Show HN: Steal My Bitcoin (stealmybitcoin.com)

technion 7 hours ago

• jackphilson 7 hours ago

  Yeah, AI seems like a good shift in "narrative making." It's easy to ask AI "give me an efficient way to "confirm or deny this narrative" and have something like this go viral. This is good because it makes narratives more truthful

  • andersonpico 7 hours ago

    Because only a fraction of people would double check (AI or otherwise), AI making it easier to flood the zone with fine tuned spam actuallu has the opposite effect. We're seeing this at play at a large scale anywhere an election is happening right now. The narratives are even less truthful than before.

  • medellin 3 hours ago

    Wow we have lost it. You really need AI to come up with something like this… let’s just end it at this point honestly.

• Catloafdev 7 hours ago

  The value proposition isn't there.

  If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'

  That's pennies for something like this.

  Add two zeros and it might get nabbed.

  Edit: others have pointed out it's not really a 0-day anymore, they're right, so it's likely more a matter of time.

  • cortesoft 6 hours ago

    So you are therefore arguing for the author's point.

    The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.

    In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.

    The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.

  • zkldi 5 hours ago

    My favourite actively unreleased 0 day exploits are the ones that are released, 5 days old, and allegedly so trivial to exploit it costs $5 in tokens.

    No, I will not spend $5 in tokens to claim your $1000 bounty. My $5 exploit is worth more than $1000. Thank you very much.

  • ufmace 6 hours ago

    I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?

    This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.

    • stouset 6 hours ago

      That's always the case for a novel exploit. There isn't a lot of value in popping somebody's PHP blog, so people who've invested time and money into a zero-day exploit have little incentive to use it for that purpose.

      The white hats want to extend the time before an exploit is in the hands of the masses who might do so just for the fun of it, and the black hats want to use it on high-value targets.

      • ufmace 5 hours ago

        I think the point is that this is completely the opposite of the narrative that was pushed about this bug - that there would be thousands+ of AI agents actively compromising every vulnerable site automatically regardless of value within minutes of the fix being released into the wild. Well, now it's 3 days after, and this has been up for 3.5 hours, and nobody has taken it yet.

    • testaccount28 6 hours ago

      random sites generally don't log carefully, or watch their logs if they do. so the risk to hacking them is low. this site almost certainly logs very aggressively. so the risk to hacking it is high.

      based on differential risk, attackers will choose targets differently. they might reason that the risk/reward on this obvious trap is not worth it. but on joe shmo's php emporium, the reward is less, but so is the risk, and it might pencil out.

      • malfist 1 hour ago

        So your answer is people could hack this easily but logs scare them?

        Well that's good news because my webserver also has logging

  • gbingles 6 hours ago

    You would have a point if it was still a 0 day. The patch is out, and open source. Anyone who cares has a bunch of the pieces for putting together their own exploit.

    Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.

  • technion 6 hours ago

    I never mentioned unreleased private exploits, I mentioned what every thought leader and popular creative wants us to believe right now.

  • ls612 6 hours ago

    It’s not a 0day it’s now 5 days and counting since disclosure. Nobody is gaining value sitting on an exploit for a vulnerability which is being actively patched.

  • 6thbit 6 hours ago

    Wallet address is there, you can donate

  • jgalt212 6 hours ago

    > The value proposition isn't there.

    That's part of the point. $500 or $1000 is a trivial amount. Since the money is still there, there's currently no trivial exploit.

    > requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done

    Depending on the exploit, and the visibility stack on the server, one may or may not be able to determine how the rabbit got in the hat.

  • paulpauper 7 hours ago

    exactly. the pros are not going to reveal their hand for $1k

    • technion 4 hours ago

      Why not? Those pros have their opportunity to use this exploit dwindling by the hour as news of this and pressure to patch grows and grows. All the major managed hosting companies had this patched in the first 24 hours.

    • girvo 6 hours ago

      That is sort of the point I thought? There’s no low skill exploit for the script kiddies to use even with AI, otherwise they’d happily use it

      The pros have RCEs, but won’t burn it for something this small.

      It’s a real vulnerability, but a complex one

• efficax 6 hours ago

  right: either it’s so hard to exploit that $1,000 isn’t enough to risk “giving away” your exploit chain or actual exploitation of this bug is impractical, either way the CVEpocalypse is overblown

• paxy 4 hours ago

  What point is an anonymous online post proving? Can anyone verify that the private key actually exists? Or which version of PHP the site is running? Or if it is running PHP at all?

  • Gigachad 4 hours ago

    If someone was able to gain access to the server and there was no key, they would report it here with proof. If someone had a working PHP exploit and it didn't work on this server, they would be able to post it here with proof.

    • paxy 4 hours ago

      I just hacked the site and wasn't able to find any key. Do you believe me? Why not? I posted exactly as much proof as the person who posted the challenge.

      • Gigachad 4 hours ago

        Shut the server down or deface it and I'll believe you. Should be simple if you've gained shell access.

      • medellin 4 hours ago

        Wow i don’t know… maybe modify the web page to have your username on it. No wow that is too hard for you leet haxers. Are you really this dumb you can’t figure out any of the hundreds of way to show proof?

• glerk 2 hours ago

  It seems like the server got DDoS’d before anyone got to the bitcoin.

• orlp 5 hours ago

  > There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view.

  Clearly people aren't cynical enough.

  I find it strange no one in this thread has even considered the possibility that the private key of the wallet isn't on the machine.

  OP gets their working exploit neatly logged (or even multiple approaches), keeps the money, strengthens the illusion the exploit isn't that bad, and gets a free $500 on top from someone who added to the wallet.

• paulpauper 6 hours ago

  no it doesn't . absence of evidence is not evidence of absence

  • fwlr 6 hours ago

    This is evidence of absence, though. Unexploited PHP servers are evidence of absence of exploits, and exploited PHP servers are evidence of presence of exploits. “Absence of evidence” would be if there were no PHP servers.

• Onavo 4 hours ago

  You can see the commenters arguing with me about ASLR in the old thread. Half the commenters here, including quite a few "thought leaders" (not gonna name names or ad hominems but everybody knows who they are), insist that there are ways to implement this exploit at scale without having to do rowhammer-style spam brute forcing. I am still waiting. There's a lot of FUD and hearsay in the tech circles grapevine but very little evidence of actual working exploits against a modern Linux server outside of "attempts".

  https://news.ycombinator.com/item?id=50188948

  I am still waiting for them to put their money where their mouth is.

  • what 5 minutes ago

    Maybe link to the argument? I can only find two comments from you on that post and only one person replied. That one reply isn’t from a “thought leader” either.

• BubbleRings 5 hours ago

  Except, it’s the top entry in HN right now. It could have gone down to the hug 20 minutes after it was posted, so nobody much has had a chance to have a go at it.

nayuki 8 hours ago

    Steal my Bitcoin
    0.65 hours without a successful hack
    
    There is a bitcoin key hidden on this server worth about $502.
    
    It is accessible to the PHP user account through the print-flag binary.
    
    This PHP version was selected from before the PHP2SHELL CVEs were released.
    
    First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
    
    All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
    Challenge wallet
    Explorer ↗
    
    bc1qlnu5…t3cxqy
    
    0.00625104 BTC
    
    ≈ $502.35 USD
    stealmybitcoin.com · Terms of participation

• xmcp123 7 hours ago

  Bahaha someone added to the fund. It’s now $1004