Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!
But if they were not, and had ill intentions, they might see $500 as a very inexpensive way to purchase an offensive malware tool to use against others.
Any exploit might be interactive with a backend component that generates and serves payload components based on interactive responses.
OP (and anyone else who exploits the server) would be able to see the transcript between the backend and the vulnerable server, containing the payload customised for the server, but not the actual code of the backend. This would be useful if it was a 0day vulnerability, but with a disclosed vulnerability getting a payload that doesn't work except on their server, without the code that generated it, might not be that much value over what they already have.
That said, there are other ways to scam by structuring things like the OP (none of this should be taken to imply the OP has actually done this, but rather why this structure as a general approach might be a bad idea):
* This could be a 'stone soup' scam where the OP has the wallet keys (obviously), and puts this up to bait the addition of more funds into the wallet by other interested people. The key might not actually even be on the server, or it might not be vulnerable. Once sufficient other people add funds, the OP could withdraw the funds, recouping their original funds plus anything others added.
* This could be run as a propaganda scam either to falsely sell that it isn't an easily exploitable vulnerability when it is (by making it unreasonably difficult to exploit compared to real-life deployments), or to over-inflate how exploitable it is (by an insider withdrawal from the wallet). Manipulating public opinion could allow an attacker with a working exploit more time, or help to sell services to fix the problem.
I think an alternative scheme that is less vulnerable to scams would be to have a ZKVM (Risc0 or similar) executing vulnerable code, such that the attacker needs to produce a zero knowledge proof transcript of getting the ZKVM into a particular state that would not be possible if they didn't have an exploit. It should also take an Ethereum address as a public input. Then write an Ethereum contract that will allow funds to be transferred to the public input Ethereum address if submitted with a valid proof transcript, and back to the source of funds after some time has passed. Everyone who wants to add to the jackpot could deploy their own version of the contract, so the one proof transcript could claim from all of them, but if unclaimed the funds go back to the source.
Alternatively (avoiding the risk exploits may be so large as to make the cost of producing the proof transcript impractical), they could be built using a public cloud provider's trusted computing offering (e.g. Google Confidential VMs). The person making the challenge could make it so the derivation (NixOS for example) to produce the entire image executing on the cloud provider in a deterministic way (with publicly known source, and hash codes of each stage publicly available). Then, from the code with the known hash, they use the vTPM to generate an attestation that a key was generated while the vTPM PCRs were in a known state (corresponding to the publicly reproducible hashes), and ensure the only way to access the key from the instance is via an exploit. It would also include logic to generate and wrap a Bitcoin wallet key, and emit the public key (with the attestations and a signature linking back via a vTPM attestation to the cloud provider's key). This way, unless the cloud provider is also in on the scam, people could be assured that the OP isn't scamming them.
It is a price signal. They expect to lose the money they want to show that nobody has an automated swarm just pwning every server running PHP connected to the internet. At least not yet, on day 5 and counting.
> A reminder that this cannot falsify the existence of an exploit, trivial or otherwise.
No, it's a not a zero knowledge proof. But if the site owner is a generally trustworthy person, then I feel that this effort is strong proof the exploit is not trivial.
The server is getting overloaded, so here's the text for reference:
Steal my Bitcoin
0.65 hours without a successful hack
There is a bitcoin key hidden on this server worth about $502.
It is accessible to the PHP user account through the print-flag binary.
This PHP version was selected from before the PHP2SHELL CVEs were released.
First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
Challenge wallet
Explorer ↗
bc1qlnu5…t3cxqy
0.00625104 BTC
≈ $502.35 USD
stealmybitcoin.com · Terms of participation
For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol
These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.
Regardless, I'm guessing the smart hackers aren't going to bother.
Great way to inject some price information into the “AI automates exploits at scale” narrative. “AI can now chain complex exploits, it’s point-and-click pwnage, you say? Over or under $500 a pop?”
It’s not very much information, I agree. Even such scant information, however, is a significant and refreshing improvement on the current state of the narrative. Kudos to the servermaster, I say.
