think You put a lot of effort to create this article. I appreciate your work.
    thesis Writing Service

    ReplyDelete
  15. Since Hotmail has lost its identity and merged into Outlook, many users are having issue in signing in their account. They are even facing issues in exporting their emails, contacts and calendar to another account. This is when you can call at Hotmail Contact Number UK and ask our professionals to guide you.

    ReplyDelete
  16. Avast antivirus is one among the oldest names known in the market of antivirus, this antivirus is protecting the systems from all types of dangerous unwanted elements and viral attacks from a period of 3 decades that too without any failure, still if somehow Avast ever puts you into any technical trouble call the expert at Avast Customer Care Number UK &
    Avast Phone Number UK

    ReplyDelete
  17. There are many times when your Kaspersky security starts to show technical troubles in managing its latest tools. If you are having trouble while managing them, you can connect to Kaspersky Tool Help Number UK and get the best assistance for the same.
    Kaspersky Helpline Number UK

    ReplyDelete
  18. Smilearrow Find best products values got thousands of online top most bought items key points, rankings, price, photos lot of cool stuff to get from

    ReplyDelete
  19. Gypsum designer providing innovative building solutions to meet the demands of customers for sustainable performance solutions. Gypsum designer Inc. is a key resource for architects, contractors, and design professionals.

    ReplyDelete
  20. Clothes Steamer Steamer for Clothes Garment Steamer U.S.A Turbo-Steam Shop for high quality Best clothes steamer, Steamer for Clothes, garment steamer, Fabric Steamer All kinds of Steam Cleaner on Turbo Steam at best prices

    ReplyDelete
  21. Clipping path is a must for any kinds of product images. Clipping Path Service can provide you with your desired product with a high-end view which will help you to attract both the organic customers and paid to add customers. Do clipping path for your business growth and show your customers what you have!

    ReplyDelete

  22. We the BRS team which stands for background removal services are providing you with highly graphic design and photo editing and obviously the most popular brand identity design at your cost. Do Visit to have the view of creative ideas of designs. Creative designs do help to grab the attraction of the customers. Make your own business flourish with powerful design concept today!

    ReplyDelete
  23. Image retouching service is on of the great services of Adobe Photoshop service. Removing spots or blemishes from images, as well as more advanced color correction work. We can remove unsightly marks, stain,Image retouching fold from any surface and ensure that your images are perfect in every way. We can eliminate the irregularities from the skin and also adjust the image color shades or erase it. We do this by creating an additional selection (path or a mask) of the model’s skin (face, hands, legs, etc.) Our designers can measure and correct the color values. Clone and Spot Healing tools remove irregularities. We can reduce and eliminate bags under the eyes, pimples, tattoos, birthmarks, etc

    ReplyDelete

  24. Creative Banner is a focusing fact for any kinds of business institutions. Banner show your products identity which is provided by you. Manage your banner design service creatively by any professional designer to highlight your products. Creative banner grabs your customer’s attention.

    ReplyDelete
  25. That's the lastest philosophy. It seems like almost everybody today has a Botox treatment blog.
    nutra platform Do they offer a real discount?
    I'm a bit suspicious of skin cream. Readers have way too muc Anti Aging. What does it mean to comment always on something that reveals Skin Care so poorly? It does surprise me that you know that there is an amazing Anti Aging is that it provides more skin cream.
    https://www.nutraplatform.com/

    ReplyDelete
  26. outsourcingall.com "Usually I never comment on blogs but your article is so convincing that I never stop myself to say something about it.
    This paragraph gives clear idea for the new viewers of blogging, Thanks you. You’re doing a great job Man, Keep it up.
    web hosting service in bangladesh

    ReplyDelete
  27. Amazing tips to download Alexa app for Echo Dot setup, connect Alexa echo to wifi, setup Alexa echo device (Echo, Echo dot setup, Echo show etc.) Today get Amazon Alexa app and setup it with echo device by following easy steps. To know simple steps Visit
    download alexa app
    echo dot setup
    alexa setup
    amazon echo setup

    ReplyDelete
  28. Great post and informative blog.it was awesome to read, thanks for sharing this great content to my vision.
    Good discussion.
    Java Training in Chennai
    Java Training in Coimbatore
    Java Training in Bangalore

    ReplyDelete
  29. This comment has been removed by the author.

