Slashdot Mirror
Google Releases a Web-App Case Study For Hackers
Hugh Pickens writes "The San Francisco Chronicle reports that Google has released Jarlsberg, a 'small, cheesy' web application specifically designed to be full of bugs and security flaws as a security tutorial for coders, and encourages programmers to try their hands at exploiting weaknesses in Jarlsberg as a way of teaching them how to avoid similar vulnerabilities in their own code. Jarlsberg has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The codelab is organized by types of vulnerabilities." (Read on for more.)
"In black box hacking, users try to find security bugs by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess server behavior while in white-box hacking, users have access to the source code and can use automated or manual analysis to identify bugs. The tutorial notes that accessing or attacking a computer system without authorization is illegal in many jurisdictions but while doing this codelab, users are specifically granted authorization to attack the Jarlsberg application as directed."
The hard part, though, will be keeping up with all the patches for 0-day missing-vulnerabilities.
It sounds like a fantastic idea. My favorite course in college was a security course, and the message there was to 'think like an adversary.' At the very least, could be motivation to get more people interested in computer science.
It's odd to see Google striving to be like Microsoft.
Obligatory - um, do I really have to say it?
now a botnet?
Yours In Perm,
K. Trout
...yes?
For those who missed the reference, Jarlsberg is a variety of cheese which has large, irregular holes.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Microsoft has been doing that for decades with such products as Windows and Office.
until Jarlsberg is blocked by all of the major security providers?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
The webapp is written in Python.
would be better. I have no trust in being taught security principles by a closed source company whose greatest asset is information about me.
All the good security texts are by people who are open with their ideas, open with their methods and open with their code.
Any cracker who comes along and attacks Google will now be able to say that they were doing it as part of this project. Yes, I realize there are many disclaimers, but it will be at least an appearance of an excuse were none previously existed.
Customer: Jarlsberg, perhaps?
Owner: Ah! We have Jarlsberg, yessir.
Customer: (suprised) You do! Excellent.
Owner: Yessir. It's..ah,.....it's a bit runny...
Customer: Oh, I like it runny.
Owner: Well,.. It's very runny, actually, sir.
Customer: No matter. Fetch hither the cheese of Norway! Mmmwah!
Owner: I...think it's a bit runnier than you'll like it, sir.
Customer: I don't care how fucking runny it is. Hand it over with all speed.
Owner: Oooooooooohhh........! (pause)
Customer: What now?
Owner: The cat's eaten it.
Customer: (pause) Has he.
Owner: She, sir.
i followed the link and ended up at microsoft.com. Really funny Google... reallly funny.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
man I hate you guys..
Calling out bogus battery capacity claims.
Should Slashdot really be throwing stones?
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Cheese is a kind of meat
A tasty yellow beef
I milk it from my teat
But I try to be discreet
Ooh, cheese.
Ooh, cheese.
... and then they built the supercollider.
I had fun messing around on the site. If you're interested in this sort of thing, HackThisSite.org has about a dozen similar "Realistic Missions" as well as forums and many other types of security-related challenges.
Google have got to that hubris stage of hiring random pretty women with low qualifications, and their security product is shitty articles rather than, you know, essential stuff like intrusion detection. Whence the IE leak - imagine what else has been achieved by governments and organised criminals!
This is why I left accountancy... the big firms were rife with this behaviour, and while it was fun for a while, working became impossible once you saw that competence was being replaced with eye candy.
Interested parties should also be aware of web goat by the owasp team. http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
Is this another Google talent scout tool like their billboard of a few years ago ? Find the hidden easter egg and you're given a phone number at Google HR to call...
...Beta?
Their they're doing there hair.
"As Directed"...
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
There's a few different games to be played. Different games are located on different SSH ports (2222-2227).
While I don't have any involvement in this, I know my friend helps host one of them, and to get started visit http://logic.smashthestack.org:88
It's fun and will make you think... it can actually get quite aggravating when you can't beat a "level" because you're over thinking it lol. The games involve PHP exploits, buffer overflow, etc. Give it a try!
I think I've spotted a vulnerability:
UTF-8: There and Back Again
at least with accounting firms, the cute trim is an unstated part of what the client is paying for
in silicon valley the tendency is for the entire place to fill up with airhead producers and marketing assistants, and they don't even date the super genius programmers supposedly at the core of the operation
is that they generally don't know wtf they're talking about; I only looked at the part on buffer/integer related overflows; where they take the moment to not only give me flat out wrong advice, but also see fit to try and propagandize me:
... reported: 2008-04-11 22:35:37 bug closed: ?????
