3 ms·

Hey, security guy here that has worked on something like this for about 2 years. This is cool but has some vulnerabilities upon a brief 10min code review. I'll

Hey, security guy here that has worked on something like this for about 2 years. This is cool but has some vulnerabilities upon a brief 10min code review. I'll see if I can circle back in about 2 weeks and make a list of what vulnerabilities EBPFSnitch has.

cmeacham98 6y ago
When you say vulnerabilities what do you mean? RCE? Privesc? Software can bypass the firewall? Also, based on your recent HN comments you seem to have claimed to find vulns in several projects, but to date have provided no proof of such claims, so I'll have to admit I'm a little skeptical.
- netsec_burn 6y ago
  Software that can bypass the firewall for certain, and a possible local privesc (I don't want to promise the LPE yet, I've only looked for 10min). Some skepticism is understandable. I've followed up on a few of the replies here outside of HN (such as the Guix project, I found a root LPE they will be releasing a fix for in the coming weeks). For 10 years or so I've not disclosed any vulnerabilities I found. Publicly unverifiable claims are necessary in security, if I were to release the POC before Guix (for instance) can patch it it'll affect their users.
  - dhaavi 6y ago
    If you publish your findings somewhere, I'd love to read what you have found! We are also building a FOSS application firewall for Linux and I would like to see what problems you have found and how we are doing in that regard. Ref: https://safing.io/portmaster/ https://safing.io/portmaster/
    - netsec_burn 6y ago
      Hey there. I did a second 10 minute code review on Portmaster. First I want to say, well done on your modular source tree. It made it very easy for me to go through your open source project. Second, Portmaster is more vulnerable than EBPFSnitch. There's a firewall bypass like EBPFSnitch and a possible auth bypass in the API. I need to verify if the auth bypass is exploitable. A blog post sounds interesting but I'd need to coordinate disclosure with you so your end users aren't affected. I'll circle back in an email thread, expect it in ~1mo.
      - dhaavi 6y ago
        Wow, thank you for looking into it! I am very much looking forward to your email.

cmeacham98 6y ago

When you say vulnerabilities what do you mean? RCE? Privesc? Software can bypass the firewall? Also, based on your recent HN comments you seem to have claimed to find vulns in several projects, but to date have provided no proof of such claims, so I'll have to admit I'm a little skeptical.

netsec_burn 6y ago
Software that can bypass the firewall for certain, and a possible local privesc (I don't want to promise the LPE yet, I've only looked for 10min). Some skepticism is understandable. I've followed up on a few of the replies here outside of HN (such as the Guix project, I found a root LPE they will be releasing a fix for in the coming weeks). For 10 years or so I've not disclosed any vulnerabilities I found. Publicly unverifiable claims are necessary in security, if I were to release the POC before Guix (for instance) can patch it it'll affect their users.
- dhaavi 6y ago
  If you publish your findings somewhere, I'd love to read what you have found! We are also building a FOSS application firewall for Linux and I would like to see what problems you have found and how we are doing in that regard. Ref: https://safing.io/portmaster/ https://safing.io/portmaster/
  - netsec_burn 6y ago
    Hey there. I did a second 10 minute code review on Portmaster. First I want to say, well done on your modular source tree. It made it very easy for me to go through your open source project. Second, Portmaster is more vulnerable than EBPFSnitch. There's a firewall bypass like EBPFSnitch and a possible auth bypass in the API. I need to verify if the auth bypass is exploitable. A blog post sounds interesting but I'd need to coordinate disclosure with you so your end users aren't affected. I'll circle back in an email thread, expect it in ~1mo.
    - dhaavi 6y ago
      Wow, thank you for looking into it! I am very much looking forward to your email.