fred diggle: Hello to the pdp architect

pdp: what's up bro

fred diggle: have you found the xss lately

pdp: why the xss
if it is only one

fred diggle: <script>monkey()</script>
because it is the fun

pdp: your sarcasm is quite childish and kind of dull really, have you though about that ?  <-- how rude :(
[smile]

fred diggle: Fredrick Diggle tries not to think about himself
it is depressing

pdp: sure it is

fred diggle: job at zoo is unrewarding
may i join you as xss finder?

pdp: I don't think that we have a place for you if you are just an XSS finder

fred diggle: Fredrick Diggle is the best google code search reg exer evar though

pdp: [smile] really

fred diggle: well second best maybe

pdp: honestly, let's cut the crap, what's up with that on FD? you just need to annoy people or what? I don't get it

fred diggle: it makes fred diggle chuckle

pdp: u and your other budies/personas/nicks
[smile]

fred diggle: actually fred diggle is only one person/nick/etc

pdp: but you are in a group

fred diggle: fd is just chucklable for many people he thinks
for example isgobblesback makes fd chuckle but fd does not know who this is
who else do you believe is also fd?

pdp: ah?

fred diggle: #define fd "fredrick diggle"

pdp: don't know, everybody else that acts like retard on FD <-- Or doesn't like pdp research into mad xss 0day

fred diggle: nah

pdp: and who have posted just 3 times
and comments on every single email

fred diggle: did you enjoy postfix 0day?
it was quite chucklable
nah honestly the first time I posted it was quite serious
And it became apparent that everyone there is essentially retarded
so fredrick diggle was born

pdp: no I understand your motives to an extend  <-- oh does he?
but what I don't understand is why you bother

fred diggle: fred diggle has lots of free time at the zoo

pdp: hah [smile]
so what's up with all that anti XSS thing, I haven't published a single XSS on GNUCITIZEN... it is mostly about how to use XSS
as an attack vector

fred diggle: its just kind of a retarded attack vector generally

pdp: well to an extend yes, but the Web is growing and I truely believe that it will become more important in the future

fred diggle: you think javascript is going to become more privleged?
I would say if anything it will become more limited

pdp: have you checked the MacOS update hack
the idea is that when macos updates
it pulls some JavaScript
which run in very relaxed sandbox
therefore attackers can take a full control of your PC
JavaScript is glue language
the reason I talk about it
and I research about it
is because it exists everywhere

fred diggle: whats the vector to jump from the js interpreter to protected/real

pdp: web and not web related

fred diggle: even in that context?

pdp: the vector is that the sandbox provides you with access to write/read and execute files
this is serious enough

fred diggle: so where does this code come from?
you talking some form of mitm?

pdp: yes, in this case, yes, I am just giving a fresh example though, keep that in mind

fred diggle: yeah
so in this case I think that talk is warranted about the specific attack
if its cool fine
but to bang the javascript drum
...
whats the point

pdp: yeh and more over if you control the network the the extend where you can provide arbitrary code to the system then you can do other stuff as well
well JavaScript is everywhere
let me give you an example

fred diggle: x86 is more places

pdp: yes

fred diggle: in fact the js becomes it
so why does it matter
in some cases I will need to go to the asm level
in some I can even use js

pdp: ok JavaScript runs on mobile phones, on every desktop, as WSH or in the Browser <-- XSS is like robots and will eventually destroy us

fred diggle: why focus on the vector?

pdp: JavaScript runs on the server side and under any architecture
I don't focus on one vector
just this is how GNUCITIZEN was born
it was Web oriented at first

fred diggle: you focus on one interpreted language with very limited uses

pdp: well I focus on stuff that none has researched yet
why bother doing the same as the others

fred diggle: if a js hack is the best vector I think most intelligent people will use it

pdp: well I don't think that people know what they are doing  <-- hear that FD, pdp thinks you are a moron :(

fred diggle: but its almost never the best vector

pdp: I am not saying that JavaScript is the ultimate tool  <-- soon we will have machines that run on XSS instead of oil
but it may become
well it depends
what you are after
for example

fred diggle: for $ from dbags maybe

pdp: if you have a sandboxed browser how your buffer overflows will help you to do something
first of all let's define what attackers are after
most serious attacks are after the data
spending so much time on hackign the client just to get into your data is usless
instead someone can utilize XSS cuz that can definitely get to your ebay account for example
simepl

fred diggle: so you are honestly in this game to protect data?
to make the world safer?

pdp: I am not
I like breaking thing not protecting against attacks
but to me the data is the ultimate goal

fred diggle: ok we are on the same page at least in that
but it seems to me
you would focus on the more complex aspects of this stuff
if your goal is really self growth/learning/breaking shit

pdp: well we do many different stuff which I cannot talk about yet  <-- pdp has mad xss 0day etc
but that will come with the time

fred diggle: everything js can do is fairly obvious just from reading the spec
if you are really interested in breaking things then break the interpreter

pdp: well there are ways to break the interpreter and hop sandboxes
but why should I talk about that
what I find is that very often people talk about theory
theorethical crap
although the research might look technically chalanging why should I publish it unless I have something solid

fred diggle: why should you ever publish it?

pdp: [smile] so what worths beeing published?

