@AJHenderson Looks like a basic buffer overflow. Boring.

@RоryMcCune Doesn't have a cute name or logo yet? I don't believe it exists.

Someone tell me how RCE is Partial all-around for CIA compromise?

Apparently Cisco's already given that thing a CVSS rating even while NIST still has it under review. They're saying Partial for all the CIA impacts, which puts the score down at 6.8.

@StackExchange So... it appears that Randal is "Live Drawing" the Rosetta spacecraft's comet landing?

I think that's the first time anyone has ever done that.

@tylerl That's ExplainXKCD's theory.

@Lucas You alive?

@RоryMcCune erm.... we get poked... a lot

@RoryAlsop fhnar

@RoryAlsop Do you like getting poked?

@Adnan and kicking

@RoryAlsop poked with the love stick ._.

rightmove.co.uk/commercial-property-for-sale/…

want

@LucasKauffman surely this imgur.com/a/mAA2k would be better

bicycle v ferrari...

Bicycle, bicycle, bicycle, bicycle, BICYCLLLLLLLEEEEEEEEEE...... RACE!

@RоryMcCune :O

@RоryMcCune this ... is ... crazy LOL

@TildalWave yeah, how he manages to keep it stable, I have no idea...

at that acceleration ... me neither

I'd imagine the wheels are locked into place

I'd like to know how he stops

slowly I'd imagine

"Quarter Mile race, sure I'll smoke you! But I need like 5 miles to stop..."

@LucasKauffman Skype?

@Adnan sure

@Adnan is this 'cause your MS14-066 PoC is ready and you're looking for volunteers to test it?

@RоryMcCune So old, I saw this yesterday. Keep up old man.

@Simon didn't post it here, so it didn't happen :op

@RоryMcCune Damn it.

@RоryMcCune I've been diffing the update since the morning.

Still not even close to where the problem is

@Adnan heh I'll be there's a fair few people on that today.. BTW did you see securityintelligence.com/…

another interesting bug in this months patches it appears

@RоryMcCune You're an appearance.

@Simon D.O.U.G.H.N.U.T.

@RоryMcCune So many useless letters in that word.

@Simon just like your name :op

fml

@Simon So are you See-mone or Symon?

@ManishEarth I can't really replicate the pronounciation "mon" of the part in English

@RоryMcCune Wow that is super awesome

"Si" would be like "see"

I bet everyone will stop using IE now.... >.>

translate.google.com/#fr/en/Simon

Listen to the French part, it's pretty accurate except it sounds fancier, le fu- France.

@RоryMcCune Looks quite interesting as well.

@Adnan and has a decent write-up..

@Simon Oh, I know how seemone is pronounced :)

I (used to) know quite a bit of French

@ManishEarth Haha.

And one of the guys on the Servo team is a French Simon

@Simon Also, if you're French-speaking, you don't get to talk about useless letters in a word :p

I don't mind the English pronunciation, I'm more used to the French one though.

@ManishEarth Meh, good point :p

@ManishEarth So you're saying the french language does or doesn't contain useless letters in words?

@raz it does

I figured, I just wanted to clarify

Eg voient

@ManishEarth I don't see anything useless in there #trolololo

It's pronounced vwa, more or less. Two consonants and three vowels do not a vowel sound make. :P

@Simon -_-

It's a plural conjugation though

But yeah, "il voit" you wouldn't pronounce the "t"

@Simon In the written form it's fine, but you French speakers breathe your words, you don't say them.

We breathe the yolo.

@Simon I hate "yolo", I hate it so... very... much

@raz You weren't around in my #yolo phase, lucky you.

@Simon well unfortunately for him #YOLO so it's not likely to happen again

@RоryMcCune Think beyond the #yolo, it can definitely happen again.

@Simon well given that @avid hasn't been seen in some weeks, you may get away with it this time (well I say that, almost inevtiably you wouldn't after one of the other "priests of the blue" takes action, but hey)

@RоryMcCune Priests of the suckers.

@ManishEarth French people don't speak; they fence with words.

That's also one great difference between French-speaking from France and from Canada; Canadians, being North-American, are utilitarians and thus use words only to express ideas or communicate information. They don't relish the beauty of rhetoric.

@RоryMcCune It's also that the kicks pack more of a punch now then before.

@ThomasPornin We don't have time to waste.

@ThomasPornin pahahaha

So, it looks like MS14-066 has a logo now but no catchy name yet?

securityaffairs.co/wordpress/30112/security/…

@Iszi Let's call it "Irresponsible dad".

@Iszi isn't that one MS14-064?

I'd heard that MS number was getting called Winshock

so there where the shell is replaced with a windows logo

@RоryMcCune No, that'd be '66.

I'd call it ShellChannel.

