software security:
ur doin it rong

1. how much to care.

how much should YOU care?
Less.

a sucker’s bet
!
“my UTU protocol uses ISO IEC 48798783 without the Helsinki
vulnerability, bitches!”.

a sucker’s bet
!
FAIL*
“Only two remote holes in the default install”.

a sucker’s bet
!
FTW!
10 years, no exploitable flaws in a top-5 mail server. UNPOSSIBLE!

in it for the girlies and the
!
actually jason fried
(not to scale)
• The guy in the rated R movie. So money!
• Not bad at security. Just not awesome. FTW!

why I care?
⌘ I’m Paranoid
⌘ What could you tell me to make me feel
better about running Adium?
⌘ Not.
⌘ Much.

why I care?
⌘ How to make literally tens of dollars
with
• Moveable Type
• NetNewswire
• John Gruber == target rich environment
• 99.99% of Mac devs

is your blog pwned?
Pwnie for mass 0wnage ’08: Wordpress

stupid mac bugs I have known
⌘ “The "Repair Permissions" tool in Disk
Utility makes /usr/bin/emacs setuid”
⌘ “osascript -e 'tell app "ARDAgent" to do
shell script "whoami"'”
⌘ QTPointerRef p =
h.toQTPointer(-2000000000, 10 /
*size*/);
⌘ install_crontab --DejaVu

2. all you need to know

if you get this, you’re 90% done
⌘ length is scary
• now you get: stack overflows, heap overflows, integer
overflows, integer underflows, uninitialized variables,
null pointer offsets.
• initialize variables, abort when malloc fails, count,
with unsigned ints, and don’t let them wrap.
• go live your life.
⌘ content is scary
• now you get: XSS, SQL injection, shell injection, xpath
injection.
• whitelist to alphanumeric and swap punctuation for
HTML entities.
• go live your life.

but what about...?
⌘ return-based exploitation of stack
cookies leaked through stale memory
that defeat 8 bit ASLR seeding on...
⌘ internationalized best-fit shift-JIS filter
evasion with union selects...

Overview of the Same Origin
• Goal is to prevent a resource loaded
from one site manipulating or
communicating with another site
• Evil.com should not be able drive
interaction on my behalf to bank.com
I mean, what do you do in Las Vegas? You gamble - and you go to strip clubs - Scott

Enter Jafar Attacks
You took too much man, too much, too much. – Benecio Del Toro

That’s GIFAR Attacks, Not Jafar
• What’s a GIFAR?
– A combination of a GIF and a JAR resulting
from the fact that a JAR keeps its relevant
data within the footer of a file, whereas GIFs
keep their relevant metadata in the header
– Allows us to create a file that is both a GIF
and a JAR
– Will load just as any image would, but will
also load as a JAR (Applet in this case)
He who makes a beast out of himself gets rid of the pain of being a man. – Hunter S.

What’s WRONG with this
Picture?

These aren’t the JARs you’re
looking for

What does this get US?
• A “Bridge” is created
• Applet can talk to your domain
• My webpage (evil.com) can talk to the
APPLET
• We use your cookies 
• We drive interaction on your behalf

3. features that fuck over
developers.

don’t do these things.
⌘ encraption
• unless it’s openssl or gpg.
⌘ password storage
• unless it’s bcrypt.
⌘ write directly into the DOM
• ever.
⌘ installers
• thanks for making my app writeable.
⌘ listeners
• do not want another web server. cannot use.
⌘ content controlled code
• blog templates
⌘ file upload/download

rubber chicken security
⌘ SSL
⌘ hackersafe
⌘ little lock icons
⌘ javascript crypto
⌘ scripting languages

the myth of the passive
⌘ it’s not 1994
⌘ the backbone sun4m doesn’t got
ethersniff
⌘ they have better things to do
• wifi assoc
• arp
• dns
• bgp
• xss
⌘ it’s all mitm now

by all means piss us off
⌘ #1 security feature: big long random
urls
• not http://app/customer/Bob or http://app/
customer/101
• http://app/customer/dZFdv5SWP23RMVADyT819UK7J
⌘ encode your data, but jumble the b64
charset.
⌘ encrypt your data. fixed key! just
scramble the sboxes! add a round! xor
the keystream!

4. fuzzing: pretty much
all you need to do.

what’s a fuzzer?
⌘ figure out the protocol packets or file
formats you use.
⌘ define structures for them.
⌘ replace fields with random garbage
• long strings, high ascii, metacharacters, negative
numbers
⌘ iterate over all fields
⌘ this finds, what, 60% of all reported
vulnerabilities?

be the world expert for your
⌘ writing a contact manager?
• write a vCard fuzzer
⌘ writing a calendar?
• write an iCal fuzzer
⌘ writing an IM client?
• write an OSCAR fuzzer
⌘ Run it. Every release. Fix stuff.
⌘ Publish it. Now you’re an expert.
⌘ Be a jerk: run it on your competitors.

there’s a framework for you
⌘ use python? get peach fuzzer, or sulley
⌘ use C? get spike
⌘ use Perl? try fuzzled
⌘ use ruby? here’s ruckus

here’s ours: ruckus
⌘ lay out structures

here’s ours: ruckus
⌘ everything is composable
⌘ forms a DOM:
• fields => html class
• “tag” => html ID

here’s ours: ruckus
⌘ cascading fuzz sheets
⌘ write test cases, run them, find stuff, fix,
get on with your life.

web dev? if you buy one thing:
⌘ make it burp suite
• first google hit for burp!
⌘ €99.
• 1% of your graphic design budget

6. there are no secrets.

you have no hope

state of the art on win32
⌘ differential debugging
⌘ virtualization

osx lagging 6 months behind,

7. outreach.

for god’s sake have a security
⌘ Link on your website:
• To report a security problem, click here.
⌘ Post a GPG key.
⌘ Designate someone your security
contact.
⌘ Publish advisories.
⌘ Act like you’ve done this before.

oh the researchers you’ll meet
⌘ kids
• want the cred, a new 360.
⌘ consultants
• want the cred.
⌘ criminals
• aren’t talking to you anyways.
⌘ researchers
• want the cred.
⌘ customers
• want you to fix it.

when they come to you...
⌘ don’t call them enhancements
⌘ don’t argue about severity

8. an indie sdlc.

all you need to do:
⌘ fuzz
⌘ secure auto-update
• with a signed cert!
⌘ crash reporter with stack/regs
⌘ outreach
⌘ stop worrying

no really we sweated this deck

Questions
(are your way of proving you paid attention)