Suspekt…

PHP Bytecode in Binnavi 2.0

I just finished porting php2sql 0.1 to the new Binnavi 2.0 database format. php2sql is my still private way to import PHP bytecode into Binnavi for manual analysation and navigation.

Here are some screenshots how the PHP bytecode of FluxBB 1.2.20 looks like in Binnavi.

First screen shows the project overview window. So far 281 PHP functions were identified. This includes those defined within fluxBB, those called in fluxBB and one virtual main function for every PHP file.

The second screenshot shows a part of the native callgraph within FluxBB.

The last screenshot shows a part of the code flow graph (CFG) of the handle_url_tag function defined in FluxBB.

Now that php2sql finally works with Binnavi 2.0 it is time to convert my PHP decompiler and code scanner to Binnavi 2.0 plugins. I will keep you updated.

Posted in PHP, Security | 5 Comments »

PHP USB Device to solve namespace problems

Now that the PHP namespace seperator is fixed as backslash developers around the world face two problems. On the one hand their source code will end up looking more ugly than .NET source code and on the other hand most non-american keyboards, especially those attached to apple computers will require strange key combinations to enter the backslash.

However rescue is near in the form of a USB device that allows you to enter the backslash character in a smooth and easy way. First pictures of this device that will be available at shop.php.net around christmas have leaked to the internet.

This should finally shut up all the namespace seperator critics and allow the PHP developers to finally release the long awaited PHP 5.3

Posted in PHP | 25 Comments »

PHP got forked

During International PHP Conference 2008 there where a lot of discussions about the stupid backslash namespace seperator decision. Most of the guys “do not want to have their PHP files look like windows registry dumps” (Quoting some unknown guy at the panel discussion). Some people even suggested forking PHP at PHP 5.3 to replace the backslash with the more accepted tripple colon (:::).

Being a man of actions the first thing I did today was to fork PHP.

Proof is here.

Posted in PHP | 36 Comments »

CGNSec - Second Meeting in Cologne

I just wanted to announce that next wednesday (5th of November) at 19:30 there will be the second CGNSec meetup in Cologne/Germany.

The meeting takes place at Hallmackenreuther, Brüsseler Platz 9, 50674 Köln (Google Maps)

Everyone working in the field of information security is invited to attend. To find us, just ask for the tables reserved for CGNSec.

Posted in CGNSec, Security | No Comments »

FreeBSD? Witches? - No Thank You

There is a common misunderstanding about me in the circles of BSD users that I have encountered once again at yesterdays first CGNSec meeting.

There is a FreeBSD kernel developer Stefan Eßer (Esser) that is also from cologne and also works in the field of IT-Security. We are not the same person and I am not related to him in any way, however he is of course invited to join us at CGNSec next month.

Ahh yes… I am also not related to that other Stefan Esser that writes books about Witches.

Posted in CGNSec, Security | No Comments »

CGNSec - First Meeting in Cologne

Next wednesday at 19:30 there will be the first CGNSec meetup in Cologne/Germany. CGNSec is inspired by the CitySec meetups that are popular in the United States and some other european and asian countries.

Everyone working in the field of information security is invited to come.

Because it is the first meeting we still have to elaborate how scalable the location will be. I therefore recommend dropping a mail to me until tuesday night if you want to attend so that we can reserve enough seats.

Posted in CGNSec, Security | No Comments »

Suhosin: canary mismatch on efree() - heap overflow detected

Users of Suhosin-Patch will sooner or later see messages like “canary mismatch on efree() - heap overflow detected” in their error log. When this happens they are often confused and don’t understand what it means.

The first questions they often ask themself are:

• Did they trigger a bug in Suhosin?

• Is something wrong with Suhosin?

In reality this means that when PHP internally tried to free some allocated memory the memory manager security features of Suhosin detected that the memory to be freed is somehow corrupted. This corruption occured somewhen between the allocation of the memory area and the attempt to free it. Suhosin detects this by writing canary values infront and after allocated memory areas. These canary values are random numbers that are stored in one of Suhosin’s internal variables. The check consists of comparing the internally stored random number with the values found infront and after the memory area. Those values are outside of anything PHP is supposed to write to and therefore a failed canary comparision can only mean two things.

1. some memory corruption destroyed/overwrote the internally stored random values
2. some memory corruption destroyed/overwrote the canaries next to the allocated memory

This means everytime Suhosin gives out an error there was a memory corruption. There are no false positives as some of the PHP developers claim again and again. This means that everytime you see this error there has been a memory corruption in PHP or one of the loaded extensions. This means there is a bug and some code in one of the loaded components that behaves wrongly.

