full-disclosure - Re: [WEB SECURITY] noise about full-width encoding bypass?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 22 May 2007 10:05:45 -0700
From: "Arian J. Evans" <arian.evans@...chronic.com>
To: "Amit Klein" <aksecurity@...il.com>, 
	"Web Security" <websecurity@...appsec.org>, 
	Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: [WEB SECURITY] noise about full-width
	encoding bypass?

On 5/22/07, Amit Klein <aksecurity@...il.com> wrote:
>
> Brian Eaton wrote:
> > Has anyone had a look at the full-width unicode encoding trick
> > discussed here?
> >
> > http://www.kb.cert.org/vuls/id/739224
> >
>
> BTW - why is this news? it has been known for long:

I think the problem here is network security folks don't understand this
stuff at all.

IDS evasion is the stuff of "landmark" papers, from the paper Thomas Ptacek
and co did on packet fragmentation and re-assembly work, to K2's polymorphic
shell-code:

http://en.wikipedia.org/wiki/Intrusion_detection_system_evasion_techniques

So there are 31 flavors of encoding types validly used by web apps using
HTTP that may or may not get interpreted, converted, or canonicalized to
ASCII or some form that a parser will execute.

We know that, and discuss it ad naseum on the WASC list, but I'm not sure
that the average Joe running an IDS understands just how limited that IDS or
firewall (with "application smart defense", etc.) may be with its "tcp
stream reassembly and HTTP decoding" capabilities.

Hence the wonky cert advisory, basically: "OMG! all valid encoding types not
decoded by IDS!!! Who knew ?!?"

So, in short Amit: It is new news to some folks, I think, probably a lot of
folks (the majority of the IT and even infosec professional population not
subscribing to these lists).

There is no God Master Guide to Encoding Ninjitsu for Web Attacksters handy
for folks to quick reference this rather complex subject, either...

-- 
Arian Evans
scrutinizing shameless software insecurity

"Diplomacy is the art of saying "Nice doggie" until you can find a rock." --
Will Rogers

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/