This is one of the most fun threads I've read in fd, and that's no small feat. Thanks for the laughs.
On Fri, Mar 14, 2014 at 3:00 PM, Nicholas Lemonias. < lem.niko...@googlemail.com> wrote: > The full-disclosure mailing list has really changed. It's full of lamers > nowdays aiming high. > > > > > > On Fri, Mar 14, 2014 at 5:58 PM, Nicholas Lemonias. < > lem.niko...@googlemail.com> wrote: > >> Says the script kiddie... Beg for some publicity. My customers are FTSE >> 100. >> >> ---------- Forwarded message ---------- >> From: Nicholas Lemonias. <lem.niko...@googlemail.com> >> Date: Fri, Mar 14, 2014 at 5:58 PM >> Subject: Re: [Full-disclosure] Fwd: Google vulnerabilities with PoC >> To: antisnatchor <antisnatc...@gmail.com> >> >> >> Says the script kiddie... Beg for some publicity. My customers are FTSE >> 100. >> >> >> >> >> On Fri, Mar 14, 2014 at 5:55 PM, antisnatchor <antisnatc...@gmail.com>wrote: >> >>> LOL you're hopeless. >>> Good luck with your business. Brave customers! >>> >>> Cheers >>> antisnatchor >>> >>> Nicholas Lemonias. wrote: >>> >>> >>> People can read the report if they like. Can't you even do basic things >>> like reading a vulnerability report? >>> >>> Can't you see that the advisory is about writing arbitrary files. If I >>> was your boss I would fire you. >>> ---------- Forwarded message ---------- >>> From: Nicholas Lemonias. <lem.niko...@googlemail.com> >>> Date: Fri, Mar 14, 2014 at 5:43 PM >>> Subject: Re: [Full-disclosure] Google vulnerabilities with PoC >>> To: Mario Vilas <mvi...@gmail.com> >>> >>> >>> People can read the report if they like. Can't you even do basic things >>> like reading a vulnerability report? >>> >>> Can't you see that the advisory is about writing arbitrary files. If I >>> was your boss I would fire you, with a good kick outta the door. >>> >>> >>> >>> >>> >>> >>> On Fri, Mar 14, 2014 at 3:55 PM, Mario Vilas <mvi...@gmail.com> wrote: >>> >>>> On Fri, Mar 14, 2014 at 12:38 PM, Nicholas Lemonias. < >>>> lem.niko...@googlemail.com> wrote: >>>> >>>>> Jerome of Mcafee has made a very valid point on revisiting separation >>>>> of duties in this security instance. >>>>> >>>>> Happy to see more professionals with some skills. Some others have >>>>> also mentioned the feasibility for Denial of Service attacks. Remote code >>>>> execution by Social Engineering is also a prominent scenario. >>>>> >>>> >>>> Actually, people have been pointing out exactly the opposite. But if >>>> you insist on believing you can DoS an EC2 by uploading files, good luck to >>>> you then... >>>> >>>> >>>>> >>>>> If you can't tell that that is a vulnerability (probably coming from a >>>>> bunch of CEH's), I feel sorry for those consultants. >>>>> >>>> >>>> You're the only one throwing around certifications here. I can no >>>> longer tell if you're being serious or this is a massive prank. >>>> >>>> >>>>> >>>>> Nicholas. >>>>> >>>>> >>>>> On Fri, Mar 14, 2014 at 10:45 AM, Nicholas Lemonias. < >>>>> lem.niko...@googlemail.com> wrote: >>>>> >>>>>> We are on a different level perhaps. We do certainly disagree on >>>>>> those points. >>>>>> I wouldn't hire you as a consultant, if you can't tell if that is a >>>>>> valid vulnerability.. >>>>>> >>>>>> >>>>>> Best Regards, >>>>>> Nicholas Lemonias. >>>>>> >>>>>> On Fri, Mar 14, 2014 at 10:10 AM, Mario Vilas <mvi...@gmail.com>wrote: >>>>>> >>>>>>> But do you have all the required EH certifications? Try this one >>>>>>> from the Institute for >>>>>>> Certified Application Security Specialists: http://www.asscert.com/ >>>>>>> >>>>>>> >>>>>>> On Fri, Mar 14, 2014 at 7:41 AM, Nicholas Lemonias. < >>>>>>> lem.niko...