The DMZ

TildalWave

12:57 AM

►

hehehe some are fantastic ... not booties, that's just the image but it's NSFW tho

Thomas Pornin

2:10 AM

@RоryMcCune And already 6 downvotes !

@tylerl I got today an email from the local sysadmin people: they were taking down a number of systems in emergency because they had to patch for the new scary OpenSSL bug.

It has gone completely viral.

TildalWave

Night folks, I think I've gone anemic from all this heartbleed already :|

Terry Chia

4:31 AM

Seeking devop with 2+ years in Heart Bleed

Tweeted by Horse_Recruiter on April 9, 2014 at 5:41 PM

Adnan

- What should clients do about heartbleed?
- Are clients affected by heartbleed?
- How affected are clients by heartbleed?
- Are clients as severely affected by heartbleed as servers?
- Is SSH affected by heartbleed?
- Is Apache affected by heartbleed?
- Is Tomcat affected by heartbleed?
- Which clients are affected by heartbleed?
- Is Facebook affected by heartbleed?
- Is OpenVPN affected by heartbleed?
- Which services are affected by heartbleed?
- What should the average user do about heartbleed?

- Is heartbleed hertbleed heartbleed?

- How heartbleed is heartbleed actually is?

AviD

5:34 AM

@ThomasPornin meh. the scarce resource is brain cycles. And if I need to spend even one extra cycle to "parse" the separation of blocks, it's not worth it. I put opening braces on new lines so the block pops out.

Adnan

@TildalWave Oh, thank you for tagging that as NSFW. I couldn't have figured it out from the thumbnail.

AviD

@TildalWave what the hell is a "vine"?

Terry Chia

@AviD Instagram for videos.

AviD

@TerryChia isnt that youtube?

or vimeo?

Terry Chia

@AviD Ok, Twitter for videos.

AviD

5:43 AM

and if its a vine, why is it on youtube?

@TerryChia so visually useless.

Terry Chia

@AviD Short, few second videos basically. It's on YT because it's a compilation.

Adnan

@TerryChia Love, you explained this to me before but I forgot, so I'll have to ask again. My tweets are private (my tweeting wall or whatever it's called is set to private). If I mention somebody, (like asking something from somebody I'm following). Example: "@TerryChia Are you going to xCon this year?"

Will they see it or not?

Terry Chia

@Adnan I won't see it if I'm not following you.

Adnan

@TerryChia Would that change if I set my tweeting wall to public?

Terry Chia

@Adnan Yes (I think).

And it's called a twitter feed. :P Not "tweeting wall". That sounds funny.

AviD

5:46 AM

@TerryChia okay 90% of that is worser thant useless crap. what the hell?

Terry Chia

@AviD Teenagers.

Adnan

@TerryChia Is your twitter tweeter twit @TerryChia?

AviD

@TerryChia uhh, yeah okay, that actually explains it.

Adnan

I guess it's called "Twitter username"

Okay, @AviD, I'll try it on you.

AviD

try what?

heh. I just got tweeted.

twerted?

Adnan

5:49 AM

@AviD Twitted?

Terry Chia

@Adnan Nah it's not. And I'll prefer to keep it private sorry. :)

@AviD Twerked?

Adnan

@TerryChia Hey, no problem at all.

@AviD So, you saw it?

Terry Chia

Just a thought, since we determined that heartbleed clients are vulnerable... anyone bothered to recompile Python yet? :P

AviD

@Adnan yeah. and responded. so is my response private too?

Terry Chia

BEST TWITTER ACCOUNT EVER!

Taylor Swift

@SwiftOnSecurity, The Internet

Tayor Swift's thoughts on #infosec. By @explanoit

6 tweets, 84 followers, following 34 users

Adnan

5:52 AM

@AviD Perfect. Now let's remove that abomination. I removed mine

@AviD How did you make your tweeter wide and big like that?

@RоryMcCune's and mine are still small and narrow

2

AviD

@Adnan I just maximized my window. But how did you see that??

