Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/400 Thanks!
Before I begin, I have a personal
note, this will be my first ever,
and I wonder if I can take a picture with
you all the fine.
Yeah.
Fine by me, fine by me,
just the SEC and
everybody say, fuck, Bill.
That's nice.
OK,
so today
I obviously going to talk about Bill, so
let's not Bill,
it's coding style sucks.
It's OPIS sucks.
It's not a type's sucks
bad, but
it is since late 87,
many legacy systems.
That's right.
Many legacy systems use it, most
sysadmins use it.
And unfortunately, unfortunately,
too many security experts use it.
And if you want to summarize it in a
quote, Bill
is worse than Python because
people wanted it was Lalibela,
the creator of the programing language.
A lot of people enthusiastic in
the crowd, so let's talk about
other types.
At first glance, those
are just regular Skylar's, you already
know, in string's float's,
etc., they even look like skulls
using these Syntex.
Then we had eles.
Those are just regular ladies,
those squiggly blankets and pretty much
looks like this.
And finally, we had dictionaries.
Those are just regular dictionaries
in there called HaShas.
They use Kennedy Blackett and looks
like this.
So far, so good.
The syntax is understandable and
everything works the way it should.
But
but we forgot
something.
What about lists?
So let's talk about lists.
Let's take the following code as an
example for the list.
The section marked in bright yellow
is the actual list
will assign the list into an essay and
then print its first element, which
is obviously one
letter signed the list into a scholarly
note. We expect this
will only use the first element of the
list and that one will be printed
out like in every other
normal language, but
not in Perl, which uses
the last element of a list.
In that case, see
what?
OK. OK.
Although that only happens
unless we cast the list
as the scholar, in which case instead
of printing see like the previous
example, it'll bring to five
the number of elements in the list.
What's.
Now, let's assign the list
into a hash, the
expected behavior is that this
Syntex will throw an exception
or at least bring undefined
when we actually use the hash, but
managed to treat that as a hash
somehow, and B,
even though it's not resembling any
sort of hashing syntax and they even
have a fucking uneven number
of elements.
What?
But we'll dove into this behavior later.
Meanwhile, it's important that you
understand that this happens
because at least is not a data
type, it's just an expression
obviously created to confuse us.
So after we saw at
least that a potential source for
problems, we thought, wait, how can
we even control the list?
Well, one obvious way is to look around
the CGI model.
It's a core module responsible for
processing and preparing HTP requests
and responses.
Its data arrives from the user using
HTP Palmettos and most,
if not all Web applications
use it.
Also, like any other thing
in Perl, it's been there for 15
years.
So let's take the following code that
brings the content of the full and bug
HTP parameters.
It will send this regular request
where one is assigned to full and A is
assigned to. Bob will see that one
and a outpointed
as expected.
But what will happen
if we send this request that
contains the same palmettos twice?
The logical thing to think is that we
will only take the first last ones once
so we see the exact same thing
happen again.
But as we already saw,
Perl and Logic aren't mixing
well together. And in fact, we'll
actually see two different lists
being printed.
That's right. If it was multi value in
nature to people, Mr. Bell just makes
at least out of it.
But what does the documentation
have to say about that?
Well, this is the this is a screenshot
from the official documentation.
It's spelled.
OK, can you see the full gamut
now?
How about now, Stilo?
How about now.
That's right. According to the
documentation you can ask to
receive an array.
How do you ask for anything.
Well you don't ask for
not annotate because the list is the
default fucking value in case of a
multivariate parameter.
What.
But what does all this to say about
that, according to them, CJI
module only takes the first documents
only. Well, in reality it returns a list
of occurrences that makes both
the documentation and the US blind
to the idea of an HTP parlamento
pollution attack.
And there's a follow up misleader.
Every programmer who reads them.
So let's start abusing
lists, let's create a list
and the hash, as you can see,
the value of the key is the list we've
created.
It will print the hash.
We'll expect something like this
to happen.
One of the key is assigned
the date we've created.
But in reality,
the hash actually looks like
this with the second element
used as the key name.
And the third element is a value assigned
what's.
That happens because at least
in hash is considered an extension
to the hash, if it was
all just political move,
although that's
actually known since 2006,
yet it got no attention
and no vulnerabilities, or at least
using this Grilk, no
vulnerabilities with such an easy
to miss quick.
So let's recap for a sec.
We know already lists are
fucked up because they'll just
plain expression's.
That's considered a Siddharta type.
We know Sedigh Barometer's can
become lists if we'll send multivolume
palmettos.
And we know that if we take a list and
place it inside the hash, it will expand
and become part of that.
And finally, and most importantly,
all of this is barely known
and is super easy to miss when coding.
So what the fuck are we going to exploit?
But, Gizella, that maxilla,
the one that manages bugs for the Linux,
Mozilla Foundation, Reddit, Mediaweek,
the Gnome Eclipse, OpenOffice
and dozens of other companies
in maxilla, some privileges are
given via a spill formed on
them and others, for example, and
use on the Mozilla dot org gained
privileges, allows it to view
confidential folfox bugs and
you use their get validated prior
to the actual registration, using
an email sent to its mailbox
containing a token used for continuing
registration in order to validate the
address.
It makes sense.
After the user enters the token, it's
asked to provide a password and every
name for its new account.
Then this code happens.
This is the code for the user creation.
It uses the Chehade function from
the back Zila user package
and insert a dictionary containing
the login name, which is the user email
address after it's already validated
the password. This is Kalala from the
user and as you probably guessed,
the real name for Message Parmentier
Bingo.
So if you'll send this regular request,
it will be created with a Lynnfield
that will also.
But you'll remember that the list inside
the hash just expands the hash.
So it will send this request
when the real name is a list containing
the string.
Also login name and the bug
Zila and admin at bookseller
dot org then suddenly
will create any and
value pair and could override
the value of login name, even
though it has been already set, thus
controlling the email address.
This vulnerability worked on the Mozilla
Zila and granted US privileges
reserved only for Mozilla employees.
Yet it's a super simple
vulnerability. Thanks.
Thank you.
This is a super simple vulnerability
that's been there for over seven
years.
So let's look at it again.
Lists are fucked up,
but those lists I show thus
far will only be public
hushes, though.
Can't be the only place vulnerable.
Right. So let's
leave hashas aside and take list
expansion Bayville to the next level
so we could really fuck things up
with some bizarre, undisclosed
vulnerabilities, NBA rules.
So this
is the function it takes
for the arguments A, B
and C and just points them
to remember the previous ones.
There are plenty more to come.
So in a regular call with
A, B and C. S values, we expect
A, B and C to be printed out, which
is exactly what happens.
But what happens if instead
of just the string QB will enter
a list containing it?
We expect the second argument
to be inserted into an array
and display that way.
But don't forget, is
that special kid in class that she
dispense whenever something it didn't
expect happens.
Sopel actually takes the single valued
list and treat it as a string in the
second Parlamento.
What?
OK, you know what?
Let's allow this one to slide, after all.
Maybe they'll just expand single value at
least into their single value.
Maybe it makes sense to develop at some
point.
Let's force the list to be a multi
value with B and C.
S element.
So it has to be in any
way expected to to bring this second
argument as an array containing
BNC. Right.
After all. That's exactly
what we've coded.
But again, Sippel says
fuck off and it'll actually treat this
thing B as the second argument
and this thing C, as the theorem.
What?
That's insane.
We actually created another
argument using only
a list.
Look at the syntax.
It's the exact same syntax you
will have used to create a regular
hedgy.
Let's try to defend against this kind
of behavior and how the code.
The third element is the
now can't just ignore
it and it has to treat our at least
affinity with the function argument
as the right.
Well, no.
In reality, Belal overrides
the third argument.
We've how it's coded into the function
with the content inside the list.
What the fuck.
What the fuck, Val?
Bill just expands our safety
bill containing moral arguments for the
function that's completely
mind blowing.
But the bill
documentation says de facto
behavior is not a bug.
It's a feature,
is it?
Thank you.
Let's look at the quote,
DBI is a call module since
1994.
I was born that
it is the most common way
to communicate with databases and almost
everyone uses it to do so.
It has only one function for
defending against escarole injections,
quote, let's see how this
function works.
It will send a regular string the
function to just place it inside the
apostrophes.
But if you're trying to inject something
like this string, quote, will escape
it for us. So it would be safe to use
inside the Coeli.
So let's see.
A regular example for using the function
in this code will call the use of CGI
metal and inserted into our query,
which is the the age variable, the
connection and the CGI variable
CGI instance, if only instead
of a regular user string and regular
query would be printed out.