I'm seeing a few comments that say $500 isn't enough, and its not worth it for them to try to hack it.
But if it costs fewer than $500 of tokens in an AI, then it seems like it is? I thought a lot of the claim people are making is that you dont actually need to hack anything you just ask an AI and it does it. The exploitable bug is public and documented. All the pieces are theoretically there, and there are repeated claims that AI is trivializing exploits and its super easy to hack things now.
If that were true, and someone can hack the server for less than $500 of tokens, its an easy profit.
I sometimes posted a donation link or joke site and got surprisingly large donations.
Made my tax audit rather painful.... "I posted a joke on the internet about binary numbers not being worth anything and someone gave me $10k of bitcoin that I'm now declaring - is it income for the work of writing the joke, or a gift? The sender likely didn't know who I was, and was likely overseas but I cannot prove who they were or which country they were in".
Wouldn't it be the same as what the tax authorities expect of street buskers, where something was done publicly (just here on the internet) and as a result randoms gave you money/cash (here again the digital equivalent) after the fact with no strings attached?
> The non default php settings he set break the exploit.
If that's the case, then there is a mitigation for all vulnerable versions, but the team that released php2shell said there is absolutely no complete mitigation and every PHP version between 5.4 and these latest updates is absolutely vulnerable. So which is true?
This will go unclaimed for a bit. It may still get claimed within the day, but
People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…
The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.
That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I, and many of my friends and cooks could take this easily. The difference is we know not to.
I suspect this is going to be more a point about the fact that most PHP server configurations do not have the ability to be exploited by the recent vulnerability that made people think the AI vulnpocalypse was here
If the actual price tag behind the “AI can trivially automate exploits, be afraid” narrative is more like $15,000 and not like $150, that puts the narrative in a very different light.
A different light, yes. But even $15k would represent a huge change in the threat landscape, particularly for nation-state actors that are already willing to spend millions on the right target.
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
> The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.
The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…
The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.
Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.
Two economists walk past $500 lying on the ground. “I know nobody leaves hundred dollar bills lying on the ground, but that really did look like five hundreds bucks back there, should we go back for it?” Says the first. The second replies “I don’t turn around for less than $15,000.”
Besides, someone is probably watching so they can learn how to pick up $15,000 whenever they find it! I'm most certainly not going to tell them.
Hillarious how people are like "I don't want my AI agent to do this hack, because people are probably watching the server, so they will see what the agent outputs." Hah, they can also prompt an agent for less than $500 to find out (also the CVE is public info).
It really just depends on how someone values their own work. When I was a child, I grabbed any money I saw on the ground, even pennies behind crates, as that was my sole "income". I don't anymore.
Your joke does remind me of a time I was doing a work errand with a colleague and he was upset that I didn't turn around and park so we could rush to pick up the cash that was on the ground that we passed. It was probably a dozen bills, but we weren't close enough to see face value. The premise was absurd to me but for him it would have been worth it. At the time we were just out of high school, and his very wealthy parents would have given him anything he asked for anyway, so I didn't see why he cared.
I suspect you could have quite an interesting experiment at Devos or Martha's Garden or similar; I suspect Warren Buffet would stop to pick up a dollar.
I'm probably not going to stop at freeway speeds for coins or a few bills, but at surface-street speeds? I probably would, more for the game than for the value.
> a fundamental misunderstanding of the economics at play
I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?
Let's assume I am a white-hat hacker with access to this allegedly widespread exploit. Obviously, I understand why a nation-state attacker wouldn't want to share their exploit here but what do I as a random citizen stand to lose? It's not like I care about hoarding the exploit to pwn innocent civilians.
You, the white-hat hacker would be concerned that your attack exploits payload will be logged either by the potentially malicious site operator who could be using this to gather various working exploits, or by other bad actors who already exploited the site before you. Unless your exploit itself is already well known and fully public that is.
What an insufferable comment. For all the hullabaloo discussing the economic value of time about $500 being an insufficient prize, you still spent what I can only assume is several minutes penning a comment that derives you zero economic value whatever.
