Top all-time · #3985
Max Justicz
Personal blog · justi.cz · on HN as justiczsecurityprogramming
Max Justicz's personal blog at justi.cz covers security and programming. Since 2017, 19 different Hacker News readers have linked it 30 times, most often “Remote Code Execution in apt/apt-get”. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
HN readers repeatedly link Max Justicz's 2019 post on an apt redirect vulnerability that allowed man-in-the-middle code execution, citing it when discussing HTTP versus HTTPS and package security.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Remote Code Execution in apt/apt-get10 people · 11 mentions · first linked 2019-01-22
- Remote Code Execution Found in CocoaPods3 people · 4 mentions · first linked 2021-04-20
- Fun with LCDs and Visual Cryptography3 people · 3 mentions · first linked 2020-07-30
- Remote code execution on rubygems.org3 people · 3 mentions · first linked 2017-10-10
- Remote Code Execution in CouchDB (and Privilege Escalation in the Npm Registry)2 people · 2 mentions · first linked 2017-11-15
- Privilege Escalation in GVisor, Google's Container Sandbox2 people · 2 mentions · first linked 2018-11-14
What Hacker News says?
Until someone thinks that it should follow redirects which probably leads to the same thing that got apt: https://justi.cz/security/2019/01/22/apt-rce.html Not saying that makes it a bad idea, but importing/downloading trusted code over http(s) is not simple even if the protocol sorta is.
Comment linking /security/2019/01/22/apt-rce.html
on “Deno 1.0”Submitted Remote code execution vulnerability in apt/apt-get as a story · 416 points
HN discussion> This is a large misunderstanding of how it works. You can't MITM millions of servers around the world just because they use HTTP for downloading their apt archives. Actually, a bug allowing exactly that was in the last 3 ubuntu LTS versions: https://justi.cz/security/2019/01/22/apt-rce.html https://usn.ubuntu.com/3863-1/ If they used HTTPS then an attacker would have to control the mirror instead of being able to…
Comment linking /security/2019/01/22/apt-rce.html
on “Ubuntu 20.04 LTS’ snap obsession has snapped me off of it”Submitted Remote Code Execution in Alpine Linux as a story · 286 points
HN discussionI found this bug! Here's my blog post about it: https://justi.cz/security/2021/04/20/cocoapods-rce.html I started looking because I wanted to find bugs in Signal for iOS, which uses CocoaPods: https://github.com/signalapp/Signal-iOS/blob/master/Podfile
Comment linking /security/2021/04/20/cocoapods-rce.html
on “Remote Code Execution Found in CocoaPods”Submitted Remote Code Execution Found in CocoaPods as a story · 220 points
HN discussionHere's the kicker: while this might sensible to you, some JSON implementations out there will reject duplicate fields (fail a parse completely), and the RFC does not even specify what is the correct behavior (override previous, ignore duplicates, fail entire parse, return non-unique keyed dictionary, something else entirely?). So while to you and I this behavior might be expected (although I'm still not sure that ov…
Comment linking /security/2017/11/14/couchdb-rce-npm.html
on “Application Load Balancers enables gRPC workloads with end to end HTTP/2 support”Submitted Remote Code Execution in CouchDB (and Privilege Escalation in the Npm Registry) as a story · 68 points
HN discussion> the overhead The computational overhead is negligible. This simply isn't a credible argument against HTTPS. Netflix send petabytes of data over HTTPS. There's no excuse for anyone else. > A medical site is different to a static html site like listed in the post. Different in degree, but not in category. Your browsing habits on ordinary non-sensitive sites can still be used to profile you. > ISP regardless of SSL k…
Comment linking /security/2019/01/22/apt-rce.html
on “No, that dot in the domain name of the URL is not a mistake (2004)”Submitted Remote Code Execution in apt/apt-get as a story · 36 points
