I will, it's late here, but I'm enjoying the show way too much. xD Instead of discussing why don't you show a client side attack with that thing that you call a vulnerability and make every one shut up?, oh wait...because you can't! ;-)
"A fail has thousand excuses, but success doesn't require any explaination". In this context a working client side exploit or a Server Shell proof is a success, any other thing is crap. Talking, complaining and showing certification don't work against a computer, a working exploit that gives you a shell does. Cheers, -- Sergio On Mar 14, 2014, "Nicholas Lemonias." <lem.niko...@googlemail.com> wrote: >Go to sleep. >---------- Forwarded message ---------- >From: Nicholas Lemonias. <lem.niko...@googlemail.com> >Date: Fri, Mar 14, 2014 at 2:16 PM >Subject: Re: [Full-disclosure] Google vulnerabilities with PoC >To: Sergio 'shadown' Alvarez <shad...@gmail.com> > > >Go to sleep.... > > >On Fri, Mar 14, 2014 at 1:50 PM, Sergio 'shadown' Alvarez ><shad...@gmail.com >> wrote: > >> Dear Nicholas Lemonias, >> >> I don't use to get in these scrapy discussions, but yeah you are in a >> completetly different level if you compare yourself with Mario. >> You are definitely a Web app/metasploit-user guy and pick up a >discussion >> with a binary and memory corruption ninja exploit writter like Mario. >You >> should know your place and shut up. Period. >> >> Btw, if you dare discussing with a beast like lcamtuf, you are >definitely >> out of your mind. >> >> Cheers, >> Sergio. >> -- Sergio >> >> >> On Mar 14, 2014, "Nicholas Lemonias." <lem.niko...@googlemail.com> >wrote: >>> >>> We are on a different level perhaps. We do certainly disagree on >those >>> points. >>> I wouldn't hire you as a consultant, if you can't tell if that is a >valid >>> vulnerability.. >>> >>> >>> Best Regards, >>> Nicholas Lemonias. >>> >>> On Fri, Mar 14, 2014 at 10:10 AM, Mario Vilas <mvi...@gmail.com> >wrote: >>> >>>> But do you have all the required EH certifications? Try this one >from >>>> the Institute for >>>> Certified Application Security Specialists: http://www.asscert.com/ >>>> >>>> >>>> On Fri, Mar 14, 2014 at 7:41 AM, Nicholas Lemonias. < >>>> lem.niko...@googlemail.com> wrote: >>>> >>>>> Thanks Michal, >>>>> >>>>> We are just trying to improve Google's security and contribute to >the >>>>> research community after all. If you are still on EFNet give me a >shout >>>>> some time. >>>>> >>>>> We have done so and consulted to hundreds of clients including >>>>> Microsoft, Nokia, Adobe and some of the world's biggest >corporations. We >>>>> are also strict supporters of the ACM code of conduct. >>>>> >>>>> Regards, >>>>> Nicholas Lemonias. >>>>> AISec >>>>> >>>>> >>>>> On Fri, Mar 14, 2014 at 6:29 AM, Nicholas Lemonias. < >>>>> lem.niko...@googlemail.com> wrote: >>>>> >>>>>> Hi Jerome, >>>>>> >>>>>> Thank you for agreeing on access control, and separation of >duties. >>>>>> >>>>>> However successful exploitation permits arbitrary write() of any >file >>>>>> of choice. >>>>>> >>>>>> I could release an exploit code in C Sharp or Python that permits >>>>>> multiple file uploads of any file/types, if the Google security >team feels >>>>>> that this would be necessary. This is unpaid work, so we are not >so keen on >>>>>> that job. >>>>>> >>>>>> >>>>>> >>>>>> On Fri, Mar 14, 2014 at 6:04 AM, Jerome Athias ><athiasjer...@gmail.com >>>>>> > wrote: >>>>>> >>>>>>> Hi >>>>>>> >>>>>>> I concur that we are mainly discussing a terminology problem. >>>>>>> >>>>>>> In the context of a Penetration Test or WAPT, this is a Finding. >>>>>>> Reporting this finding makes sense in this context. >>>>>>> >>>>>>> As a professional, you would have to explain if/how this finding >is a >>>>>>> Weakness*, a Violation (/Regulations, Compliance, Policies or >>>>>>> Requirements[1]) >>>>>>> * I would say Weakness + Exposure = Vulnerability. Vulnerability >+ >>>>>>> Exploitability (PoC) = Confirmed Vulnerability that needs >Business >>>>>>> Impact and Risk Analysis >>>>>>> >>>>>>> So I would probably have reported this Finding as a Weakness >(and not >>>>>>> Vulnerability. See: OWASP, WASC-TC, CWE), explaining that