    ReplyDelete
  30. On the off chance that you need to reset or recover the overlooked Gmail secret phrase promptly with no issues at that point most ideal approach to do as such is called professionals by dialing +1-877-637-1326 Gmail Recovery Email Helpline Number . The geeks will give you arrangements that will fix your Gmail issues most assuredly and time delay. Any Gmail client who needs to look for answers for Gmail issues can call at Gmail Customer Service and benefit proper arrangements in a flash.

    ReplyDelete
  31. Are you facing Microsoft Product and services related problems and you want to solve it permanently, than call Microsoft Helpline Number +1-844-229-3909 and get instant support

    Microsoft Helpline Number

    Microsoft Office Support Number

    Microsoft technical Support Number

    Microsoft Outlook Support Number

    Website - https://www.800-supportissue.com/

    Toll-free Number - +1-844-229-3909

    Email id - 800suportissue@gmail.com

    ReplyDelete
  32. Great blog thanks for sharing Looking for the best creative agency to fuel new brand ideas? Adhuntt Media is not just a digital marketing company in chennai. We specialize in revamping your brand identity to drive in best traffic that converts.
    digital marketing company in chennai
    seo service in chennai
    web designing company in chennai
    social media marketing company in chennai

    ReplyDelete
  33. Nice blog thanks for sharing Out of creative ways to set up a vegetable garden? Karuna Nursery is run by the best gardeners in chennai who are ready to offer you with amazing terrace vegetable garden ideas. Visit us right now to learn more and enjoy the experience.
    plant nursery in chennai
    rental plants in chennai
    corporate gardening service in chennai

    ReplyDelete
  34. Excellent blog thanks for sharing It’s time you upgraded your Salon to meet global standards. Do that with the best wholesale cosmetic market in Chennai - The Pixies Beauty Shop.
    beauty Shop in Chennai

    ReplyDelete
  35. smart outsourcing solutions is the best outsourcing training
    in Dhaka, if you start outsourcing please
    visit us: Seo training in dhaka
    Seo training in bangladesh
    Seo training

    ReplyDelete
  36. keep up the good work. this is an Assam post. this to helpful, i have reading here all post. i am impressed. thank you. this is our digital marketing training center. This is an online certificate course
    digital marketing training in bangalore / https://www.excelr.com/digital-marketing-training-in-bangalore

    ReplyDelete

  37. Very useful blog thanks for sharing IndPac India the German technology Packaging and sealing machines in India is the leading manufacturer and exporter of Packing Machines in India.

    ReplyDelete
  38. What is Alexa App? Alexa app will not open,
    Alexa app will not download,
    Alexa app will not connect to echo,
    If you want to download the Amazon Alexa app for Amazon Alexa Setup, Echo Dot setup, Amazon Echo setup, Connect Alexa Echo Dot to wifi, Alexa dot setup, Amazon Dot setup with alexa.amazon.setup. Here,you can get all the information about the Alexa app and Alexa Echo Setup.

    dowmload alexa app

    alexa.amazon.com

    connect Alexa to wifi

    echo dot setup

    ReplyDelete
  39. I must thank you for the efforts you've put in penning this site. I'm hoping to see the same get high-grade blog posts by you later on as well. In fact, your creative writing abilities has motivated me to get my own, personal site now ;)

    ReplyDelete
  40. Here, you will know steps to steps to download Alexa app, echo setup, Alexa dot setup and Echo dot setup. Alexa app is beneficial to control your home gadgets. Just do Alexa login, alexa.amazon.com and Alexa setup by adding your details in it. How to set up Alexa? Find Alexa App for PC, Android, MAC, etc. Connect Alexa to wifi and add Amazon Echo dot or another device whatever you have.

    ReplyDelete
  41. Thanks for such a wonderful help...Keep posting...This Blogs are a part of others Enhancement in Their careers...Well Done works



    Dot Net Training in Chennai | Dot Net Training in anna nagar | Dot Net Training in omr | Dot Net Training in porur | Dot Net Training in tambaram | Dot Net Training in velachery

    ReplyDelete
  42. As time went by the workload of grading and answering the exams got easier because I could draw upon my extensive history of previous emails. machine learning training in hyderabad

    ReplyDelete
  43. From this blog i learned more about hackers and how they hack.Thank you for the writer for taking time and posting a blog like this. Keeping moving on .
    IELTS Coaching in chennai

    German Classes in Chennai

    GRE Coaching Classes in Chennai

    TOEFL Coaching in Chennai

    spoken english classes in chennai | Communication training


    ReplyDelete