Adnan

@AviD Go to my tweeter and look at my page. It's narrow and weird

Terry Chia

@Adnan TWSS?

Adnan

@TerryChia But hey, really, was there some opt-in Twitter upgrade?

Terry Chia

@Adnan Hahahahaha!

AviD

5:56 AM

@Adnan and mine isnt?

Terry Chia

@Adnan No clue.

Adnan

@AviD Why does mine look like that? Maaaan, every time I look at it and compare it to yours I feel sad :(

2

AviD

perhaps because you changed the template etc.

@Adnan starwhoe ;-)

Adnan

@AviD Last one, yup.

@AviD Oooh, how can I change that template again?

AviD

@Adnan clikc "Me", then click "Edit Profile"

Adnan

6:00 AM

@AviD Yeah? It shows me a place to change my picture

No mention of templates

AviD

@Adnan sorry, "theme"

dunno, maybe its the header pic.

Terry Chia

@Adnan Maybe @AviD is just a beautiful and unique snowflake.

AviD

if I was, I would be water by now. Summer is here.

Terry Chia

@AviD Don't worry. Winter is coming.

Caught the new GoT episode yet?

@ThomasPornin, @Code, anyone else with good crypto knowledge --- can I get some thoughts on this? github.com/pyca/cryptography/issues/846

Rоry McCune

7:09 AM

ya know what's super odd about twitter

Adnan

@RоryMcCune Do tell

Rоry McCune

I put a picture in the chat transcript of that heartbleed honeypot

and it got tweeted by some guy from the transcript

and now that tweet has been retweeted all over the place

like the most I've seen a tweet I did get tweeted is one/two retweets

this one is more like 50

and all it does is link to that picture in the chat transacript

v.odd

oh yeah and I get an e-mail every time someone retweets it..

Terry Chia

@RоryMcCune Turn it off. :P

Rоry McCune

@TerryChia yeah it was more that I've never had cause to need to before (used to be interesting to see retweets) and I've no idea why this tweet is getting RT'd so much

Terry Chia

Twitter gives you pretty fine grained control over email notifications.

@RоryMcCune Funny stuff gets retweeted a lot.

Rоry McCune

7:14 AM

@TerryChia could be that but I bet if I'd RT'd the tweet I got the image from it wouldn't have gone round as much..

I guess that's down to the number of followers the original tweeter has..

Terry Chia

@RоryMcCune Why do some questions become rep trains? Same theory.

It's completely random.

Rоry McCune

@ThomasPornin ridiculous!

@TerryChia true it's pretty random but I think yesterday mentioning heartbleed was a +500% powerup

I looked at the "winning" answer for that "should I change all my passwords" question, bad idea, now I'm angry about how wrong it is and it's not 8:30 yet

Terry Chia

@RоryMcCune Link?

Rоry McCune

13

A: Should I change all my passwords due to heartbleed

Short answer: Yes, all passwords. Long answer: At first sight, you only need to change the secret key of the certificate. But due to several reasons, all passwords are affected. Here's why: Reason 1: Chained attack Someone captured the secret key of the certificate. From that time on, he coul...

luckily I'm saved the time of putting together a rebuttal 'cause it just got closed

Terry Chia

Ugh, TL;DR. Why is it wrong?

Rоry McCune

7:24 AM

@TerryChia hey says to change all passwords 'cause they might have been compromised either directly or 'cause the admin might have logged in to the site and had his password compromised

so every time a site admin might have done something risky you reset all your passwords?

Terry Chia

Heh.

Rоry McCune

every time an apache bug comes out which is RCE you reset all your passwords

Terry Chia

Time to start drinking I think?

Rоry McCune

assuming of course that changing all your passwords is a risk free activity

I'll bet that if people to a huge password reset sweep they'll set it to be the same.

on multiple sites

that or they'll forget them quickly

far better advice would be to get 2FA on critical account and start using a password manager

that advice I could get behind

Adnan

Almost 0.4% of ALL questions on Sec.SE are now about heartbleed!! About ONE attack.

