No, I’m not dead yet
January 9th, 2007 by iljaBeen a while since I blogged. I’ve been busy you know, xmas, 23c3, newyears, recovering from all that, ….
So, euh, happy new year to those 2 people that read my blog (even tho it’s more then a week late). I guess it’s customary to make predictions for 2007, however, I’m not going to do that. When people do that, they’re either safe bets or total bullshit !, I won’t participate in that.
Since I haven’t blogged in a while this blogpost will be a mix of things I wanted to blog about in the past 3 weeks.
I guess I’ll start of with my “report” on 23c3. Man was that awesome ! It was my 5th c3 congress (in a row). And as usual, it rocked ! getting drunk, sleep deprived, socializing and wachting talks for 4 days. 2 of those talks were even mine.
I did an IT security standup comedy together with fefe. we basicly bashed pretty much everyone (but it was not evenly divided, apple got a lot of the bashing). Ofcourse any kind of it related bashing has to include Joerg Schilling. Fefe had this great schilly joke. How many schilly’s does it take to screw in a light bulb ? None, it’s not his fault the light is off ! Anyways, the feedback we got on it wasn’t all bad, although apparently people couldn’t hear me all that well, fefe, who was standing right next to me could hear me just fine, so there must have been something wrong with the microphone. I guess we didn’t entirely go up in flames as we expected we would.
I also gave a talk that I called “Unusual bugs”, at 11:30 in the morning on the 4th (and last) day. That was painful ! (although apparently some people in the us got up at 5:30 in the morning to watch the stream :( which is way more painful). Regardless of the fact it was that early a fair amount of people still showed up (go figure). I talked about exploiting NULL pointer derefs, some issues with alloca(), recursive stack overflow, problems with regex’s and some other stuff. the slides are online if you want to see them (ilja.netric.org/files/Unusual%20bugs%2023c3.pdf). All in all I’d say that talk went pretty well. I got some awesome feedback on it, and people have told me about some related things I didn’t know yet. I also did an demo with an 0day OpenBSD kernel bug. Apparently OpenBSD exploits are easy crowd pleasers, I wonder why. Somewhere in my talk (during the regex thing) I talked about the ^ sign, and not knowing it’s name I called it the hat sign, untill Fabienne was kind enough to tell me it’s called the caret sign. I was told I should submit that talk to cansec aswell, so I did, let’s wait and see if they’ll accept it.
Anyways, 23c3 was just great ! I met up with Gadi Evron btw (you know, the guy that owns the fuzzing mailing list) He’s quite cool. I also ended up seeing his talk about fuzzing the corporate world. It was pretty cool, it wasn’t really a technical talk tho, he talked more about how we can introduce fuzzing in the corporate world. What made the talk so great is the way Gadi does it. He pretty much forces audience participation upon you. Remember this, if you ever go see his talk, and you don’t want to get handed the mike to answer some questions, go sit in the back! if you like that kind of presenting, then I would highly recommend seeing any future talk by Gadi.
I also saw Joanna’s talk. It was good, as you can expect from her, however, I was a little bit disapointed that it wasn’t more technical (which you usually expect from her). At some point someone disagreed with something she said (I can’t quite remember what) and sort of a discussion took place between him and Joanna, at the end someone in the audience yelled “Objection, speculation” and she moved on. Somewhere near the end of her talk she said something security related about NetBSD and I could barely hold my laughter.
So I also attended fefe’s bignum talk, which was interesting. Not that I have any interest in _EVER_ writing bignum code, but he did some benchmarks aswell, to see if how faster certain things work compared to other. I was shocked to see his “div” benchmarks, I knew division is slow, but I had no idea it was this slow. In the end he remarked that a lot of the actions you need for bignum code are actually by definition slow, coz that’s how people design their crypto stuff, the slower it is by design, the better. (so for those who don’t know, you usually only use bignum code for crypto stuff).
Ofcourse I also saw Kaminsky’s talk! the man is an awesome entertainer! If you’ve never seen any of his talks then you should definatly go see one of them when you have the chance, even if you’re not interested in any of the topics he’ll cover, you’ll still like his talks, trust me.
and so, after 23c3 I spend 8 hours in the car, getting back home, yea that was really fun ….