I thought the exploit was trivial and we all need to be extremely worried and take down our php services until a patch? So what exactly are you handing over?
> I, and many of my friends and cooks could take this easily.
This is a server that allegedly has some BTC on it (AFAICT it’s just a claim made by the website itself, zero corroborating evidence), definitely nothing else valuable, and likely has a lot of monitoring to capture whatever exploit you send, and with a less-vulnerable-than-usual setup. Unless you’re really desperate for the money and want to take a gamble on the server having the not very meaningful bounty it says it has, it’s strictly negative value compared to the average production php server that’s still unpatched. If I have a working exploit I’m mass deploying against everyone, I too would skip this one, similar to how mass market malware tends to disarm itself when it detects security research tooling.
No, I don’t think actual working exploit is trivial either, but people are wayyyy overselling this stunt in this thread.
The average PHP server that is unpatched now will remain unpatched after OP publishes the exploits because that server’s admin is clearly not scouring the web for security vulnerabilities.
Also, an increasing number of admins of PHP servers probably are no longer alive, so they will not be applying security patches.
80h ago we had no info other than a vague post from the php page saying a massive security flaw will be announced tomorrow. And a post from a PHP core dev saying shut it all down.
Everyone with inside info was sounding the alarm so the rest of us had to take it incredibly seriously.
This is where I am, currently. There's a lot of talk about the low opportunity-cost here, but I think that relies on the assumption that there also isn't a single opportunistic person out there with access to the RCE. That doesn't strike me as a strongly supported assumption, in my experience.
You may need to brush up on your game theory. It's worth it to spend $1 for a 1% chance to win a million dollars. You don't need to be certain the key is there for it to be worth it to do a supposedly trivial exploit.
Shouldn’t the expected value of attempting this somehow include the likelihood of the key actually being on the machine? Surely the probability is much higher than 0? I would guess the expected value for actually being the first one is around $300, not 0
There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.
Yeah, AI seems like a good shift in "narrative making." It's easy to ask AI "give me an efficient way to "confirm or deny this narrative" and have something like this go viral. This is good because it makes narratives more truthful
Because only a fraction of people would double check (AI or otherwise), AI making it easier to flood the zone with fine tuned spam actuallu has the opposite effect. We're seeing this at play at a large scale anywhere an election is happening right now. The narratives are even less truthful than before.
If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'
I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?
This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.
random sites generally don't log carefully, or watch their logs if they do. so the risk to hacking them is low. this site almost certainly logs very aggressively. so the risk to hacking it is high.
based on differential risk, attackers will choose targets differently. they might reason that the risk/reward on this obvious trap is not worth it. but on joe shmo's php emporium, the reward is less, but so is the risk, and it might pencil out.
> that's good news because my webserver also has logging
In the future, every website will carry a little blurb of text in the footer of their pages intended to scare off would-be hackers and their AI agents:
“The server of this website employs append-only remote logging and state-of-the-art monitoring and intrusion detection. Unauthorized access or attempts there of WILL be prosecuted to the fullest extent of the law. The outcome of such prosecution is and always will be astronomical amounts of money in damages that the guilty party will pay to the victim, alongside decades of prison time for the party guilty of computer crimes. Do not even try.”
That's always the case for a novel exploit. There isn't a lot of value in popping somebody's PHP blog, so people who've invested time and money into a zero-day exploit have little incentive to use it for that purpose.
The white hats want to extend the time before an exploit is in the hands of the masses who might do so just for the fun of it, and the black hats want to use it on high-value targets.
I think the point is that this is completely the opposite of the narrative that was pushed about this bug - that there would be thousands+ of AI agents actively compromising every vulnerable site automatically regardless of value within minutes of the fix being released into the wild. Well, now it's 3 days after, and this has been up for 3.5 hours, and nobody has taken it yet.
It’s not a 0day it’s now 5 days and counting since disclosure. Nobody is gaining value sitting on an exploit for a vulnerability which is being actively patched.