Wow.

Rory Alsop

7:31 AM

I'm getting an urge to merge!

All of them

Into one

And then ban heartbleed questions forever more

....

Adnan

100% @Terry would masturbate to that.

Terry Chia

@Adnan Wut?

Adnan

@TerryChia You know, because you've requested a ban on heartbleed a few times.

Rоry McCune

@RoryAlsop it'll run and run this one, I'm started to get e-mails from services I use about it

and that dumb story in the BBC about changing all your passwords <sigh>

Terry Chia

@Adnan I only asked the mods to nuke the tag. :P

Adnan

7:34 AM

@TerryChia and that would be fantastic

Rоry McCune

bbc.co.uk/news/technology-26965015

rassin' frassin' university professors

all websites should tell you they've updated their SSL

should they tell you every MS patch tuesday too

and about the fact they use PHPMyAdmin

Terry Chia

@RоryMcCune Are you sure @TildalWave did not take over your account?

Adnan

Honestly, this is the most obnoxious security incident I've witnessed in my adult life.

Rоry McCune

I woke up grumpy

people were banging around and shouting as I woke up (my in-laws are here and getting ready to head off)

Terry Chia

@RоryMcCune You need to step away from the Internet then. :)

Rоry McCune

7:40 AM

but really it's cause this is really annoying, first security thing in the news for a while, and the advice is all wrong...

Terry Chia

@RоryMcCune Really? Where were you when the Snowden stuff happened?

Adnan

@RоryMcCune In-laws asking about hearbleed?

Rоry McCune

instead of taking a chance to talk about defence in depth or perhaps why corporates rely on open source software but don't contribute to it's security, it's things like "change all your passwords"

@Adnan they asked about changing all their passwords after that BBC news story

Adnan

@RоryMcCune I was thinking my father was the only ******* one

Rоry McCune

@TerryChia that's not really IT Sec though (apart from the bit where the most secure organisation on the planet let a contractor take unlimited data from them and couldn't even say what he took)

Adnan

7:42 AM

Got a call from him this morning telling me that all the Internet has been hacked by the Russians and CIA

Rоry McCune

@Adnan hell no after the news coverage in the UK, I'll bet a v.large number of IT/ITSec people will get those questions today

Terry Chia

@RоryMcCune Dual EC DRBG? RSA?

Rоry McCune

hey @RoryAlsop how many people have you had ask so far

@TerryChia sure you'd think that would be bigger, malicious planting of weaknesses in crypto.... did it even get any mainstream press

noooo

@TerryChia you're just trying to make me grumpy now aren't you..

Terry Chia

@RоryMcCune Hehe.

Lucas Kauffman

7:55 AM

I'm writing an article about heartbleed, maybe I should post it on Sec.Se?

as it seems that we have mass panic here where people start claiming it's a virus

and that all security is compromised on the intertubes

CodesInChaos

Only if you manage to write it without mentioning the H* word. I developed an allergy to that.

Rоry McCune

modern.ie/en-us/virtualization-tools#escape-from-xp

ok that's quite funny

Lucas Kauffman

@CodesInChaos H?

Rоry McCune

@CodesInChaos you're allergic to hemorrhoids ?

Lucas Kauffman

@CodesInChaos I'm trying to asses the actual impact rather than fud

@CodesInChaos heartbleed? I've used it once

Falcon Momot

8:02 AM

the actual impact is hard to assess, since we're all uncertain as to how long this has been exploited in the wild for.

Lucas Kauffman

@FalconMomot that's the point

deed02392

Is it correct the dodgy code has existed for 2 years?

Lucas Kauffman

@FalconMomot but you are only impacted if you actually used openSSL and while a lot of services use it, that doesn't even cover half the internet

@FalconMomot @rorym @CodesInChaos if you want I can let you proof read

Adnan

@deed02392 Yup, ever since the implementation of heartbeat into OpenSSL

Falcon Momot

@LucasKauffman there is also this neat thing called protected mode where you can't access the memory of random processes from one process, so the compromise is limited to data the process running openssl can work with I think.

