fred diggle: Hello to the pdp architect
pdp: what's up bro
fred diggle: have you found the xss lately
pdp: why the xss
if it is only one
fred diggle: <script>monkey()</script>
because it is the fun
pdp: your sarcasm is quite childish and kind of dull really, have you though about that ? <-- how rude :(
[smile]
fred diggle: Fredrick Diggle tries not to think about himself
it is depressing
pdp: sure it is
fred diggle: job at zoo is unrewarding
may i join you as xss finder?
pdp: I don't think that we have a place for you if you are just an XSS finder
fred diggle: Fredrick Diggle is the best google code search reg exer evar though
pdp: [smile] really
fred diggle: well second best maybe
pdp: honestly, let's cut the crap, what's up with that on FD? you just need to annoy people or what? I don't get it
fred diggle: it makes fred diggle chuckle
pdp: u and your other budies/personas/nicks
[smile]
fred diggle: actually fred diggle is only one person/nick/etc
pdp: but you are in a group
fred diggle: fd is just chucklable for many people he thinks
for example isgobblesback makes fd chuckle but fd does not know who this is
who else do you believe is also fd?
pdp: ah?
fred diggle: #define fd "fredrick diggle"
pdp: don't know, everybody else that acts like retard on FD <-- Or doesn't like pdp research into mad xss 0day
fred diggle: nah
pdp: and who have posted just 3 times
and comments on every single email
fred diggle: did you enjoy postfix 0day?
it was quite chucklable
nah honestly the first time I posted it was quite serious
And it became apparent that everyone there is essentially retarded
so fredrick diggle was born
pdp: no I understand your motives to an extend <-- oh does he?
but what I don't understand is why you bother
fred diggle: fred diggle has lots of free time at the zoo
pdp: hah [smile]
so what's up with all that anti XSS thing, I haven't published a single XSS on GNUCITIZEN... it is mostly about how to use XSS
as an attack vector
fred diggle: its just kind of a retarded attack vector generally
pdp: well to an extend yes, but the Web is growing and I truely believe that it will become more important in the future
fred diggle: you think javascript is going to become more privleged?
I would say if anything it will become more limited
pdp: have you checked the MacOS update hack
the idea is that when macos updates
it pulls some JavaScript
which run in very relaxed sandbox
therefore attackers can take a full control of your PC
JavaScript is glue language
the reason I talk about it
and I research about it
is because it exists everywhere
fred diggle: whats the vector to jump from the js interpreter to protected/real
pdp: web and not web related
fred diggle: even in that context?
pdp: the vector is that the sandbox provides you with access to write/read and execute files
this is serious enough
fred diggle: so where does this code come from?
you talking some form of mitm?
pdp: yes, in this case, yes, I am just giving a fresh example though, keep that in mind
fred diggle: yeah
so in this case I think that talk is warranted about the specific attack
if its cool fine
but to bang the javascript drum
...
whats the point
pdp: yeh and more over if you control the network the the extend where you can provide arbitrary code to the system then you can do other stuff as well
well JavaScript is everywhere
let me give you an example
fred diggle: x86 is more places
pdp: yes
fred diggle: in fact the js becomes it
so why does it matter
in some cases I will need to go to the asm level
in some I can even use js
pdp: ok JavaScript runs on mobile phones, on every desktop, as WSH or in the Browser <-- XSS is like robots and will eventually destroy us
fred diggle: why focus on the vector?
pdp: JavaScript runs on the server side and under any architecture
I don't focus on one vector
just this is how GNUCITIZEN was born
it was Web oriented at first
fred diggle: you focus on one interpreted language with very limited uses
pdp: well I focus on stuff that none has researched yet
why bother doing the same as the others
fred diggle: if a js hack is the best vector I think most intelligent people will use it
pdp: well I don't think that people know what they are doing <-- hear that FD, pdp thinks you are a moron :(
fred diggle: but its almost never the best vector
pdp: I am not saying that JavaScript is the ultimate tool <-- soon we will have machines that run on XSS instead of oil
but it may become
well it depends
what you are after
for example
fred diggle: for $ from dbags maybe
pdp: if you have a sandboxed browser how your buffer overflows will help you to do something
first of all let's define what attackers are after
most serious attacks are after the data
spending so much time on hackign the client just to get into your data is usless
instead someone can utilize XSS cuz that can definitely get to your ebay account for example
simepl
fred diggle: so you are honestly in this game to protect data?
to make the world safer?
pdp: I am not
I like breaking thing not protecting against attacks
but to me the data is the ultimate goal
fred diggle: ok we are on the same page at least in that
but it seems to me
you would focus on the more complex aspects of this stuff
if your goal is really self growth/learning/breaking shit
pdp: well we do many different stuff which I cannot talk about yet <-- pdp has mad xss 0day etc
but that will come with the time
fred diggle: everything js can do is fairly obvious just from reading the spec
if you are really interested in breaking things then break the interpreter
pdp: well there are ways to break the interpreter and hop sandboxes
but why should I talk about that
what I find is that very often people talk about theory
theorethical crap
although the research might look technically chalanging why should I publish it unless I have something solid
fred diggle: why should you ever publish it?
pdp: [smile] so what worths beeing published?
fred diggle: whats worth me giving up what I have spent hours on to a list of idiots for nothing?
hrrm maybe a picture of a carrot
pdp: I like that you are taking all these stuff from the fun side of things...
