Until 2023 I ran our on-prem Jira, Confluence, Bitbucket, etc etc. I had an ancient 6c/6t box with about 24G of memory, and a couple 10K drives & 500G SSDs. It was fast, responsive, rock solid, and LDAP had everybody's accounts synced perfectly.
Then they strong-armed everybody but the largest enterprises onto their cloud. The alternative was painful (exporting/munging/importing to an alternative) so most of us went along for the ride. It took less than a year for them to start enshittifying their core product. Now it's basically unrecognizable from the product we used on-prem only three years ago.
I'll always be salty that my box of spare parts was superior to their cloud service in nearly every way.
Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.
Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.
Humans never visit but I have some websites with ancient cms's. When I got bored playing with them I download the html, change the extensions to php and replace the site with a static copy. People then tirelessly try to hack it since they have laundry lists of known vulnerabilities. (Now that I think about it I regret not making the admin area public for added nostalgia.)
Not that I follow my own advice, but a popped server can still be a liability for you. If you don't need it online I would take it down. Don't want to suddenly realise you've been an email spam node for several months.
It's fine, I am just being a nit, but static doesn't mean zero code. There is still a server and program turning a web request into a response. But in your case it's not your problem, it's cloudflare's.
I only mentioned it in the assumption they had a VM or shared hosting, in which case it's worth thinking about.
Before you can hack a static website you first have to realize it is one and you need the motivation to do so.
My "audience" is motivated by it being very outdated software. If non of the exploits work they will think I've patched everything.
There must be more interesting targets out there?
If you are capable enough to hack appache the choice of target makes no sense.
My best security layer is that one first has to even find my websites. If you do there are plenty of better targets among them. From the business end however the most secure look the least secure.
It's a shared hosting account, if I try to send bulk email they will immediately unplug it.
That leaves only the glory of pwning the last instance of some obscure cms?
It would probably make me laugh? Everything will be back up within a week. Nothing of value is lost.
It would be an automated scan and exploit across all services exposed, and the motivation is just to add a node to a botfarm/ddos network or spam node. Your website is already on a database if it has an SSL certificate and domain.
Like you said, shared hosting and low value server so you don't mind either way.
It's always worth thinking about, and the only true "protection" is logging, logging, logging. If you're not reading system logs, you'll never know your daemon was segfaulting for a while, nor will you see that SSH login. Or iptables egress traffic to weird places. Whatever. Point is, knowing what your box is up to, is the only way to meaningfully perform due diligence.
My point though, in my prior comment, was attack surface.
With PHP you have outdated code in the ORM/MVC/whatever. Then you have your code. At least with only a web server and static HTML, and entire litany, and the most likely part to get compromised, is not there any more.
In my 30+ years of experience dealing with people getting compromised, it's always been some asshat not doing security updates (eg, using a distro and updating daily). Or worse, just compiling stuff then not updating builds on a daily or weekly basis.
Outside of that, it's been bad PHP code. Or perl. Or whatever.
I think once out of all the times I've been called to clean up a mess, has it been the web server itself. Bearing in mind "I didn't update my OS/web server for a year, and now I got hacked!!" isn't "it was the web server", it's "dumbass didn't do security updates".
Anyhow.
You're not wrong, yes everything is vulnerable. But PHP + framework + PHP code bugs == 9999, web server == 1 of the time.
If it's a computer publicly visible on the internet then it has an attack surface, not having a scripting language enabled reduces it a lot but not entirely. There is still a web server involved in a static site being served, amongst other services that computers often have by default.
If it's shared hosting, still a problem, just not theirs.
When I stood up some sites last year, I used codenames for the subdomains thinking I was obfuscating a little. I didn't know about the transparency logs until months later.
Yeah... you have to remember to setup and fully secure the site before LE certs are issued or you're going to have a bad time. Learned that the hard way when I popped a couple dozen wordpress sites in one go.
On one hand yes, but on the other hand just configuring your server to refuse connections by IP address rather than server name seemed to drop roughly half the bots I ever see.
I always had a decent bit of background noise, I think hosting on AWS comes with that. But after someone linked to me on hackaday the bot traffic went through the roof. One link to you from a noteworthy website, and all bets are off forever.
Could be because of number of pages you have. At work we have several million public content pages, so a few badly behaving bots can already do a lot of damage.
For my personal website it’s 10x more bots but I barely notice because it’s a few pages.