Lucas Kauffman

8:05 AM

@FalconMomot you mean private SSL keys :p

deed02392

@Adnan Jesus

Falcon Momot

@LucasKauffman I'm just about ready to go to bed, but please do link :)

deed02392

Also, I hate to be that guy but, NSA?

Falcon Momot

@LucasKauffman well yeah, among other things

Adnan

@deed02392 webcache.googleusercontent.com/…

Falcon Momot

8:05 AM

@deed02392 I'd imagine they might be more subtle.

Lucas Kauffman

@FalconMomot I'm still working on it, if not tonight have a look at it tomorrow

deed02392

@FalconMomot Two years to find it

Falcon Momot

@deed02392 but it's hardly subtle at all.

deed02392

@FalconMomot How do you define subtle if not that it took so long to discover? How much more subtle could you be for such an effective attack?

Falcon Momot

@deed02392 you'd try to target, a little bit at least, so that the whole world doesn't explode when it's discovered. ;)

deed02392

8:08 AM

I would agree with you that it's not subtle at all but that's easy to say now we know the exploit. I am amazed it has been in the wild for 2 years

Adnan

@deed02392 Found it github.com/openssl/openssl/commit/…

Falcon Momot

@deed02392 that it was speaks mostly to the insane complexity of TLS (among other things) and the fact that detailed knowledge about it is perhaps more limited than it should be.

deed02392

nice @Adnan

Rory Alsop

RoryM - I'm delighted in on holiday. Might write up a canned response tonight before I go back in to the office tomorrow

Falcon Momot

See also: BEAST

CodesInChaos

8:10 AM

We have fifty fucking h****b**** questions. Seriously.

deed02392

@FalconMomot Which no doubt they'd be aware of and so yes it would be considered subtle enough, especially with the lack of spotlight they enjoyed 2 years ago

Rory Alsop

Actually, does anyone want to write the definitive blog post on this?

Adnan

43 mins ago, by Adnan

Almost 0.4% of ALL questions on Sec.SE are now about heartbleed!! About ONE attack.

Falcon Momot

s/attack/vuln/

Rory Alsop

I will be at home later this afternoon and will aim to cleanup the bleeding heart crap. Useful flags will help me

Adnan

8:11 AM

@RoryAlsop Oh good lord! Thank you! Finally

Lucas Kauffman

@RoryAlsop I'm doing one atm, want less fud, more facts

Terry Chia

Hey @CodesInChaos, mind weighing in on this? github.com/pyca/cryptography/issues/846

CodesInChaos

@TerryChia There was a related discussion in the context of NSS: bugzilla.mozilla.org/show_bug.cgi?id=868948

Terry Chia

@CodesInChaos Ah thanks, I'll read through it.

CodesInChaos

Constant time GCM implementations without AES-NI costs quite a bit of performance compared to variable time GCM.

Rоry McCune

8:15 AM

@LucasKauffman sure

@LucasKauffman if you're looking for conclusions, can I suggest you add a bit about potential useful outcomes of this, something about "should perhaps companies look at the open source software they rely on for their billion dollar enterprises and consider contributing to security reviews of them"

6

deed02392

Ha @Adnan did you know AMD released an APU with an architecture codename of 'Kaveri'

Lucas Kauffman

@RоryMcCune excellent idea

deed02392

@RоryMcCune starred

Adnan

@deed02392 Now way! Does it mean something else is some other language?

deed02392

@Adnan Haha I don't know, but kaveri suits it if it's supposed to act as some kind of co-processor

There's not even a wiki article on it, though

Adnan

8:22 AM

Well, I took a look at the list

Desna
Ontario
Zacate
Llano
Hondo
Trinity
Weatherford
Richland
Kaveri
Kabini
Temash
IGP
Wrestler
WinterPark
BeaverCreek

