1,560 reputation
11028
bio website serverfault.com
location
age 34
visits member for 4 years, 11 months
seen Dec 1 at 21:15

Do not trust any security related answers you see on SO. Not from me, not from anyone. There are very smart people on SO and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.

I have been writing exploit code for more than 4 years. I have spoken 3 years in a row at DEFCON. Currently I am the top answerer and asker of security questions on Stack Overflow.

I actively hunt for vulnerabilities and I have found many over the years. According to the Department of Homeland I have found a vulnerability with a severity metric of 13.5 which makes it into the top 1,000 most dangerous of all time and the most dangerous CSRF vulnerability ever discovered.


Jul
18
comment Is there a windows equivalent to chroot?
@MarkM Interesting, but with the grsecuirty improvements the only method of breaking out would be to rip a hole into kernel land, which could be done buffer overflow in linux (or whatever kernel you are using).
Jul
18
comment Is there a windows equivalent to chroot?
@MarkM So you would say that a chroot isn't a security system? Also, that attack doesn't work on a grsecurity chroot (grsecurity.net).
Jul
18
comment Is there a windows equivalent to chroot?
One of my processes was poorly written and very insecure, management doesn't want to fix it because it would be "too expensive". I expect this process to get owned eventually and i want to limit the impact on my system. If you really believe there is nothing to gain, then you must read more about chroots.
Jul
5
comment Sockets found by lsof but not by netstat
@Robert Munteanu You have to set break points upon socket creation and look at the stack trace and memory at that point. I suspect you are falling into an infinite loop. Being able to look at any variable and step though your code is going to be the best approach for complex problems like this.
Jul
4
comment Sockets found by lsof but not by netstat
@Robert Munteanu If you are building this app thenthis is a question for stackoverflow. Never the less you are opening too many sockets.
Jun
29
comment What risks are associated with allowing anonymous access from the LAN to the internet?
@Evan Anderson it isn't clear if that is his configuration, although even with only HTTP access you can piss of the DoD and get a nasty C&D in the mail.
Jun
29
comment R, PHP & Apache
Sounds like your hosting company sucks.
Jun
28
comment My site seems to be hijacked… but only when visited from another site… how?
@Zoredache your right that the problem could be an issue with configuration or a vulnerability in another service. However many exploits work regardless of configuration or security settings, such as sql injection. Even with AppArmor and SELinux a system can still be exploited easily.
Jun
17
comment Why shouldn't root be allowed to login via ssh?
because its old and no one uses it.
Jun
14
comment compromised site
@Longpoke The Register called this exploit an Apocalyptic Infection (theregister.co.uk/2010/05/11/phpnuke_infection_purged). Thats a great complement for any security researcher but I prefer the title "masSEXploitation". I guess Russian mob like candy :)
Jun
14
comment compromised site
@Longpoke AppArmor and SElinux are more like a chroot than a canary, its another layer of access control that is per-process instead of per user/group. And btw i just got accepted to speak at Defcon and i'll be talking about the AppArmor bypass that i used in my exploit :)
Jun
14
comment compromised site
@Longpoke (AppArmor<=SELinux && ASLR/SSP!=AppArmor)
Jun
14
comment compromised site
@Longpoke If you look at these exploitation methods discussed in these 2 papers I think you'll agree that it would be difficult to pull this off in some kind of super worm thats able to break any vulnerable site. ngssoftware.com/papers/HackproofingMYSQL.pdf securereality.com.au/studyinscarlet.txt
Jun
14
comment compromised site
@Longpoke Ubuntu's AppArmor rule sets jail MySQL from writing to the web root. SELinux under rhel/fedora does something very similar. I am actually working with ubuntu to fix a AppArmor Bypass issue that i have discovered. The worm could be doing a vulnerability scan and exploiting common RCE issues (RFI/eval()/file_put_contents()), and this is more likely that sql injection, and i recommend running a vuln scan (w3af is pretty sick). Although i suspect these criminals are more simplistic.
Jun
14
comment compromised site
+1 good link. Its well known that GoDaddy has some major problems with security.
Jun
14
comment compromised site
@Longpoke I am happy to discuss exploit development, however i do not appreciate these comments when you do not have a better answer.
Jun
14
comment compromised site
@Longpoke Yes load_file() does work, but into outfile "/var/www/backdoor.php" is more easily automatble. Ubuntu is good about stopping these attacks, although i think GoDaddy uses windows. It is worm, no hacker is going to burn an afternoon breaking some random ass site, he is going to break into tens/hundreds of thousands of sites using an automated agent (worm).
Jun
14
comment compromised site
@Longpoke Yes chrome and frefox will throw a google warning of an infected site, if you click on more info it will most often tell you the name of the worm. I've done this, you can't tell me otherwise.
Jun
14
comment compromised site
@pinniger Change your ftp password anyway, make sure only machines with av's have it. Someone at a internet cafe could also jack your password. Another option is to look for files like fckedtor or old versions php-mailer, they where really common worms. You could try removing the write bit from all files (chmod 500 is usually best). However, this is just addresses the symptom of the problem.
Jun
14
comment compromised site
@Longpoke yeah if his local machine has a virus that is sniffing for ftp, then yeah he needs an anti-virus. I have personally cleaned up sites that where affected by this.