12 comments

  • sammy22554 hours ago
    Any Cloudflare employees reading this, your network map has a few PoPs missing from it <a href="https:&#x2F;&#x2F;www.cloudflare.com&#x2F;network&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cloudflare.com&#x2F;network&#x2F;</a> notably, Perth (PER) Australia. Hobart (HBA) Australia. Wellington (WLG), New Zealand. Christchurch (CHC), New Zealand. Nausori (SUV), Fiji.
  • skinfaxi4 hours ago
    Would love to learn more about their internal behavioural detection program.<p>&gt; One of the first things our security team did was confirm that our existing endpoint detection would catch this exploit. Our servers run behavioral detection that continuously monitors process execution patterns. It doesn&#x27;t rely on knowing about specific vulnerabilities; it watches for anomalous behavior across the fleet.
    • CGamesPlay4 hours ago
      Would certainly be interesting to learn more about. A simple check: allowlist of known &quot;processes that run as root&quot;. Any new process shows up, <i>something</i> happened.
      • jeffbee4 hours ago
        Based on what? Proc title?
        • CGamesPlay4 hours ago
          Proc title is very easily forged (without root even). Obviously a real privileged process could modify the kernel and do whatever it wants, but if I were trying to detect this I would start with &#x2F;proc&#x2F;$id&#x2F;exe.
          • Retr0id4 hours ago
            &#x2F;proc&#x2F;pid&#x2F;exe is also easily forged, without root. For example you can do LD_PRELOAD=evil.so &#x2F;bin&#x2F;foo on any dynamic executable, or spawn &#x2F;bin&#x2F;foo unmodified and inject code via ptrace or &#x2F;proc&#x2F;pid&#x2F;mem.<p>I have a fileless, execless copyfail exploit that works by injecting shellcode directly into systemd&#x27;s pid 1. (I should probably publish it at some point...)
            • jeffbee4 hours ago
              Yeah the whole system is based on the ability of one task to apparently become another task, that&#x27;s how Unix works. So the indicators in &#x2F;proc are just that: indicative at best.<p>There&#x27;s no reason the task should even be assumed to be executing code in a file. A process can map code into anonymous memory and continue executing there without even branching. Again this is considered a feature of the system rather than a flaw.
          • jeffbee4 hours ago
            Maybe, but there&#x27;s a prctl to change that reference which a root process can use.
        • dboreham4 hours ago
          They might just compute a hash over the binary, or the code space in memory.
        • parliament324 hours ago
          It&#x27;s curious they&#x27;re just &quot;monitoring&quot; rather than preventing.<p>In a serious environment you&#x27;d run IPE with dm-verity&#x2F;fs-verity to ensure binaries are whitelisted and integrity-checked at every execution.
          • staticassertion3 hours ago
            lol no one does that (edit: or, rather, that is extremely uncommon, even in &quot;serious&quot; environments, for a ton of reasons).
            • parliament322 hours ago
              Look at the FedRAMP requirements around integrity protection, then look at how massive the list of complaint products is. I promise, pretty much everyone in regulated environments is. It&#x27;s so prevelant Azure is even pushing a turnkey solution for k8s <a href="https:&#x2F;&#x2F;learn.microsoft.com&#x2F;en-us&#x2F;azure&#x2F;aks&#x2F;use-azure-linux-os-guard" rel="nofollow">https:&#x2F;&#x2F;learn.microsoft.com&#x2F;en-us&#x2F;azure&#x2F;aks&#x2F;use-azure-linux-...</a>
              • staticassertion26 minutes ago
                Nothing about fedramp requires that you enable any of the features you&#x27;re talking about. Linking to a public preview of an Azure product that doesn&#x27;t even run with enforcement on is not great supporting evidence.
              • jeffbee2 hours ago
                If you have much experience with fedramp, and it sounds like you do, perhaps you might agree that it is a huge list of things that superficially indicate doing something, without actually doing anything. As the documentation for IPE freely admits, it has no protective benefits because it is unaware of anonymous executable regions.
                • parliament322 hours ago
                  It sure has limitations, but &quot;no protective benefits&quot; is pretty wrong. In a real world example, if your containerized application has an RCE, you&#x27;re preventing the attacker from executing binaries they tampered with or down&#x2F;up-loaded. Combined with minimal distroless containers, it&#x27;s a very effective attack surface reduction strategy, and works much better than the legacy scan-occasionally integrity-checking methods (rkhunter et al).