All of them, including Kaveri, seem to be river names

deed02392

Ahh I should have looked at them in context

I only saw it because it appeared in a list of AMD processors that support AES-NI

Adnan

@deed02392 Would have been more interesting if they actually meant the Finnish word.

deed02392

And I'm pretty sure Bulldozer, Piledriver and Jaguar aren't rivers :P

AES instruction set

Advanced Encryption Standard Instruction Set (or the Intel Advanced Encryption Standard New Instructions; AES-NI) is an extension to the x86 instruction set architecture for microprocessors from Intel and AMD proposed by Intel in March 2008. The purpose of the instruction set is to improve the speed of applications performing encryption and decryption using the Advanced Encryption Standard (AES). New instructions {| class="wikitable" |- ! Instruction ! Description |- | AESENC | Perform one round of an AES encryption flow |- | AESENCLAST | Perform the last round of an AES encryption flow |-...

Adnan

:D

deed02392

How did your experimenting go, did you find any private keys in the end?

Falcon Momot

8:35 AM

@RоryMcCune it's kind of sad that this isn't standard procedure, especially for something so obviously security-critical. Without an audit you're paying for, the code is effectively completely untrusted.

deed02392

@FalconMomot It's very sad and really quite shameful of companies making extensive use of it

openssl.org could do with a makeover and some way of promoting sponsors or something

perhaps they need to look more like a business and not a collective of geeks that companies think can't be wrong and can be exploited for free functionality

Falcon Momot

hmm

on the other hand, piracy in enterprise environments is hardly uncommon

and when you have sub-week release cycles it gets difficult to do detailed audits of things

#devopsconsideredharmful

hey maybe for my master's thesis instead of doing it on entropy analysis I should do it on why "devops" is a monstrosity and needs a massive paradigm shift to not be a liability.

Rоry McCune

@FalconMomot it's extremely sad, especially when you look at the roster of companies using it

Falcon Momot

@RоryMcCune also governments

Rоry McCune

@FalconMomot yep, and you can bet that after this bug, a load of offensive security types will be poring over the codebase looking for more problems...

Falcon Momot

8:42 AM

the Canada Revenue Agency got hit with it, all of 21 days before the filing deadline

@RоryMcCune I'm surprised it's taken them this long. Those vulns are at this point as good as (or better than) vulns in a TCP/IP stack.

undoubtedly more abundant too.

Rоry McCune

@FalconMomot well I'd bet some of the top-end types will have had this + others in the bag for a while, but the range will widen out a lot now I'm sure

deed02392

I feel almost certain this has been being exploited in the wild for a long while before we discovered it

Falcon Momot

it does have a pretty strong version dependency though

deed02392

Yeah, ironically the later versions which the larger more sensitive corporations are most likely to have 'upgraded' to

I bet the assholes still with exploitable NTP servers aren't susceptible

AviD

@TerryChia no no, winter is come and gone.

and - yeah. GoT is great.

@RоryMcCune the fact that it's so popular?

deed02392

8:50 AM

ietf.org/rfc/rfc2324.txt

I lol'd

I was really tired when I watched the new GoT, I feel like I need to watch it and maybe the last half of season 3 again

Rоry McCune

@AviD yeah, an image from the chat transcript gets RT'd like 50 times, no information useful or otherwise just a picture

deed02392

Is there a standard in development for an Internet of Things protocol? E.g. a wifi kettle and a Wifi enabled power socket using a compatible protocol?

Falcon Momot

@deed02392 there was some standard for home automation that likely covers it: X10.

though X10 with 802.11 would be silly

and I guess it's not really much of an internet of things protocol at all

deed02392

Mmm that's a lower level protocol than I'm thinking of

AviD

I think you missed the point of that xkcd... namely the dripping sarcasm. Your answer is also a bit blown out of proportion, but that at least is in tune with most of the mass media's treatment of this. — AviD ♦ 20 secs ago

Rоry McCune

8:58 AM

@AviD heh

AviD

@RоryMcCune also - what web site allows an admin to log on and directly access the database??

