Follow

eh? *raises eyebrow*

"you have a security vulnerability on your website! it's, uh... your git directory being accessible publicly. Now please pay me in cryptocurrency."

(...how'd they get "frost@" for the email address?)

[transcript in reply]

spam scam ""security report"" email 

Dear Team,

I trust this communication finds you in good health and spirits. I am writing to you as a cybersecurity professional who specializes in identifying and addressing vulnerabilities within online platforms. Regrettably, I have identified a critical security vulnerability on your esteemed website, brightfur.net, which necessitates urgent attention.

This detected vulnerability permits unauthorized individuals the ability to access and download all source codes and sensitive data, including passwords associated with your admin panel and database. The urgency of mitigating this vulnerability cannot be overstated to prevent unauthorized access and potential data loss.

I strongly recommend that this communication be promptly escalated to your dedicated technical team or IT department for immediate redressal.

The vulnerability stems from an unsecured git directory that is accessible publicly. There exists a wealth of resources and articles that delineate the means to exploit this security oversight, leading to unauthorized access to sensitive and crucial data integral to the operational integrity of your website and potentially your server. You can review the vulnerability via this link: brightfur.net/.git/logs/HEAD.

In the spirit of cybersecurity community support, should you feel inclined to acknowledge my efforts in identifying and reporting this vulnerability, contributions to support my cybersecurity initiatives are welcomed in the following cryptocurrency:

[several various cryptocurrency addresses]

Your immediate action to secure the vulnerability will safeguard your website’s integrity and the sensitive data contained therein. I remain at your disposal for any further information or assistance required in this regard.

Warm regards

This is the ENTIRE contents of that file that's supposedly a "security vulnerability", by the way:

0000000000000000000000000000000000000000 cf5a600bb5a02cc87d573a0dfd9bcfeadc400bb4 Frost <frost@brightfur.net> 1697961814 -0700  commit (initial): Initial commit
cf5a600bb5a02cc87d573a0dfd9bcfeadc400bb4 b73ad338b82a2a41cdffb420b14062a65a89cbb7 Frost <frost@brightfur.net> 1697961920 -0700 commit: Remove info on domain root

like, okay, I GUESS someone could download our git dir, poke at it, and see the stuff we used to have there mentioning our plurality.

Are we particularly worried about that? No.

We're more concerned about people we're not out to finding us out by poking the domain, and/or web scrapers. Neither of which are going to bother with all that.

...Also, bold of them to assume we HAVE an admin panel or a database. :3

I bet this is written by an LLM. Scrape website, feed website into LLM, ask LLM to point out any "vulnerabilities" and write up a letter.

pfff "all source codes and sensitive data"

well yes you can get the source code it's WHAT YOU DOWNLOAD WHEN READING THE PAGE
it's not exactly a secret!

okay Ylf uses PHP on his blog and that doesn't have the source code readily available, but that's just because of how PHP works.

Maybe it's not written by an LLM. An LLM wouldn't have this slightly odd-feeling grammar.

Sign in to participate in the conversation
Mastodon Glitch Edition

This is a private instance for us.