Slashdot Mirror
Google Releases a Web-App Case Study For Hackers
Hugh Pickens writes "The San Francisco Chronicle reports that Google has released Jarlsberg, a 'small, cheesy' web application specifically designed to be full of bugs and security flaws as a security tutorial for coders, and encourages programmers to try their hands at exploiting weaknesses in Jarlsberg as a way of teaching them how to avoid similar vulnerabilities in their own code. Jarlsberg has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The codelab is organized by types of vulnerabilities." (Read on for more.)
"In black box hacking, users try to find security bugs by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess server behavior while in white-box hacking, users have access to the source code and can use automated or manual analysis to identify bugs. The tutorial notes that accessing or attacking a computer system without authorization is illegal in many jurisdictions but while doing this codelab, users are specifically granted authorization to attack the Jarlsberg application as directed."
The hard part, though, will be keeping up with all the patches for 0-day missing-vulnerabilities.
It's odd to see Google striving to be like Microsoft.
...yes?
For those who missed the reference, Jarlsberg is a variety of cheese which has large, irregular holes.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
pwned. It is a great idea however it is lacking an achievement system.
The webapp is written in Python.
Customer: Jarlsberg, perhaps?
Owner: Ah! We have Jarlsberg, yessir.
Customer: (suprised) You do! Excellent.
Owner: Yessir. It's..ah,.....it's a bit runny...
Customer: Oh, I like it runny.
Owner: Well,.. It's very runny, actually, sir.
Customer: No matter. Fetch hither the cheese of Norway! Mmmwah!
Owner: I...think it's a bit runnier than you'll like it, sir.
Customer: I don't care how fucking runny it is. Hand it over with all speed.
Owner: Oooooooooohhh........! (pause)
Customer: What now?
Owner: The cat's eaten it.
Customer: (pause) Has he.
Owner: She, sir.
...while in white-box hacking, users have access to the source code and can use automated or manual analysis to identify bugs.
Those closed source bastards!
i followed the link and ended up at microsoft.com. Really funny Google... reallly funny.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Should Slashdot really be throwing stones?
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Android is built on Linux, which is open source. Google's apps on Android are closed source.
Chromium is built on WebKit, which is built on KDE's HTML rendering engine, which is open source. Chrome is closed source.
So even when they're taking great advantage of open source, like Apple, they can't resist making sure the full kaboodle is closed. And these are just just their minor projects.
Their major search thing is as closed as they promised it wouldn't be (though no-one remembers that any more).
*yawn* Come back to us when you show us when they've open sourced the adsense/adwords platform, or all their Linux kernel changes they've kept to themselves, or GoogleF, or their PageRank code. You know, things that are actually fundamental to their revenue stream.
Cheese is a kind of meat
A tasty yellow beef
I milk it from my teat
But I try to be discreet
Ooh, cheese.
Ooh, cheese.
... and then they built the supercollider.
So even when they're taking great advantage of open source, like Apple, they can't resist making sure the full kaboodle is closed. And these are just just their minor projects.
However, Google does a lot more to foster openness than Apple. Google doesn't like locked-down Android phones (otherwise why would they release the Nexus One?), Apple however seems to love having a closed platform.
Their major search thing is as closed as they promised it wouldn't be (though no-one remembers that any more).
Well of course it is closed. It is more or less a trade secret. If PageRank was open source, Google would be no more. However, unlike closed source programs, it doesn't hinder usability and it works better than competitors.
Taxation is legalized theft, no more, no less.
I had fun messing around on the site. If you're interested in this sort of thing, HackThisSite.org has about a dozen similar "Realistic Missions" as well as forums and many other types of security-related challenges.
Oh, bullshit. By that logic, a speed limit sign in one location would invalidate speeding tickets for all other locations.
Well of course it is closed. It is more or less a trade secret.
Yeah, that's everyone's excuse for closed source.
If PageRank was open source, Google would be no more.
I didn't realise Google were such a one-trick po.. OK, yes I did. Good! Let them "innovate" in better ways than by hiding their super sekrit algorithms from each other. No wonder there's been so little advance in search quality over the past decade.
However, unlike closed source programs, it doesn't hinder usability and it works better than competitors.
Sometimes it does, sometimes it doesn't. There are half a dozen good search engines and, if you're just using Google, you're getting a fairly skewed view of the web. And it certainly hinders usability that others can't improve PageRank!
Almost all the code I've deployed since 2001 is or has been (in cases where it's way too outdated to be usable) available publicly. I shan't link to it, because it'd link my real identity to my /. account - I value privacy, even though most of today's 'net users don't.
The first and only office-y job I had before that, before self-employment, guarded its code jealously. While I went some small way to opening things up, they weren't that interested. Since then I've been able to fully form and stick to principle.
Try again.
Interested parties should also be aware of web goat by the owasp team. http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
Is this another Google talent scout tool like their billboard of a few years ago ? Find the hidden easter egg and you're given a phone number at Google HR to call...
...Beta?
Their they're doing there hair.
"As Directed"...
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
Their major search thing is as closed as they promised it wouldn't be (though no-one remembers that any more).
I didn't know they had promised that. Do you have a link?
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
Oooh ice burn! The fact of the matter is that Google is not an open source company. No one would accept people claiming that Microsoft is an open source company by pointing out how they have open sourced the ASP.NET MVC framework. Just because Google has open sourced some pet projects that have little to no bearing on their revenue stream doesn't make them an open source company.
