@Aria : yes, I can load the ᴜʀʟ that trigger the dump in every application (including curl or wget). The problem is the python version they use was compiled in 2013. There are lot of bugs discovered since.
Loading the ᴜʀʟ is enough to trigger it. authentication isn’t required.
@Aria : Yes, this seems to be related to sandboxing (and I know from previous disclosure there is an ᴏꜱ‑level sandbox). However, all addresses are 32 bits. Those strings were just in the dump.
@Aria : not to mention I’m currently running only Windows®.
I could share the dump file containing those string publicly if it didn’t contained path that reveal the name of the famous website.
@Aria No, it isn’t. It’s because I have full control of the python source code that I can cause those segmentation fault.
My aim is execute native assembly and bypass the sandbox.
I read doing this was rewarded by Google for java. I recognize I’m unsure if I achieved anything with python : it’s so easy that I suspect that unlike java, there are other protections and it’s not a vulnerability.
I am looking if there's any open sourced sanbox based on nacl - it would be useful in many ways, I found some of these yesterday like some f-shell, I am trying to build it, so then I could sanbox python scripts or java
myself
However I dont think it will be straightforward, but if google did it, it may be easier with open source software
The dump consist of a single continuous memory region that start straight after the under allocated buffer. I didn’t loaded any third party modules except for webapp2 which is required for sending the response.
I could comment on every answer, but I don't want to get in a flame war with everyone. Just want to discuss some of these ideas and why they may/may-not work.
@MechanicalSpecies In ways it does, however, remember, you only care about your money, and you don't have experience protecting it. They, on the other hand, have to worry about lots of peoples money, and have lots of experience protecting it. It's not a foolproof system by any means, but on balance, they're going to be much better at protecting money than an amateur. That's my experience, in any case.
@MechanicalSpecies There are certainly notable exceptions. The book Financial Serial Killers chronicles a number of them. Worth a read, if you're interested in the subject.
Would you give the same advice to someone who's fairly technical? E.g., one could use an offline password manager (e.g., KeePass) and store it in a safe along with the means of MFA. Attackers need your master password and access to the safe. (or access to the offline backups for the password database)
I have my doubts about the security practices of individual accountants and financial analysts within those companies.
Granted, it may still be a good idea to hire them to manage your money for non-security reasons.
@MechanicalSpecies I would certainly agree with you that you should use an offline password manager and MFA where ever you can, regardless of how much money you have.
@Xander what do you make of the suggestions in that thread to split your money up into lots of investment accounts? (Why people keep focusing on banks, I don't know.) It seems to me that that doesn't increase security. Again, you might do that for financial reasons, but not security.
@MechanicalSpecies The heart of my answer was really speaking to how very high net worth individuals do manage the wealth, and that things like passwords and 2FA tokens simply aren't relevant in them, generally speaking. (I have a small amount of personal experience with folks in this category, and a larger amount of professional experience with them, not as an infosec professional, but from my prior career as an accountant.)
@MechanicalSpecies This may actually not be an option. I have very limited experience in this area, but I have a friend who is a personal banker for HNW clients, and his bank requires (or did require, at the time) that customers who want to use them, use them for all of their investable assets.
@MechanicalSpecies Additionally, that sounds like a lot more trouble than it's worth. And I've never known a HNW individual to try this, as a security measure, or for any other reason.
@MechanicalSpecies I understand the theory that diversification is good for security, but I tend to agree with you. In this case its better as a theory than in practice.
@Xander here's how much Personal Capital charges. That was just the first ones I thought of. I'm sure there are lots of these companies. https://www.personalcapital.com/images/website3/wealth-management/how-we-work/[email protected]
@MechanicalSpecies It sure it. A traditional private bank is even more, where you might pay 1.0-1.5%. And they won't even let you in the door if you only have $1 million. I wonder if the Internet competition is starting to bring their fees down? I'm sure it must do sooner or later.
@Xander I know I'd be tempted to use the <0.1% fees that Vanguard and others provide. It seems that the argument for low-fee index investing may be applicable here. Which would mean maybe a "special arrangement" with Vanguard about additional security measures with them. If you didn't want to pay an investment company huge fees to do the same thing for you.
@MechanicalSpecies Yup. It's not just about security through (not even secondarily about security, for that matter.) There are much bigger financial incentives, such as their ability to do tax minimization and manage to specific goals.
@Xander Right. Very true. At that point the question is whether those fees pay for themselves or not. Maybe the savings from tax loss harvesting is in excess of the high fees, maybe not.
