Detectify's security team writes about web vulnerabilities, bug bounties, and misconfigurations such as Nginx, plus some Go debugging.
HN links it mainly for the write-up on gaining read access to Google's production servers, and commenters credit the team with finding bugs in many big sites.
I see, so XML has few tradeoffs other than complexity. So I'm sure given your insistent questions, XML has a native representations for:
- A ring buffer.
- A decimal type.
- A complex number.
No, it doesn't. It's all up to the contract. And there's nothing in XML that makes it more convenient to describe a complicated contract, than JSON (or any other format).
So XML made a tradeoff of complexity, and gained nothing.
Oh, and this is one issue you won't see happen with JSON:
http://blog.detectify.com/post/82370846588/how-we-got-read-access-on-googles-production-servers
Yes, they managed to get full blown read access to Google's servers, including "/etc/passwd" and "/etc/hosts" by passing an XML file and using a standard XML feature.
"[N]aive XML parsers that blindly interpret the DTD of the user supplied XML documents. By doing so, you risk having your parser doing a bunch of nasty things. Some issues include: local file access, SSRF and remote file includes, Denial of Service and possible remote code execution. If you want to know how to patch these issues, check out the OWASP page on how to secure XML parsers in various languages and platforms."
You might want to reevaluate your point about complexity after reading this.
JSON has only two features:
1. Simple.
2. Readable.
The first feature make it possible for your wristwatch to parse JSON with its pin-sized CPU. The second feature makes it possible for you to parse JSON with your pin-sized... Anyway, just…
There is a saying "If someone can make it, someone can break it"
This applies to physical security also.
There are way too many attack vectors for you to plug every possible hole.
20 years ago do you think anyone was considering that you could determine the contents of memory otherwise inaccessible your process just by reading the memory accessible to you in certain manners (Rowhammer, [1])
Or that a device taped under your desk could read your encryption keys right out of the air? [2][3]
Or that an attacker could intentionally cause errors by overclocking/undervolting "glitching" your device to cause it to skip certain instructions in order to gain access to it? [4][5][6]
Or that exploiting flaws in the way a CPU tries to predict the next instructions could lead to privileged information leakage? [7]
A sibling commenter hit the nail on the head. You have a large surface area to protect. They only need to find one tiny crack.
But by far the most common vulnerabilities are simply someone not properly validating input[8][9][10]<-(a ton of specific attack incidents listed here), or not allocating memory properly [11]
[1] https://en.wikipedia.org/wiki/Row_hammer
[2] https://www.theregister.co.uk/2015/06/20/tempest_radioshack/
[3] https://www.tau.ac.il/~tromer/radioexp/
[4] https://toothless.co/blog/bootloader-bypass-part1/
[5] https://av.tib.eu/media/32392
[6] https://www.multichannel.com/news/black-sunday-fix-dbs-pirates-132341
[7]…
How many times do people need to talk about SQL injection before people writing web apps get it? This isn't news and this isn't hard to completely avoid. Just do it and stop being amazed every time someone puts a tick mark in an URL parameter (or any parameter for that matter).
EDIT: I looked around this detectify website and found this gem: http://blog.detectify.com/post/22258359654/zerg-rush-how-to-influence-google
"326 exploits found"
I have so much faith that this company will do well. If you're interested in others like it that might fair better, you can try WhiteHat Security or Tinfoil Security, both of which do web security scanning as a service.
https://www.whitehatsec.com/
https://www.tinfoilsecurity.com/
This looks pretty neat! I had a few questions:
- Is there any way to add `perf` profiling?
- Could allocation graphs be added, similar to what pprof offers (e.g. the one midway through this article https://blog.detectify.com/2019/09/05/how-we-tracked-down-a-memory-leak-in-one-of-our-go-microservices/)? I've found these to be very helpful in practice since flame graphs make it harder to see what lower-level functions are being called a lot.
It runs in process tho, so it would have had the exact same result with heartbleed. Its keys need to be readable to that user, so exploits like http://blog.detectify.com/post/82370846588/how-we-got-read-access-on-googles-production-servers would also still leak your private keys. So no net win here unfortunately.
opencryptoki has a softhsm too, but again, it appears to run in process. Same problems.
I hope it doesn't get unnoticed that the guys who discovered this vulnerability created a really great product, Detectify :
https://detectify.com/
They also discovered vulnerabilities in many big websites (dropbox, facebook, mega, ...). Their blog also has many great write-ups : http://blog.detectify.com/