But if we try to inject an
apostrophe quote, we'll take care of
it and escape it so we can't inject
any malicious ASCII.
Well, looks like you're right.
After all, it's been there for more than
two decades.
Well, I think it's time for
the demo.
So what we have here,
just a sec.
Right.
This is a code I've created,
you can see it magnified,
right?
Does the SEC how can I fucking
magnify something in a little while?
S. Oh, sorry, sorry about
that.
No.
OK, so
do you see the gold, we just keep the
valuables and then connect
to the debris and then put into
that exact same query
we used in our in
the presentation.
So if I open back up for
just a sec, let's see what
it is.
There you go.
Oh, oh, something happened.
Something happened
in Perilla
just might be seen.
No.
Kind of like an.
In Logits.
Nope.
I copied the notepad, so
what I'm sending now is
this request.
OK, look at it.
CNN.
I'm saying this request really user
equals admin, OK?
Now, let's see what the output of that
request will bring us.
So it brought us this.
I can zoom in, zoom, it doesn't work.
I don't know why on Minutos
can can download the fun solely
wait. You know what?
Maybe I can.
Let's see.
Such an intuitive ed.
Skrull, yeah, it doesn't work, it just
goes back to the presentation if I
scored, so.
Oh no it doesn't.
Oh.
Yeah, and
this is how your school so you just
select all formulas as well, username
equals admin, right?
Everything is well and now we'll send
admin apostrophe.
OK, we'll try to inject an apostrophe.
So we got back this
OK.
And apostrophe has been escaped, so
we couldn't inject anything.
And now I'm going to send this request.
I'm going to type it in notepad.
I'm going to send this
request.
And we'll see what happens.
Good luck, Bill.
And this is what came back,
no escaping, this is the by fiscal.
Yeah, that's good.
Inject everything
so back to the presentation.
That happens because
we could bypass escaping because, quote,
thanks, in fact, to arguments
this thing, to quote and it's type
which defaults to string, I
never saw anyone uses that
type of argument.
But if someone did, it's supposed to
help the function decide what to do with
this thing and if
and how it should escape it.
Quote, Does that by matching the type
against several constants declared
in the module.
These constants are actually just numbers
ranging from the number two to the number
eight. So when we've inserted the number
two as the second argument, quote,
thought this thing is actually an
integer and decided to let go and it
is without escaping it.
Now, that is the second
failure.
That is the second failing
dysfunction, and she didn't even validate
we've inserted an actual number,
who is the feature now, bitch?
So you're probably wondering what could
be achieved with all that mind blowing
fucked up? She doesn't bill when we
call bypass authentication and
execute code and upload any file,
would like to think wiki inject this girl
into movable type and
then just a small portion
of what could really be achieved if
someone took the time and effort for
exploiting stuff with it.
By the way, I'm
just saying, for example,
just silts just search
CGI and quote at GitHub.
And consider what you can
do with it.
So let's sum up lists,
al-Hasani, this bizarre expression
is a hazard of this bizarre language.
Now is the time to stop
using it.
Yeah, stop using
it. Stop the night only
God stop.
Yes, but before
he stop them, it's functional and
complicated, Opie.
And most importantly, stop the security
breaches that are all over the place.
And if you do end up writing, Bill,
at least know your goddamn language
features.
Thank you.
Senate agreed to Q&A.
So please line up at the microphones
and for Samuel will take a few questions.
Do you have questions?
The Internet has questions.
Oh, we have a question.
OK.
The Internet has one question right now.
Can you avoid this with proper user
validation and use of strict
and and warnings?
Are you strict?
Doesn't do anything.
In that case. It
just the at least it doesn't
have anything to do with strict.
Um, for the second part,
after we release the Baccelli
vulnerability, the author
of CJP AM released a new vision
for of JPM that
I don't know tries to restrict the use
of this list behavior.
But in reality, all it does
is when you send Multivolume and actually
Parmeter, it just won't
do so.
If I use it, it just warns
me I attacked the system.
So thanks for the info about.
Yeah, microphone, too,
yeah, I'm going to be the one asshole
here who really loves people.
I've been waiting for you.
Could you go back to the summary
you gave?
What was that of the previous night with
the summary? Yeah, sorry.
Sorry about that.
