Comment by sillysaurusx | Hacker News Reader

Comment by sillysaurusx | Hacker News Reader

Everyone's coming up with hollywood style explanations (it's encryption! it's AI!) but as a former pentester, one of the more likely explanations is that it's probably just looking for vulnerabilities in an automated way. The first thing you do when you get an account somewhere as a pentester is to try to stuff as many strings as possible into weird places just to see what happens.

I don't think automated techniques are very effective (or weren't in 2016) but it seems more likely to be vuln hunting than choosing your Wordpress blog for encrypted comms vs established places like Twitter.

EDIT: faizshah https://news.ycombinator.com/item?id=34866169 points out that https://perishablepress.com/block-random-string-comment-spam... observes the same phenomenon, and the author notes that all of the IP addresses come from Russia. This seems to lend credence to the idea that it's looking for vulns, since, well, lots of traffic from Russia is looking for vulns.

While that’s possible, I don’t think that’s what’s happening here. This looks exactly like the behavior of an email burying attack (https://news.ycombinator.com/item?id=34868298).

Notice that the email addresses appear legitimate. Vulnerability scanners don’t use email addresses like those. One of those emails shows up in HIBP, indicating that it probably belongs to a real person.

Yes, most vuln scanners/exploits will inject random strings, then scrape the website looking for those strings, to see if injection is successful.

> I don't think automated techniques are very effective (or weren't in 2016)

Aren't the things that Tenable/Rapid7/etc do when scanning the network automated testing (techniques)? They seem effective at finding stuff. Or Metasploit.

I know at least sometimes they just do a simple check of the version of a service and report off that. We've issued vendor-supplied hotfixes that don't update the version number, and even though the software is patched, scanning tools will still report that it's vulnerable.

Back ported fixes in certain distros are a nightmare when doing vuln management.

"Scanner says its a vulnerable version based on the version number"

"Well, its up to date... Fix is back ported..."

Imagine having this argument, over dozens of tickets, every $time_interval.

Its no wonder actual critical issues go unfixed.

Yes. RedHat/CentOS/other LTS OSes are a nightmare for vulnerability scanning. I should say it's a bonanza for the security contractors and a nightmare for those of us that actually deal with it. So many pencil pushers throwing fits when you reply to the hundreds of vulnerability tickets with 'vendor back ported fix'. Also see PCI compliance.

I wouldn’t post encrypted comm to Twitter because I‘d suspect they keep tight logs on my IP. A random blog probably wouldn’t.

If you have to worry about that, then the encrypted communication is just theater.

WordPress logs all comment IP addresses forever.

That's what proxies are for.

I guess you‘d need a MITM SSL proxy to mask your originating IP? That seems to be a bit complicated for this usecase, if Twitter uses certificate pinning?

EDIT: I see now that I had a misconception here. There's no need for a MITM proxy in this case.

Why would you need the MITM part? Just use Tor, VPN or a forwarding proxy to tunnel all your traffic through an IP you can't be connected with.

They (used to?) block most Tor nodes and popular VPNs. But I just found out they launched an onion service last year!

It can't be what you say because there is no variance between posts.

ok, thanks for the explanation.

Automated vuln scanning seems to wax and wane in utility. I tend to use a lot of them to augment my work.

Automated web app scanners tend to lag heavily behind the current "trends" in web development - for example, only recently did BurpSuite start properly supporting auditing single page apps, and it still misses loads of shit.

Fuck, almost none of them can handle OpenAPI or Swagger specs properly, let alone WSDL files.

Handling complex authentication flows is still a nightmare, and almost none of the commercial scanner offerings have ways to "hook" or "trace" the app under test.

Reply on news.ycombinator.com