Alpine Linux warns of an OpenSSH server flaw that can let a remote attacker log in to an account without knowing its password. The attack needs only one SSH connection and a password between 257 and 1,024 bytes. It applies when password authentication is enabled, the server uses the non-PAM package - or the PAM package with UsePAM disabled - and the system has both an account with an empty password field and at least one account whose password hash uses the $5$ or $6$ format. The bug arises because musl treats passwords longer than 256 bytes as an error, returning a value that matches the empty field used by passwordless accounts. A salt borrowed from another account makes the vulnerable check possible. Alpine releases 3.16 through 3.24 and edge are affected; no CVE had been assigned when the warning was issued.
The recommended fix is to install the corrected package for the relevant Alpine branch and restart sshd, since upgrading does not restart the running daemon. If an update is not possible, disable PasswordAuthentication and restart the service after verifying key-based access. Systems already using that setting, PAM with UsePAM enabled, or no applicable password hashes are not affected. Special care is advised for Tiny Cloud images from versions 3.18.11 through 3.24.3: their passwordless alpine account can become exploitable once a $6$ hash is added, and its passwordless doas access can then enable root access. Administrators should check logs for password logins to passwordless accounts and investigate related activity; if a compromise cannot be ruled out, treat the machine as compromised.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A URL-encoding flaw in Hugging Face Chat let unauthenticated requests bypass an admin check and trigger bulk exports of users’ private conversations. The exported data was sent to a configured dataset destination rather than returned directly to the requester. (twitter.com)
Claude Code’s “Don’t Ask Again” setting was linked to passwords and other secrets being exposed in 1,122 public GitHub files. The finding highlights how coding-agent features can accidentally put sensitive data into public code repositories. (apiiro.com)
Hackers stole $133 million from a French bank by targeting a service provider. The available details do not explain how the attack was carried out. (bleepingcomputer.com)
U.S. intelligence reportedly believes Nvidia CEO Jensen Huang had a romantic relationship with suspected Chinese spy Alice Huang, who allegedly sought access to restricted AI chips. Alice Huang is linked to Megaspeed, whose subsidiary faces allegations of smuggling $2 billion in AI chips into China. (tomshardware.com)
A report alleges China is linked to at least 18 overseas police stations in Canada, including three in the Greater Toronto Area. The RCMP is investigating reports of criminal activity connected to the stations. (ctvnews.ca)
Colframe is a low-interaction honeypot that imitates supermarket refrigeration controllers from Danfoss and Dixell. It is designed to attract and observe activity targeting these systems, including Modbus-based threats. (github.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.