fred diggle: whats worth me giving up what I have spent hours on to a list of idiots for nothing?
hrrm maybe a picture of a carrot

pdp: I like that you are taking all these stuff from the fun side of things...
and you are right
it is not worthed

fred diggle: I think that I know what drives you

pdp: what is it

fred diggle: and I would appreciate you being honest about it

pdp: cool

fred diggle: but its to make a name for yourself
no?

pdp: not really
I love my work man

fred diggle: as do I
but the world will never know who fredrick diggle is
as is true of the others that you call trolls

pdp: yes, but what do you get out of your joy
ok I must agree

fred diggle: that is the ends friend

pdp: that I try to make GNUCITIZEN more popular
but the reason I try to do that
is because I am tired of being someone else pone
as you probably you are
so to an extend, the research I am doign is also an escape
a life hack if you like
so yes it is for $
and yes we make a name out of it
but the goals are higher
I love the hacker culture first of all
I love it
and this is the reason why I do other projects like Hakiri which I hope will work

fred diggle: So how do you hope to get out?

pdp: by giving my best

fred diggle: I mean what is the "out" for a sec researcher

pdp: put it this way
I presume you are a sec researcher

fred diggle: nah I work at a zoo

pdp: if I can pay you to do your own research in your own defined time frame, would you like that?

fred diggle: here is my question though
do you really believe that there are people willing to pay for that type of person to do xss?
to do anything remotely related to it
the only money in xss is in "app scanning" crap and consulting
which means you are either a pawn to big business and ultimately the economy
or you are the business trying to survive in the economy and sec is not you focus
there are certainly research jobs out there
but without demonstrating an understanding of the fundamentals of comp arch... they are all out of reach

pdp: I don know why everyone brags about comp arch, it is almost like if you understand the stack you are 1337
why is that?

fred diggle: ultimately what the people hiring for those jobs are looking for is an understanding of the lowest level

pdp: not true

fred diggle: because the higher levels are easy once you have tat

pdp: what peopel are looking for is someone who understand the bigger picture
and then they can hire
anyeone to do the low stuff

fred diggle: so you want to be a manager?
researchers never understand the big picture

pdp: nope, I like to be on my own with GNUCITIZEN, with Hakiri and everything that I believe in

fred diggle: actually i should say don;t need to

pdp: they do
it depends what you research

fred diggle: if thats the sort of research you enjoy then be an economist
and look at trends it the sec idustry
its the same crap

pdp: no socialscientist is better

fred diggle: fien then do that

pdp: but why should I do that when I know something esle
already
and I like doing it
maybe in 50 years we all go into politics

fred diggle: in 50 years fred diggle will be dead
unfortunately

pdp: well, you never know
you might decide to freeze yourself

fred diggle: unless someone cures pancreatic cancer in the next 3 months then I am fairly sure
but that aside

pdp: I am sorry to hear that

fred diggle: to address what you said earlier
about stacks etc
when did you get the impression that we worship that sort of drivle

pdp: I get the idea is that people in the sec research circles value everything that is related to how low system architecture work and abolish everything that is at level 7 or ring 3 pick

fred diggle: nah that is a misunderstanding

pdp: it is true

fred diggle: I value things that are new and inovative
exloiting a buffer overflow of a stack variable is generally niether

pdp: XSS is kind of new and can get very innovative, to an extend that you never know what has happended but you don't value it because you don't like that it is not asm
thing about it for a second
the browser and every other
JavaScript/ whatever sandbox
restricts your from doing things
so when you make it do what you want
don't you think this is innovative?

fred diggle: cite me some time when you made the javascript interpreter do something it wasn;t supposed to
?
I mean there are a couple possibilities that I see

pdp: you cannot look it from the intrepeter point of view because under neat the intrepereter is the OS or the APP to be more precise
so in that case you realy on the same old exploiting software techniques
you can make the intrepreter crash or whatever and with that gain control over the process
this is fine

fred diggle: nah
far more interesting would be a logic bug in the interpreter
which lets you do ...
etc

pdp: here is a logic bug for you

fred diggle: if its a blind strcpy in a js interpreter it won't hold my interest

pdp: well the intrepeter is not like Pyton and Ruby
it is really bare
it doesn't even have functionalities
it is just the developer that decides what the intrepreter should have
for example, let's say that you want to get out of sandbox
maybe the typical stuff you have in firefox
the sadnbox has only 3 functions usually in XPCOM
dump, debug and importFunction
nonne of them are useful in whatever way
and you are really locked
one way to get of the sandbox
is to return a value
which has a bit of sugger
the sugger looks like this
{valueOf: function () {whatever}}
if there is an object outside the sandbox
which compares the return value to 1
or something else
you might be able to overwrite strings outside of the sandbox
which may influence the execution path
in firefox for exmaple
you don't have only one sandbox
you have layers of sandboxes
so it does get quite interesting when it comes to stuff like this

fred diggle: so what I see is one piece of mildly interesting information that could some day maybe be usful in some very specific part of a very specific exploit

pdp: yes but this is what JS is... it is domain specifc platform
the things that work in Firefox may not work in PDF
and will be completely differnt from wSH
so it is not that you learn just how x86 works
every single platform is different
JavaSript is just a glue language, really
but I am also tired talking about it

fred diggle: so stop
thats a good solution

pdp: [smile] well there are tones of people that find all these stuff very valuable
so I keep doing it because there are more developments

fred diggle: anyway fredrick diggle needs to go clean up after the hippopotamus
it has been enlightening

pdp: me 2