On 32 bit it used to be from 0xc0000000 to 0x00000000

This gives 3GB available to process

This includes mmap-ed files

user2284570: however since there's ASLR now in every system this helps only on some specific kernels where it isnt happening

@Aria : I see that no variables which are allocated on heap before 0xf00000000

I admit, I’m not sure at all about the remote instruction set. The only things I’m sure is it’s linux2 32 bits and little‑endian.

What I found allow me to read arbitrary addresses from an array allocated on heap.

It also seems there debugging symbols left…

ld-nacl-x86-64.so.1 __nacl_irt_shutdown __nacl_irt_setsockopt __nacl_irt_getpeername __nacl_irt_fstat __nacl_irt_select __nacl_irt_recvfrom __nacl_irt_connect __nacl_irt_getsockname __nacl_irt_recv __nacl_irt_write __nacl_irt_socketpair __nacl_irt_send __nacl_irt_getcwd __nacl_irt_seek __nacl_irt_read __nacl_irt_stat __nacl_irt_sendmsg __nacl_irt_recvmsg __nacl_irt_poll __nacl_irt_pselect __nacl_irt_close __nacl_irt_sendto __nacl_irt_accept __nacl_irt_socket __nacl_irt_getsockopt

no idea on what ld-nacl-x86-64.so.1 could refer to.

Looks like Android

or Chrome

developer.chrome.com/native-client

@Aria for hosting a very large website ?

I’m talking about a sever side memory leak.

Not really

@Aria : it seems unlikely. But why not… I heard ᴀʀᴍ powered servers can be good choice for performance per watt

Are you sure that dump is from the server and not from chrome browser on linux?

though, I don’t understand x86-64 in ld-nacl-x86-64.so.

However, this library is not on my chrome browswer on linux

@Aria : yes, I can load the ᴜʀʟ that trigger the dump in every application (including curl or wget). The problem is the python version they use was compiled in 2013. There are lot of bugs discovered since.

Loading the ᴜʀʟ is enough to trigger it. authentication isn’t required.

OK I think that ld-nacl-x86-64.so might be a Sandbox in which process runs

@Aria : Yes, this seems to be related to sandboxing (and I know from previous disclosure there is an ᴏꜱ‑level sandbox). However, all addresses are 32 bits. Those strings were just in the dump.

@Aria : not to mention I’m currently running only Windows®.

I could share the dump file containing those string publicly if it didn’t contained path that reveal the name of the famous website.

It may be some nexe file built with nacl toolchain, I am just looking at it

I have this toolchain in fedora

definitely need a more private chat for sharing it.

There's no private over there, all in public

I think it may be some custom sandbox, something really nifty like Google IMO

@Aria : you pointed it out. It’s Google app engine. and not with the flexible environment.

cloud.google.com/appengine/docs/go/runtime

I think it's Dropbox using Go in Google Cloud

I had Dropbox on target list but still havent went on that, havent read their hacking rules whatever they have prices and what is permitted

dropbox.com/jobs/listing/91333

@Aria No, it isn’t. It’s because I have full control of the python source code that I can cause those segmentation fault.

My aim is execute native assembly and bypass the sandbox.

I read doing this was rewarded by Google for java. I recognize I’m unsure if I achieved anything with python : it’s so easy that I suspect that unlike java, there are other protections and it’s not a vulnerability.

I am looking if there's any open sourced sanbox based on nacl - it would be useful in many ways, I found some of these yesterday like some f-shell, I am trying to build it, so then I could sanbox python scripts or java

myself

However I dont think it will be straightforward, but if google did it, it may be easier with open source software

@Aria : thank you. And here is the dump that contains that nacl information (it’s at the end of the file)

The dump consist of a single continuous memory region that start straight after the under allocated buffer. I didn’t loaded any third party modules except for webapp2 which is required for sending the response.

I want to chat about this question: security.stackexchange.com/questions/131164/… Where should I do it? Here?

I could comment on every answer, but I don't want to get in a flame war with everyone. Just want to discuss some of these ideas and why they may/may-not work.

@MechanicalSpecies Sure, feel free to chat about it here. Comments are for clarification, not discussion in any case.

Agreed. Ah, hey Xander!

It seems to me that things like letting outside groups manage your finances just opens up more attack vectors.

