31 ms·

I'm impressed by how competent and professional some independent security researchers are. How do people learn this stuff? Are there any resources that anyone

I'm impressed by how competent and professional some independent security researchers are. How do people learn this stuff? Are there any resources that anyone here can recommend?

JMTQp8lwXL 7y ago
In this particular instance, it's a savvy understanding of the HTTP protocol. Both the 'Transfer-Encoding' and 'Content-Length' headers have opposite goals: one says how many bytes of response body data there is; the other signals that it is limitless until (IIRC) an empty newline is transmitted. Realizing that different systems resolve the question of "Well, what should I (the system) do when I get both headers?" and you realize you can break the atomicity of the HTTP request-- which opens up a really interesting (and severe) class of exploits. I'm not very good at finding vulnerabilities, beyond the obvious sql-injection attack types that we are generally trained to avoid. I imagine, however, getting good at finding these is a skill that can be learned with time. Alternatively, finding vulnerabilities might be more akin to pharmaceutical developments: with a 1,000 swings, you're missing at least 950 of them, or more. A dash of luck in there.
- tptacek 7y ago
  It probably helps to know that this particular bug was a major announcement at Black Hat last year, by James Kettle, who is a vulnerability research celebrity. So lots of people are looking for this particular bug. Black Hat talks are eventually published online for free; here's this one: https://www.youtube.com/watch?v=upEMlJeU_Ik https://www.youtube.com/watch?v=upEMlJeU_Ik
  - JMTQp8lwXL 7y ago
    Given how widely publicized request smuggling was, I'm surprised it's still a problem for apps with large user bases like Slack.
    - lonelappde 7y ago
      Other commenters note that some platforms intentionally leave this vuln open because closing it breaks some buggy clients. Convenience over security.
      - JMTQp8lwXL 7y ago
        I suppose if having account takeovers is worth the convenience-- sure, it's a tradeoff each company will have to make individually.
- toyg 7y ago
  I found it very similar, conceptually speaking, to buffer overflows; it’s just that, instead of messing with boundary checks in memory, you are doing it on boundary checks in connections. It also reminds me of the issue of character encoding in (x)html, where you have different ways to specify it (http headers, xml declaration, meta tags...) and if they don’t agree you can get corruptions downstream.

I'm impressed by how competent and professional some independent security researchers are. How do people learn this stuff? Are there any resources that anyone here can recommend?

JMTQp8lwXL 7y ago

In this particular instance, it's a savvy understanding of the HTTP protocol. Both the 'Transfer-Encoding' and 'Content-Length' headers have opposite goals: one says how many bytes of response body data there is; the other signals that it is limitless until (IIRC) an empty newline is transmitted. Realizing that different systems resolve the question of "Well, what should I (the system) do when I get both headers?" and you realize you can break the atomicity of the HTTP request-- which opens up a really interesting (and severe) class of exploits. I'm not very good at finding vulnerabilities, beyond the obvious sql-injection attack types that we are generally trained to avoid. I imagine, however, getting good at finding these is a skill that can be learned with time. Alternatively, finding vulnerabilities might be more akin to pharmaceutical developments: with a 1,000 swings, you're missing at least 950 of them, or more. A dash of luck in there.

tptacek 7y ago
It probably helps to know that this particular bug was a major announcement at Black Hat last year, by James Kettle, who is a vulnerability research celebrity. So lots of people are looking for this particular bug. Black Hat talks are eventually published online for free; here's this one: https://www.youtube.com/watch?v=upEMlJeU_Ik https://www.youtube.com/watch?v=upEMlJeU_Ik
- JMTQp8lwXL 7y ago
  Given how widely publicized request smuggling was, I'm surprised it's still a problem for apps with large user bases like Slack.
  - lonelappde 7y ago
    Other commenters note that some platforms intentionally leave this vuln open because closing it breaks some buggy clients. Convenience over security.
    - JMTQp8lwXL 7y ago
      I suppose if having account takeovers is worth the convenience-- sure, it's a tradeoff each company will have to make individually.
toyg 7y ago
I found it very similar, conceptually speaking, to buffer overflows; it’s just that, instead of messing with boundary checks in memory, you are doing it on boundary checks in connections. It also reminds me of the issue of character encoding in (x)html, where you have different ways to specify it (http headers, xml declaration, meta tags...) and if they don’t agree you can get corruptions downstream.