Message-ID: <d4ee6946-0508-4457-b351-c9529f6689e2@katmail.1gravity.com>
Date: Fri, 14 Mar 2014 21:50:13 +0800
From: Sergio 'shadown' Alvarez <shadown@...il.com>
To: "Nicholas Lemonias." <lem.nikolas@...glemail.com>,
 Mario Vilas <mvilas@...il.com>, full-disclosure@...ts.grok.org.uk,
 Pedro Ribeiro <pedrib@...il.com>
Subject: Re: Google vulnerabilities with PoC

Dear Nicholas Lemonias,

I don't use to get in these scrapy discussions, but yeah you are in a completetly different level if you compare yourself with Mario.
You are definitely a Web app/metasploit-user guy and pick up a discussion with a binary and memory corruption ninja exploit writter like Mario. You should know your place and shut up. Period.

Btw, if you dare discussing with a beast like lcamtuf, you are definitely out of your mind.

Cheers,
  Sergio.
-- Sergio

On Mar 14, 2014, "Nicholas Lemonias." <lem.nikolas@...glemail.com> wrote:
>We are on a different level perhaps. We do certainly disagree on those
>points.
>I wouldn't hire you as a consultant, if you can't tell if that is a
>valid
>vulnerability..
>
>
>Best Regards,
>Nicholas Lemonias.
>
>On Fri, Mar 14, 2014 at 10:10 AM, Mario Vilas <mvilas@...il.com> wrote:
>
>> But do you have all the required EH certifications? Try this one from
>the
>> Institute for
>> Certified Application Security Specialists: http://www.asscert.com/
>>
>>
>> On Fri, Mar 14, 2014 at 7:41 AM, Nicholas Lemonias. <
>> lem.nikolas@...glemail.com> wrote:
>>
>>> Thanks Michal,
>>>
>>> We are just trying to improve Google's security and contribute to
>the
>>> research community after all. If you are still on EFNet give me a
>shout
>>> some time.
>>>
>>>  We have done so and consulted to hundreds of clients including
>>> Microsoft, Nokia, Adobe and some of the world's biggest
>corporations. We
>>> are also strict supporters of the ACM code of conduct.
>>>
>>> Regards,
>>> Nicholas Lemonias.
>>> AISec
>>>
>>>
>>> On Fri, Mar 14, 2014 at 6:29 AM, Nicholas Lemonias. <
>>> lem.nikolas@...glemail.com> wrote:
>>>
>>>> Hi Jerome,
>>>>
>>>> Thank you for agreeing on access control, and separation of duties.
>>>>
>>>> However successful exploitation permits arbitrary write() of any
>file of
>>>> choice.
>>>>
>>>> I could release an exploit code in C Sharp or Python that permits
>>>> multiple file uploads of any file/types, if the Google security
>team feels
>>>> that this would be necessary. This is unpaid work, so we are not so
>keen on
>>>> that job.
>>>>
>>>>
>>>>
>>>> On Fri, Mar 14, 2014 at 6:04 AM, Jerome Athias
><athiasjerome@...il.com>wrote:
>>>>
>>>>> Hi
>>>>>
>>>>> I concur that we are mainly discussing a terminology problem.
>>>>>
>>>>> In the context of a Penetration Test or WAPT, this is a Finding.
>>>>> Reporting this finding makes sense in this context.
>>>>>
>>>>> As a professional, you would have to explain if/how this finding
>is a
>>>>> Weakness*, a Violation (/Regulations, Compliance, Policies or
>>>>> Requirements[1])
>>>>> * I would say Weakness + Exposure = Vulnerability. Vulnerability +
>>>>> Exploitability (PoC) = Confirmed Vulnerability that needs Business
>>>>> Impact and Risk Analysis
>>>>>
>>>>> So I would probably have reported this Finding as a Weakness (and
>not
>>>>> Vulnerability. See: OWASP, WASC-TC, CWE), explaining that it is
>not
>>>>> Best Practice (your OWASP link and Cheat Sheets), and even if
>>>>> mitigative/compensative security controls (Ref Orange Book),
>security
>>>>> controls like white listing (or at least black listing. see also
>>>>> ESAPI) should be 1) part of the [1]security requirements of a
>proper
>>>>> SDLC (Build security in) as per Defense-in-Depth security
>principles
>>>>> and 2) used and implemented correctly.
>>>>> NB: A simple Threat Model (i.e. list of CAPEC) would be a solid
>>>>> support to your report
>>>>> This would help to evaluate/measure the risk (e.g. CVSS).
>>>>> Helping the decision/actions around this risk
>>>>>
>>>>> PS: interestingly, in this case, I'm not sure that the Separation
>of
>>>>> Duties security principle was applied correctly by Google in term
>of
>>>>> Risk Acceptance (which could be another Finding)
>>>>>
>>>>> So in few words, be careful with the terminology. (don't always
>say
>>>>> vulnerability like the media say hacker, see RFC1392) Use a CWE ID
>>>>> (e.g. CWE-434, CWE-183, CWE-184 vs. CWE-616)
>>>>>
>>>>> My 2 bitcents
>>>>> Sorry if it is not edible :)
>>>>> Happy Hacking!
>>>>>
>>>>> /JA
>>>>> https://github.com/athiasjerome/XORCISM
>>>>>
>>>>> 2014-03-14 7:19 GMT+03:00 Michal Zalewski <lcamtuf@...edump.cx>:
>>>>> > Nicholas,
>>>>> >
>>>>> > I remember my early years in the infosec community - and sadly,
>so do
>>>>> > some of the more seasoned readers of this list :-) Back then, I
>>>>> > thought that the only thing that mattered is the ability to find
>bugs.
>>>>> > But after some 18 years in the industry, I now know that there's
>an
>>>>> > even more important and elusive skill.
>>>>> >
>>>>> > That skill boils down to having a robust mental model of what
>>>>> > constitutes a security flaw - and being able to explain your
>thinking
>>>>> > to others in a precise and internally consistent manner that
>convinces
>>>>> > others to act. We need this because the security of a system
>can't be
>>>>> > usefully described using abstract terms: even the academic
>definitions
>>>>> > ultimately boil down to saying "the system is secure if it
>doesn't do
>>>>> > the things we *really* don't want it to do".
>>>>> >
>>>>> > In this spirit, the term "vulnerability" is generally reserved
>for
>>>>> > behaviors that meet all of the following criteria:
>>>>> >
>>>>> > 1) The behavior must have negative consequences for at least one
>of
>>>>> > the legitimate stakeholders (users, service owners, etc),
>>>>> >
>>>>> > 2) The consequences must be widely seen as unexpected and
>>>>> unacceptable,
>>>>> >
>>>>> > 3) There must be a realistic chance of such a negative outcome,
>>>>> >
>>>>> > 4) The behavior must introduce substantial new risks that go
>beyond
>>>>> > the previously accepted trade-offs.
>>>>> >
>>>>> > If we don't have that, we usually don't have a case, no matter
>how
>>>>> > clever the bug is.
>>>>> >
>>>>> > Cheers (and happy hunting!),
>>>>> > /mz
>>>>> >
>>>>> > _______________________________________________
>>>>> > Full-Disclosure - We believe in it.
>>>>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>>> > Hosted and sponsored by Secunia - http://secunia.com/
>>>>>
>>>>
>>>>
>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
>>
>>
>>
>> --
>> "There's a reason we separate military and the police: one fights
>> the enemy of the state, the other serves and protects the people.
>When
>> the military becomes both, then the enemies of the state tend to
>become the
>> people."
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>
>------------------------------------------------------------------------
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists