Georgi Guninski's blog

Mitigating malicious packages in gnu/linux

As end user and contributor of gnu/linux, I am concerned about malicious packages (either hostile developers or hacked developers or another reason) and have two questions:

• What do linux vendors to avoid malicious packages?

• As end user what can I do to mitigate malicious packages?

Some thoughts and rants:

1. This already happened in 2003 with the micq package in debian: unnoticed easter egg causing DOS, see [1].

2. This already happened to Redhat in 2008? see [5], Red Hat OpenSSH Backdoor Vulnerability

3. In 2015 Microsoft issued weird update, see [6],[7].

4. Portable malware in portable languages (Java, Javascript), taking the worst from windoze.

5. Google play. Google play has about 2.8M packages [2] for android. Debian has about 31K packages [3] XXXold_stat. To our surprise google play is only about 90 times bigger than debian per number of packages and the metrics is unclear for size of binary packages or lines of code. Google scans for malware, not sure how effective is this.Google's permissions of applications are mitigating factor.

6. The art of backdooring: sufficiently sophisticated backdoor is indistinguishable from secure code, see Obfuscation contest [4].

7. Getting root vs reading $HOME vs euid == DAEMON. Getting root is important, but there is more interesting in user's $HOME.

1 2 3 4 5 6 7

Minor security issue in punbb with SQLite

Georgi Guninski security advisory #76, 2019

Running punbb-master from https://github.com/punbb/punbb
from Thu 07 Nov 2019 11:23:33 AM UTC

Installing on http://host/forum
In install.php set:
 
database type: SQLite3
database name: database1

Accessing http://host/forum/database1 returns the full raw database,
including hashes and email addresses.

If attacker guesses the name "database1" or brute force from common
database names, this gives her read access of the raw database.

If you consider this a bug, as workaround set database to something
hard to guess.

Other forum software explicitly want the SQLite database to
be non-accessible from the web.

-- 
CV:    https://j.ludost.net/resumegg.pdf
site:  http://www.guninski.com
blog:  https://j.ludost.net/blog

Controversy and exploitability of gcc issue 30475 |assert(int+100 > int)|

There is heated discussion on gcc's bugzilla starting from 2007:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=30475
and clang is also affected, depending on optimization flags.

poc is the program at end.

gcc with all optimization flags optimizes away |assert(a+100 > a)|
even if there is no integer overflow, only signed overflow.

clang fires the assertion with -O0, but also optimizes it away
with -O3

The formal verifier CBMC fires the assertion, which might of
interest about formally verified programs.

Signed integer arithmetic is commonly used even without integer
overflows. If |(int) -1 < (unsigned int) 2| holds, this would
be disaster.

Could this compiler issue be security problem?

Any workarounds?

===poc===
#include 

int foo(int a) {
  assert(a+100 > a);
  printf("%d %d\n",a+100,a);
  return a;
}

int main() {
  foo(100);
  foo(0x7fffffff);
}
=========


CV:    https://j.ludost.net/resumegg.pdf
site:  http://www.guninski.com
blog:  https://j.ludost.net/blog