    • staticassertion3 hours ago
      Syscalls and kernel module loading can both be logged, I assume that&#x27;s sufficient here.
      • skinfaxi3 hours ago
        Yes but I am interested in hearing about cloudflare&#x27;s implementation, how they scale it to their whole fleet, and what kinds of heuristics they are using to classifying behavior as anomalous.
    • mobeigi4 hours ago
      I&#x27;d very much like to learn more about this too, deserves its own blog post.
  • srcreigh4 hours ago
    It’s fascinating that already had a system which could identify the exploit at runtime. How can I learn more about that?
  • mkj3 hours ago
    If they&#x27;re already running a custom Linux kernel build, why did they have AF_ALG enabled? Seems the perfect situation to limit features to only those actually being used.
    • computerfriend3 hours ago
      In the article they explain that some of their services use it.
  • electra20123 hours ago
    &gt; Despite our practice of deploying Linux patch updates every two weeks, we remained vulnerable because a month-old mainline fix had yet to be backported to our primary kernel line.<p>Hopefully a wake-up call to those who believe older distro LTS kernels are getting all the security fixes Canonical and Redhat would want you to believe.
  • cluckindan1 hour ago
    Has anyone figured out whether this CVE was intentional?
  • PunchyHamster3 hours ago
    for us it was<p>* Get list of modules from Puppet&#x27;s facts, confirm module isn&#x27;t used anywhere (it wasn&#x27;t) * `install algif_aead &#x2F;bin&#x2F;false` in &#x2F;etc&#x2F;modprobe.d&#x2F;disable-algif.conf * Run a check using exploit code to check it is no longer working<p>I imagine CF runs more stuff that could use it I guess but apparently it&#x27;s not often used API
  • cube004 hours ago
    &gt; At the time of the &quot;Copy Fail&quot; disclosure, the majority of our infrastructure was running the 6.12 LTS version<p>That could be as low as 50.1%, I wish they&#x27;d provide an actual percentage.
  • jmclnx3 hours ago
    &gt; Linux kernel build based on the community&#x27;s Long-Term Support (LTS)<p>CopyFail only highlights why Companies want LTS. If there was a supported kernel built prior to 2017, most large companies would still be on that version, avoiding this issue all-together.<p>The corporate mindset is usually &quot;never upgrade unless there is new hardware needed or critical software failure&quot;. All CopyFail did was reinforce that mindset.<p>I wonder if CopyFail will cause enterprises put pressure on the Linux Foundation to maintain a &quot;ultra LTS&quot; were it is supported for 20 years ?
    • PunchyHamster3 hours ago
      &gt; CopyFail only highlights why Companies want LTS. If there was a supported kernel built prior to 2017, most large companies would still be on that version, avoiding this issue all-together.<p>Sadly not really how it works for say Red Hat. They routinely backport features while keeping whatever &quot;stable&quot; number on kernel. We even had displeasure of them backporting a bug... same bug to 2 different RHEL versions
    • tempest_3 hours ago
      The longer you wait the more painful the switch will eventually be.
  • dboreham4 hours ago
    The &quot;Hunting for Exploitation&quot; section is unclear to me: &quot;The exploit leaves a distinctive trace in kernel logs when it runs.&quot; Hmm. Wouldn&#x27;t a system with a compromised kernel also log exactly what the attacker wanted logged?
    • cube004 hours ago
      I guess the hope is the kernel has been able to successfully transmit that log message to the immutable central logging infra before it gets compromised.<p>Although given the tendency for end point logging agents to run on buffers to reduce their network chattiness I do wonder if a fast acting exploit could dump that buffer before it manages to be transmitted.<p>I don&#x27;t think any of the agents are complex enough to immediately transmit permission elevation log messages over the regular background noise.
    • QuantumNoodle2 hours ago
      Also 48 hours prior the disclosure is a very narrow window? I wonder if their logs don&#x27;t go back further or if there was another reason to look back only two days.
