How is this even possible btw? Doesn’t the private key have to match the public key? Surely this would have been noticed earlier if it had a short public key as well?
Cryptographic hash functions are functions that take a variable-length input and return a fixed-length output, which can be used in, for example, a digital signature.
ca cert issue is a lot harder to exploit than a lot of people are acting. ... Not that it magically makes it less important to fix, but perhaps a reason to not let the stress rise just yet.
20 replies
Context: PHP Remote code execution.
Link to Lemmy thread
Just make sure not to get MITM'd by someone whose secret key password is "4".
Not the password. The key. The entire key (excluding metadata) is
0b100.How is this even possible btw? Doesn’t the private key have to match the public key? Surely this would have been noticed earlier if it had a short public key as well?
They use Cryptographic hash functions, so the actual key length is not reflected in the resulting hash length.
“Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, [and ] 237.”
Don't worry, they've changed their key. It's "5" now.
It's Five 5s, uncrackable.
There’s a PHP rce issue, and a ca cert issue, both going around right now. Good times.
ca cert issue is a lot harder to exploit than a lot of people are acting. ... Not that it magically makes it less important to fix, but perhaps a reason to not let the stress rise just yet.
Yea. I don't think most normies, not even most home server nerds have much real exposure to this particular vulnerability.
So everyone, go harden your infrastructure, because it's the right thing to do, not just because of this.
This is why i steered out of cybersecurity
It would interest me to do research to find exploits, or red team / pen testing type stuff. But incident response seems pretty stressful.
Switch them off or take them offline first. No point in exposing them to unknown exploits.
Yep, that's what we did. Waiting for je patched builds to finish now.
I was thinking of upgrading my servers recently to get away from a very old Ubuntu version. Good thing I waited.
how is that good?
Because now I don’t need to SSH into the damn thing again.
I’m lazy.
Mastodon is all over with this too.