You would have a point if it was still a 0 day. The patch is out, and open source. Anyone who cares has a bunch of the pieces for putting together their own exploit.
Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.
So you are therefore arguing for the author's point.
The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.
In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.
The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.
This logic doesn't work here, because it relies on the premise that you alone potentially have an unreleased zero-day exploit, which is not the case.
If prompting an AI could exploit this for less than $500 in token spend, then you should immediately do so, since if you don't, in a few minutes' time someone else will.
This is evidence of absence, though. Unexploited PHP servers are evidence of absence of exploits, and exploited PHP servers are evidence of presence of exploits. “Absence of evidence” would be if there were no PHP servers.
An unexploited PHP server means "there exists a configuration that is not exploitable".
Which is how hundreds of previous exploits have had people publish information on what to temporarily tweak/disable/block, such that the exploit wouldn't work.
What is novel about this case, and for which i do not know the explanation, is that nobody in-the-know was willing to confirm them before the CVE dropped.
right: either it’s so hard to exploit that $1,000 isn’t enough to risk “giving away” your exploit chain or actual exploitation of this bug is impractical, either way the CVEpocalypse is overblown
> There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view.
Clearly people aren't cynical enough.
I find it strange no one in this thread has even considered the possibility that the private key of the wallet isn't on the machine.
OP gets their working exploit neatly logged (or even multiple approaches), keeps the money, strengthens the illusion the exploit isn't that bad, and gets a free $500 on top from someone who added to the wallet.
Except, it’s the top entry in HN right now. It could have gone down to the hug 20 minutes after it was posted, so nobody much has had a chance to have a go at it.
You can see the commenters arguing with me about ASLR in the old thread. Half the commenters here, including quite a few "thought leaders" (not gonna name names but everybody knows who they are), insist that there are ways to implement this exploit at scale without having to do rowhammer-style spam brute forcing. I am still waiting. There's a lot of FUD and hearsay in the tech circles grapevine but very little evidence of actual working exploits against a modern Linux server outside of "attempts".
Maybe link to the argument? I can only find two comments from you on that post and only one person replied. That one reply isn’t from a “thought leader” either.
What point is an anonymous online post proving? Can anyone verify that the private key actually exists? Or which version of PHP the site is running? Or if it is running PHP at all?
I reconfigured nginx on one of my servers to log all attempted multipart POST requests. Been tailing the log, and while there is a trickle of entries, they all are for empty forms, none are php2shell specific.
Interestingly enough, virtually all of these come from the Google Cloud IP space. There was a single hit from China and two from Europe.
OP just posted that there's a solve. And from a previous update thread apparently their first config was not actually exploitable? So ... seems like it is happening. Maybe not instantly, at least not if the site just remains down for hours because it's functionally DoSed, but it still is apparently exploitable.
yeah between updating the challenge and it getting solved only like a bit over 2 hours passed and that is with the server probably still being super overloaded
> Yes! Was serving pure html through PHP before 13:00-ish UTC when I added that page
Yet somehow people on this site still cheerfully use those products for serious work. Can you not see what's being attempted here? They're trying to have you outsource your thinking so they can shape it.
Only works for low value targets, where you don't have to trust your coworkers. You would also need to set up the detection capabilities to be figure out the intrusion path, or the flag is pretty meaningless. And at that point you may just as well put tripwires onto sensitive files.
378 comments
[ 0.24 ms ] story [ 31.6 ms ] threadBut if they were not, and had ill intentions, they might see $500 as a very inexpensive way to purchase an offensive malware tool to use against others.
OP (and anyone else who exploits the server) would be able to see the transcript between the backend and the vulnerable server, containing the payload customised for the server, but not the actual code of the backend. This would be useful if it was a 0day vulnerability, but with a disclosed vulnerability getting a payload that doesn't work except on their server, without the code that generated it, might not be that much value over what they already have.