HN discussionapt (dpkg) binaries need to be anyway PGP signed, so HTTPS is just a another layer of security, which is mostly redundnant. Not too long ago, apt in fact predominantly used HTTP. However, then this MITM vulnerability was found that would've been avoided by using HTTPS, and I think they pretty much switched to using HTTPS from then on: https://justi.cz/security/2019/01/22/apt-rce.html
Comment linking /security/2019/01/22/apt-rce.html
on “GnuTLS audit: passive cleartext recovery attack”Submitted Show HN: BountyGraph: Crowdfunded Bug Bounties and Security Audits as a story · 23 points
HN discussionBecause http protocols give you lots of extra chances to screw things up. https://justi.cz/security/2019/01/22/apt-rce.html > Unfortunately, the HTTP fetcher process URL-decodes the HTTP Location header and blindly appends it to the 103 Redirect response:
Comment linking /security/2019/01/22/apt-rce.html
on “Deciphering the Messages of Apple’s T2 Coprocessor”Submitted Remote Code Execution on packagist.org as a story · 19 points
HN discussionDoes it include the fix for apt's recent mirror redirect vulnerability? If not, any update to a fresh system would be trivially susceptible to a MITM attack if redirects aren't disabled. This includes docker images as well: https://justi.cz/security/2019/01/22/apt-rce.html Canonical really should enable https as an additional layer of protection. This isn't the first time a bug in apt's authentication was found and…
Comment linking /security/2019/01/22/apt-rce.html
on “Ubuntu 18.04.2 LTS Released”Submitted Fun with LCDs and Visual Cryptography as a story · 4 points
HN discussionThe attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html
Comment linking /security/2019/01/22/apt-rce.html
on “HTTP redirect vulnerability in apt package manager”Submitted Privilege Escalation in GVisor, Google's Container Sandbox as a story · 4 points
HN discussionSimilar issues: - Hacking 3,000,000 apps at once through CocoaPods - https://justi.cz/security/2021/04/20/cocoapods-rce.html - Remote code execution in Homebrew by compromising the official Cask repository - https://blog.ryotak.me /post/homebrew-security-incident-en/ - Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies - https://medium.com/@alex.birsan/dependency-confusion-4a5d60f…
Comment linking /security/2021/04/20/cocoapods-rce.html
on “Supply Chain Attack on Composer”Submitted Remote code execution on rubygems.org as a story · 4 points
HN discussionYou mean like - https://justi.cz/security/2019/01/22/apt-rce.html ? tbf, I'm being a bit hyperbolic. Its totally reasonable to have security at different layers. One good thing about HTTPS though is it is a very well tested layer. Crypto is such an easy thing to screw up, even when doing just basic stuff.
Comment linking /security/2019/01/22/apt-rce.html
on “RIP HTTP”Submitted Privilege Escalation in GVisor, Google's Container Sandbox as a story · 3 points
HN discussionI did a write-up of the vulnerability details here: https://justi.cz/security/2017/10/07/rubygems-org-rce.html
Comment linking /security/2017/10/07/rubygems-org-rce.html
on “Unsafe Object Deserialization Vulnerability in RubyGems”Submitted Compromising Thousands of Websites Through a CDN as a story · 3 points
HN discussionAlso worth noting that there have been apt RCE's capable of being exploited by a MITM. https://www.debian.org/security/2016/dsa-3733 https://justi.cz/security/2019/01/22/apt-rce.html I really don't see how anyone can still defend not using TLS for debian packages.
Comment linking /security/2019/01/22/apt-rce.html
on “The Fascinating World of HTTP Strict-Transport-Security”Submitted Remote Code Execution on rubygems.org as a story · 3 points
HN discussionMax Justicz post about the vulnerability https://justi.cz/security/2019/01/22/apt-rce.html
Comment linking /security/2019/01/22/apt-rce.html
on “USN-3863-1: APT vulnerability”Submitted Hacking 3M apps at once through CocoaPods as a story · 2 points
HN discussionSubmitted Fun with LCDs and Visual Cryptography as a story · 2 points
HN discussionSubmitted Fun with LCDs and Visual Cryptography as a story · 1 points
HN discussion