Rоry McCune

@AviD badly designed ones :)

AviD

no, I dont even think that.

Rоry McCune

@AviD you've never seen phpmyadmin exposed to the Internet?

AviD

I have actually seen a couple of business apps like that, but those are features. not in common web apps...

Rоry McCune

8:59 AM

if so you've not seen enough low-end web app reviews..

AviD

@RоryMcCune and that gives direct access to the db?

Falcon Momot

not allowing admins access to the database seems a little like view-based access control to me?

Rоry McCune

@AviD yeah phpmyadmin is direct database manipulation

and it's had loads of security bugs

AviD

oh hmm. then again, you're using PHP, so none of these other issues is your biggest problem.

Rоry McCune

I've seen it quite a bit in the past, just sitting there somewhere predictable like /phpmyadmin

@AviD you dissing facebook again.

AviD

9:00 AM

hehe

Rоry McCune

@JeffFerland won't be happy

AviD

@FalconMomot no, it's indirection and encapsulation. nothing to do with views.

Falcon Momot

it just doesn't feel like the right place to enforce access constraints.

though making a web form that forwards totally arbitrary stuff to the database does seem to serve no purpose besides making attackers have an easy go of it.

and of course I didn't think of the case right away where the application "admin" might not have access to the backing database at all, but hey.

the application has creds on the database, at some point, and probably also has them in memory.

Adnan

@Xander You should answer this security.stackexchange.com/questions/55351/…

AviD

@FalconMomot no, its not about "enforcing access constraints", its about not even creating such a channel.

Falcon Momot

9:13 AM

@AviD there has to be at least some channel. it's just a matter of defining what can go over the control channel, but that has to be at least everything the application can do.

AviD

an indirect one.

there is a world of difference in allowing the application to send specific commands, as opposed to allowing an admin to access the database directly.

it's like the difference between an API and an open file share.

Adnan

@deed02392 Oh, @Kisuminttu wanted me to tell you that there are companies like Roccat use a lot of Finnish words for their product names: Apuri, Syva, Isku, Kova, Savu, etc.

deed02392

ROCCAT Kone XTD

haha

Is Roccat a Finnish company? Seems odd considering it has two 'c's in the name

Adnan

@deed02392 Yup, that's @Kisuminttu's mouse.

@deed02392 German

deed02392

isn't that odd

I know of quite a lot of Finnish companies, I wonder how many average people realise how significant Finland really is

Huhtamaki, Nokia, Rovio (Angry Birds), Kone (escalators/lifts all over the world)

Kisunminttu

9:19 AM

@Adnan Actually, I have the original version of that mouse... IMHO the "upgrades" to that original model haven't contributed any good features : )

Adnan

@Kisunminttu Where did you find a computer to login?

Kisunminttu

I just started looking at the names and apparently they've expanded to some other language as well...

@Adnan In the room where I work. : )

Most of my work is done on the computer

Adnan

@Kisunminttu I feel like I don't know you.

@Kisunminttu One of ROCCAT's mouse pads is called Siru.. hehehehe

Kisunminttu

@Adnan What do you mean?

Yeah I noticed that. Höhöhö : P

Adnan

@deed02392 Whoa!! You can list Finnish companies that aren't Nokia or Rovio!

You're a fine one, young man.

deed02392

9:24 AM

\o/ You just start to notice it very quickly when you're familiar with the language

Kisunminttu

Hmmm... I used to have a keyboard from Roccat and it got awful reviews from people. I hated that thing and destroyed it in the end. I was just trying to find out what the model was but they've apparently stopped making it. Hehehe.

deed02392

@Kisunminttu I've got a microsoft keyboard that is God-awful, the keys are extremely stiff

I took it apart and washed it and it's still crap. I think the holes for the key pegs are too small

I need to find a suitable lubricant

Adnan

@deed02392 Heeeey! What's with you going around asking my girlfriend about "suitable lubricants"?