What you say lists are hazardous
in bizarre expressions, but
what you really need to see is that
Arrison lists are two completely separate
constructs. And if I look at the examples
you gave about using lists and document
calls, it's really
looked like you were really trying for
lists to be patient errors.
I want them to be python errors, but
if you want pipefitter, he's going to use
Python
useful.
So, yeah, I know
it's only an opinion. It's not a really
question. But this what this boils
down is that you have found two functions
that are designed very badly
in, for example, the code that takes the
second argument that shouldn't happen.
Yemen blame the poor.
That's what you guys do,
blame the program.
But no, no, no, no,
no, no, no.
Wait, wait, wait, wait, wait.
For a serious tone.
Like, why do we even have
lists if you already have?
What's the point of lists?
You know, the what
you can assign them to do and you can
assign them to an area.
They are not a data type.
They are expressions.
We have them from the first place.
You know, I don't know.
Firstly, four, five.
First of all, thank you for the talk
is to entertaining
and I'm glad to.
Do you have any idea why it
took so long for somebody to actually
notice this?
I don't know, I don't know.
Because it's what?
Right, probably,
probably.
Microphone three, yeah,
thanks for the awesome talk.
Long time no pass, so
I don't know if it's a stupid question,
but your
code, there was no warning enabled,
no use. Does this change anything?
I was wondering.
It doesn't change anything.
And warnings just warns, you
know, when you program it, like when you
program an application and boogum
it use a single valued parameter,
it doesn't do anything.
But it actually warns you because
I when I first learned parleys,
use warnings.
And if there's a single warning, you have
a huge problem.
A warning is that you can I
can now enable warnings and the safe
will work just fine.
If showed previously, do you want me to.
No, no, I believe you.
I was just wondering.
OK, ok.
OK, because I can.
Thanks again. No probs.
Internet ok.
One other question from the Internet.
How to avoid or fix these errors in
applications already written in Perl.
So in order to avoid
this stuff,
you actually have to
treat every CGI parameter as a
scholar if you actually intend to
use it as a scholar.
Like if you don't want to if you want to
pass an error into a function
or a hash and that the hash
will actually treat it as another error,
you have to backslash the reference
to that list.
You have to backslash a variable.
So that's how you overcome that.
I'll discuss it. This is.
Microphone, for
the example, with GBI, I
use the manual, quote, function,
I usually use prepared statements,
have it checked if that's safe
or is in there as well prepared
statements, I'll say if I did check them.
But you can inject
more values.
The propelled statement as
a result from this, you can inject
anything into any function if you're
inserted into a list.
Once you gained an
argument that that it's at least
you control you control every other
argument in the function that follows it.
You understand, right?
Microphone five, yeah, I just
want to ask you if you know what
references are and if you read the
document page, then you should know
that you use prepare
those like three fettling through the.
Yeah,
yeah, I, I did read
that the manual for the debate.
This is obviously bad programing.
Right. But again, blame the problem.
It's that basic.
You can say anything you want about the
reference and the
language isn't supposed to work that way.
But you know, if we're looking at
it logically, it does.
It does supposed to work that way.
I don't think so, it's documented
learning, Pearl.
Yes,
it DBI is in the
first chapter.
Sure thing.
OK, nice to know.
Microdata.
Yeah, this is a microphone
to address can can repeat
it. Flattening lists
and arguments and references, passing
reference. It's basic documentation,
it's basic design of the language.
So not no problem.
The reference thing is
completely fine.
But the problem is in the CGI, you
understand it when you get I completely
agree that the two modules, the,
the box you found, those are bad.
I blame the programmers of those modules.
Yes, exactly.
Exactly.
That's the point.
That's the point. That's not good
programing. That's bad programing that
everyone does, you know,
unless you like
in two entities, not even
if you're programing. Twenty percent.
That's still worked on bookseller.
They maintained it for, like, I don't
know, two thousand ninety eight,
something like that. And they still
haven't figured out yet that
this is what CGI does.
There's one last question on all three,
so my impression of what's going on here
is that basically
you have a weird type of value that
allows you to mess with the structure of
a syntax tree at runtime.
Are you aware of any other languages that
do that?
Because if there are, it's very
likely that they're going to be
exploitable in a very similar fashion
because nobody is going to understand
this is if there are more
languages, I give
more presentation, I guess.
Sorry, man, I don't know if anyone
any.
So thanks, Nathaniel,
no problem. Thank you.
Thank you all.