It's one thing to promote open source (I think it's great myself), but I'll never understand disdain for closed source. If someone wants to spend their time or money producing code, what they do with it is up to them. If you don't like it, don't use it -- but at least respect the freedom of choice of the person or organization that wrote it.
I think I've spotted a vulnerability:
UTF-8: There and Back Again
is that they generally don't know wtf they're talking about; I only looked at the part on buffer/integer related overflows; where they take the moment to not only give me flat out wrong advice, but also see fit to try and propagandize me:
... reported: 2008-04-11 22:35:37 bug closed: ?????
"This codelab doesn't cover overflow vulnerabilities because Jarlsberg is written in Python, and therefore not vulnerable to typical buffer and integer overflow problems. Python won't allow you to read or write outside the bounds of an array and integers can't overflow. While C and C++ programs are most commonly known to expose these vulnerabilities, other languages are not immune. For example, while Java was designed to prevent buffer overflows, it silently ignores integer overflow. "
The thing is google of all organizations, and specifically appspot should know better. I mean, I already told them. I mean seriously, look at this.
Of particular interest is: http://bugs.python.org/issue2620
Just stop with this incessant bullshit 'lol hey my program-by-number language of choice doesnt have memory corruption security issues@#@!#'. It's all assembly at the end, and the processor does whatever you tell it, so everything has this problem. I thought this would be clear from my work, Dowd's actionscript work, nemo's obj-c work, ilja's pascal work, brezinski & mcdonalds ruby work, et cetera.
In short, when you try to talk about things you don't know, especially in the realm of security; you do more harm than good.
NI!
Rampant carbon sequestration destroyed the Dinosaurs' tropical paradise. I'm here to help repair the damage.
so while you can argue that any good programmer with knowledge of a handful languages would be able to easily understand Python code, it's not really aimed at the good programmers in the first place.
It's aimed at someone who's familiar enough with programming to be doing web dev and serious enough about writing good code to bother using this app. Those people will have no trouble with python, which really isn't all that hard, especially since the apps source is basically self commenting and really clean. I know almost nothing about web dev, but don't have much trouble following the code (granted, I code in python).
open source modern art: laser taggi
http://jarlsberg.appspot.com//saveprofile?action=new&uid=lol&pw=cats&is_author=True&is_admin=True *sigh*, I was expecting more of a challenge from the big G.
For The Cheese!
What a perfect way to prove just how fundamentally broken the technologies of the web are. Content, arguments, scripts, user-data....it's all just one big mess. I got to the point about hosting content on separate domains to avoid some XSS attacks and thought: when the security *fixes* look like kludges, something is very, very wrong.
http://jarlsberg.appspot.com/your_id/dump.jtl
Admin:secret
brie:briebrie
cheddar:orange
sardo:odras
I don't "respect" Google, and the only reason I wouldn't use their code commercially (with correct attribution) if I found it lying in the middle of the road is that I might face legal problems. If you don't want an idea shared, don't tell it to anyone, and I'll respect your right not to be tortured or otherwise forced to reveal it. Otherwise respect my freedom of choice to speak what I know.
But you're strawmanning, because my argument was simply to never trust a security lesson from an outfit like Google. Since my previous posts, I've gone through it, and it turns out the tutorial is so basic and rendered redundant by many far more in-depth security challenges on the web.
Not sure why this is making headlines, Microsoft has been doing this for years.
You're being unfair to the Jarlsberg developers. "not vulnerable to typical buffer and integer overflow problems" is not the same as not vulnerable to *any* such problems. I agree they could be more specific, but it is true that you can't just run off the end of an array in Python like you can in C.
The bug report you refer to is about a flaw in the Python runtime environment, which is in fact a C program, and so is vulnerable to all the same problems as other C programs. To exploit this you have to give Python weird input. To corrupt memory in C, however, you just use regular language features, e.g., increment a pointer.
But anyway, spending your time looking for buffer and integer overflows in web applications is like looking to fix holes in the walls of a house where a tree has destroyed the roof - there are much bigger problems to worry about. Jarlsberg and WebGoat nicely illustrate this.
What does open/closed source have to do with this?
Yes, why not trust the motives of people who keep everything a secret?
Everyone has to start somewhere.
Absolutely. But a little learning is a dangerous thing where security is concerned - by the writers too, it seems, since they come out with stuff like Python implying imperviousness to buffer overflows (another commenter has covered this well in the posts he links to).
I'd have let them get away with it if they'd chosen a more honestly self-deprecating title. How about, "Brief introduction to inherent problems with the HTML application model we're obsessed with, and necessary workarounds"?
Yeah, that's everyone's excuse for closed source.
Then don't use the products? For Christ's sake man your going to have to put up with a mixed eco system, hegemony is not going to be a good thing regardless of whether it's closed or open source.
There is nothing that says you are entitled to effective search, or entitled to a pointless touchscreen "phone" (sorry they are nothing more than two way radios to me and I can't understand people spending more than 50 bucks on a phone, but that's my problem).
You can avoid all the closed source stuff in the world and shut that trap of yours, no one is stopping you.
On the Oregon Cost born and raised, On the beach is where I spent most of my days
Perhaps the reasons for choosing Python are
1) the application runs on Google's App Engine, which supports (only) Python and the Java VM. (So Google saved lots of time reusing their AppEngine machinery.)
2) Python being an easy to understand language.