6 ms·

This is INSANELY COOL. If it's smart enough to learn how to build a JPEG in a day, use it with netcat and it could probably send quite a lot of things down in

• gear54rus 12y ago
  Yeah, netcat would be fun. Although, it seems that it also straces (or similar?) the app it tests. > it triggers a slightly different internal code path in the tested app This would be impossible on the network.
  • rwg 12y ago
    Why impossible? (Hint: 127/8 is a network, too.)
    • gear54rus 12y ago
      This is a no-fun zone :) I thought the comment author meant to release (the kraken) out in the open - to test publicly (or at least on LAN) available services. Or am I missing something?
      • gwern 12y ago
        If you find problems in a local Apache, it's a good bet those may also be problems with some remote Apaches somewhere on the Internet.
  • tux3 12y ago
    >Yeah, netcat would be fun. Although, it seems that it also straces (or similar?) the app it tests. Ah yes, I forgot this little detail. I wonder if you can get it to work on the local machine first, but talking throught a socket instead of stdin. Then, pipe the result throught netcat !
    • tptacek 12y ago
      Conceptually the output generation and the trace collection aren't coupled. As long as you can (a) instrument the target to collect traces and (b) programmatically feed it variant inputs, the same technique will work. (This isn't a new concept, although afl is a particularly tight implementation of it; you can look up the paper for "autodafe" for a (much) earlier version).
      • jacquesm 12y ago
        > autodafe That's got to be the funniest and most appropriate name for a piece of software ever.
        • fluxist 12y ago
          It's what you oughtn't to do but you do anyway :)
  • BetaCygni 12y ago
    Combine it with a timing attack and possibly it could ;)
  • jacquesm 12y ago
    Mock it locally, exploit it globally. One more reminder why it's useful to turn off your server signatures, especially if they spew out version information.
    • jMyles 12y ago
      Oh ho ho no you don't. That's security through obscurity, and that's never ever OK for anybody. I never understood this attitude. It has always been my experience that obscurity is in fact an important part of security. It's a weakness when mistaken for security, not when understood as part of it. Sadly, I do actually have signatures (with version information) to mute.
      • icelancer 12y ago
        People knee-jerk say that because they assume it's the only thing being done to secure an asset, when obviously it's a valid defense in depth measure, one with very low marginal cost (setting a few variables in conf files).
        • XorNot 12y ago
          This really depends. The marginal cost of "what version is this box running, why doesn't this work, oh we don't have that tool?" could be very high on something like that. I mean remembering, that the net is full of slow brute-forcers and the like. Just because it takes a few days to run through all the exploits doesn't mean that someone won't do it - that's thinking of security in human, individual terms, as though the threat is targeted rather then general.
          • jacquesm 12y ago
            But here is where it comes in handy: If you have your version numbers out there in some database and a 0 day for that particular version hits then you're hacked. If not then you might be able to patch your system before a breach happens. It's no guarantee but since it costs very little and gives you possibly a bit more time when you need it badly it does not hurt. Obviously you need to cross all your other t's and dot the i's too. And if you need your headers to tell you what versions are running and what tools are installed you are doing something else very wrong.
• heywire 12y ago
  And this is how Skynet was born.
• eridius 12y ago
  The overhead of executing a binary and of doing network traffic are orders of magnitude in difference. This synthesized a jpeg in a day. The equivalent operation with a network connection assuming an always-available fast server would probably take years.
  • sjf 12y ago
    If you are trying to fuzz a protocol, there is no reason not to test it on a local machine. And it would probably end up _faster_ than the jpeg example because a network request has less overhead than execvp.
    • eridius 12y ago
      Only if you're capable of running the server on the local machine. So yeah, you could fuzz open-source software this way, but that's only going to test the underlying transport protocol, e.g. testing HTTP for nginx. When talking about bringing down services, you presumably need to attack the service itself, and that typically means attacking a server whose code you don't have access to. Open-source services that are run as-is, e.g. databases and the like, usually aren't exposed to the world.
      • Namrog84 12y ago
        Doesn't have to be open source. Just cause you don't have the source or its not free doesn't mean you can't still fuzz it. Though If some company is running some home brew solution then yes. But plenty of people run services based upon technologies that are semi widely available. Even if not open source.
        • eridius 12y ago
          True, you don't need the source, but you do need the service. And my point was that the software you can run are the software providing the underlying support for the service (e.g. HTTP handling with Nginx, databases with Mysql, etc), and is not the service directly.