    • rithdmc3 hours ago
      The attack itself creates the logs, which - reading between the lines - are shipped to a central log server. A compromised server might not send any new indicators to the logs, but existing logs moved off device would still be available.<p>I&#x27;d like to know <i>what</i> those distinctive traces are, which is also missing :(
    • PunchyHamster3 hours ago
      Your exploit would have to get root and kill&#x2F;exploit the logging daemon near instantly, else the log will already be sent to remote before you can change it locally
  • john_strinlai4 hours ago
    this is a techincal dive into <i>how</i> cloudflare responded, not a confirmation <i>that they responded</i><p>for whatever reason, unknown to me, hn automatically strips &quot;how&quot; from the start of titles. i cant remember ever seeing a title where this was an improvement.
    • dang44 minutes ago
      Of course you can&#x27;t, because the cases it improves don&#x27;t get noticed, while the remainder stick out like sore thumbs.
    • gamegoblin3 hours ago
      I learned a few years ago that HN also editorializes by dropping &quot;world&#x27;s&quot; from titles<p>Before: Teens break record for world&#x27;s longest kickball game<p>After: Teens break record for longest kickball game
      • Velocifyer3 hours ago
        I do actually agree with that change.
        • gamegoblin3 hours ago
          It occasionally leads to kinda ambiguous headlines, e.g.<p>&quot;China opens world&#x27;s longest undersea tunnel&quot;<p>vs<p>&quot;China opens longest undersea tunnel&quot;<p>It&#x27;s a little unclear if it&#x27;s the longest undersea tunnel in the world, or just in China
        • jmalicki3 hours ago
          It doesn&#x27;t give enough recognition to the true longest game of space kickball.
      • buredoranna3 hours ago
        ... what a world.
    • dpoloncsak3 hours ago
      Interestingly, there&#x27;s a current post on the front page with &quot;How&quot; at the start of the title.<p>&gt; <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48018715">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48018715</a> &quot;How do I inform Windows that I’m writing a binary file?&quot;<p>I wonder if it ending in a &#x27;?&#x27; has anything to do with it?<p>edit: Upon review, at the time of posting it was actually on the 2nd page
      • john_strinlai3 hours ago
        not sure about that specific case or if &#x27;?&#x27; has anything to do with it, but there is a short editing window where the submitter can re-add the &quot;how&quot; or whatever back in
      • GavinAnderegg3 hours ago
        I’ve been hit by this when posting links. If you edit the post, you can re-add the stripped word and it will stay. “Why” is another that is often stripped.
    • varun_ch4 hours ago
      I&#x27;m yet to see a good example of the title stripping, at least for &quot;how&quot; and &quot;how to&quot; (although perhaps this is survivorship bias).
    • trollbridge4 hours ago
      Starting a title with “How” is standard clickbait.
      • gilrain3 hours ago
        Starting a sentence with “How” is standard English, too.
      • Goronmon4 hours ago
        If we are taking that attitude why not go all the way?<p>Titles are standard clickbait.
        • miki1232113 hours ago
          With LLMs, you could actually do anti-clickbait titles. Extract the article text with something like r.jina.ai, and ask an LLM to generate a ~80-character summary that explains the main point of the article for people too busy to read it.<p>I do think this would genuinely be useful.
          • senko3 hours ago
            You&#x27;re absolutely right! (errm...oops....anyways...)<p>The fact that LLMs usually generate anodyne summaries is actualy a benefit here.<p>I used my website-to-markdown tool[0] to get the text, piped the output to claude -p and got a pretty decent &quot;<i>Patching Copy Fail at scale: how bpf-lsm bought us time before the kernel reboot</i>&quot; result.<p>[0] <a href="https:&#x2F;&#x2F;markshot.dev" rel="nofollow">https:&#x2F;&#x2F;markshot.dev</a>
          • john_strinlai3 hours ago
            back in my day, people just used the thing that rattles around inside their skull for such tasks
            • senko3 hours ago
              To do that, you need to read the article first, which is the point of click-bait titles. The point of the defense is to avoid exposing your neurons to that stuff.
              • john_strinlai3 hours ago
                i would hope that people are reading articles first and submitting them to hn because they are interesting, rather than submitting articles to hn blindly.
                • senko3 hours ago
                  I agree with you on that, but that just holds true (we hope) for the OP.<p>HN already editorializes the title, to help everyone other than the OP (not all people agree over what&#x27;s interesting to them). Now we&#x27;re just arguing over the degree.