Plagued 4chan - the Internet hate machine

  • 🐕 I am attempting to get the site runnning as fast as possible. If you are experiencing slow page load times, please report it.

Will the 4chan hack be the end of it?

  • Yes, goodbye forever 4chan

    Votes: 1,031 18.5%

  • No, they will rise from the ashes, stronger than ever

    Votes: 343 6.2%

  • This will rattle them but it will be forgotten about next week

    Votes: 2,322 41.6%

  • I am just here for the janny phonebooking

    Votes: 1,093 19.6%

  • What the fuck is 4chan

    Votes: 218 3.9%

  • Yotsuba&!

    Votes: 569 10.2%
  • Total voters
    5,576
BigBadBastich said:
Has it been covered by news outlets? They covered the site before on Fox years ago and other places during the mid 2010's controversies like Fappening and GG.
Click to expand...
Daily news I guess
20250417_100839.webp
 
Last edited by a moderator:
  • Feels
Reactions: Foreverial
GilaCutter said:
This may come to you as a shock, but I don't consider some random twitter troons to be "mainstream".
Click to expand...
The most mainstream coverage I've seen so far is this.
He did research on what /qa/ is and didn't call 4chan a heckin nazi website so it's already ahead of most journos.
 
Last edited:
  • Like
  • Informative
Reactions: Sectonia 64 ( ͡ᵔ ͜ʖ ͡ᵔ ), Nothing Is Written, Fucker Carlson and 2 others
ringtones said:
you ruined my night thanks
Click to expand...

Do you like Kenny G? His early work was a little too synthpop for my tastes, but when Gravity came out in '85, I think he really came into his own, commercially and artistically. The whole album has a clear, crisp sound, and a new sheen of consummate professionalism that really gives the songs a big boost. He's been compared to Grover Washington Jr, but I think Kenny has a much more bitter, cynical sense of humor. In '86, Kenny released this, Duotones, his most accomplished album. I think his undisputed masterpiece is "You Make Me Believe", a song so saccharine, most people probably don't listen to the lyrics. But they should, because it's not just about the pleasures of companionship, and the importance of romantic dedication, it's also a personal statement about Kenny himself.
 
  • Like
  • Winner
Reactions: Vernon Dozier, CEO of Autism and datura_binge
Nothing Is Written said:
Taking longer than expected I fucking hate this codebase.

View attachment 7233849

No MIME confirmed, assumes PDFs are safe and passes them to the shell, Ghostscript isn't sandboxed and runs as the same process I'm fucking losing my mind.

I have two versions of the server running right now to see how Ghostscript interacts with legacy FBSD. Ghostscript itself was really vulnerable ~v9.x so it's a rabbit hole right now.
Click to expand...
all of the image uploads make calls to command line processors that are intended to be the file type validation method. the only sanitization the others have is anti cmd injection. old versions of gifsicle have rce vulns, and old versions of pngcrush have BoF DoS vulns that maybe could be weaponized to get RCE by someone good at binex. the cmd injection filters would give you some bad bytes, but its possible that every single file upload type is vulnerable.
 
  • Informative
  • Horrifying
  • Agree
Reactions: Ashen OA'non, gentoofag, Guy who lurks and 4 others
23iwakura23 said:
all of the image uploads make calls to command line processors that are intended to be the file type validation method. the only sanitization the others have is anti cmd injection. old versions of gifsicle have rce vulns, and old versions of pngcrush have BoF DoS vulns that maybe could be weaponized to get RCE by someone good at binex. the cmd injection filters would give you some bad bytes, but its possible that every single file upload type is vulnerable.
Click to expand...

It gets worse.
 
  • Lunacy
Reactions: YoRHa No. 2 Type B
23iwakura23 said:
all of the image uploads make calls to command line processors that are intended to be the file type validation method. the only sanitization the others have is anti cmd injection. old versions of gifsicle have rce vulns, and old versions of pngcrush have BoF DoS vulns that maybe could be weaponized to get RCE by someone good at binex. the cmd injection filters would give you some bad bytes, but its possible that every single file upload type is vulnerable.
Click to expand...
Do you think it's possible this exploit has been used in the past by bad actors who DIDN'T make it obvious they breached the server?
Like just someone exporting data and then returning everything to normal?
 
  • Thunk-Provoking
  • Like
Reactions: Hantavirus, Catastrophe-TM, YoRHa No. 2 Type B and 1 other person
Smooth Jazz said:

Do you like Kenny G? His early work was a little too synthpop for my tastes, but when Gravity came out in '85, I think he really came into his own, commercially and artistically. The whole album has a clear, crisp sound, and a new sheen of consummate professionalism that really gives the songs a big boost. He's been compared to Grover Washington Jr, but I think Kenny has a much more bitter, cynical sense of humor. In '86, Kenny released this, Duotones, his most accomplished album. I think his undisputed masterpiece is "You Make Me Believe", a song so saccharine, most people probably don't listen to the lyrics. But they should, because it's not just about the pleasures of companionship, and the importance of romantic dedication, it's also a personal statement about Kenny himself.
Click to expand...
yeah, I really like his christmas album, I had it on casette as a kid. I got into the sax a little bit because I'm a big fan of Chuck Greenberg (another fuckin' jew but what can you do) of Shadowfax. I kind of have a Lyricon
 
Nothing Is Written said:
Taking longer than expected I fucking hate this codebase.

View attachment 7233849

No MIME confirmed, assumes PDFs are safe and passes them to the shell, Ghostscript isn't sandboxed and runs as the same process I'm fucking losing my mind.

I have two versions of the server running right now to see how Ghostscript interacts with legacy FBSD. Ghostscript itself was really vulnerable ~v9.x so it's a rabbit hole right now.
Click to expand...
23iwakura23 said:
all of the image uploads make calls to command line processors that are intended to be the file type validation method. the only sanitization the others have is anti cmd injection. old versions of gifsicle have rce vulns, and old versions of pngcrush have BoF DoS vulns that maybe could be weaponized to get RCE by someone good at binex. the cmd injection filters would give you some bad bytes, but its possible that every single file upload type is vulnerable.
Click to expand...
Nothing Is Written said:
It gets worse.
Click to expand...
If you're willing, I would love to read a longform post or thread with your analysis of the hack and other flaws in 4chan's code and the environment in which it ran.
 
  • Agree
  • Like
Reactions: Sneedifarms, XYZpdq Jr., The Taxman and 2 others
Unlicensed Shitposter said:
Do you think it's possible this exploit has been used in the past by bad actors who DIDN'T make it obvious they breached the server?
Like just someone exporting data and then returning everything to normal?
Click to expand...
Yes, absolutely. It is not even a controversial question really. All you need is one successful RCE chain and then you get a shell and then you do whatever you want. You can be as quiet and non-destructive as you want after that point.
 
You must log in or register to reply here.
Back