@Iszi so for the MS14-064 they'll need something else, perhaps a moody looking teenager as apparently the bug is 19-years old....

paging @Simon :op

@Iszi Nobody has made the obvious Star Wars joke with "order 66" ?

The Darth VBScript bug.

@ThomasPornin Who said you could talk before you came back with a working PoC?

@Iszi Bugs are boring. The real vulnerability is in the people's minds.

Finding the catchy name is thus the ultimate exploit.

I deem this bug: LABRADOODLE

@Iszi "e flaw is particularly dangerous for users that servers that expose website." thar be sum good engrish"

good thing their MS Paint skills are better than their English

@raz Or perhaps heartworm

because a heartworm causes a poodle to have a heart bleed

oh, did anyone else notice the stealth activation of other TLS protocols going out in the patch for 066 as well?

not that it mattered for me since I already manually activated them, but I found that interesting

@AJHenderson Stealth? One article I saw was pointing at Microsoft bragging over it.

@AJHenderson Probably just taking advantage of having to update schannel

I'm still trying to figure out how RCE is only a "Partial" C/I/A compromise according to Cisco, and now NIST.

@Iszi 'cause they don't want a CVSS 10 vuln?

ooh speaking of CVSS, this has to be the stupidest rating I've seen in a while

default IIS install page showing.... that's a CVSS 5.0 (according to Nexpose rapid7.com/db/vulnerabilities/http-iis-default-install-page)

have one of those puppies on Internet and you fail PCI

@RоryMcCune LOL, wow.

God damn it! Sooo many changes in the MS14-066 patch!

I give up on trying to locate the bug

@Adnan Maybe that's the point

@RоryMcCune YOU donut.

@raz I remember that with MS13-082 it didn't take me a couple of hours of digging to get to where the problem was.

Of course, I wasn't remotely close to exploiting it, but still got somewhere with figuring out what was happening

@Simon hey hey I liked that joke

@RоryMcCune I gotta say it was quite good.

But I'd also like to remind you that I'm 12.

@Simon No reminder needed for you. Ever.

@Iszi Daddy, if you keep going you're gonna get punched out by your son.

@Simon sure but I was thinking more of physical age than mental

@Simon so you are a dozen doughnuts

HELP THEY'RE ATTACKING ME FROM EVERYWHERE.

@AJHenderson She's disgusting.

Wow. The .Net Framework is being ported to Linux and OSX, open-sourced and relicensed under the MIT license, and source will be available on GitHub.

weblogs.asp.net/scottgu/…

@Xander Whaaaaaat? Can we expect a UNIX version of IIS?

@Simon My first thought was PowerShell on Linux.

ô_ô

@Simon I don't know about that, but they just did a demo of stepping through a .Net 5 app running in a Docker container on Linux with the remote debugger.

@Simon You've been able to run ASP.NET on Linux via Apache and Mono for forever. I'd expect they'd continue to leverage existing web servers like that rather than build a *NIX version of IIS.

@Xander Ah I didn't know that. You could take a project and run it without any modification on linux?

@Xander That's kinda nifty and interesting, but it's shadowed by my hatred for .NET

@Simon Yes. with the caveat that Mono didn't support everything the .Net framework did, so you were limited to its (large) subset of functions, and you have to take cross-platform requirements into account, and not do things like hard-code Windows path separators. It's really not very hard though. I built an ASP.NET app for Mono and Linux way back in 2005.

@raz Your loss.

@Xander That's quite awesome.

@Xander Way back in 2005. Nobody was around back then!

@Xander On a similar note, I tend to write small projects in C# and run then with Mono on Linux and OS X, and it works rather well.

The main advantage of .NET is that, on Windows, the classes give access to about everything in the system.

@ThomasPornin Nice. I also use KeePass on my Linux machines via Mono, so I don't need to bother with KeePassX.

This won't be true for a Linux port of .NET.

PowerShell on Linux would be an unrewarding experience since it would still have to launch many external commands to actually get things done.

You're an external command.

@Simon To exploit SSL you need to have Thomas Pornin access.

@Xander I'll believe it when I see it, that's been tried a couple times with a variety of backtracks and failings

as a .Net developer, it would thrill me though

@AJHenderson Yup, true. This appears to be the real deal though, as they're already demo'ing it.

@raz We should raid his house.

@raz why you hate .net?

it's the best hope for true reasonable performance cross platform applications

as long as it actually gets framework implementation support

which it sounds like might FINALLY be happening

I have wanted to smack MS for gimping themselves since the first time they quasi open-source/ported it

@AJHenderson hasn't Java been doing that whole reasonable performance for cross platform thing for years?

