News for hackers. Stuff that matters.

A comment on 35-year-old vulnerability discovered in scp. Parent comment

Re:35-year-old vulnerability discovered in scp by nathan_long on Tuesday January 15, 2019 @08:55AM (#18911103)
> The argument that "you trusted this server enough to connect to it and download a file, therefore you clearly should trust it enough to permit it to execute arbitrary executables on your machine" is false in both cases.

Great point. Also, imagine that you control the server and you know that it was compromised. Surely you want to be able to download logs and other files from it for inspection without having your own machine compromised.

[ Parent | on HN ]
Re:35-year-old vulnerability discovered in scp by toyg on Tuesday January 15, 2019 @10:41AM (#18911903)
> Surely you want to be able to download logs

Uhm, nope: you want to shut it down and perform forensics on the disk. Once it's rooted, I wouldn't touch it with a barge pole.

[ Parent | on HN ]
Re:35-year-old vulnerability discovered in scp by XCabbage on Tuesday January 15, 2019 @10:46AM (#18911943)
I've been a web developer for over 5 years and never once worked somewhere where I'd have any imaginable way of physically accessing the disk of a server. Everything's been cloud-based. I don't know the exact ratios, but I'd expect my experience not to be unusual.
[ Parent | on HN ]
Re:35-year-old vulnerability discovered in scp by organsnyder on Tuesday January 15, 2019 @10:54AM (#18912008)
You should still access that data in an offline manner, though—ideally:

1. Shut down the instance

2. Connect the storage as secondary storage on another (disconnected from the network) instance

3. Do forensics using your cloud provider's out-of-band management interface

4. Throw away that instance as soon as you're done

[ Parent | on HN ]
Re:35-year-old vulnerability discovered in scp by detaro on Tuesday January 15, 2019 @10:53AM (#18912000)
You can't physically access the disk, but you often can download a snapshot or disk image, which is created at the hypervisor level.
[ Parent | on HN ]
Re:35-year-old vulnerability discovered in scp by spenczar5 on Tuesday January 15, 2019 @12:02PM (#18912641)
Every cloud provider out there would help you get an image of the disk if you told them it was due to a security breach.
[ Parent | on HN ]