Profile picture
Mudge @dotMudge
, 5 tweets, 2 min read Read on Twitter
Due to Floating Point emulation, Linux MIPS (Kernels 2.4.3.4 through 4.7 2001-2016) have executable stacks.

The patch, released in 2016 and still present - Kernel 4.8, introduces a universal DEP and ASLR bypass.

cyber-itl.org/2018/12/07/a-l…

cyber-itl.org/assets/papers/…
Think about this for a moment...

MIPS is the most common architecture for home routers (ubiquity, Netgear, Asus, linksys) and similar devices.

It is also found in telecom gear, next gen corporate firewalls, corporate switch fabric, etc. for control plane, data plane, or both.
What makes this particularly tough to remediate is that addressing the issue needs the Kernel fix and *also* updates to the compiler toolchains and *also* that vendors/developers adopt both of these and *also* turn on the needed settings if they aren’t default enabled...
Given that the issues go back to 2001 that’s a lot of vulnerable gear.

Linux MIPS looks like a pretty consistently soft target in this area past, present, and foreseeable future.
Mad props to @m0thran for a lot of really great work!
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Mudge
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @dotMudge see all

Profile picture
A few weeks back the non-profit group CITL, cyber-itl.org, released a comparative report of software hygiene in 28 home routers...

and vulnerabilities that affect all Linux MIPS systems (not just IoT).

Some thoughts and data...

(Thread 1/N)

cyber-itl.org/2018/12/07/a-l…
This thread intends to get past some security nihilism, use data to refute some assumptions put forward by people as “facts”, and point out the big picture... which the security community largely missed.

Something about not being able to see the forrest through the trees ;)

2/
Let’s look at the router paper first.

cyber-itl.org/assets/papers/…

It’s true that none of the routers did well in regards to basic software safety hygiene, but thinking there’s nothing consumers can do is security nihilism and misses the actionable information in the paper...
Read 16 tweets
Profile picture
On ‘names are hard’, X509 Distinguished Names (DN) can be a downright minefield.

Consider military (gov) where rank is part of the distinguished name field.

So what happens when someone gets a pay raise (get’s promoted)?

Each time that happens the DN changes which means...
The old certificate needs to be revoked.

Onto the certificate revocation list it goes...

New digital certificates are issued, access cards re-provisioned, CAs updated (and eventually synchronized).

Life goes on...

But what happens to the certificate revocation list (CRL)?
According to Wikipedia there were over 17 million Common Access Cards issued by 2008.

That’s a decade ago and there are ~1.4 million people in the US military this year alone (according to Google). Don’t forget that we’re talking about a lot more than just military people...
Read 5 tweets
Profile picture
Unfortunately this is not a new revelation or disclosure.

Going back to 2009 there was an engagement that used a battle command system.

The opposing force in the exercise found the contractor, downloaded the user and training materials from a web and FTP site, exposed...

1/
to the public Internet, and found by scanning the IP range of the sub-contractor who did the work.

Then, they just logged in as privileged users to all the battle systems. You would think that would have been game over (it was a very simple default password).

2/
However, the defenders claimed foul (?!?).

While the OpFor (opposing force) was frustrated, they said ‘fine’.

They proceeded to essentially fuzz the input and found numerous ways to crash the system. Some of these were probably exploitable, but for the exercise, ...

3/
Read 8 tweets

Related threads

Profile picture
#linux #bash #obfuscation #technique #bashfuscation
padding commands with history expansion characters (#exclamation mark (!))
! ! ! ! echo this is test
(removed the previous tweet as I revealed too much info !)
#linux #bash #obfuscation #bashfuscation

using history expansion character -> !! (i.e. last command)

ca
!!t really

is equivalent to
cat really

(only 4 interactive shell)
#linux #bash #obfuscation #bashfuscation

padding commands with empty commands (: ;)

: -> true (do nothing)
; -> command separator

: : ; : ; cat really
! ! ! : : ; : ; cat really
Read 8 tweets
Profile picture
Vai chegar ou já chegou na timeline de vocês uma discussão sobre os termos do novo Código de Conduta do #Linux. Aparentemente alguns desenvolvedores não gostaram do CdC e estão querendo cancelar suas contribuições ao kernel, supostamente ameaçando o Linux. Thread.
O Linux é gerenciado pela GPL2. A licença não menciona capacidade de cancelamento (revoke em inglês). Isso está mencionado como uma brecha que essas pessoas poderiam usar para cancelar o licenciamento do seu código. Na prática, isso é falso.
Essa thread do Stack Exchange dá as bases legais. Você pode ler pra se aprofundar.
opensource.stackexchange.com/a/4013/13174
Na prática somente se houvesse quebra dos termos da licença isso seria aplicável.
Read 13 tweets
Profile picture
#linux #bash #path #obfuscation
goal: obfuscate /etc/passwd
1) #directorytraversal: /mnt/././../etc/././passwd
2) escape characher: /etc/.\/\/\/\/\/passwd /etc/.\/.\/.\/.\/passwd /\e\t\c/passwd
3) null character /et$'c/pa\u0000/notexist/path'sswd
....
#path #obfuscation using #symbolic #link
ln -s / anything
head -n 2 anything////../etc/passwd

ln -s ../../ wow
head -n 2 ././wow/../etc/passwd

* ../ after a sym link applies to the sym link not the current path
filename expansion #globbing

cat /et*/pa**wd

command expansion
$(echo /e)tc$(echo /pa*)wd

+ other string obfuscation techniques
Read 5 tweets
Profile picture
#linux #bash #obfuscation using shell parameter expansion:

alphabet=abcdefghijklmnopqrstuvwxyz
${alphabet:2:1}at really
${alphabet: -24:-23}at really
${alphabet: -24:1}at really
${alphabet:2:-23}at really

gnu.org/software/bash/…
similar #bat #windows (ss64.com/nt/syntax-subs…)
The goal is to obfuscate the following command:
cat really
in which, really is a file.
Using arithmetic (add, sub, mul, div, mod, and pow) for calculating index or lenght
${alphabet: 2:(-20-3)}at really
Read 6 tweets
Profile picture
#linux #bash #obfuscation using octal vals
$'\143\141\164' really

gnu.org/software/bash/…
"Words of the form $'string' are treated specially. The word expands to string, with backslash-escaped characters replaced as specified by the ANSI C standard."

Variations
$'\143'$'\141'$'\164' really
$'\143'''$'\141'''''''''''''$'\164' really
$'\143'''$'\141'''""''''""''$'\164' really

Explanation:
'' -> empty string
""-> empty string
'a''b' -> 'ab' (concatenation)

(deleted the previous one, as the picture had a problem)
To give you a headache

t=
$'\143'''$'\141'$t''"$t"''`$t`''$'\164' really
Read 13 tweets
Profile picture
Do-It-Yourself Keyboards. Added helix keyboard.
xahlee.info/kbd/diy_keyboa…
the classic Microsoft Natural Keyboard Elite (year 1998 to 2014) is now $199 on amazon.
amzn.to/2qKUVPn
see
Microsoft Natural Keyboard
xahlee.info/kbd/Microsoft_…
which do you prefer
Read 32 tweets

Trending hashtags

#symbolic #Malachi #technology #Zionism #Corruption #righteousness #internet #disaster #ThursdayThoughts #Jude #SkyBridgeAZ #KoreanWar #famine #business #command #ping #national #linux #Latino #decimal #TeamLegal #prophet #IntelChips #minister #Asiatic

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!