You might do it for other reasons, but I have a hard time seeing that as a security precaution.

@MechanicalSpecies In ways it does, however, remember, you only care about your money, and you don't have experience protecting it. They, on the other hand, have to worry about lots of peoples money, and have lots of experience protecting it. It's not a foolproof system by any means, but on balance, they're going to be much better at protecting money than an amateur. That's my experience, in any case.

@MechanicalSpecies There are certainly notable exceptions. The book Financial Serial Killers chronicles a number of them. Worth a read, if you're interested in the subject.

I'll check it out.

Would you give the same advice to someone who's fairly technical? E.g., one could use an offline password manager (e.g., KeePass) and store it in a safe along with the means of MFA. Attackers need your master password and access to the safe. (or access to the offline backups for the password database)

I have my doubts about the security practices of individual accountants and financial analysts within those companies.

Granted, it may still be a good idea to hire them to manage your money for non-security reasons.

@MechanicalSpecies I would certainly agree with you that you should use an offline password manager and MFA where ever you can, regardless of how much money you have.

@Xander what do you make of the suggestions in that thread to split your money up into lots of investment accounts? (Why people keep focusing on banks, I don't know.) It seems to me that that doesn't increase security. Again, you might do that for financial reasons, but not security.

@MechanicalSpecies The heart of my answer was really speaking to how very high net worth individuals do manage the wealth, and that things like passwords and 2FA tokens simply aren't relevant in them, generally speaking. (I have a small amount of personal experience with folks in this category, and a larger amount of professional experience with them, not as an infosec professional, but from my prior career as an accountant.)

@MechanicalSpecies This may actually not be an option. I have very limited experience in this area, but I have a friend who is a personal banker for HNW clients, and his bank requires (or did require, at the time) that customers who want to use them, use them for all of their investable assets.

@MechanicalSpecies Additionally, that sounds like a lot more trouble than it's worth. And I've never known a HNW individual to try this, as a security measure, or for any other reason.

@MechanicalSpecies I understand the theory that diversification is good for security, but I tend to agree with you. In this case its better as a theory than in practice.

@Xander Fascinating stuff. I wonder how much those management companies cost...

@MechanicalSpecies Their fees are based on a percentage of assets under management. So, the more money you have, the more they cost. :-)

0.89% for the first $1M. 0.49% over $10M

That's a lot of money.

@MechanicalSpecies It sure it. A traditional private bank is even more, where you might pay 1.0-1.5%. And they won't even let you in the door if you only have $1 million. I wonder if the Internet competition is starting to bring their fees down? I'm sure it must do sooner or later.

@Xander I know I'd be tempted to use the <0.1% fees that Vanguard and others provide. It seems that the argument for low-fee index investing may be applicable here. Which would mean maybe a "special arrangement" with Vanguard about additional security measures with them. If you didn't want to pay an investment company huge fees to do the same thing for you.

@MechanicalSpecies Yup. It's not just about security through (not even secondarily about security, for that matter.) There are much bigger financial incentives, such as their ability to do tax minimization and manage to specific goals.

@Xander Right. Very true. At that point the question is whether those fees pay for themselves or not. Maybe the savings from tax loss harvesting is in excess of the high fees, maybe not.

@MechanicalSpecies Yup, and for me, it's purely academic because I'll never have enough money to find out in the first place. :-)

Hello, something that I don’t understand : isn’t Google’s nacl supposed to catch most heap overflows ?

nacl=Google native client version that use modified toolchains.

<VentOn> Ugh, I hate retaliatory down votes. </VentOn>

Hey DMZ, can I get some advice on an answer here? Apparently people do not like it: security.stackexchange.com/a/131295/97432

@AstroDan Yup. But, on a gamified site, it's part of life. I had one last week.

In my experience revenge downvotes are pretty rare

@AstroDan I think it's a fine answer.

LOL, rare yes but he pretty much said as much in a (Deleted) comment

@AstroDan The other answer is all over the place.

Thanks @Xander I was not sure because it picked up a downvote in the first few minutes which has never happened to me before.

@Xander I tried commenting on it but then gave up. There is no arguing with paranoia.

Anybody have checklists along the lines of web.nvd.nist.gov/view/ncp/repository ?

@MechanicalSpecies LOL.