Denim Group, Ltd.

Building the PFF PHP Fuzzer on Mac OS X

By Dan Cornell

Recently I have been looking at some PHP security testing issues and I needed a fuzzer.  I found a PHP fuzzer called PFF available via the Digital Dwarf Society.  The original author's webpage doesn't seem to be up anymore, but the Digital Dwarf folks had a cached version of the actual code available.

The build instructions that come with the tool are:

cc pff.c -o pff -lssl

The problem with that was that on my OS X laptop (version 10.5.6) I got the following build messages and errors:

Undefined symbols:
  "_BIO_f_base64", referenced from:
      _encode_base64 in cc2Np5yM.o
  "_BIO_ctrl", referenced from:
      _encode_base64 in cc2Np5yM.o
      _encode_base64 in cc2Np5yM.o
  "_BIO_new", referenced from:
      _encode_base64 in cc2Np5yM.o
      _encode_base64 in cc2Np5yM.o
  "_BIO_s_mem", referenced from:
      _encode_base64 in cc2Np5yM.o
  "_BIO_write", referenced from:
      _encode_base64 in cc2Np5yM.o
  "_BIO_push", referenced from:
      _encode_base64 in cc2Np5yM.o
  "_BIO_free_all", referenced from:
      _encode_base64 in cc2Np5yM.o
ld: symbol(s) not found
collect2: ld returned 1 exit status

Part of these issues seemed to stem from OpenSSL include/library issues, so I Googled around a bit and updated my build command to:

cc pff.c -o pff -lssl -lcrypto

That helped ... a bit.  At that point my error messages had dwindled to:

pff.c: In function ‘genfilename’:
pff.c:346: warning: assignment makes pointer from integer without a cast
Undefined symbols:
  "_strndup", referenced from:
      _genfilename in ccQlatXg.o
ld: symbol(s) not found
collect2: ld returned 1 exit status

Progress!  After a bit of searching, I found out that, apparently, Mac OS X doesn't support the "strndup" function as it is a GNU-specific extension to the standard library (reference is here).  Who would have thought?

So, in the spirit of getting this to work, I updated the source code to replace the "strndup" function call with a call to "strdup."  Then I re-ran:

cc pff.c -o pff -lssl -lcrypto

Now the build runs properly.  Success!  Also, the pff binary runs as it should so I can start fuzzing away on PHP functions.

The diff for the pff.c file is:

346c346
<      if((name = strdup(filename)) == NULL) {
---
>     if((name = strndup(filename,strlen(filename))) == NULL) {

I am about to mail this along to the Digital Dwarf (info@digitaldwarf.de) and SETEC/calcite (calcite@setec.org) folks but I also wanted to post the info publicly as well.  Happy PHP fuzzing!

More info on strdup, strndup and associated functions can be found here.

--Dan
dan _at_ denimgroup.com

PS - Photo is of my dog, Cody.  He's a good boy.  (c) Dan Cornell 2008.

Denim Group and Aaron Copeland Featured in San Antonio Startup Blog

By Dan Cornell

Denim Group's Director of Operations, Aaron Copeland, was interviewed by Alan Weinkrantz of San Antonio Startups.

--Dan
dan _at_ denimgroup.com

Quoted In Express News Coverage of Security and Obama's Blackberry

By Dan Cornell

Roy Bragg from the Express News quoted me in an article on email security and President Obama's BlackBerry.

--Dan
dan _at_ denimgroup.com

(photo is from my trip to Tangier, Morocco after the OWASP EU Summit 2008)

OWASP San Antonio: Vulnerability Management in an Application Security World

By Dan Cornell

This Thursday (1/29/2009) I am going to be speaking at the first OWASP San Antonio meeting of the year.

San Antonio OWASP Chapter: January 29, 2009
Topic: Vulnerability Management in an Application Security World
Presenter: Dan Cornell, Principal, Denim Group
Date: January 29, 2009 11:30am – 1:00pm
Location: San Antonio Technology Center (Web Room) 3463 Magic Drive San Antonio, TX 78229

Abstract:

Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities.

This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.

Presenter Bio:

Dan Cornell has over ten years of experience architecting, developing and securing web-based software systems. As a Principal of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group application security research team, investigating the application of secure coding and development techniques to the improvement of web based software development methodologies. He is also the primary author of sprajax, Denim Group’s open source tool for assessing the security of AJAX-enabled web applications.

