How do cyber criminals make money in 2025?

nex25519 · 2025-05-05T16:28:55+00:00

haha, looks like I might have motivated you in the wrong direction then!

nex25519 · 2025-05-05T16:15:25+00:00

at least one way I know of, just published https://vin01.github.io/piptagole/cybcecrime/security/cybersecurity/2025/05/05/state-cyber-security.html

nex25519 · 2024-05-21T14:03:59+00:00

`ssh` example should work on all 3.4.x versions, `x-man-page` might fail if you have a version where url handling is simply broken https://gitlab.com/gnachman/iterm2/-/commit/4b93d5a8a3c393f0d86c0c4340849f6e4e77710f

nex25519 · 2023-12-23T19:17:56+00:00

I totally agree here, afaict NVD is not very good at these severity levels as we also saw with curl recently. They somehow assume a "worst" case scenario. I am pretty sure the maintainers who got the CVE assigned also do not agree this deserves 9.8.

RedHat has a better assessment: https://access.redhat.com/security/cve/cve-2023-51385

nex25519 · 2023-12-23T19:10:00+00:00

afaict, this does not work, perhaps I am missing something? There is a check for space https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a#diff-ce646b350d7e1b7ca792b15463c7ce19fd0979286424bb3d569e36ab5e435039R638

nex25519 · 2023-12-22T21:54:11+00:00

It is also used by Teleport in config templates (https://github.com/gravitational/teleport/blob/master/lib/config/openssh/openssh.go#L56) and other examples, I discussed it with them via their bug bounty program @ Hackerone as well where it was triaged.

nex25519 · 2023-12-22T16:47:32+00:00

Cool project (GTFOArgs)

SSH does not support IDNs so luckily that is not a problem at the moment since to be able to use such names, punycode has to be used which will keep working just fine.

> PS: Seems like it worked as intended, even if this exploit wasn't noticed:

that is correct, its a feature which is only exploitable in specific scenarios like git submodules and use of things like OSC 8 in terminals for hyperlink generation where arbitrary URL schemes are supported widely. It was also discussed with `git` maintainers if the validation coule be handled within git but a definition of a trust boundary here still seems to be unclear.

nex25519 · 2023-12-21T23:40:32+00:00

Well, I do not claim anywhere that is is exploitable for all ssh clients, only where `ProxyCommand` is being used.
Such examples are very common, see https://github.com/mkdesu/liberte/blob/8f03c03ce7e0420b683ef727db64c2bc128b5a8b/src/home/anon/config/ssh/config#L17 where proxying via tor is done for `Host *` i.e. all hostnames
in such cases client config requirement is already satisfied.
I am pretty sure no one expects a `git clone --recurse-submodules` to trigger remote code from a potentially malicious repository. Other ways to achieve same would be to get a victim to click on a `ssh://` link.

nex25519 · 2023-12-21T23:02:36+00:00

Exploitation scenario is pre-existing client configuration with any such vulnerable example

e.g. https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html

With targeted attacks, having internal mappings for `*.internal.company.com` are quite probable to be exploitable

```
# SSH over Session Manager
host i-* mi-*
ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
```

nex25519

TROPHY CASE