@Tinned_Tuna no

Java can give you reasonable performance or cross platform, but getting good performance often requires making it break cross platform and vice versa

there are some exceptions, but the entire architecture of Java is a bass ackwards approach to the problem

the JVMs have improved, which has helped some, but building from an oversimplified processing engine and trying to hack in optimizations in real time is stupid

You're an oversimplified processing engine.

where as building a universally efficiently implemented complex instruction set, while it takes some up front costs to implement the instructions, provides far greater performance if properly implemented

@AJHenderson are you basically arguing RISC v. CISC for virtual machines?

@Tinned_Tuna yes, but to a larger extreme, the base Java VM is extremely, extremely RISC

note, my main exception case is that I am all for Java on embedded systems with very basic architectures

the bigger core of my argument is the fact the JVM has to try to figure out how to make simple instructions run more efficiently on the available processor is inherently backward

@ThomasPornin mr bear, I came a cross a post from you and was wondering if it's still valid to use 3DES-CBC with an MD5 MAC to secure SSH traffic? I'm assuming it still is?

@AJHenderson I guess I shouldn't judge since I haven't work a ton with it. The API just seems clunky and hard to use.

But now that I think about it, that's kind of just Microsoft in general.

@LucasKauffman You won't be hacked through poor cryptography if you do that.

@raz really? The API is actually really powerful and easy to use. I guess it probably depends on your background though

I've heard lots of arguments about why people don't like .Net, but it is more often people complaining that either the good tools are too expensive or they make it too easy to do

After 30 GB or so you will begin to encounter block collisions, but the leakage about the data is really minimal and won't be readily exploited in the context of a SSH connection.

(thinking intelisense dumbs people down or some such)

3DES is quite slow in software so you may want to use AES, not for "improved security", but for performance. Depending on your network.

@AJHenderson JVM was designed to potentially allow creating a physical CPU that runs the bytecode directly.

And they did: en.wikipedia.org/wiki/Jazelle

Performance issues are overrated. For pure CPU tasks that fit in L1 caches, Java code is typically 2x to 4x slower than optimized C code (without breaking portability).

@ThomasPornin yeah, don't get me wrong, I'm all for Java on simple architectures that closely resemble the ideal Java bytecode, my objection is just to the approach of compiling to a simple bytecode and then trying to effectively work backwards to reintroduce optimization

backwords

For other kinds of tasks, cache issues and I/O tend to dominate and Java is as fast as anything else

Though they tend to suffer from a "slow start" syndrome, which is not related to the bytecode design.

It rather is a consequence of the language stance of "runtime initialization".

@AJHenderson Having looked at the bytecode quite closely, it is not that simple. The support opcodes for the try..catch are horrendous.

@Simon quiet doughnut ;)

Everyone here is misspelling the word "donut", it's shameful.

Main culprit for Java slowness is systematic array bounds checks

Followed by the tendency of the JIT compiler to be trigger-happy with loop unrolling, so sometimes you get out of L1 cache (and that kills performance a lot).

@ThomasPornin in modern java (with an actual for-each style construct), many of the bounds checks could be avoided ('urrah!)

@Tinned_Tuna Yes. Could.

... "A sufficiently smart compiler" and all that :-p

@Iszi I'm going with WinSock

@AJHenderson I'd also dispute your premise. Working over a simple set of regular opcodes makes life a lot easier for the compiler. Complex instructions would not promote efficiency; it would rather be the opposite.

Complex instruction are good if you want not-too-bad performance with a simple JIT compiler, that merely concatenates corresponding code chunks.

(Ultimately, the model of Forth)

But you would be stuck under the "10x slower than C" bar.

@ThomasPornin but having a complex instruction doesn't restrict you from using simple instructions, assuming you don't remove the simple instructions from your system

it does make the compiler more complex though

@AJHenderson And compiler complexity is at odds with compiler efficiency.

but you aren't fully compiling JIT with .Net, you are choosing the most efficient calls, that said, there could be some loss when one platform can implement a complex instruction efficiently and another platform can not

so you'd still want to target a platform during compilation for maximum performance on that platform

but you are right, it is primarily a trade off of when you pay the cost

either you pay the cost of optimization at compile time when building or you pay it at run time while either starting or while executing, depending on your approach

that's the reason cisc chips exist in the first place, even if practically, most cisc chips now a days are implemented more like risc chips with a front end, since it is easier to make risc chips run fast and it simplifies the die

da de dee da de die

that said, I will also admit that I have not followed Java closely for the last 8 years or so and I have heard they've made great strides on improving the JVM greatly

and then there is the other big flip side, you have to really know .Net to maximize efficiency with it. It does make it very easy to use bloated objects that introduce their own costs that aren't needed for what you are doing

which is .Net's biggest weakness

well aside from the lack of strong framework availability, which is obviously a major issue as well

@AJHenderson As you say, all chips are really RISC; some are just disguised as CISC. Efficient compilers need to target the underlying efficient RISC-like opcodes.

