oasisbob
Was a bit surprised (well, no, not really) to see that the linked XWEB bulletin in that alert mentions a backdoor which can be used to help customers regain access to breached systems. Wondering how likely it is that this backdoor algo has also been leaked or reverse-engineered too:
(translated from French to English with Google Translate)
> If your password has been changed and you are unable to log in, please contact Copeland Technical Support, available 24/7, at [...] and ask for instructions on how to obtain a temporary password. Copeland technical support will need the current date of the XWEB EVO and the MAC address displayed on the XWEB login page.
That's a really strong argument for why systems like this need layered security and should not accept incoming connections from the internet at large.
Some examples I've seen have crawlers which mask themselves 99% of the time by faking Chrome, but which will leak their real identity in UA strings which share the overall fingerprint of the swarm.
(I'm looking at you, Replit.)
You have large VC companies evading rate limits and other restrictions and they're causing real economic harm through their actions.
Bots can easily identify themselves through REP in RFC 9309. This isn't difficult or confusing.
The proposed text of the bill is rather straightforward. It turns more on the "stealth" bit than "bot".
(a) Prohibition.—A person may not—
(1) deploy, direct, or cause to be deployed, a stealth bot to access a website, digital platform, or online service in a manner that is reasonably likely to damage, impair, or burden the technical or commercial operation of a website or other internet service; or
(2) intentionally misrepresent, conceal, or obscure the nature of the bot to appear as a human user for use in connection with a generative AI model or service.
(6) STEALTH BOT.—The term “stealth bot” means a bot that accesses, retrieves, scans, indexes, scrapes, or otherwise interacts with a website, digital platform, or online service without prior disclosure of its identity and purpose, in particular by—
(A) failing to identify itself including through a valid and accurate user-agent string; or
(B) failing to disclose the specific nature and purpose of the bot, including any proposed use and purpose of page content (including text and data mining, search indexing, inferencing, artificial intelligence development, support, or operations (such as training, fine tuning, retrieval augmented generation)) or other automated processing at the time access is requested and in a format that the website operator can access.
Some places do have really well built out platforms where logging, instrumentation, databases, deployment methodologies, IaC, etc have well-built happy paths that exclude a bunch of accidental complexity.
I think a lot of other places are either too small or grow too quickly with the wrong set of values and admit too much into their "platform" which had very little design to begin with.
If anyone should be navel-gazing coming out of this incident, surely it's the trust store maintainers. If there's a big concrete improvement to be made, short of burning down the web PKI ecosystem, I'm not sure it's obvious yet.
Southwest airlines does it.
Rackspace used to do it, to the point of needing to ask them pretty please stop provisioning hardware on central time. Obnoxious.
Given Wayne's hints in the timeline that this issue was discovered by an agent, it might be one of the first big corporate death sentences due to AI?
This bit sets my hair on fire. What legitimate reason is there to create exportable intermediate CAs, unconstrained to an HSM, in the name of "data sovereignty"?
It's the complexity of the world which should drive you towards keeping this stuff offline.
Hell, I used to manage some VoIP switches which would hard-lock if you hit them with `nmap -A`. More people need to learn this lesson.
More important than what? What is a perfect balance?
This is not a good way of stating an opinion about what one should value.
The standards say SFTP. Most everyone ignores that part and have been using S3 buckets by bilateral consensus instead for years.
eg, Garland Mineral Springs is primarily located on private land, and was destroyed by flooding and river avulsion. The entry carries a name of a specific researcher, but the description is obviously LLM generated.
https://www.soakingsprings.com/hot-springs/washington/garlan... https://garlandmineralsprings.com/
I definitely know what those small brown boxes which ship UPS ground look like. Very normal.
I used to work for a financial institution small enough to sometimes need someone from the back office to help fill in as a warm body for dual-control when we received cash shipments.
It only took a couple sessions in a vault to get entirely bored with having a half million dollars in front of you.
The problem with this perspective is that it ignores the victimization which is happening to all sorts of sites right now.
On one hand, you have content owners/suppliers which are trying to place restrictions on how much free bulk use is allowed.
When scrapers go to exotic lengths to evade the blocks, eg by using thousands of ephemeral IP addresses to collect an entire corpus, saying stuff like that makes it sound like it's all a wash.
"Oh, what a silly situation... How did we ever end up like this? It's not good for anyone ..."
No, there is a victim trying to defend themselves from rampant theft of resources, and a corporate asshole which doesn't care about the effects of their actions.
Haven't dove into RFC1928 yet, but curl documents the `--socks5-hostname` option and mentions that DNS resolution can be the responsibility of the client, or the proxy.
Wondering if it's possible the proxy receives both the destination IP address (resolved by the client) as well as the purported connection hostname, and is performing filtering on the later.
I suspect there could be other layers in their proxy too, eg for MiTMing TLS. `NO_PROXY` as described in the report might not be literally bypassing the proxy and sending a request directly from the client container, but rather a directive to the first tool/proxy layer to bypass later proxy layers.