5

:D

Kisunminttu

@deed02392 I bet it's not half as horrid as the Roccat one was. Every time you used caps lock -> instant freeze, need to reboot. Trying to get the multimedia keys to work? Wishful thinking. Trying to write anything on it was impossible, it skipped almost 30% of the key presses. The only thing that worked on that thing was changing profiles... As a keyboard, it sucked.

I should have "lubricated" it with gasoline and "polished" it with a match.

2

Terry Chia

I still need to get a new keyboard.

deed02392

9:28 AM

Oh right, I forgot you two are in a relationship

@Kisunminttu lol

It's so frustrating because my old one wasn't half bad

Kisunminttu

@TerryChia Anything mechanical is awesome, but hey, I'm biased.

2

Terry Chia

@Kisunminttu Yeah, I want a good one though.

Kisunminttu

@Adnan :*

deed02392

It isn't fair. I might see if MS will send me a new one

Kisunminttu

Gotta run, break is over.

Adnan

9:29 AM

@TerryChia She can help you with that. She's like the expert on these matters. At least compared to me.

@Kisunminttu Love, when you're back, recommend some models for @Terry

Kisunminttu

@Adnan Hehehe. I'm the hardware know-how part of our relationship.

And yep, I sure will!

Adnan

@Kisunminttu I don't like the sound of that.

:p

Terry Chia

@Kisunminttu ahem

Kisunminttu

@Adnan Oh. that.

Adnan

@Kisunminttu Fly now.. fly! Back to work. :*

Kisunminttu

9:31 AM

@Adnan Enjoy your day, love : )

deed02392

n'awww söpö

AviD

@AviD Non-applet Java programs have full permissions anyway (just like native programs – the JVM is a native program) so I don't know what a security flaw there would look like. — ntoskrnl 20 hours ago

can somebody please explain to me what he meant?

Adnan

9:50 AM

Ahhh.. now I have to read the question, that answer, your comments, aaand his comments.

Terry Chia

@AviD I think he's just an idiot.

AviD

@Adnan best value for link.

@TerryChia I dont think so, at least not usually.

Terry Chia

Applet sandbox escape vulns don't apply to Android etc but other JVM vulns sure do.

AviD

@TerryChia right, exactly - but noone mentioned applets or sandbox until he did.

Terry Chia

@AviD Hence "he's just an idiot".

AviD

9:52 AM

@TerryChia in this case, its possible.

Terry Chia

A code execution vuln in the JVM can be pretty nasty.

Adnan

@AviD Ooooh... now I know what he means.

AviD

@Adnan because he said its correct?

Terry Chia

Ok, I can see his point WRT to Android.

Because Android does not use the JVM runtime.

But I still don't understand why he is even bringing Applets into the conversation.

AviD

@TerryChia no?

Terry Chia

9:54 AM

@AviD Android uses the Dalvik runtime.

Adnan

He's stating that native (non-applet) apps run and (almost) interact directly with the machine, then there's no difference between malicious code and vulnerable JVM.

AviD

ah fine, fair enough.

Terry Chia

Not the regular JVM you run on your desktops/servers etc.

AviD

@TerryChia its still a jvm though.

well, technically not.

because it doesnt run java directly....

Terry Chia

@AviD It's not.

Adnan

9:55 AM

@AviD The error in his logic is very clear when you have a Java server running on a JVM susceptible to some RCE vuln.

AviD

@Adnan still not getting what that means.

Terry Chia

It doesn't support a bunch of languages that compiles to the JVM for example.

AviD

fine, but all that is irrelevant - he was making claims about the JVM.

Terry Chia

@AviD Yeah, hence "he's just an idiot".

That's like saying anything that doesn't run in a sandbox will not have security flaws.

Adnan

@AviD He thinks that because an application is native to the machine, then malicious code (in the native application) is equally or more sever than a vulnerable JVM.

He's wrong, of course.

AviD

9:59 AM

@Adnan and he's also right.

but thats not what he was saying.

Adnan

@AviD In the comment you linked, that's exactly what he's saying.

Transcript for