bypass

利用 Cloudflare Workers 繞過 Cloudflare 自家的阻擋機制

在 Hacker News 首頁上看到「How to bypass Cloudflare bot protection (jychp.medium.com)」這則，裡面的文章是「How to bypass CloudFlare bot protection ?」這篇，利用 Cloudflare Workers 繞過 Cloudflare 自家的 CAPTCHA 機制。

這個漏洞有先被送給 Cloudflare，但被認為不是問題，所以作者就決定公開：

Several months ago I submitted what appeared to be a security flaw to CloudFalre’s bugbounty program. According to them, this is not a problem, it’s up to you to make up your own mind.

技術上就是透過 Cloudflare Workers 當作 proxy server，只是看起來 Cloudflare 對自家 IP 有特別處理，在設定妥當後，用 Cloudflare Workers 的 IP address 去連 Cloudflare 的站台，幾乎不會觸發 Cloudflare 的阻擋機制。

不過 free tier 還是有限制，主要就是數量：

The first 100,000 requests each day are free and paid plans start at just $5/10 million requests, making Workers as much as ten-times less expensive than other serverless platforms.

作者也有提到這點：

So let’s enjoy the 100 000 request/day for your free Cloudflare account and go scrape the world !

但這是個有趣的方法，加上信用卡盜刷之類的方式，這整包看起來就很有威力...

繞過 Screensaver Lock 的有趣話題...

在 Hacker News Daily 上看到「Screensaver lock by-pass via the virtual keyboard」這篇，裡面這邊題到了 screensaver lock 的有趣話題。

先講嚴肅一點的，這個 bug 被編號為 CVE-2020-25712，問題出在 xorg-x11-server 上：

A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

比較有趣的事情是，這個 bug 是小朋友在亂玩時拉出 virtual keyboard 觸發的：

A few weeks ago, my kids wanted to hack my linux desktop, so they typed and clicked everywhere, while I was standing behind them looking at them play... when the screensaver core dumped and they actually hacked their way in! wow, those little hackers...

然後他說他自己搞不出來：

I tried to recreate the crash on my own with no success, maybe because it required more than 4 little hands typing and using the mouse on the virtual keyboard.

另外一個人也說他家小朋友也弄出 segfault 了：

My kids came upon a similar cinnamon-screensaver segfault! I've emailed details of how to reproduce the problem to root@linuxmint.com.

小朋友超強 XDDD

LinkedIn 忘記續約導致 SSL Certificate 過期

Netcraft 上看到 LinkedIn 出包的消息，這次是 country-mixed 的版本出包：「LinkedIn certificate blunder leaves users LockedOut!」。

在 DNS 上也可以看出來這兩個 CNAME 到不一樣的 load balancer 上：

;; ANSWER SECTION:
www.linkedin.com.       260     IN      CNAME   2-01-2c3e-003c.cdx.cedexis.net.
2-01-2c3e-003c.cdx.cedexis.net. 93 IN   CNAME   pop-ehk1.www.linkedin.com.
pop-ehk1.www.linkedin.com. 3560 IN      A       144.2.3.1

;; ANSWER SECTION:
de.linkedin.com.        86400   IN      CNAME   cctld.linkedin.com.
cctld.linkedin.com.     86400   IN      CNAME   mix.linkedin.com.
mix.linkedin.com.       213     IN      CNAME   pop-ehk1.mix.linkedin.com.
pop-ehk1.mix.linkedin.com. 3546 IN      A       144.2.3.5

而 SSL Labs 上也看得出來在 Alternative names 的地方是不一樣的：「SSL Server Test: www.linkedin.com (Powered by Qualys SSL Labs)」、「SSL Server Test: de.linkedin.com (Powered by Qualys SSL Labs)」。

然後因為 LinkedIn 有設定 HSTS，所以使用者在界面上完全無法登入：

在 Google Chrome 上可以用 badidea 繞過 (參考「在 Google Chrome 連上因 HSTS 而無法連線的網站」)，但在 Mozilla Firefox 上的話目前沒找到方法可以在界面上 bypass，而是需要改 SiteSecurityServiceState.txt 這個檔案：「HTTP Strict Transport Security prevents me from accessing a server that I'm doing development on」。

不過也因為兩個 cluster 獨立運作，網址改一下應該就會動了...

這幾年比較很少看到大公司出這種包，還蠻有趣的 XD

Google Chrome 會 bypass Adblock 的問題

新版的 Google Chrome 使得 YouTube 可以繞過 Adblock 類軟體的阻擋限制 (像是 uBlock Origin)，導致這些使用者會需要「看完完整的廣告影片 (無法 skip)」才能看本篇：「Google Chrome reportedly bypassing Adblock, forces users to watch full-length video ads」。

目前確認這是在修正 CVE-2015-1297 時產生的 bug：

Update: We have been contacted by Rob Wu, a developer on the Chromium project - the open-source foundation for the Chrome browser - who has informed us that this change was not intentional but, rather, an unintended result of fixing a previous security issue (CVE-2015-1297). He confirmed that the issue will only be seen if the YouTube app is installed and that, at the moment, apart from disabling AdBlock or whitelisting YouTube, the only solution, as described above, is to uninstall the app. The problem is expected to be patched in the upcoming weeks or, at least, when Chrome 46 is released.

目前的暫時解法是移除掉 YouTube 這隻 app，或是將 YouTube 放到白名單網站。