35-year-old vulnerability discovered in scp

Re:35-year-old vulnerability discovered in scp by eslaught on Tuesday January 15, 2019 @06:14AM (#18910324)

It gets printed to the console by default when you run cloud-init, and e.g. in AWS you can retrieve the console logs with an API call and grep for what you want.

I've got a script sitting around here somewhere which does this... Not necessarily in a state that's easy to reuse, of course.

[ Parent | on HN ]

Re:35-year-old vulnerability discovered in scp by __david__ on Tuesday January 15, 2019 @12:38PM (#18913043)

It doesn't work if your cloud init prints too much. AWS only holds a certain amount and the so the API call will truncate the output and lose the key (it shows you the tail and not the head of I remember correctly). Our organization has this problem (we run puppet in cloud init which spews like crazy).

I did notice recently that cloud init has an option to hot a web hook when it is complete and they have options in there to add the host key to the POST. But I wonder how to make a web hook that would be immune to spoofing…

[ Parent | on HN ]