Tue 06 Sep 2022 10:39:24 AM EEST

sagemath denial of service with abort() in gmp: overflow in mpz type

sagemath 9.0 and reportedly later on ubuntu 20.

sagemath gives access to the python interpreter, so code execution is trivial.

We give DoS attacks, which terminates the sagemath process with abort(), when raising symbolic expression to large integer power.

We get abort() with stack:

gmp: overflow in mpz type

#6  0x00007f55c83ee72e in __GI_abort () at /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79
#7  0x00007f55c56e0d20 in __gmpz_realloc ()
#8  0x00007f55c56dd2b0 in __gmpz_n_pow_ui ()
#9  0x0000000000000000 in GiNaC::numeric::power(long) const ()
#10 0x0000000000000000 in GiNaC::numeric::pow_intexp(GiNaC::numeric const&) const ()

The non-minimal testcase

#sagemath code, copyright Georgi Guninski

def binnk3u(n,k):  return ( (n/k)**(k))                             
print("passed :(")

Posted by joro | Permanent link

Mon 02 May 2022 02:12:30 PM EEST

Луди мишки и луди нощни пеперуди

Луди мишки и луди нощни пеперуди

Има мишки, заразени от паразит, които не ги е страх от котки.

Васко Кръпката пее за нощни пеперуди

Нощни пеперуди около лампата кръжат.
Сигурно са луди и искат да изгорят.
Съвсем близо летят и даже хич не им пука.
Обичат да им е напечено, защото иначе е скука.
Нощни пеперуди, прозорец без перде.
Луната им се чуди колко шантави са те.
Избягали са от тъмницата със светлината на саме.
Не се побират във матрицата и не умират от шубе.

Posted by joro | Permanent link

Fri 14 Jan 2022 08:31:25 AM EET

Macro wars with MicroSoft

Macro wars with MicroSoft

Microsoft (AKA MS and M$) used to be rich empire, now appearing to have not very good times.

M$ lost the phone wars, the cloud wars, the browser wars and possibly other macro wars.

  1. For the phone wars: Bill Gates is an Adroid user
  2. For the cloud wars:

    Amazon’s AWS and Microsoft’s Azure are the big boys of the cloud computing world, even though AWS is much bigger than Azure. How much bigger? Well, AWS’s server capacity is about 6 times larger than the next 12 competitors combined.

  3. For the browser wars:

As of December 2021, Microsoft's Edge browser had a United States market share of 5.92 percent.

Posted by macrowar | Permanent link

Sat Sep 4 18:07:22 EEST 2021

Blessing and beer software licences

Blessing and beer software licences

I have done some manual static analysis and even read the licenses.


SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world.

The source code files for other SQL database engines typically begin with a comment describing your legal rights to view and copy that file. The SQLite source code contains no license since it is not governed by copyright. Instead of a license, the SQLite source code offers a blessing:

 May you do good and not evil
 May you find forgiveness for yourself and forgive others
 May you share freely, never taking more than you give.


 * ----------------------------------------------------------------------------
 * "THE BEER-WARE LICENSE" (Revision 42):
 * <phk@FreeBSD.ORG> wrote this file.  As long as you retain this notice you
 * can do whatever you want with this stuff. If we meet some day, and you think
 * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
 * ----------------------------------------------------------------------------


Posted by EULA | Permanent link

Mon Aug 23 12:49:11 EEST 2021

DLL hijacking: 21 years old and still alive

DLL hijacking: 21 years old and still alive

Trustworthy defense in depth: DLL hijacking

Wikipedia on DLL hijacking

Due to a vulnerability commonly known as DLL hijacking, DLL spoofing, DLL preloading or binary planting, many programs will load and execute a malicious DLL contained in the same folder as a data file opened by these programs.[11][12][13][14] The vulnerability was discovered by Georgi Guninski in 2000.[15] In August 2010 it gained worldwide publicity after ACROS Security rediscovered it again and many hundreds of programs were found vulnerable.[16] Programs that are run from unsafe locations, i.e. user-writable folders like the Downloads or the Temp directory, are almost always susceptible to this vulnerability.

Our original advisory is from Mon, 18 Sep 2000

The DLL hijacking is CVE-2000-0854

It was known since 2000-09-19 that third party programs are vulnerable too, e.g. Bugtraq: Exploit using Eudora and the Guninski hole

The nimbda worm was released on the same day and used the vulnerabilities in the advisory.

Searching the web returns many results since 2020 and a site Latest DLL Hijack news.

In other news from 2020 Almost 300 Wi ndows 10 executables vulnerable to DLL hijacking

Appears to us the vulnerability is so hard to fix it will live forever ⬛.