So one of the things I noticed after my unusual bugs talk, the OpenBSD guys fix bugs _FAST_. I mean really fast ! bugfix and announcement within a few days. Not many vendors can pull that off. While preparing the OpenBSD exploit for my talk, I also noticed that if you mmap with MAP_ANON, your fd has to be set to -1 (on BSD), why in the hell is that ? it gets ignored anyways. that tiny piece of code that checks for -1 in that case is just bloat, would be great if someone just removed that. In linux this is not the case btw, the kernel will just ignore the fd in that case (as it should !).
A few days ago fefe told me about these inotify syscalls in the linux kernel. Basicly you use them so you can get informed automatically about any change to any file. I quickly looked at the code that does it and stumbled on some small security bug. Basicly, what you do is, you call inotify_init() to get an fd to an inotify event queue. then using that fd you can add or remove watch points. There are limits set to how many of those watch points and fd’s you can get (I believe you can change them in /proc as root) and there’s a race condition in the code that checks if you’re over the limit, and increasing the count of how many you already have:
asmlinkage long sys_inotify_init(void)
{
…
user = get_uid(current->user);
if (unlikely(atomic_read(&user->inotify_devs) >=
inotify_max_user_instances)) {
ret = -EMFILE;
goto out_free_uid;
}
… a whole bunch of stuff …
atomic_inc(&user->inotify_devs);
…
}
So it checks it, then does a whole bunch of stuff, and only after that changes the count of how many you have. So you could race this and call inotify_init() a bunch of times and basicly go over the limit you’re supposed to have. Ofcourse I reported this to security@kernel.org, but they don’t seem to care about this at all. I even got a mail back from torvalds himself saying “we simply don’t care whether the limit is exceeded _exactly_, or if somebody can come in and exceed it just a little bit.”, WTF ? yea I know the skies aren’t falling, but this is a bug and simply needs fixing! And I wonder how they define “a little bit”, my guess is, if you spend some time figureing things out, you could probably greatly exceed the limit. the code to add inotify watches suffers from the same race.
Recently I’ve had some success with manual fuzzing, I didn’t really want to blog about this, coz it’s pretty lame, but fuck, manual fuzzing can be pretty effcient. So euh, what you basicly do is look at some binary file in a hex editor, change some values, and see what happens. Things really _SHOULDNT_ break on this, but they do. it’s pretty sad really. Anyways, I usually use the 010 hex editor for this (it also has some templates that support certain files, like wav, avi, zip, …). You should give it a try sometimes, chances are you’ll find some nice 0day with it.
When reading some stuff on wikipedia I also ran into the irony mark, I’m so going to use that! it’s basicly a reversed question mark.
I also released a unix ioctl fuzzer a few days ago, if you’d like to give it a try you can download it here. It works (somewhat) on Open-, Net-, FreeBSD and linux. I also have a somewhat hacked up version for osx, which I’ll release at some point. It’s been quite effective, I found the OpenBSD kernel bug with it for example. somewhat simular, I’ve started working on a sysctl fuzzer, we’ll see how that goes.
A cool blog you should definatly check out is bitty’s blog, she was also kind enough to make my cool 23c3 slides.
another blog you should read, is the art of software security assesment’s blog, from the guys who made THE code auditing bible !
And another blog related announcement, another bug of the month kinda thing. Month of the apple bugs. Some seem to think these kind of things are a mistake, I on the other hand will sit back, relax, eat some popcorn, and ejoy the show. And if it tickles my funnybone, I’ll laugh !
I also ran into this idefense advisory. What’s so funny about this one is that the vedor simply won’t fix the bug: “QUALCOMM will not be addressing this issue with a software patch and instead recommends that administrators block access to the affected port from untrusted sources at the network level.” WTF ??? this is a heap overflow in what looks like a supported product, how can you (as a vendor) refuse to fix it ???
Last, but not least, I was going over some BSD syscalls and saw the revoke() syscall. I’d never heard of this one before, apparently it takes a pathname as input and invalidates _ANY_ fd on the system to that path (assuming you either own the file or are root). Somehow I think there’s gotta be some security bugs related to this. How can there not be ? Suids for example don’t get written with the idea that open fd’s they have all the sudden get invalidated, without any kind of notice. anyways, I still need to dig into this one, expect some funny results from this at some point.
Edit: More proof that I’m an idiot, the advisory I linked to wasn’t idefense it was zdi, yea, think I should take that reading 101 class again.
