full-disclosure - Re: [WEB SECURITY] noise about full-width encoding bypass?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cd1bdfdd0705221724i46a7ab68l916486af9029a9a5@mail.gmail.com>
Date: Tue, 22 May 2007 17:24:26 -0700
From: "Arian J. Evans" <arian.evans@...chronic.com>
To: "Amit Klein" <aksecurity@...il.com>, 
	"Web Security" <websecurity@...appsec.org>, 
	Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: [WEB SECURITY] noise about full-width
	encoding bypass?

On 5/22/07, Amit Klein <aksecurity@...il.com> wrote:
>
>
> Fair enough. Still, I expect at least the websecurity mailing list to
> give credit where credit is due...

Hmm, good point, No argument, but...as we see more of this
character encoding set awareness I wonder:

1. Where do you draw the line on what is "new"?

2. The Cert advisory is telling us that a lot of folks consider this "new".
(Maybe you should link them back to Scambray and McClure's late 90's
prediction  that Unicode would be the death of IDS?)

3. There are two or more completely separate dialoges here, between
network sec, and app sec. A lot of folks deserve credit for related research
on the network side, and probably even the VX side of the house.

If you look at the VX'er history they dealt with many of the same issues
independent of network and appsec, yet we don't credit any of them...
(probably because they largely wrote in Russian and Polish).

3. The reality is that we are going to see stuff like Cert advisories for
things
that are (or should be) pretty damn obvious, and redundant, as people start
to understand charsets and encoding types more. Let's say I found a
web-based
triple-decode shellcode canonicalization recently: is that a "new vuln"?

Canonicalization order:

Unix Shellcode --> Hex URL --> HTML Hexdecimal Reference --> raw text

Should I publish a Cert advisory on this? I'm pretty sure their IDS
isn't gonna catch it. In fact, I am pretty sure no one's is.

Who do I credit?

Not trying to escape responsibility by any means; I am having
trouble getting my head around the depth of this hole though.

Thanks,

-- 
Arian Evans
software security stuff

"Diplomacy is the art of saying "Nice doggie" until you can find a rock." --
Will Rogers

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/