Posted by LD_PRELOAD | Permanent link

Tue Aug 17 14:35:14 EEST 2021

Opinion: Governments don't want IT security, they want to have cyber weapons

Opinion: Governments don't want IT security, they want to have cyber weapons

Support for the above claim:

It provides both the exploits and RCS to government intelligence and law enforcement agencies around the world, and has come under attack for selling to repressive regimes, who've used them to target political activists and dissidents. But more interesting than the fact that the company possessed zero days---this was already known---is the correspondence around how Hacking Team acquired these valuable tools, prized equally by criminal hackers and government intelligence agencies.

If governments wanted security, they would report the bugs to the vendors.

Like in traditional warfare, cyber warfare requires weapons. It is very hard to construct physical nuclear bomb, but to construct cyber nuclear bomb requires just skills and zero budget. Some drunk skilled kid may do a lot of damage in the real world.

Who watches the watchers?

Posted by joro | Permanent link

Sat Jul 24 18:28:55 EEST 2021

Potential symlink attack in python3 __pycache__

Potential symlink attack in python3 __pycache__

Not sure if this is vulnerability, but it looks like
classical symlink attack.

In python3, if a script in directory DIR1 does "import another",
then python3 creates directory __pycache__ in DIR1 and puts
some files in __pycache__.

According to our tests, if DIR1/__pycache__ is symlink to something,
then python3 follows the symlink.

We suspect the attacker has little to no control on the created files,
except that the files are created.

Here is an artificial session of root shooting herself in the leg
on ubuntu 20:

root@bialokote:~# python3 --version
Python 3.8.10
root@bialokote:~# cat /tmp/a.py
try:  import joro2
except:  print("error in import (2)")
root@bialokote:~# cat /tmp/joro2.py
print("in joro 2")
root@bialokote:~# rm ~/tests/*
root@bialokote:~# rm /tmp/__pycache__ #XXX
root@bialokote:~# ls -l ~/tests
total 0
root@bialokote:~# ln -s ~/tests/ /tmp/__pycache__ #XXX shooting in leg
root@bialokote:~# python3 /tmp/a.py
in joro 2
root@bialokote:~# ls -l ~/tests
total 4
-rw-r--r-- 1 root root 144 Jul 24 16:58 joro2.cpython-38.pyc

Posted by chix for free | Permanent link

Thu Jul 22 11:57:32 EEST 2021

ipython3 may execute code from the current working directory

Summary: under certain circumstances, ipython3 may execute
code from the current working directory. This might be a
problem if the current working directory is not trusted.

python3 is safe.

Tested on ubuntu 20.

The following session illustrates it:

joro@bialokote:~/tests/dir2$ pwd
joro@bialokote:~/tests/dir2$ ipython3 --version
joro@bialokote:~/tests/dir2$ ls ~/tests/dir1
a.py  joro-orig.py  __pycache__
joro@bialokote:~/tests/dir2$ ls ~/tests/dir2
joro.py  __pycache__
joro@bialokote:~/tests/dir2$ cat ~/tests/dir1/a.py
try:  import joro
except:  print("error in import")
joro@bialokote:~/tests/dir2$ cat ~/tests/dir2/joro.py
print("imported joro :)")
joro@bialokote:~/tests/dir2$ ipython3 ~/tests/dir1/a.py
imported joro :)

Posted by joro | Permanent link

Fri Jan 15 11:43:40 EET 2021

Bitcoin trivia

Bitcoin is a cryptocurrency:.

In our humble opinion it is more like crypto gold rather than currency, because it doesn't support fast transactions.

One of its main advantages is that the number of coins has known upper bound, preventing inflation.

In addition it is decentralized, making it "government resistant".

According to [1] it was invented in 2008 by an unknown person or group of people using the name Satoshi Nakamoto and started in 2009.

Its market capitalization is $713,435,159,726 (7.1 * 10^11) and just for comparison the GDP of Bulgaria is 67.93 billion (68 * 10^9) and Tesla's market capitalization is $800 billion (800 * 10^9).

We find it ironic that the anonymous Satoshi Nakamoto is 23rd richest person in the world on January 4, 2021 :)

Unless otherwise stated, all dates apply to sources of Fri 15 Jan 2021.

Posted by money for nothing | Permanent link

Fri Oct 9 14:02:03 EEST 2020

Closed vs open source in light of the windows leak of 2020-09-25

Closed vs open source in light of the windows leak of 2020-09-25

There is debate which is more secure: closed or open source.

Since the answer is very complicated and depends on many factors, we are over simplifying things.

On 2020-09-25 microsoft's windows source leaked [1].

Closed source advocates claim closed source is more secure, since the closed is secret.

Q1: To what extent the m$ leak disproves the above claim about secrecy?


Assume that in the near future the number of m$ vulnerabilities:

  1. Greatly increase or
  2. Stay at the same level or
  3. Greatly decrease XXX?

Could this be related to the leak and what conclusions follow?

1 2

Posted by sgub | Permanent link