HN Reader

While I think an update to the Apache version is a good idea, this is a very low quality report. There are tons of people scanning the web looking for out-of-date software and sending low effort reports about known CVEs. This is the kind of report even large companies ignore.

Critically, it's not even clear that this is a vulnerability report. Yes the version is out dated, and yes there are known CVEs, but is the server actually vulnerable?

The CVE referenced has the key phrase: "... whose response headers are malicious or exploitable". This does not appear to be a CVE that would impact every installation. You need to find a way to control the response headers, meaning you need to chain another vulnerability.

Without verifying that the server is vulnerable this isn't a vulnerability report. It's a suggestion to install updates. Paired with the poor delivery, it seems reasonable for the author to get blocked and ignored.

Checking version numbers usually isn’t a good way of determining whether software on Linux is vulnerable to CVEs. Big distros (especially Red Hat derivatives) lock software versions but back port security patches. Reporting “vulnerabilities” solely based on reported version number is pure noise.

To be fair, even if he did update apache. It's running at linode. One phone call from the feds and they have what want.

Either don't collect anything useful or at least host the server somewhere where a US warrent doesn't as easily work as cutting butter with a hot knife...

Giving an author 90 minutes of lead time before public negative press doesn’t count as responsible disclosure.

Especially when that press doesn’t mention the specific security vulnerabilities you’re reporting to them. Here is a link to the blog post which accompanied the OP’s text: https://micahflee.com/unfortunately-the-iceblock-app-is-acti...

Is it reasonable to expect a maintainer to assume in good faith when the report is this unactionable?

Disclaimer: UK citizen. I don’t know anything about ICE or whose side I’m “supposed to be on” politically here. I’m just responding to the details in the article. The app might as well be TodoApp.

The vulnerability couldn’t have been reported in a worse way. OP gave unreasonably short deadlines, allowed moral opinions about the software to interfere with responsible disclosure, and interspersed details about the potential vulnerability with inflamatory remarks about the mission of the product. I don't think OP's goal was actually to secure the app.

OP was going to publish a scathing blog post about ICEBlock either way, and essentially engineered a situation where the ICEBlock author had to act within unreasonable timelines. He published the original blog post an hour and a half after reporting the vulnerability. Then gave a week’s deadline before another one.

Sure, potentially the ICEBlock author also allowed feelings to interfere with upgrading the vulnerable version too.

But ICEBlock has millions of users, according to the blog post. I’m cautious about upgrading dependency versions for apps I manage with <100 internal users. In my experience, upgrades are 99% trivial, and 1% cause disastrous headaches and downtime. If I were the ICEBlock author, I would put this on a list of things to look into, and ensure that it was tested thoroughly if I did decide to upgrade. It’s not as simple as running “sudo apt upgrade”.

And I imagine that given the scale of the product, the author has incredible demands on his time, and can’t just drop everything because somebody (who has already shown themselves to be communicating rather negatively) imposes an arbitrary short deadline.

Now maybe it turns out that I’m unaware that ICEBlock is a huge net negative for the world, which is why this post has so many upvotes. But just interpreting the facts as they’re presented in the article, and substituting ICEBlock for TodoApp… I don’t see how the developer has acted unreasonably.

Post script: I followed up and read the original blog post (https://micahflee.com/unfortunately-the-iceblock-app-is-acti...), which I largely agree with. I still think Micah has mishandled communicating the vulnerability.

Wait. So Apache is outdated and that’s all you found? And it’s escalated to this? Wow. I would ignore this guy also. Using nmap is an elite skill now?

Maybe calling the app "activism theather" was not a very constructive approach.

I've had a negative impression of ICEBlock's developer since GrapheneOS debunked their privacy-related excuses for not creating an Android version: https://bsky.app/profile/grapheneos.org/post/3lt2prfb2vk2r

I think Micah misses the mark here. ICEBlock has vulns, yes, but this was inappropriate.

> run something like sudo apt update && sudo apt upgrade

I assume this means that the author of this post has seen the Debian version in their nmap. The latest version of which would be 2.4.65-1~deb12u1[1]. You'll notice that there is a Debian version number attached to the Apache version number which means that the version number NMAP found doesn't necessarily mean software is unpatched. I've never used Iceblock or talked to this developer but I have no doubts he's dealing with beg bounties[2], harassment, and bad faith critique of his software which the screenshotted messages look like.

EDIT: For the sake of clarity, I think I should have phrased it the other way around. Bad faith messages look like the ones the author sent. I'm not discussing the actual intention of the messages but the pattern seeking brain's reception to them.

[1]: https://security-tracker.debian.org/tracker/source-package/a...

[2]: https://www.troyhunt.com/beg-bounties/

Is this guy fishing for a job at DOGE? Otherwise I'm not sure what could explain why he's acting in pretty much the "worst practice" manner possible when doing security reports. Even stuff like the literal teens doing the Burger King (? iirc) and Monster energy reports that got posted here recently, while flawed, were still way better than this.

Unless I've got the timeline wrong did the author contact ICEBlock's creator about the outdated Apache version and then a few hours later post publicly about it? If that's the case I can understand why he blocked the author.

His arguments against creating an Android version made it seem like he didn't really know what he was doing, when the app first got publicity.

The author of this blog post, Micah Lee, has destroyed his reputation.

