4 ms·

> I find it fascinating that people are putting so much efforts optimizing exploitation techniques, yet ~nobody bothers fixing them, even if it only takes a cou

> I find it fascinating that people are putting so much efforts optimizing exploitation techniques, yet ~nobody bothers fixing them, even if it only takes a couple of lines of code and 20 minutes. There's definite reward in having a 0-day. Either you can get a bounty, or sell it in the hacker-souk. That "couple of lines of code and 20 minutes" is sort of in the eye of the beholder. If you are a highly-experienced language developer, the fixes are likely to be a lot more obvious, simpler, more comprehensive, and robust, than if you are a relatively junior IC.

maple3142 2y ago
I think it is probably because a lot of things are deemed as acceptable. For example, the stream filter chain one is only exploitable if the input to some php IO functions like file_get_contents are attacker-controlled, and those things are already treated as LFR vulnerabilities in application, not the language runtime. Also some of the them (e.g. stream filter chain) are fun and useful enough (turning LFI into RCE), so I bet there definitely some people would rather those thing is not fixed. Given that a properly-secured application wouldn't be affected.
eru 2y ago
Well, you can produce the exploit all on your own and showcase it. But to get your fix in, you'd have to interact with the PHP ecosystem.
est 2y ago
Breaking something is easier than protecting everything from all fronts. Hackers write the worst code, but all the mess needs only one successful hit to become a 0day.
- blueflow 2y ago
  Instead of making a website about it, you can take any step of your exploit chain and change the code that exploit cannot possibly work, and submit that as patch. You would still get a CVE number assigned that you can add to your resume. For example, look at the glibc/iconv CVE some other user posted[1]. In the section "Out-of-bound write when converting to ISO-2022-CN-EXT" they have mapped out the boundary checks. By diagnosing the problem this detailed, they already did 90% of the work. The other 10% are the patch and writing to the mailing list. [1] https://www.ambionics.io/blog/iconv-cve-2024-2961-p1 https://www.ambionics.io/blog/iconv-cve-2024-2961-p1
  - frogsRnice 2y ago
    Making a website about it benefits other people; finding the vulnerability helps other people; even if its 10%, why can’t someone else do it? Surely someone doing all this would already have submitted a patch if they felt comfortable.
PaulRobinson 2y ago
I think if somebody wants to describe themselves as an "ethical hacker", and a conference wants to let people talk about exploits they've found, the minimum bar for disclosure is at least a description of a mitigation that could be taken, and ideally an actual code diff if its an open source project. There's a bit of street cred for finding a 0day, a bit of glamour about figuring out the puzzle. There's not much for the person who fixes it. I think as an industry it might be worth trying to fix that somehow.
- calvinmorrison 2y ago
  Selling hacks is ethical
  - berkes 2y ago
    Why? And: Always?
    - calvinmorrison 2y ago
      Paying for bounties is paying for exploits. That is to say, choosing not to pay for exploits is tantamount to selling your customers off for a price, the price of the bounty.
  - PaulRobinson 2y ago
    Let's suppose you are right. Why not accompany that with a proposed fix, too?
    - frogsRnice 2y ago
      Don’t necessarily agree that selling hacks is ethical, but if I already spent time figuring out how to exploit a system - reporting it to the relevant place is charity. Ill do that, but Im definitely not spending time trying to fix the code if the solution isn’t immediately obvious. ++ so if you have to fight to get the bug recognised in the first place
  - 2y ago
pjmlp 2y ago
When liability and cybersecurity laws start being more hardly enforced, many companies will certainly bother to fix them. It like no one cares to keep a kitchen clean, or a factory in order, until the inspection shows up and closes doors. Naturally even for those, we are at various levels of how those inspections are honestly enforced across the globe.
deleted 2y ago
[deleted]

maple3142 2y ago

I think it is probably because a lot of things are deemed as acceptable. For example, the stream filter chain one is only exploitable if the input to some php IO functions like file_get_contents are attacker-controlled, and those things are already treated as LFR vulnerabilities in application, not the language runtime. Also some of the them (e.g. stream filter chain) are fun and useful enough (turning LFI into RCE), so I bet there definitely some people would rather those thing is not fixed. Given that a properly-secured application wouldn't be affected.

eru 2y ago

Well, you can produce the exploit all on your own and showcase it. But to get your fix in, you'd have to interact with the PHP ecosystem.

est 2y ago

Breaking something is easier than protecting everything from all fronts. Hackers write the worst code, but all the mess needs only one successful hit to become a 0day.

blueflow 2y ago
Instead of making a website about it, you can take any step of your exploit chain and change the code that exploit cannot possibly work, and submit that as patch. You would still get a CVE number assigned that you can add to your resume. For example, look at the glibc/iconv CVE some other user posted[1]. In the section "Out-of-bound write when converting to ISO-2022-CN-EXT" they have mapped out the boundary checks. By diagnosing the problem this detailed, they already did 90% of the work. The other 10% are the patch and writing to the mailing list. [1] https://www.ambionics.io/blog/iconv-cve-2024-2961-p1 https://www.ambionics.io/blog/iconv-cve-2024-2961-p1
- frogsRnice 2y ago
  Making a website about it benefits other people; finding the vulnerability helps other people; even if its 10%, why can’t someone else do it? Surely someone doing all this would already have submitted a patch if they felt comfortable.

PaulRobinson 2y ago

I think if somebody wants to describe themselves as an "ethical hacker", and a conference wants to let people talk about exploits they've found, the minimum bar for disclosure is at least a description of a mitigation that could be taken, and ideally an actual code diff if its an open source project. There's a bit of street cred for finding a 0day, a bit of glamour about figuring out the puzzle. There's not much for the person who fixes it. I think as an industry it might be worth trying to fix that somehow.

calvinmorrison 2y ago
Selling hacks is ethical
- berkes 2y ago
  Why? And: Always?
  - calvinmorrison 2y ago
    Paying for bounties is paying for exploits. That is to say, choosing not to pay for exploits is tantamount to selling your customers off for a price, the price of the bounty.
- PaulRobinson 2y ago
  Let's suppose you are right. Why not accompany that with a proposed fix, too?
  - frogsRnice 2y ago
    Don’t necessarily agree that selling hacks is ethical, but if I already spent time figuring out how to exploit a system - reporting it to the relevant place is charity. Ill do that, but Im definitely not spending time trying to fix the code if the solution isn’t immediately obvious. ++ so if you have to fight to get the bug recognised in the first place
- 2y ago

pjmlp 2y ago

When liability and cybersecurity laws start being more hardly enforced, many companies will certainly bother to fix them. It like no one cares to keep a kitchen clean, or a factory in order, until the inspection shows up and closes doors. Naturally even for those, we are at various levels of how those inspections are honestly enforced across the globe.

deleted 2y ago

[deleted]