bugtraq - Re: Sanctum AppScan 4 misses potential vulnerabilities in wrapped links

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200309261549.h8QFnr9s009648@turing-police.cc.vt.edu>
Date: Fri, 26 Sep 2003 11:49:53 -0400
From: Valdis.Kletnieks@...edu
To: "Dawes, Rogan (ZA - Johannesburg)" <rdawes@...oitte.co.za>
Cc: "'RAFAEL SAN MIGUEL CARRASCO'" <rsmc@....es>,
	bugtraq@...urityfocus.com
Subject: Re: Sanctum AppScan 4 misses potential vulnerabilities in wrapped links

On Fri, 26 Sep 2003 09:35:46 +0200, "Dawes, Rogan (ZA - Johannesburg)" <rdawes@...oitte.co.za>  said:
> I am inclined to agree with Sanctum's position here. Without actually
> executing the javascript, and triggering all the possible events, and
>
> would be overlooked by this technique. I'm still of the opinion that *no*
> automated tool can provide complete coverage of an arbitrary web
> application, simply because of the potential complexity. It's like solving
> the halting problem, to my mind.

That's because it *is* the Turing Halting Problem, more or less.

Fortunately, we can mostly work around the problem by applying some constraints
to the problem space - for instance, we can simulate the Javascript and see if
what pops out is "legal" or "illegal".  We then finesse the Turing issues by
simply declaring that any Javascript that takes over X amount of resources
(CPU, memory, network accesses, whatever) is tossed in the "illegal" pile.
This is demonstrably free of both Turing issues (since every test is guaranteed
to produce a result in X or less) and fulfills the Principle of Least Surprise
("I'd not have asked to visit that webpage if I knew it would take 2 hours to
do so").

The biggest remaining issue is the totally b0rked Javascript security model -
it isn't clear that it's possible to write an accurate simulator that does it
correctly.  The proof of this statement is the obvious fact that if it WERE
possible to write such a beast, vendors would be shipping it as their
Javascript interpreter. ;)

Content of type "application/pgp-signature" skipped