| |||||||||||||
Github compromised, or not?!Github compromised, or not?!Posted Mar 5, 2012 19:24 UTC (Mon) by PaXTeam (subscriber, #24616)In reply to: Github compromised, or not?! by aliguori Parent article: Github compromised
> [...]since for a brief period of time, it was a zero-day exploit that someone more malicious could have exploited.
0-day doesn't mean what you think it does. the bug *stopped* being 0-day (read: exploitable by only those in the know) the moment it was published. and from what i read, it wasn't Egor who introduced the bug in the first place or kept its existence secret for any significant amount of time, so if you really want to place blame for exposing github users to danger then you need to look no further than github & rails devs themselves.
(Log in to post comments)
Github compromised, or not?! Posted Mar 5, 2012 21:46 UTC (Mon) by aliguori (subscriber, #30636) [Link]
An exploit was in the wild before the fix was available. That makes it a 0-day. See http://en.wikipedia.org/wiki/Zero-day_attack
The terminology comes from the fact that many hacking groups would wait until patch Tuesday, and then disassemble the patch and create exploits. That means that these exploits would have a short window of time (usually a few days) where an administrator could be apply the fix before being concerned about the exploit.
0-day exploits are out in the wild before a fix is available.
Github compromised, or not?! Posted Mar 5, 2012 23:19 UTC (Mon) by PaXTeam (subscriber, #24616) [Link]
> An exploit was in the wild before the fix was available. That makes it a 0-day.
nope, it doesn't. and quoting wikipedia on it just shows how clueless both you and they are. first, the term '0-day' comes from the warez world where it had a different meaning ('fresh stuff', not released and traded anywhere else before that day, and the wiki is wrong on this meaning too, btw). since the late 90's it was then used for similar (initially) 'fresh stuff' traded among the hacker underground signifying the novelty of the exploit and the underlying security bug (read: unknown by anyone else). unlike a warez 0-day though which loses its 0-dayness after one day (there even used to be terms for 0-hour, etc), a 0-day exploit remains 0-day until either the exploit or the underlying bug becomes public. the Microsoft patch Tuesday has never had anything to do with the term, 0-day predates that event by a decade.
tl;dr: 0-day exploits are about bug/exploit secrecy, not fix availability.
Github compromised, or not?! Posted Mar 6, 2012 8:24 UTC (Tue) by Los__D (guest, #15263) [Link]
I just love people who can't accept that an expression doesn't mean what it used to mean. They provide for hours of fun.
Github compromised, or not?! Posted Mar 6, 2012 9:43 UTC (Tue) by epa (subscriber, #39769) [Link]
If you use bizarre and incomprehensible jargon like '0-day' instead of saying what you mean, then you deserve what you get.
Github compromised, or not?! Posted Mar 7, 2012 14:11 UTC (Wed) by pboddie (subscriber, #50784) [Link]
Well, Wikipedia is a wiki, obviously, and you can always improve it by adding references to the proper definitions.
Github compromised, or not?! Posted Mar 6, 2012 11:50 UTC (Tue) by nix (subscriber, #2304) [Link]
It was worse than that. The exploit was a design feature of Rails, and was documented as being a probable security hole! So this is an N-day exploit where N is the moment they documented it...
|
|||||||||||||