1.5 hours after an email you publish? Seems very bad faith to me

I'm directionally with Micah Lee on this in that I think all of these kinds of applications are activism theater, and I would hate for anything I say to sound like I'm getting the "ICEBlock" guy's back --- I'm sure it's bad and you shouldn't use it (though: Micah Lee's previous takedown of ICEBlock more or less comes down to "anybody can claim they saw ICE anywhere and also they don't have warrant canaries", which is... not interesting).

But I'm struck that Lee reported CVE-2024-38476 to the author, with a simple link to the NVD site, based on a banner grab.

For those unfamiliar, 2024-38476 is part of a batch of vulnerabilities Orange Tsai announced at Black Hat that year. You can (and very much should) read more about them here:

https://blog.orange.tw/posts/2024-08-confusion-attacks-en/ [†]

This is extremely good (and elegant) vulnerability research. It's also very situational. Lee reports that 38476 "could take over your server". Could it? Did Lee check? 38476 is a second-order vulnerability that pivots CRLF injection in another vulnerable application to an Apache handler override (just read it, it's fucking awesome). If you've got `mod_proxy` enabled, you've got a decent shot at SSRF with it --- SSRF is game-over on a corporate network, but situational when the target is a hobby server. Otherwise, the most likely outcome of it is being able to dump source code (by rewiring the request handling of something from, say, PHP back to HTML). The RCE's on these vulnerabilities are things like "if you were running Redmine, which installs into /usr/share on Ubuntu, you can pull the Rails signing key". Is... that happening here?

Or is this report basically "I did a banner grab, then Googled that version, then made a whole big thing about it to embarrass the author of ICEBlock"?

Which I mean if that's the goal, mazel tov, I don't like these things either, but let's just be clear on what's actually happening here. If not: it would be super interesting to hear a real-world exploitation scenario of Orange Tsai's rewrite bugs against ICEBlock, and Lee should keep on writing.

[†] I wrote about this at the time here: https://news.ycombinator.com/item?id=41199205

I don’t think the best way to communicate with someone is by questioning their character and intentions, then simply demanding something of them. All this blog post does is show that you need to mature in both your communication style and your security knowledge. CVE != Vulnerable

No PoC exploit, no real exploitability. I propose we use the term "CVE Kiddie" until this bullshit stops. It could even be a fake-advertised version header.

> outdated software with known vulnerabilities

Maybe I missed it, but was it ever established that these general vulnerabilities are actually relevant to this specific system/implementation?

no one looks good here

I am strongly politically aligned with the intention behind ICEBlock, but the app itself has always struck me as the work of someone who is either dangerously underinformed about the practical implications of computer security when pissing off federal paramilitary groups or who is absolutely insane. There might be a way to make something like ICEBlock that isn’t an unintentional honeypot, but the fact that this was on the fucking App Store didn’t give me a lot of hope it was built that way.

At some point, the fact that this is on Apache 2.Old.Vulnerable is an interesting detail, but I honestly don’t know how you’d make this app secure against the actual threat model here no matter what version of anything you’re running. Dude’s way out past where patching against CVEs is sufficient.

Am hour and a half isn't enough time to read a DM. Also, the vulnerability would be difficult to exploit.

Honestly this seems overly dramatic from both sides

It's pretty likely the guy blocked the author after seeing them link a blog post insulting his work, no?

Sure he should take the vulnerability report seriously, but it's pretty clear that bundling a report above the words "activism theater" isn't going to make someone want to read it.

Instead, just "hey man, you're on a vulnerable version of httpd" is likely going to be more effective.

I’ve never built something like ICEBlock that puts me personally in the crosshairs of not just normal hacking attempts, but also the political will of the federal government. I can’t imagine the cess pool that is Joshua’s DMs. I think OP makes all the right assessments when examining how seriously ICEBlock is taking the risks here. The Android push notifications assertion is proof enough to make me raise a pretty big question, let alone the other issues raised.

Were I building something that I would want to assert the level of privacy claims that ICEBlock asserts, I would absolutely be taking any/all reports about security extremely seriously.

For reference here was his previous article

https://micahflee.com/unfortunately-the-iceblock-app-is-acti...

I tend to agree with the comment on the blog that this version might be patched, and there's no proof of the server being actually vulnerable.

Hack it then, micah. Show how l33t you are

Me having no idea what ICEBlock was thinking that they sent laywers after the author and ignored the warnings. This isn't that but its almost. He seems to genuinely want to help people but doesn't seem to know what he is doing, especially in relation to security.

Hopefully it doesn't end up doing more harm than good

Seems like the author is more interested in writing about "activism theater" than anything else.

The author comes off a bit as a prick there... why didn't he just say "hey man I think you have an issue, it's there, now here's how to fix it (he didn't tell him, he just says in his blog post "it's easy"), and BTW I'm here for a video call if you want me to get through it together"

In the software development / security world, someone reporting a vulnerability to you is one of the greatest things one human can do for another.

I've been burned in the long past when trying to be helpful to an activist. The accuracy of information provided was never a consideration.

Was the author expecting to be praised for submitting multiple false claims? Why do they feel entitled to anything let alone a positive response or action..

Assuming Debian because why not, (and because I don't want to look at RHEL):

2.4.57 never made it into Debian stable, only went as far as testing and unstable.

2023-10-19 was when 2.4.57 was superseded by 2.4.58 in unstable.

So assuming they are not using RHEL or similar, they have either pinned Apache httpd, used a custom build, or haven't updated their server since the start of 2024.

- - -

Since then, there have been 11 moderate, 8 important security fixes according to Apache.