@googlemail.com> wrote: >>>>>>> >>>>>>>> Thanks Michal, >>>>>>>> >>>>>>>> We are just trying to improve Google's security and contribute to >>>>>>>> the research community after all. If you are still on EFNet give me a >>>>>>>> shout >>>>>>>> some time. >>>>>>>> >>>>>>>> We have done so and consulted to hundreds of clients including >>>>>>>> Microsoft, Nokia, Adobe and some of the world's biggest corporations. >>>>>>>> We >>>>>>>> are also strict supporters of the ACM code of conduct. >>>>>>>> >>>>>>>> Regards, >>>>>>>> Nicholas Lemonias. >>>>>>>> AISec >>>>>>>> >>>>>>>> >>>>>>>> On Fri, Mar 14, 2014 at 6:29 AM, Nicholas Lemonias. < >>>>>>>> lem.niko...@googlemail.com> wrote: >>>>>>>> >>>>>>>>> Hi Jerome, >>>>>>>>> >>>>>>>>> Thank you for agreeing on access control, and separation of >>>>>>>>> duties. >>>>>>>>> >>>>>>>>> However successful exploitation permits arbitrary write() of any >>>>>>>>> file of choice. >>>>>>>>> >>>>>>>>> I could release an exploit code in C Sharp or Python that permits >>>>>>>>> multiple file uploads of any file/types, if the Google security team >>>>>>>>> feels >>>>>>>>> that this would be necessary. This is unpaid work, so we are not so >>>>>>>>> keen on >>>>>>>>> that job. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Fri, Mar 14, 2014 at 6:04 AM, Jerome Athias < >>>>>>>>> athiasjer...@gmail.com> wrote: >>>>>>>>> >>>>>>>>>> Hi >>>>>>>>>> >>>>>>>>>> I concur that we are mainly discussing a terminology problem. >>>>>>>>>> >>>>>>>>>> In the context of a Penetration Test or WAPT, this is a Finding. >>>>>>>>>> Reporting this finding makes sense in this context. >>>>>>>>>> >>>>>>>>>> As a professional, you would have to explain if/how this finding >>>>>>>>>> is a >>>>>>>>>> Weakness*, a Violation (/Regulations, Compliance, Policies or >>>>>>>>>> Requirements[1]) >>>>>>>>>> * I would say Weakness + Exposure = Vulnerability. Vulnerability + >>>>>>>>>> Exploitability (PoC) = Confirmed Vulnerability that needs Business >>>>>>>>>> Impact and Risk Analysis >>>>>>>>>> >>>>>>>>>> So I would probably have reported this Finding as a Weakness (and >>>>>>>>>> not >>>>>>>>>> Vulnerability. See: OWASP, WASC-TC, CWE), explaining that it is >>>>>>>>>> not >>>>>>>>>> Best Practice (your OWASP link and Cheat Sheets), and even if >>>>>>>>>> mitigative/compensative security controls (Ref Orange Book), >>>>>>>>>> security >>>>>>>>>> controls like white listing (or at least black listing. see also >>>>>>>>>> ESAPI) should be 1) part of the [1]security requirements of a >>>>>>>>>> proper >>>>>>>>>> SDLC (Build security in) as per Defense-in-Depth security >>>>>>>>>> principles >>>>>>>>>> and 2) used and implemented correctly. >>>>>>>>>> NB: A simple Threat Model (i.e. list of CAPEC) would be a solid >>>>>>>>>> support to your report >>>>>>>>>> This would help to evaluate/measure the risk (e.g. CVSS). >>>>>>>>>> Helping the decision/actions around this risk >>>>>>>>>> >>>>>>>>>> PS: interestingly, in this case, I'm not sure that the Separation >>>>>>>>>> of >>>>>>>>>> Duties security principle was applied correctly by Google in term >>>>>>>>>> of >>>>>>>>>> Risk Acceptance (which could be another Finding) >>>>>>>>>> >>>>>>>>>> So in few words, be careful with the terminology. (don't always >>>>>>>>>> say >>>>>>>>>> vulnerability like the media say hacker, see RFC1392) Use a CWE ID >>>>>>>>>> (e.g. CWE-434, CWE-183, CWE-184 vs. CWE-616) >>>>>>>>>> >>>>>>>>>> My 2 bitcents >>>>>>>>>> Sorry if it is not edible :) >>>>>>>>>> Happy Hacking! >>>>>>>>>> >>>>>>>>>> /JA >>>>>>>>>> https://github.com/athiasjerome/XORCISM >>>>>>>>>> >>>>>>>>>> 2014-03-14 7:19 GMT+03:00 Michal Zalewski <lcam...