57 posts
GitHub now scans public and private repositories for WeChat keys and tokens — including those for WeChat Official Accounts, Mini Programs, and WeChat Pay — and forwards them to Tencent. You'll get a key leak notification on Tencent's side.
We're always setting permissions on folders and files in Linux with chmod 777. Those 777 digits are the permissions — just three numbers expressing three kinds of permission for three kinds of role. Let's break them down one by one.
At 12:15 a.m. yesterday my phone lit up; emails and text messages poured in one after another — network traffic alerts, CPU alerts. There must be something unspeakable behind this. Why do hundreds of threads keep dropping? Why do callbacks take forever to return? Why does MySQL keep getting assaulted?
A week ago someone kept hammering my traffic — see the post Notice: This Site Was Recently Hit by Malicious Traffic. Today, past 4 a.m., every monitoring channel started howling at me through app, DingTalk, email, and SMS: another scan. Fortunately, having been burned last time, I already had countermeasures ready, so there was essentially no damage.
Starting 2022-04-27 22:18:22, this site came under hostile traffic from a China Telecom residential broadband line in Jinjiang District, Chengdu, Sichuan, China. Here's the post-incident breakdown. Please browse this site normally and politely.
A follow-up to my last post, "Post-Mortem: Redis on 6379 Got Hacked, Turned into a Replica and Used to Mine Monero". This one analyzes the attacker's script and reproduces how they exploited unauthorized Redis access to get a shell and mine crypto.
We use Redis at work to cache and speed up static content. Since it was a dev environment I just spun up a Redis image in Docker and skipped setting a password, figuring iptables would keep me safe. Recently it started misbehaving.
On April 6, Debian published a security update fixing a cross-site scripting vulnerability found in the Python HTML sanitizing library bleach. python-bleach is an allowlist-based Python library that sanitizes HTML text by escaping or stripping tags and attributes.
GitHub Actions is a free CI/CD service, and it's now being abused to mine cryptocurrency. I introduce what GitHub Actions is in another post, so I won't repeat it here — see "First look at GitHub Actions Workflows".
Three days ago, two malicious commits were pushed into the php-src repository maintained by the PHP team on its git.php.net server. Both commits faked signatures — his own, and that of PHP creator Rasmus Lerdorf.