I never had this issue really… until two years ago, new website new host… boom, hugged to death by thousands of bots per second. This is on an alicloud vps.
I recently brought up a website on a never-before-seen .com domain. Within about 10 mins of bringing it up with a SSL certificate, Anthropic came knocking on the door requesting the front page. (Almost certainty due to them watching the Public Certificate Transparency logs)
Had a bit setup a new Wordpress install before I could lock it down. I was very confused why a brand new install didn’t give me the setup page before seeing in the logs someone had automated it. Pure evil to be scraping new renewals and dns changes to look for this kinda stuff.
For the record I thought I had this site behind basic auth.
Is that basically the delta between Cloudflare’s Pages analytics and Google Analytics? CF says I get thousands of visits a day and GA says it’s like 3-4 users.
You pretty quickly learn to qualify incoming traffic since it directly impacts how you track conversions. But definitely to begin with, you see thousands of "people" view a page and no one bites, it can be disheartening until you realise it was mostly bots.
I have basically 180d entirely on view metrics, they are more or less noise to a small business owner. Did someone buy or not, that's all you actually need to care about.
Even big retail stores are pushing back on crap like KEPLAR/foot traffic tracking, since it doesn't actually change what you do, or impact sales.
Measure sales, measure customer delight, make those the targets.
This is so true. Every junior sysadmin I have trained over the years (including myself) has had a “are we being attacked?!” moment when tasked with WAF report analysis, monitoring fail2ban logs, etc.
Monitoring WAN traffic really gets the paranoia juices flowing.
I remember when you could stand up a website and no bots would scrape it or scan it. It was a lovely time. No one had firewalls or antivirus and things were working fine until the worms and viruses started coming. You could be confident that your guests were real, so much so we had guest counters on many public sites.
Just build your website yourself as deep in the stack as you can instead of piling up 50 abstractions on top of each other. Some decisions like having your page be accessible by IP can only happen if you use technology like generic http servers (like apache or nginx) from the 2000s instead of implementing the lower stacks and actually thinking about whether that makes sense for a second.
If when you build a website or a backend, your server responds to requests by IP address (for example), you are building a bottom 90% product, and considering most software markets are super top-heavy, (say 1% win), that's ngmi land.
Exactly this. It's no different from a bot pretending to be Googlebot. I've tried reporting abusive IPs to various foreign hosts, but nothing every comes to it. I've settled for just blacklisting excessively abusive IP ranges.
Years ago, I built a sort of camo-proxy like, in Elixir. It was doing full passthrough of the User-Agent because the project that I originally built it for needed it for the upstreams (i don't remember why). Anyway, I ended up pulling it into pleroma -- a couple of months later, we had been informed by some instance owners that google itself were sending them DMCA notices, because it was proxying googlebot's request, with its user-agent!
Google (and other “legitimate” scrapers) publish the ip ranges they crawl from, anyone claiming to be googlebot (or whatever) but not in the ip range can safely be black holed.
Almost lol: grep, sort and uniq. If I notice someone is hammering my employer's ecommerce site, I'll block them. It isn't required often so I've been reluctant to spend the time setting up fail2ban.
I am always surprised that its considered legal.
IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
That sort of vulnerability scanning is at best legally dubious, and almost certainly illegal under CFAA and similar state statues when there's clear criminal intent. That's why the 2022 DOJ guidance regarding non-prosecution good faith security research was such a big deal at the time.
> IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
From experience: this does happen regularly in some neighborhoods of some cities in the US, and even that isn't always an enforcement priority. So lack of enforcement on the internet, where most the perpetrators probably aren't even in a jurisdiction with an extradition treaty, isn't exactly surprising.
Yeah, It started bothering me enough that I recently put together a system where when a application detects a bad actor(a bot enumerating too fast, a random scan for vulnerabilities, etc) it notifies the firewall. Right now I am just shutting them down, But have plans for a honeypot/tarpit system, something real slow that takes up all their time. Something like "have fun at 300 baud"
I'm doing the same thing. Set up a honeypot API and having it log everything anything tries to access outside that home page. Collected 15,000 hits in a week from 300 unique IPs doing the usual WordPress and .env scans.
I'm just collecting the data now to be used to secure some of my upcoming projects, but I would absolutely also like to take it in a direction where it sends the bots into an infinite slow loop, or preferably something that burns as many tokens as possible for them.
