4chan - the Internet hate machine

  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account

Will the 4chan hack be the end of it?

  • Yes, goodbye forever 4chan

    Votes: 1,051 18.2%

  • No, they will rise from the ashes, stronger than ever

    Votes: 363 6.3%

  • This will rattle them but it will be forgotten about next week

    Votes: 2,396 41.4%

  • I am just here for the janny phonebooking

    Votes: 1,122 19.4%

  • What the fuck is 4chan

    Votes: 252 4.4%

  • Yotsuba&!

    Votes: 599 10.4%
  • Total voters
    5,783
BigBadBastich said:
Has it been covered by news outlets? They covered the site before on Fox years ago and other places during the mid 2010's controversies like Fappening and GG.
Click to expand...
Daily news I guess
20250417_100839.webp
 
Last edited by a moderator:
GilaCutter said:
This may come to you as a shock, but I don't consider some random twitter troons to be "mainstream".
Click to expand...
The most mainstream coverage I've seen so far is this.
He did research on what /qa/ is and didn't call 4chan a heckin nazi website so it's already ahead of most journos.
 
Last edited:
ringtones said:
you ruined my night thanks
Click to expand...

Do you like Kenny G? His early work was a little too synthpop for my tastes, but when Gravity came out in '85, I think he really came into his own, commercially and artistically. The whole album has a clear, crisp sound, and a new sheen of consummate professionalism that really gives the songs a big boost. He's been compared to Grover Washington Jr, but I think Kenny has a much more bitter, cynical sense of humor. In '86, Kenny released this, Duotones, his most accomplished album. I think his undisputed masterpiece is "You Make Me Believe", a song so saccharine, most people probably don't listen to the lyrics. But they should, because it's not just about the pleasures of companionship, and the importance of romantic dedication, it's also a personal statement about Kenny himself.
 
Nothing Is Written said:
Taking longer than expected I fucking hate this codebase.

View attachment 7233849

No MIME confirmed, assumes PDFs are safe and passes them to the shell, Ghostscript isn't sandboxed and runs as the same process I'm fucking losing my mind.

I have two versions of the server running right now to see how Ghostscript interacts with legacy FBSD. Ghostscript itself was really vulnerable ~v9.x so it's a rabbit hole right now.
Click to expand...
all of the image uploads make calls to command line processors that are intended to be the file type validation method. the only sanitization the others have is anti cmd injection. old versions of gifsicle have rce vulns, and old versions of pngcrush have BoF DoS vulns that maybe could be weaponized to get RCE by someone good at binex. the cmd injection filters would give you some bad bytes, but its possible that every single file upload type is vulnerable.
 
23iwakura23 said:
all of the image uploads make calls to command line processors that are intended to be the file type validation method. the only sanitization the others have is anti cmd injection. old versions of gifsicle have rce vulns, and old versions of pngcrush have BoF DoS vulns that maybe could be weaponized to get RCE by someone good at binex. the cmd injection filters would give you some bad bytes, but its possible that every single file upload type is vulnerable.
Click to expand...

It gets worse.
 
I realize this is a thread about 4chan but can we fucking stop uploading "favorite images" or whatever? THIS isnt an image board and it's just shitting up the thread because its got nothing to do with the topic at hand.
 
23iwakura23 said:
all of the image uploads make calls to command line processors that are intended to be the file type validation method. the only sanitization the others have is anti cmd injection. old versions of gifsicle have rce vulns, and old versions of pngcrush have BoF DoS vulns that maybe could be weaponized to get RCE by someone good at binex. the cmd injection filters would give you some bad bytes, but its possible that every single file upload type is vulnerable.
Click to expand...
Do you think it's possible this exploit has been used in the past by bad actors who DIDN'T make it obvious they breached the server?
Like just someone exporting data and then returning everything to normal?
 
Smooth Jazz said:

Do you like Kenny G? His early work was a little too synthpop for my tastes, but when Gravity came out in '85, I think he really came into his own, commercially and artistically. The whole album has a clear, crisp sound, and a new sheen of consummate professionalism that really gives the songs a big boost. He's been compared to Grover Washington Jr, but I think Kenny has a much more bitter, cynical sense of humor. In '86, Kenny released this, Duotones, his most accomplished album. I think his undisputed masterpiece is "You Make Me Believe", a song so saccharine, most people probably don't listen to the lyrics. But they should, because it's not just about the pleasures of companionship, and the importance of romantic dedication, it's also a personal statement about Kenny himself.
Click to expand...
yeah, I really like his christmas album, I had it on casette as a kid. I got into the sax a little bit because I'm a big fan of Chuck Greenberg (another fuckin' jew but what can you do) of Shadowfax. I kind of have a Lyricon
 
Nothing Is Written said:
Taking longer than expected I fucking hate this codebase.

View attachment 7233849

No MIME confirmed, assumes PDFs are safe and passes them to the shell, Ghostscript isn't sandboxed and runs as the same process I'm fucking losing my mind.

I have two versions of the server running right now to see how Ghostscript interacts with legacy FBSD. Ghostscript itself was really vulnerable ~v9.x so it's a rabbit hole right now.
Click to expand...
23iwakura23 said:
all of the image uploads make calls to command line processors that are intended to be the file type validation method. the only sanitization the others have is anti cmd injection. old versions of gifsicle have rce vulns, and old versions of pngcrush have BoF DoS vulns that maybe could be weaponized to get RCE by someone good at binex. the cmd injection filters would give you some bad bytes, but its possible that every single file upload type is vulnerable.
Click to expand...
Nothing Is Written said:
It gets worse.
Click to expand...
If you're willing, I would love to read a longform post or thread with your analysis of the hack and other flaws in 4chan's code and the environment in which it ran.
 
Unlicensed Shitposter said:
Do you think it's possible this exploit has been used in the past by bad actors who DIDN'T make it obvious they breached the server?
Like just someone exporting data and then returning everything to normal?
Click to expand...
Yes, absolutely. It is not even a controversial question really. All you need is one successful RCE chain and then you get a shell and then you do whatever you want. You can be as quiet and non-destructive as you want after that point.
 
You must log in or register to reply here.
Back
Top Bottom