Thoughts on companion worms

I wrote a paper almost a year ago now and since it has been
reviewed by a lot of skilled people including, but not limited
to, anti virus researchers, its time to make it public.

Its about a special kind of worm and vulnerabilities
which are commonly under-hyped like CVE-2008-2383 which
most people would probably only recognize as local, if at all.

You can find the paper here.

Enjoy reading it, if you feel that X-mess is coming :)
This is most likely the last posting for this year, so
I wish you merry X-mas and happy new year. You can find me
at the 26C3 in Berlin this year, if everything goes straight.

Always check return value!

A nice bug inside the FreeBSD runtime linker has been
reported here.

It was good that I hashed my previous exploit
(discovered it some months ago) in my twitter message
from November 5th:

md5 4b1717926ed0d4823622011625fb1824 sha1 6871fd05efbddf7eea4447f7bfdc1c9a45979fe3

Since a public exploit is now available anyway,

I also make my version public and you can check the

hashes

here 

to prove it.


I have a strange feeling that this re-discovery comes now,
since I talked to some people regarding BSD bugs lately.
Nevertheless I know kingcope is a skilled reviewer and
it was not the first time he had BSD as a target.

Adventures in Heap Cloning

Heap seems to be a magic word. I never got download rates
like this for a paper. Since there was no feedback that
told me that I am completely wrong, I make it
available to a broader public now. A small chapter has been
added: 'Countermeasures'.
The paper is available here.
You probably know that I am not a memory-guy, so do not
expect much more research in this area by me.
I rather really enjoy developing code that hashes
like this:  
sha1: c60a0e1daff22c0d97eb03f509c7135d119d830b
md5: fcb19f8317449ad9f93a12fccb63c650.

xorl blog seems to be up again

A few weeks/months ago I sadly realized that the author
of the xorl blog was quitting his writeups. Now it seems
that he is continuing his activities. Now I have
something nice to read at the beginning of the day.
Although he doesn't speak about vulnerabilities he found
himself, its one of the better security blogs in my opinion.
I really enjoy reading it and like to recommend it to
everyone interested in software trickery.
I want more OpenBSD foo. :)

injectso 32bit x86 port

injectso now supports x86 and x86-64 architecture. make automagically

compiles the correct version.I also added some code cleanups and

error checking as well as the possibility to inject DSO's with relative

pathnames as suggested by a patch I received.

Do not forget to vote (right toolbar:) !

New injectso available

I ported injectso to the new glibc (2.5, 2.9 and 2.10 tested).
It now runs on Linux/x86-64 machines. Original  developed
by Shaun Clowes in 2001 for i386 and sparc it showed that
there is a really simple way on current systems to do that.

unixdump UNIX-socket sniffer available

Update:
Released new version (0.42) since 0.41 (not avail anymore)
crashes when accessing udmp device afer rmmod.
(The dynamically assigned major number was not updated
for unregistering.) Thanks to myself for reviewing my own
code :)

Ok, its finally avail here.

Do not run it inside an xterm or otherwise its
like sniffing all tcp traffic remotely on a ssh shell.
BTW ssh. Due to my ssh timing/packet-size patch
I've been called a Iran circumvention developer.

Really funny wording. I like to add that to my
resume.
And right in time while typing
they play LOA with Love to let you down.
What do you want more?

When const really means const

Who cares about const? Its never enforced anyways!?

Except in Linux kernels built with gcc 4.x (maybe even
before?). If you declare a pointer member const
(the thing it points to, not the pointer itself), like
proto_ops in the socket struct, the pointee will be placed in a
RO location which means you cant redirect socket operation
functions like recvmsg(). You have to make the right PTE
writable in order to redirect the functions.
Rootk^H^H^H^H^HCertain debugging LKMs like my unixdump
require to redirect some functions in order to record
whats sent across sockets. unixdump works like tcpdump
for inet sockets. The version which is available now was
written in 2006 for the 2.6.16 kernel and doesnt work with
recent/current ones (and its dirty and hackish anyways).
Thats why I ported it within the last days to current kernels.
It will be uploaded soon.
The way you can modify const members changed in current kernels;
in fact is is easier than before b/c a new function lookup_address()
is exported and you do not need to walk the PGD down.

GCC -fmudflap

Programs compiled with -fmudflap are given protection by GCC
against overflow conditions etc. The GCC then adds a runtime
to track&check operations on arrays etc..
To specify runtime behavior, you can pass various
options via the $MUDFLAP_OPTIONS environment variable.
If we look how the mudflap runtime is
handling these options, we have:

...
case viol_gdb:

snprintf (buf, 128, "gdb --pid=%u", (unsigned) getpid ());
system (buf);
...


Note, that mudflap is made for security reasons. For programs
like network servers or setuid binaries.
I made a bugzilla entry into the GCC bugzilla since this
should be changed somehow :)

Small improvement for inotify

The inotify tool got a small improvement yesterday, so you
can pass -r (recursion) to it. It now also allows you to recursively
watch newly created/modified/deleted/accessed files/dirs
in newly created subdirs of the watched directory.
This already showed me some differences between man versions :)