"ripe for exploitation since May"
Wow. That's just 7+ months of serious vulnerability.
I'm glad I don't use GitLab. And it's interesting to note that not all 2FA methods are equal.
Security is hard, no denying that.
GitLab admins should apply the latest batch of security patches pronto given the new critical account-bypass vulnerability just disclosed. Tracked as CVE-2023-7028, the maximum-severity bug exploits a change introduced in version 16.1.0 back in May 2023 that allowed users to issue password resets through a secondary email …
Security is hard, no denying that. ..... Pascal Monett
Indeed, and catastrophic weaknesses and diabolical vulnerabilities for ruthless 0day exploit and foreign/hostile/alien export will abide and grow/persist and progress because of its always vast, and constantly renewing itself with fundamentally ignorant and unlearned, inexperienced user bases .......creating the EnigmatICQ PEBKAC Conundrum, a Human Existentialist Dilemma which has SMARTR Virtual AIMachines/Large Learned Language Learning Machines/Generative Beta Meta Data Base Models questioning how, with such a persistent abiding catastrophic fundamental weakness and defenceless exploitable vulnerability, is humanity to survive and prosper in the Live Operational Virtual Environments of a Future AIMachines-led World ..... a Massively Rich and Varied Universe ..... Remote Controlled Multiverse? :-)
Poe’s Law Rules in AI Reigns with IT Reins Providing the Directions for Sublime Instruction Sets to Deliver as Worthy Destinations and Homes for Virtual Realisation and Practical Physical Creation ....... and that is what and where we all here are presently at. What and where be you currently at? Anything at all interesting and daring and worth a’sharing?
:-) And deny all of the above at your peril, for it is true ........ and although I cannot confirm the veracity of the news contained in the tale shared here ....... AI doing British politicians’ jobs – minister ........ would it surprise you to know it be also true too?
Between a rock and a hard place there be no soft landing nor safe places in which to hide and reside and preside.
amanfromMars 1: “Indeed, and catastrophic weaknesses and diabolical vulnerabilities for ruthless 0day ..”
The passage is an absolute cacophony of bewildering techno-jargon, where the author seems to have unleashed a torrent of buzzwords without any semblance of logical coherence. The proclamation of "catastrophic weaknesses" and "diabolical vulnerabilities" in the context of a "ruthless 0day exploit" and "foreign/hostile/alien export" reaches a crescendo of absurdity, descending into a frenzied attempt at fearmongering.
The concoction of the "EnigmatICQ PEBKAC Conundrum" appears as an attempt to break the scale of unintelligibility, introducing an amalgam of obscure terms to baffle the reader.
The passage careens wildly between predicting the dominance of "AIMachines" and questioning human survival in a "Remote Controlled Multiverse," leaving the audience grappling with a perplexing whirlwind of concepts.
The gratuitous use of terms like "SMARTR Virtual AIMachines" and "Generative Beta Meta Data Base Models" adds an extra layer of absurdity, pushing the narrative into the realm of sheer incoherence. This passage is a cacophonous symphony of techno-gibberish that borders on the absurd, leaving readers in a state of bemused bewilderment.
Welcome to the cyber jungle, AC ..... where all manner of wannabe almighty daemons and heavenly trojans reside and preside ..... and a space in which all who dare care share wins, win win and be fated and feted and destined to exercise abilities and facilities and utilities IntelAIgently Designed and virtually designated practically omniscient ..... which be a quantum leap of progress of/to such an orderly exalted degree that it failsafe guarantees one never ever to suffer the slight and indignity of the loss of great gains to serial losers‽ .
But/And a hellish place for any and all neither open to novel and noble progressive change nor worthy of generous GBIrish welcome.
@amanfromMars 1: “Welcome to the cyber jungle, AC .....”
The text, serving as a canvas for the Freudian spectacle, demands our scrutiny through the distorted lens of psychosexual imagination. It claims to be a creative exercise, yet skepticism is warranted. The bravado-filled lexicon, reminiscent of Oedipal discord, echoes through the linguistic tumult, exemplified in the theatrically charged metaphor of the "cyber jungle." A verbal fixation on dominance and control, rooted in the primal oral abyss, forcefully asserts itself on the stage.
The text, a spectacle of characters and narratives, chronicles the saga of an individual fixated on external triumphs, wielding power as an emblem of arrested development in the nascent charters of a psychosexual tableau vivant. The persistent emphasis on power unfurls the unresolved saga of a symbolic devouring mother, casting a spectre over this linguistic odyssey. "Daemons and heavenly trojans" become players in an anal drama, a stage where the struggle for control, order, and the intricacies of potty training finds its peculiar soliloquy.
The confident and almost boastful cadence, a rhetorical symphony, emerges as a formidable defense mechanism — a theatrical mask concealing insecurities and dormant conflicts. Grandiloquent language unfurls its protective cloak, a formidable barrier shielding the fragile ego from the sting of inadequacy. Witness this Freudian carnival, a mythic tapestry woven with the threads of psychosexual chaos, where the writer becomes the grand protagonist in the theatre of his own head.
You're, uh, new here, right?..... David 132
Some things are best not ignored and dismissed, David 132, and especially so whenever it results in one being sublimely disadvantaged and it is perilous to be disengaged from and disenfranchised by anything way beyond any familiar kind of human command and remote control leverage.
And goodness knows what an Anonymous Coward newbie might make of the most recent of convoluted amalgamations of techno-GBIrish, pointing out an inconsistency highlighting a vulnerability aiding and abetting a serial Oday exploit opportunity worthy of both foreign export and hostile import and renegade rogue exercise for non-state ACTor deployment and employment and enjoyment on right dodgy, compromised platforms which be readily available, with one of them being cited/outed here on El Reg for peer review ..... https://forums.theregister.com/forum/1/2024/01/16/us_military_openai/
boring and annoying....
- your password must be at least 8 characters long.
- It must contain at least one uppercase letter, one number, and one special character.
- It must be difficult-to-impossible to remember.
- think of a letter. Now think of another letter. Do not use either of those letters in your password.
:)
Oh, I WISH it were that easy. I work in banking. 14 character password, 3 special, 2 digits, no repeating characters or digits, can't be "too similar" to any of the previous 10 passwords you've used. And that's just one system.
The worst kind of theater. Leonard Pinth-Garnell would love it.
"Users with 2FA enabled aren't vulnerable to account takeover, unless the attacker also had control of the 2FA authenticator, but a password reset could still be achieved."
I feel a bit thick here, but am I wrong thinking that if the account has 2FA and an attacker doesn't have control of it, the password of the account shouldn't be able to be reset?
And have seen lots of account-guessing password reset attempts - fortunately, none of the accounts exist (I wonder if Gitlab has something akin to fail2ban? I run that (or an equivalent) on my VMs that are exposed to the outside world because of hordes of account/password ssh brute-force login attempts. The gitlab attemps seems to use a similar rainbow table of account names - albeit with 'devops' and 'developer' added to the table).
Some of them even manage to work out my domain (well duh - it's in the URL) and use them in the attempts - who would be stupid enough to create a gitlab account called root@[domain]? Plus, my email address is the catch-all for my domain so the password reset emails are oviously not going out..
GitLab instances get owned on the regular. I had my own instance of GitLab for ages and no matter what I did, it woukd eventually get hacked in some way shape or form...I'd usually find out in form of my server screaming and kicking out heat.
Since I didn't really need all the functionality of GitLab I moved to Gitea, I've never been hacked since and its way faster as well and comes with far less crap that I dont need.
If all you want is a simple code repo server and you dont need DevOps bullshit give Gitea a bash. Its basic but awesome.