it is >not >>>>>>> Best Practice (your OWASP link and Cheat Sheets), and even if >>>>>>> mitigative/compensative security controls (Ref Orange Book), >security >>>>>>> controls like white listing (or at least black listing. see also >>>>>>> ESAPI) should be 1) part of the [1]security requirements of a >proper >>>>>>> SDLC (Build security in) as per Defense-in-Depth security >principles >>>>>>> and 2) used and implemented correctly. >>>>>>> NB: A simple Threat Model (i.e. list of CAPEC) would be a solid >>>>>>> support to your report >>>>>>> This would help to evaluate/measure the risk (e.g. CVSS). >>>>>>> Helping the decision/actions around this risk >>>>>>> >>>>>>> PS: interestingly, in this case, I'm not sure that the >Separation of >>>>>>> Duties security principle was applied correctly by Google in >term of >>>>>>> Risk Acceptance (which could be another Finding) >>>>>>> >>>>>>> So in few words, be careful with the terminology. (don't always >say >>>>>>> vulnerability like the media say hacker, see RFC1392) Use a CWE >ID >>>>>>> (e.g. CWE-434, CWE-183, CWE-184 vs. CWE-616) >>>>>>> >>>>>>> My 2 bitcents >>>>>>> Sorry if it is not edible :) >>>>>>> Happy Hacking! >>>>>>> >>>>>>> /JA >>>>>>> https://github.com/athiasjerome/XORCISM >>>>>>> >>>>>>> 2014-03-14 7:19 GMT+03:00 Michal Zalewski <lcam...@coredump.cx>: >>>>>>> > Nicholas, >>>>>>> > >>>>>>> > I remember my early years in the infosec community - and >sadly, so >>>>>>> do >>>>>>> > some of the more seasoned readers of this list :-) Back then, >I >>>>>>> > thought that the only thing that mattered is the ability to >find >>>>>>> bugs. >>>>>>> > But after some 18 years in the industry, I now know that >there's an >>>>>>> > even more important and elusive skill. >>>>>>> > >>>>>>> > That skill boils down to having a robust mental model of what >>>>>>> > constitutes a security flaw - and being able to explain your >>>>>>> thinking >>>>>>> > to others in a precise and internally consistent manner that >>>>>>> convinces >>>>>>> > others to act. We need this because the security of a system >can't >>>>>>> be >>>>>>> > usefully described using abstract terms: even the academic >>>>>>> definitions >>>>>>> > ultimately boil down to saying "the system is secure if it >doesn't >>>>>>> do >>>>>>> > the things we *really* don't want it to do". >>>>>>> > >>>>>>> > In this spirit, the term "vulnerability" is generally reserved >for >>>>>>> > behaviors that meet all of the following criteria: >>>>>>> > >>>>>>> > 1) The behavior must have negative consequences for at least >one of >>>>>>> > the legitimate stakeholders (users, service owners, etc), >>>>>>> > >>>>>>> > 2) The consequences must be widely seen as unexpected and >>>>>>> unacceptable, >>>>>>> > >>>>>>> > 3) There must be a realistic chance of such a negative >outcome, >>>>>>> > >>>>>>> > 4) The behavior must introduce substantial new risks that go >beyond >>>>>>> > the previously accepted trade-offs. >>>>>>> > >>>>>>> > If we don't have that, we usually don't have a case, no matter >how >>>>>>> > clever the bug is. >>>>>>> > >>>>>>> > Cheers (and happy hunting!), >>>>>>> > /mz >>>>>>> > >>>>>>> > _______________________________________________ >>>>>>> > Full-Disclosure - We believe in it. >>>>>>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>>>>>> > Hosted and sponsored by Secunia - http://secunia.com/ >>>>>>> >>>>>> >>>>>> >>>>> >>>>> _______________________________________________ >>>>> Full-Disclosure - We believe in it. >>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>>>> Hosted and sponsored by Secunia - http://secunia.com/ >>>>> >>>> >>>> >>>> >>>> -- >>>> "There's a reason we separate military and the police: one fights >>>> the enemy of the state, the other serves and protects the people. >When >>>> the military becomes both, then the enemies of the state tend to >become the >>>> people." >>>> >>>> _______________________________________________ >>>> Full-Disclosure - We believe in it. >>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>>> Hosted and sponsored by Secunia - http://secunia.com/ >>>> >>> >>>
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