I don't really care about the morality of that. I'm a big fan of fighting fire with fire.
> something real slow that takes up all their time
Not to throw water on your plan, but the bots I've written intentionally run very slow with respect to each target. When done in parallel, across a wide range of targets, it doesn't slow down the effort at all.
I don’t really have a reason to use WordPress anymore. I’m about halfway through switching my site over to something else that I can control with github and AI. Now these boats are mostly getting static files unless there’s a reason to show something else and even then the footprint is very small. There’s just not that much to hack.
I've done the same by scraping the HTML/JS/CSS off our own Wordpress site and sticking it in S3 (behind CloudFront, of course). It was a mild hassle at the time, but would take seconds with today's LLMs. It was a great decision and has been no hassle since, as we didn't really need a CMS, it was just the default for the person who did our design.
Most servers with port 25565 open get hits from either Minecraft griefer bots, or from a bot that looks for that port and warns anyone on that server about the risks of leaving that port open. It doesn't take a huge scale operation to spam every IPv4 address in the world, there are only 2^32 of them, and even then many of those addresses are reserved.
Definitely gotten worse from where I'm standing — you used to be able to just filter on the UA string and move on, now you can't even trust that. Same junk traffic, but harder to sweep away.
People or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.
There are a few novel ones but I’ve been seeing most of them in my logs for longer than generative AI has existed. This isn’t remotely new, the vector is just getting bigger.
Indeed, it doesn't seem to think that the fairly large cities of Vancouver, Calgary, Edmonton, Regina, Winnipeg, and Thunder Bay have a population of approximately zero. Anywhere in northern Montana has the "beam" shoot all the way over to Maine before reaching 100K, which isn't quite right since it passes through a couple medium Canadian cities and dozens of prairie towns.
I think this tool would be much more interesting in the western US if they had incorporated Canadian census data as well.
Lots of people didn't invest in mortgage backed securities but still got screwed in 2008. When something is systemic, you don't have to be directly exposed to be effected when it goes sideways.
But to be fair they’re much less well known, and quite well concealed, and are partly on private land, with big fences, cameras and scary warning signs. Tourists don’t seem to be much interested in post-medieval fortifications.
It's probably somewhat regional, as the ones in Canada seem to have pretty good tourism interest, especially when they're right inside a city like Quebec and Halifax.
But we're also very starved for true "Medieval Castles" like Europe or east Asia, so we take what we can get!
And Casa Loma is only a castle in the same sense as the one at Disneyworld. These may be textually and superficially similar to historic castles but are completely different. A knowledgable historian would not curate this list. The author should indicate this is just a technical demonstration.
Looks like its started to publish new imagery again! I'm sure those fellows are relieved to have it working... I can't imagine the stress of trying to debug something that far away and unreachable!
It once made me exit the highway, using the nearly empty exit ramp, then do a U-turn on the surface street and get back using the lightly used entrance ramp. Wow, all that effort to move about 250m forward in traffic, saving me perhaps 30 seconds of time on my 3 hour drive. Very "over-optimized" software does bizarre stuff that no sane person would ever do.
There's likely an "updater service" that runs with elevated privs that's used for all kinds of other nasty stuff. Windows task scheduler is full of stuff like this if you know where to look, and plenty of hidden services on Macos.
The problem is that there haven't been good enough native ways to do updates & maintenance on installed applications, at least in the past, so this type of stuff became acceptable and commonplace.
You can use basically any hardware. I've done it with trash-picked laptops and USB ethernet adapters. Best option these days is a N100/N150 mini-pc with multiple NICs onboard, but with the price of everything going up maybe trashpicking will make a return.
I don't see the issue with dry cask storage medium term, and deep geological storage long term. Spent fuel isn't really that dangerous once it's been cooled down and for a couple decades before putting it in the ground, to the point that there are far more dangerous natural things you can dig up.
What concerns me is that 250 years of fossil fuel energy continues to store its waste products in my lungs and the water I drink. That's the issue we need to solve with urgency.
Then they strong-armed everybody but the largest enterprises onto their cloud. The alternative was painful (exporting/munging/importing to an alternative) so most of us went along for the ride. It took less than a year for them to start enshittifying their core product. Now it's basically unrecognizable from the product we used on-prem only three years ago.
I'll always be salty that my box of spare parts was superior to their cloud service in nearly every way.