Unfortunately the PHP developers refuse to support PHP users that decided to go with the more secure version of PHP, because the patch could influence how PHP works and be the cause of the bug. They require their users to reproduce the problem with a vanilla PHP with valgrind running.

The obvious problems with this are

1. Running PHP in valgrind has a much greater influence on how PHP works than Suhosin-Patch has
2. Using valgrind wrongly means the memory corruption bugs cannot be found
3. Using valgrind correctly does not necessary reveal the bug, because it might be hidden by memory alignment or just because valgrind cannot detect that class of memory corruptions
4. A memory corruption that Suhosin might detect everytime might only crash a vanilla (valgrind) PHP once every thousand invocations or might not result in a crash at all but in wrong computation results
5. Some memory corruptions occur in memory areas that are unused due to alignment, they will not result in misbehaviour of vanilla PHP - However any memory corruption is a bug in PHP (or extensions) that should be fixed and a little harmless memory corruption today could turn into a remote exploit in the future when the code is changed (or when PHP is executed on another (new) architecture).
6. A normal user will not be able to recompile PHP and reproduce with valgrind correctly
7. A not reproduced memory corruption still exists but will not be fixed

That said the only option for users of the more secure PHP is at the moment to try to get support for their problem at their distribution’s PHP maintainers because the people at PHP.net will not be interested in helping them. However due to the reasons above the distribution maintainers might not be able to help you, because they cannot reproduce the bug (although Suhosin proved its existance).

If you know what you are doing then just use valgrind on the Suhosin patched PHP and simply claim that you reproduced the bug without Suhosin installed. This will also give you a higher probability of reproducing the problem.

Because of this I will think up some debugging functionality for Suhosin that will make it easier for users to tell the PHP developers where their bug is located. More information about how this will be implemented will be released during the next month.

Posted in PHP, Security | 6 Comments »

PHP 5.3 and Delayed Cross Site Request Forgeries/Hijacking

Although PHP 5.3 is still in alpha stage and certain features like the PHAR extension or the whole namespace support are still topics of endless discussions it already contains smaller changes that could improve the security of PHP applications a lot.

One of these small changes is the introduction of a new php ini directive called request_order. request_order is the response of the PHP developers to me preaching for years that using $_REQUEST is not only deprecated but actually dangerous for PHP applications. With request_order it is now possible to control in what order $_REQUEST is created and what variable sources are taken into account. This finally allows removing cookie data from $_REQUEST without removing them from $_COOKIE also.

Because removing cookies from $_REQUEST might break badly written software request_order is not set by default. However the recommended setting by the PHP developer is to set it to “GP” which means only $_GET and _POST data is merged into $_REQUEST with $_POST data overwriting $_GET data.

To learn why using $_REQUEST is a bad idea and what Delayed Cross Site Request Forgeries/Hijacking are continue reading…
Read the rest of this entry »

Posted in PHP, Security | 13 Comments »

Starbucks, WIFI, Internet and South Korea

When I came to Seoul, South Korea I had already heard about the high distribution of broadband internet access. Therefore I was not suprised at all that my hotel room had ethernet sockets that provided me with fast internet access. What suprised me however was the fact that it was for free. In Germany or the USA you usually pay atleast 10$ per day for a similiar connection.

On the other hand when I visited Starbucks I had to learn the hard way that without Microsoft Windows you are an outsider in South Korea. It is simply not possible to connect to the NETSPOT hotspots within Starbucks Korea without Microsoft Windows and without Internet Explorer. On the one hand their special connectivity software only exists for Windows and on the other hand the web login seems to require an activex module for credit card payment.

With this kind of limit in place I can now understand why devices like the IPOD Touch are far cheaper in South Korea than in Germany. You simply cannot use them

I think the guys behind NETSPOT should really consider redesigning their system to be compatible to non Microsoft systems, like osx or linux. After all it is not that hard to do credit card billing.

PS.1: Yes I know that the NETSPOT hotspots seem to let everything through on port 53 UDP which might allow VPN tunnels on port 53 but I am only speaking about legal access here.

PS.2: Beside that little annoyance I really love South Korea and plan to come back as often as possible

Posted in korea | 3 Comments »

Slides from my Lesser Known Security Problems in PHP Applications Talk at ZendCon

Here are the slides of my ZendCon talk about Lesser Known Security Problems in PHP Applications.

(PDF) Lesser Known Security Problems in PHP Applications

Posted in PHP, Security | 18 Comments »