That said, there are other ways to scam by structuring things like the OP (none of this should be taken to imply the OP has actually done this, but rather why this structure as a general approach might be a bad idea):
* This could be a 'stone soup' scam where the OP has the wallet keys (obviously), and puts this up to bait the addition of more funds into the wallet by other interested people. The key might not actually even be on the server, or it might not be vulnerable. Once sufficient other people add funds, the OP could withdraw the funds, recouping their original funds plus anything others added. * This could be run as a propaganda scam either to falsely sell that it isn't an easily exploitable vulnerability when it is (by making it unreasonably difficult to exploit compared to real-life deployments), or to over-inflate how exploitable it is (by an insider withdrawal from the wallet). Manipulating public opinion could allow an attacker with a working exploit more time, or help to sell services to fix the problem.
I think an alternative scheme that is less vulnerable to scams would be to have a ZKVM (Risc0 or similar) executing vulnerable code, such that the attacker needs to produce a zero knowledge proof transcript of getting the ZKVM into a particular state that would not be possible if they didn't have an exploit. It should also take an Ethereum address as a public input. Then write an Ethereum contract that will allow funds to be transferred to the public input Ethereum address if submitted with a valid proof transcript, and back to the source of funds after some time has passed. Everyone who wants to add to the jackpot could deploy their own version of the contract, so the one proof transcript could claim from all of them, but if unclaimed the funds go back to the source.
Alternatively (avoiding the risk exploits may be so large as to make the cost of producing the proof transcript impractical), they could be built using a public cloud provider's trusted computing offering (e.g. Google Confidential VMs). The person making the challenge could make it so the derivation (NixOS for example) to produce the entire image executing on the cloud provider in a deterministic way (with publicly known source, and hash codes of each stage publicly available). Then, from the code with the known hash, they use the vTPM to generate an attestation that a key was generated while the vTPM PCRs were in a known state (corresponding to the publicly reproducible hashes), and ensure the only way to access the key from the instance is via an exploit. It would also include logic to generate and wrap a Bitcoin wallet key, and emit the public key (with the attestations and a signature linking back via a vTPM attestation to the cloud provider's key). This way, unless the cloud provider is also in on the scam, people could be assured that the OP isn't scamming them.
No, it's a not a zero knowledge proof. But if the site owner is a generally trustworthy person, then I feel that this effort is strong proof the exploit is not trivial.
For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol
These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.
Regardless, I'm guessing the smart hackers aren't going to bother.
If that were true, and someone can hack the server for less than $500 of tokens, its an easy profit.
i picked the wrong profession
Made my tax audit rather painful.... "I posted a joke on the internet about binary numbers not being worth anything and someone gave me $10k of bitcoin that I'm now declaring - is it income for the work of writing the joke, or a gift? The sender likely didn't know who I was, and was likely overseas but I cannot prove who they were or which country they were in".
Also, I live in a place where that was probably many months pay to the auditor.
≈ $2,018.29 USD
Now
The non default php settings he set break the exploit.
If that's the case, then there is a mitigation for all vulnerable versions, but the team that released php2shell said there is absolutely no complete mitigation and every PHP version between 5.4 and these latest updates is absolutely vulnerable. So which is true?
Unfortunately that's only enough to serve a static site and definitely not why or how anyone deploys PHP.
People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…
The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.
That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I, and many of my friends and cooks could take this easily. The difference is we know not to.
Make it $15-25k and it’ll get yoinked instantly.
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
I think what he's saying is if you had that, you certainly wouldn't use it on a known honeypot for 500 bucks.
Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.
The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…
The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.
Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.
It is just kind of fun to poke at something like this.
> Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I don't give a shit about the $500, nor would I ever attempt actually hacking something that wasn't explicitly a game (like this).
> The difference is we know not to.
Borrrrinnnggggg
Sure you can.
Hillarious how people are like "I don't want my AI agent to do this hack, because people are probably watching the server, so they will see what the agent outputs." Hah, they can also prompt an agent for less than $500 to find out (also the CVE is public info).
Your joke does remind me of a time I was doing a work errand with a colleague and he was upset that I didn't turn around and park so we could rush to pick up the cash that was on the ground that we passed. It was probably a dozen bills, but we weren't close enough to see face value. The premise was absurd to me but for him it would have been worth it. At the time we were just out of high school, and his very wealthy parents would have given him anything he asked for anyway, so I didn't see why he cared.