"This codelab doesn't cover overflow vulnerabilities because Jarlsberg is written in Python, and therefore not vulnerable to typical buffer and integer overflow problems. Python won't allow you to read or write outside the bounds of an array and integers can't overflow. While C and C++ programs are most commonly known to expose these vulnerabilities, other languages are not immune. For example, while Java was designed to prevent buffer overflows, it silently ignores integer overflow. "
The thing is google of all organizations, and specifically appspot should know better. I mean, I already told them. I mean seriously, look at this.
Of particular interest is: http://bugs.python.org/issue2620
Just stop with this incessant bullshit 'lol hey my program-by-number language of choice doesnt have memory corruption security issues@#@!#'. It's all assembly at the end, and the processor does whatever you tell it, so everything has this problem. I thought this would be clear from my work, Dowd's actionscript work, nemo's obj-c work, ilja's pascal work, brezinski & mcdonalds ruby work, et cetera.
In short, when you try to talk about things you don't know, especially in the realm of security; you do more harm than good.
NI!
Rampant carbon sequestration destroyed the Dinosaurs' tropical paradise. I'm here to help repair the damage.
so while you can argue that any good programmer with knowledge of a handful languages would be able to easily understand Python code, it's not really aimed at the good programmers in the first place.
It's aimed at someone who's familiar enough with programming to be doing web dev and serious enough about writing good code to bother using this app. Those people will have no trouble with python, which really isn't all that hard, especially since the apps source is basically self commenting and really clean. I know almost nothing about web dev, but don't have much trouble following the code (granted, I code in python).
open source modern art: laser taggi
http://jarlsberg.appspot.com//saveprofile?action=new&uid=lol&pw=cats&is_author=True&is_admin=True *sigh*, I was expecting more of a challenge from the big G.
We’re all waiting for your next article of course. Holiday Apartments Bol
For The Cheese!
What a perfect way to prove just how fundamentally broken the technologies of the web are. Content, arguments, scripts, user-data....it's all just one big mess. I got to the point about hosting content on separate domains to avoid some XSS attacks and thought: when the security *fixes* look like kludges, something is very, very wrong.
http://jarlsberg.appspot.com/your_id/dump.jtl
Admin:secret
brie:briebrie
cheddar:orange
sardo:odras
Not sure why this is making headlines, Microsoft has been doing this for years.
Pet peeve much?
1. How many people in the world do you think know about this issue? There's info on a Python bug list and slides for a single security conference. Guess what? Very, very few developers, security or not, follow every Python bug or every conference paper. So instead of complaining about how negligent the author is, why don't you just tell HIM about the bug? Get used to the fact that NOBODY in the real world pays active attention to academic advances in any field. If one of these advances is yours, it's up to you to spread the word. Blame the world if you like, but you're the only one who can/will change it.
2. There is no way in hell this codelab does more harm than good. So the author did not mention one attack vector? Of course he didn't. Nobody in the world is aware of every single vulnerability that is conceivably out there. And so you think this means nobody should ever tell others what they know about security? Great idea!
3. There's a big difference between a function breaks in Python because of what will almost certainly be a transient bug in the language implementation, and a function breaks in C++ because it breaks by design. Get off your high horse.
You're being unfair to the Jarlsberg developers. "not vulnerable to typical buffer and integer overflow problems" is not the same as not vulnerable to *any* such problems. I agree they could be more specific, but it is true that you can't just run off the end of an array in Python like you can in C.
The bug report you refer to is about a flaw in the Python runtime environment, which is in fact a C program, and so is vulnerable to all the same problems as other C programs. To exploit this you have to give Python weird input. To corrupt memory in C, however, you just use regular language features, e.g., increment a pointer.
But anyway, spending your time looking for buffer and integer overflows in web applications is like looking to fix holes in the walls of a house where a tree has destroyed the roof - there are much bigger problems to worry about. Jarlsberg and WebGoat nicely illustrate this.
Perhaps the reasons for choosing Python are
1) the application runs on Google's App Engine, which supports (only) Python and the Java VM. (So Google saved lots of time reusing their AppEngine machinery.)
2) Python being an easy to understand language.