An example is the PowerPC cores found in the PS3 and XBox 360.

They implement the full PowerPC instruction set, but three quarters of the instructions are done with an in-chip interpreter and microcode, so compilers must avoid these instructions at all costs

(Not only is the microcode quite slow, but there is an inherent 11-cycle penalty just for having such an opcode, because the CPU must flush its pipeline)

But you have the same situation with x86. Each opcode is first split into a sequence of RISC-like opcodes by the CPU.

Compilers now see the assembly as some kind of compression scheme on the flow of elementary opcodes.

I'd argue that bytecode formats that most promote JIT efficiency are those that most closely map to the internal RISC-like opcodes used at the core of the CPU.

And all CPU brands really look the same when viewed that way.

@ThomasPornin that I would agree with, the question is how closely they map though

if they map closely, then it is hands down ideal, the debate is on which is better when you aren't close to it, do you want something that gives you more details about what is being attempted so you can adapt knowing what is going on or do you want to have to reverse engineer the intent on the fly to find optimizations

@AJHenderson From the point of view of Java designers, both are equivalent, especially since they control both the JVM and the Java compiler.

I.e. they find it easy to recognize constructions produced by the Java compiler since they wrote the Java compiler too...

which is, indeed, not an ideal situation, but at a completely different level.

As an example:

when you initialize in Java a byte[] like: byte[] x = { 12, 17, 1, 120, ... }

@ThomasPornin it still isn't as clear as explicit intents even if they can recognize it, which is part of why it took a long time to tune the JVM to run as efficiently as they have now managed to get it

you get in fact initialization code that creates the array of bytes, then painfully fills it one value after another.

The sequence of opcodes is easy to recognize; it takes only 20 lines of code or so in the compiler.

Then the compiler can produce the equivalent of a memcpy() call in that case, which is much faster and also much smaller

@AJHenderson Why they took so long is another question.

Personally I blame C++

yeah, but if it was instead an instruction to memcopy, a framework would know how to efficiently implement memcopy. Now, I suppose something even more ideal would be something that uses simple codes but also indicates intents over it

but that would dwarf the complexity of either C# or Java

@AJHenderson My point is that most "simple" intents are already quite easy to detect right now.

but then you still have the challenge of knowing which intents are valuable when you don't know what hardware will be executing

Those that would really help are the hard ones (e.g. those related to lifetimes of temporary objects)

They are hard to detect for the JIT compiler but also for the bytecode producer because they exist only in the head of the programmer.

and in fairness, I'm not saying that a framework is easier to develop correctly, just that it should be possible to build a framework that would run better. .Net has it's limitations, but I prefer the framework approach, or atleast something that doesn't require reverse engineering of intents

This discussion is so nerdy that I feel like I'm gonna have to drown in pink when I get home to cleanse myself.

@Simon just remember, this kind of nerdy is what gets people good pay checks though ;)

Good for you if money can make you happy.

@Simon money doesn't make me happy, but being able to work 9-5 and not have to worry about money makes it a lot easier to not be distracted from being happy :)

@Adnan gist.github.com/hmoore-r7/01a2940edba33f19dec3

@Xander Motherducker!!

@Xander Pwning a client seems to be trivial with this. Now how do we pwn a server?

Anyone else notice this?

> Cisco also published a number of Snort rules for MS14-066. If you have a VRT subscription, you should see these rules with an SID from 32404 through 32423.

isc.sans.edu/forums/diary/…

One would think that should be useful for exploit development.

@Iszi But but but.. I imagine such rules are for devices protecting servers, no?

It could be my general fatigue today, but I cannot think of a situation where this can be used to attack servers

Oh... client-certs :|

@Adnan Probably, but strictly speaking Snort could pick up traffic in either direction - could be used to detect exploitation of internal clients as well.

@Iszi Of course, there's that as well

@Adnan Am I missing something? Did we get some more details on the vulnerability? Last I knew, it was just "send a special packet to something running SCHANNEL and get RCE".

@Iszi Oh, never mind. I made an assumption about where SPVerifySignature is used

It could be used anywhere

@ThomasPornin it's just a connection which is opened once in a blue moon though

I see that 2 donuts have recently joined the chat: @RoryAlsop and @Kisunminttu

@Simon that's doughnut to you, mister

fml

@Simon sweet bagel!

it's even pinned now

@ManishEarth That's the ugliest thing I've never said.

@Kisunminttu watcha' so are you a vuln-hunting widow tonight then?

@Kisunminttu the really funny part is that I generally use donut, but just for here, I use doughnut

@AJHenderson perfect :-)

@RoryAlsop img-9gag-lol.9cache.com/photo/ag01r0w_700b.jpg

I'm slightly perplexed by how the guy asking this question has managed to compile over 1K of rep here.