I suspect you could have quite an interesting experiment at Devos or Martha's Garden or similar; I suspect Warren Buffet would stop to pick up a dollar.
I'm probably not going to stop at freeway speeds for coins or a few bills, but at surface-street speeds? I probably would, more for the game than for the value.
I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?
Let's assume I am a white-hat hacker with access to this allegedly widespread exploit. Obviously, I understand why a nation-state attacker wouldn't want to share their exploit here but what do I as a random citizen stand to lose? It's not like I care about hoarding the exploit to pwn innocent civilians.
I thought the exploit was trivial and we all need to be extremely worried and take down our php services until a patch? So what exactly are you handing over?
> I, and many of my friends and cooks could take this easily.
Extreme doubt.
No, I don’t think actual working exploit is trivial either, but people are wayyyy overselling this stunt in this thread.
Also, an increasing number of admins of PHP servers probably are no longer alive, so they will not be applying security patches.
Now it's only worth it to hack a website that's asking to be hacked if the prize is $15k.
Everyone with inside info was sounding the alarm so the rest of us had to take it incredibly seriously.
No, you couldn't.
I genuinely have no idea how to even start calculating this probability. How would we do it? Is there reliable data on honeypots?
It clearly isnt happening.
If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'
That's pennies for something like this.
Add two zeros and it might get nabbed.
That's part of the point. $500 or $1000 is a trivial amount. Since the money is still there, there's currently no trivial exploit.
> requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done
Depending on the exploit, and the visibility stack on the server, one may or may not be able to determine how the rabbit got in the hat.
This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.
based on differential risk, attackers will choose targets differently. they might reason that the risk/reward on this obvious trap is not worth it. but on joe shmo's php emporium, the reward is less, but so is the risk, and it might pencil out.
Well that's good news because my webserver also has logging
In the future, every website will carry a little blurb of text in the footer of their pages intended to scare off would-be hackers and their AI agents:
“The server of this website employs append-only remote logging and state-of-the-art monitoring and intrusion detection. Unauthorized access or attempts there of WILL be prosecuted to the fullest extent of the law. The outcome of such prosecution is and always will be astronomical amounts of money in damages that the guilty party will pay to the victim, alongside decades of prison time for the party guilty of computer crimes. Do not even try.”
What risk?
The white hats want to extend the time before an exploit is in the hands of the masses who might do so just for the fun of it, and the black hats want to use it on high-value targets.
It may not have happened this time, but we are rapidly approaching a future where this will be the case for every exploitable bug.
Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.
The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.
In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.
The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.
No, I will not spend $5 in tokens to claim your $1000 bounty. My $5 exploit is worth more than $1000. Thank you very much.
If prompting an AI could exploit this for less than $500 in token spend, then you should immediately do so, since if you don't, in a few minutes' time someone else will.
Which is how hundreds of previous exploits have had people publish information on what to temporarily tweak/disable/block, such that the exploit wouldn't work.
What is novel about this case, and for which i do not know the explanation, is that nobody in-the-know was willing to confirm them before the CVE dropped.
No it doesn’t. An equally plausible explanation is that nobody has tried. (Replace “PHP server” with “someone’s vehicle.”)
Clearly people aren't cynical enough.
I find it strange no one in this thread has even considered the possibility that the private key of the wallet isn't on the machine.
OP gets their working exploit neatly logged (or even multiple approaches), keeps the money, strengthens the illusion the exploit isn't that bad, and gets a free $500 on top from someone who added to the wallet.
https://news.ycombinator.com/item?id=50188948
I am still waiting for them to put their money where their mouth is.
Sometimes thought leaders make mistakes ;-)
Interestingly enough, virtually all of these come from the Google Cloud IP space. There was a single hit from China and two from Europe.
> Yes! Was serving pure html through PHP before 13:00-ish UTC when I added that page
If it gets swept you are breached.