@coredump.cx>: >>>>>>>>>> > Nicholas, >>>>>>>>>> > >>>>>>>>>> > I remember my early years in the infosec community - and sadly, >>>>>>>>>> so do >>>>>>>>>> > some of the more seasoned readers of this list :-) Back then, I >>>>>>>>>> > thought that the only thing that mattered is the ability to >>>>>>>>>> find bugs. >>>>>>>>>> > But after some 18 years in the industry, I now know that >>>>>>>>>> there's an >>>>>>>>>> > even more important and elusive skill. >>>>>>>>>> > >>>>>>>>>> > That skill boils down to having a robust mental model of what >>>>>>>>>> > constitutes a security flaw - and being able to explain your >>>>>>>>>> thinking >>>>>>>>>> > to others in a precise and internally consistent manner that >>>>>>>>>> convinces >>>>>>>>>> > others to act. We need this because the security of a system >>>>>>>>>> can't be >>>>>>>>>> > usefully described using abstract terms: even the academic >>>>>>>>>> definitions >>>>>>>>>> > ultimately boil down to saying "the system is secure if it >>>>>>>>>> doesn't do >>>>>>>>>> > the things we *really* don't want it to do". >>>>>>>>>> > >>>>>>>>>> > In this spirit, the term "vulnerability" is generally reserved >>>>>>>>>> for >>>>>>>>>> > behaviors that meet all of the following criteria: >>>>>>>>>> > >>>>>>>>>> > 1) The behavior must have negative consequences for at least >>>>>>>>>> one of >>>>>>>>>> > the legitimate stakeholders (users, service owners, etc), >>>>>>>>>> > >>>>>>>>>> > 2) The consequences must be widely seen as unexpected and >>>>>>>>>> unacceptable, >>>>>>>>>> > >>>>>>>>>> > 3) There must be a realistic chance of such a negative outcome, >>>>>>>>>> > >>>>>>>>>> > 4) The behavior must introduce substantial new risks that go >>>>>>>>>> beyond >>>>>>>>>> > the previously accepted trade-offs. >>>>>>>>>> > >>>>>>>>>> > If we don't have that, we usually don't have a case, no matter >>>>>>>>>> how >>>>>>>>>> > clever the bug is. >>>>>>>>>> > >>>>>>>>>> > Cheers (and happy hunting!), >>>>>>>>>> > /mz >>>>>>>>>> > >>>>>>>>>> > _______________________________________________ >>>>>>>>>> > Full-Disclosure - We believe in it. >>>>>>>>>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>>>>>>>>> > Hosted and sponsored by Secunia - http://secunia.com/ >>>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> Full-Disclosure - We believe in it. >>>>>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>>>>>>> Hosted and sponsored by Secunia - http://secunia.com/ >>>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> “There's a reason we separate military and the police: one fights >>>>>>> the enemy of the state, the other serves and protects the people. When >>>>>>> the military becomes both, then the enemies of the state tend to become >>>>>>> the >>>>>>> people.” >>>>>>> >>>>>>> _______________________________________________ >>>>>>> Full-Disclosure - We believe in it. >>>>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>>>>>> Hosted and sponsored by Secunia - http://secunia.com/ >>>>>>> >>>>>> >>>>>> >>>>> >>>> >>>> >>>> -- >>>> “There's a reason we separate military and the police: one fights >>>> the enemy of the state, the other serves and protects the people. When >>>> the military becomes both, then the enemies of the state tend to become the >>>> people.” >>>> >>> >>> >>> _______________________________________________ >>> Full-Disclosure - We believe in it. >>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>> Hosted and sponsored by Secunia - http://secunia.com/ >>> >>> >>> -- >>> Cheers >>> Michele >>> >>> >> >> > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > -- “If debugging is the process of removing software bugs, then programming must be the process of putting them in.” - *Edsger Dijkstra*
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