Sodas and snacks will be provided. Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com or call (210) 572-4400.

Hope to see folks there!

--Dan
dan _at_ denimgroup.com

The Road to Houston TechFest

By Dan Cornell

I was up in Houston last weekend for the rescheduled Houston TechFest.  The hurricane delayed this from the original date, but the event was still packed.

I flew into Houston for the day to give my talk on Static Analysis Techniques for Testing Application Security.  Unfortunately, when I was headed to my early-morning flight, I noticed that the airport had been overrun by birds:

Yikes!  I didn't know who my pilot was, but I wasn't convinced he would be able to successfully land a 737 in the San Antonio River.  After all, the Hudson is a little wider than the Riverwalk...

Fortunately I made it to Houston all right and checked in with the TechFest folks.  The event was at the University of Houston so I went to the bottom of the student center where the event was being held to try and get some work done before my talk.  I soon found myself trapped between a bunch of martial arts students:

And some folks playing "Magic - The Gathering" :

No offense to the "Magic - The Gathering" crowd, but I had to cast my lot with the martial arts folks.  Cards representing elven chain mail and whatnot are no match for a crowd of folks ready to break actual bricks with their hands.

Fortunately everyone got to remain friends and I made it to my talk unscathed.

There was a great group there and we had some great questions such as:

• Does the fact that most .NET static analysis tools rely on decompiling MISL make .NET, as a language, less secure than Java? (Both Java bytecodes and .NET MSIL are pretty easy to decompile, so there aren't a ton of differences there.  .NET static analysis tools usually use MSIL binaries because .NET code exists in a variety of languages and it is easier to write one parser/decompiler for MSIL that will work for all .NET languages wheras Java bytecode is almost always compiled from Java source code, thus making Java source or Java bytecode reasonably equally attractive choices for tool builders.)
• Are there any subsets of PMD rules that are best for running security checks? (There are security-specific PMD checks, but they are mainly related to API misuse.  I don't know of any collection that includes the explicit security rules along with rules from other categories that often have security implications.)

One thing I talked about Saturday that was relatively new was the OWASP Open Review Project (ORPRO) which provides advanced static analysis capabilities for open source projects.

Overall it was a great session and I will be posting the slide deck shortly.

--Dan
dan _at_ denimgroup.com

Videos from SegSaddle Visit

By Dan Cornell

Yesterday I posted about SegSaddle's presentation to the Denim Group Lunch and Learn program.  I put together a YouTube playlist with videos from the SegSaddle visit to Denim Group.

Here they are:

--Dan
dan _at_ denimgroup.com

SegSaddle Visits Denim Group

By Dan Cornell

One of the great things we do at Denim Group is our Lunch and Learn program where we have lunchtime presentations from Denim Group folks as well as others.  We were fortunate enough to have Brian Hughes and Lissa Martinez from SegSaddle drop by the office last Friday to give a talk and - more importantly - let us try out their products.  SegSaddle makes after-market modifications for the Segway Personal Transporter to make it more useful for a wider range of people.

Brian talked us through the design of their SegSaddle and SegSurrey products that allow Segway riders to sit while riding.  Then we all got to take turns riding.

_{The SegSurrey was so easy to ride even I could figure it out.}

_{Greg trests his skills on the in-office slalom course.}

_{Lucas and Brian.}

_{Brian shows Daryl the ropes.}

There are some more photos of the event up here on Flickr.

Thanks again to Brian and Lissa.  We have had some great Lunch and Learn presentations, but getting the chance to try out their Segway modifications really took the cake.

_{Lissa and Brian received Denim Group mugs and PostIt notes for their troubles.  Exciting!}

--Dan
dan _at_ denimgroup.com

Halloween, Denim Group Style

By Dan Cornell

We finally got the pictures from our annual Halloween dress-up event online. If you look close over on the right you can see John Dickson dressed as Chuck Norris.  I, as always, wore a ladybug costume originally meant for a five year old.

Apparently some folks in the office thought it would be funny to dress up like me.  You can tell I had meetings Friday because I'm actually wearing pants and shoes for a change.

We had some really good ones this year and I'm looking forward to next year.  Now everyone just needs to finish eating candy and get back to work.

--Dan
dan _at_ denimgroup.com