and you are right
it is not worthed
fred diggle: I think that I know what drives you
pdp: what is it
fred diggle: and I would appreciate you being honest about it
pdp: cool
fred diggle: but its to make a name for yourself
no?
pdp: not really
I love my work man
fred diggle: as do I
but the world will never know who fredrick diggle is
as is true of the others that you call trolls
pdp: yes, but what do you get out of your joy
ok I must agree
fred diggle: that is the ends friend
pdp: that I try to make GNUCITIZEN more popular
but the reason I try to do that
is because I am tired of being someone else pone
as you probably you are
so to an extend, the research I am doign is also an escape
a life hack if you like
so yes it is for $
and yes we make a name out of it
but the goals are higher
I love the hacker culture first of all
I love it
and this is the reason why I do other projects like Hakiri which I hope will work
fred diggle: So how do you hope to get out?
pdp: by giving my best
fred diggle: I mean what is the "out" for a sec researcher
pdp: put it this way
I presume you are a sec researcher
fred diggle: nah I work at a zoo
pdp: if I can pay you to do your own research in your own defined time frame, would you like that?
fred diggle: here is my question though
do you really believe that there are people willing to pay for that type of person to do xss?
to do anything remotely related to it
the only money in xss is in "app scanning" crap and consulting
which means you are either a pawn to big business and ultimately the economy
or you are the business trying to survive in the economy and sec is not you focus
there are certainly research jobs out there
but without demonstrating an understanding of the fundamentals of comp arch... they are all out of reach
pdp: I don know why everyone brags about comp arch, it is almost like if you understand the stack you are 1337
why is that?
fred diggle: ultimately what the people hiring for those jobs are looking for is an understanding of the lowest level
pdp: not true
fred diggle: because the higher levels are easy once you have tat
pdp: what peopel are looking for is someone who understand the bigger picture
and then they can hire
anyeone to do the low stuff
fred diggle: so you want to be a manager?
researchers never understand the big picture
pdp: nope, I like to be on my own with GNUCITIZEN, with Hakiri and everything that I believe in
fred diggle: actually i should say don;t need to
pdp: they do
it depends what you research
fred diggle: if thats the sort of research you enjoy then be an economist
and look at trends it the sec idustry
its the same crap
pdp: no socialscientist is better
fred diggle: fien then do that
pdp: but why should I do that when I know something esle
already
and I like doing it
maybe in 50 years we all go into politics
fred diggle: in 50 years fred diggle will be dead
unfortunately
pdp: well, you never know
you might decide to freeze yourself
fred diggle: unless someone cures pancreatic cancer in the next 3 months then I am fairly sure
but that aside
pdp: I am sorry to hear that
fred diggle: to address what you said earlier
about stacks etc
when did you get the impression that we worship that sort of drivle
pdp: I get the idea is that people in the sec research circles value everything that is related to how low system architecture work and abolish everything that is at level 7 or ring 3 pick
fred diggle: nah that is a misunderstanding
pdp: it is true
fred diggle: I value things that are new and inovative
exloiting a buffer overflow of a stack variable is generally niether
pdp: XSS is kind of new and can get very innovative, to an extend that you never know what has happended but you don't value it because you don't like that it is not asm
thing about it for a second
the browser and every other
JavaScript/ whatever sandbox
restricts your from doing things
so when you make it do what you want
don't you think this is innovative?
fred diggle: cite me some time when you made the javascript interpreter do something it wasn;t supposed to
?
I mean there are a couple possibilities that I see
pdp: you cannot look it from the intrepeter point of view because under neat the intrepereter is the OS or the APP to be more precise
so in that case you realy on the same old exploiting software techniques
you can make the intrepreter crash or whatever and with that gain control over the process
this is fine
fred diggle: nah
far more interesting would be a logic bug in the interpreter
which lets you do ...
etc
pdp: here is a logic bug for you
fred diggle: if its a blind strcpy in a js interpreter it won't hold my interest
pdp: well the intrepeter is not like Pyton and Ruby
it is really bare
it doesn't even have functionalities
it is just the developer that decides what the intrepreter should have
for example, let's say that you want to get out of sandbox
maybe the typical stuff you have in firefox
the sadnbox has only 3 functions usually in XPCOM
dump, debug and importFunction
nonne of them are useful in whatever way
and you are really locked
one way to get of the sandbox
is to return a value
which has a bit of sugger
the sugger looks like this
{valueOf: function () {whatever}}
if there is an object outside the sandbox
which compares the return value to 1
or something else
you might be able to overwrite strings outside of the sandbox
which may influence the execution path
in firefox for exmaple
you don't have only one sandbox
you have layers of sandboxes
so it does get quite interesting when it comes to stuff like this
fred diggle: so what I see is one piece of mildly interesting information that could some day maybe be usful in some very specific part of a very specific exploit
pdp: yes but this is what JS is... it is domain specifc platform
the things that work in Firefox may not work in PDF
and will be completely differnt from wSH
so it is not that you learn just how x86 works
every single platform is different
JavaSript is just a glue language, really
but I am also tired talking about it
fred diggle: so stop
thats a good solution
pdp: [smile] well there are tones of people that find all these stuff very valuable
so I keep doing it because there are more developments
fred diggle: anyway fredrick diggle needs to go clean up after the hippopotamus
it has been enlightening
pdp: me 2