Hacker News Reader

Comment by majorchord | Hacker News Reader

> I have not seen an exploit in the wild.

How would you see one? Have you deployed your own army of honeypots that are actively logging and looking for corrupt IP options packets? If you're not already looking for it, I think it's very likely that most people who get hacked will have no way of knowing how it happened, so we can't consider those incidents as being a result of this particular bug.

Are you actually monitoring for this specifically or just trying to use a sample size of 1 group of servers to prove something?

View on HN

The recent wave of vulnerabilities has actually prompted a lot of people to set up honeypots, monitoring, etc. and the rate of actual exploits has been notably very low for the general public.

Most of the October CVEs we've seen were situations that require an extremely complex chain of attacks - amazing if you want to break into a bank, or fuck up some grocery freezers, not so useful for scanning random public boxes and doing "hacks of opportunity"

Apologies for the lack of links - it's a scattering of random people I've read talking about this, not any coordinated study. But if you read between the lines on all of the threads about these CVEs, you'll notice a lack of "I was hit by this" stories - which is pretty normal for more complex vulnerabilities.

The reason these sat unnoticed for so long is precisely because it's difficult to actually exploit them.

If anyone has anecdotes to the contrary, I'm definitely interested in hearing it, of course!

I've been counting inbound packets with options set on my edge routers for a couple of days. So far: zero.

Jesus H Christ! the bug is a narrow use-after-free race that needs SYNs carrying ipv4 options to make it to the box. I do not need an army of honeypots to tell you it most likely doesnt to have a way into a classic 443 machine... come on now.

Except I was able to use the PoC to exploit several of my "classic 443 machines" sitting on the internet, like millions of other servers out there.

You had services running that actually use MPTCP?

Not uncommon, it is enabled by default in Go.

I think it's used internally within Caddy?

MPTCP is not a requirement for the bug, but yes, I had several, as I use it to aggregate multiple ISP connections.

https://access.redhat.com/security/vulnerabilities/RHSB-2026...

> Multipath TCP is not a required condition for this flaw.

I contemplated not even responding to you because of how unbelievably abusive and rude I have watched you be on IRC to me and many others for literally decades, and was a big reason why I quit, but I decided this issue was more important for everyone else's sake that I should still speak up.

Reply on news.ycombinator.com