Some new whitepapers ...

[David Litchfield]

Hey all,

I've written two papers available from here
http://www.ngssoftware.com/papers.htm

The first deals with buffer _underruns_ , DEP and Address Space Layout
Randomization on Windows. During the paper's review process I was pointed to
http://www.phrack.org/show.php?p=58 which deals with the same conceptual
issues to defeat PaX on Linux but, as my paper was completed, I thought I
may as well still go ahead and release it. Besides mine discusses buffer
underruns, too :)

The second paper talks about using inference as a means of drilling for data
with SQL injection and it is based upon a talk I presented at Blackhat
Europe earlier on in the year. I divide SQL injection data theft attacks
into three classes - inband, out-of-band and inference. The first, in-band,
uses the existing connection to get data out; the second, out-of-band, uses
another channel, e.g. smtp by using builtin database mail functions; and
lastly inference. With inference there is no actual transfer of data -
rather it can be inferred what the data is by making observations about
differences in the way an application behaves.

Cheers,
David Litchfield
NGSSoftware Ltd
http://www.ngssoftware.com/

[Lila Buchalski]

Has anyone written any white papers/articles on banking information
security?

I would be interested in publishing quality white papers/articles that
had to do with any of the following:

-Core banking application security
-Identity theft
-VoIP security
-Compliance to information security regulations
-Other banking and information security related security topics.

Let me know if you have any questions.

Thanks,
Lila B.

Lila Buchalski
Editor
http://www.Bankinfosecurity.com


-----Original Message-----
From: David Litchfield [mailto:davidl@ngssoftware.com]
Sent: Wednesday, October 05, 2005 8:20 AM
To: bugtraq@securityfocus.com
Subject: Some new whitepapers ...

Hey all,

I've written two papers available from here
http://www.ngssoftware.com/papers.htm

The first deals with buffer _underruns_ , DEP and Address Space Layout
Randomization on Windows. During the paper's review process I was
pointed to
http://www.phrack.org/show.php?p=58 which deals with the same conceptual

issues to defeat PaX on Linux but, as my paper was completed, I thought
I
may as well still go ahead and release it. Besides mine discusses buffer

underruns, too :)

The second paper talks about using inference as a means of drilling for
data
with SQL injection and it is based upon a talk I presented at Blackhat
Europe earlier on in the year. I divide SQL injection data theft attacks

into three classes - inband, out-of-band and inference. The first,
in-band,
uses the existing connection to get data out; the second, out-of-band,
uses
another channel, e.g. smtp by using builtin database mail functions; and

lastly inference. With inference there is no actual transfer of data -
rather it can be inferred what the data is by making observations about
differences in the way an application behaves.

Cheers,
David Litchfield
NGSSoftware Ltd
http://www.ngssoftware.com/

--
Internal Virus Database is out-of-date.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.11.7/112 - Release Date:
9/26/2005

[Jerome Athias]

This is a cryptographically signed message in MIME format.

--------------ms000808010309040809050805
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Hi,

nice job Mr L
an other new interesting paper to check:


x86-64 buffer overflow exploits and the borrowed code chunks
exploitation technique
http://www.suse.de/~krahmer/no-nx.pdf

Cheers
/JA

--------------ms000808010309040809050805
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIIPxDCC
BMgwggQxoAMCAQICBAIAApswDQYJKoZIhvcNAQEFBQAwRTELMA kGA1UEBhMCVVMxGDAWBgNV
BAoTD0dURSBDb3Jwb3JhdGlvbjEcMBoGA1UEAxMTR1RFIEN5Ym VyVHJ1c3QgUm9vdDAeFw0w
MjA4MjcxOTA3MDBaFw0wNjAyMjMyMzU5MDBaMIHcMQswCQYDVQ QGEwJHQjEXMBUGA1UEChMO
Q29tb2RvIExpbWl0ZWQxHTAbBgNVBAsTFENvbW9kbyBUcnVzdC BOZXR3b3JrMUYwRAYDVQQL
Ez1UZXJtcyBhbmQgQ29uZGl0aW9ucyBvZiB1c2U6IGh0dHA6Ly 93d3cuY29tb2RvLm5ldC9y
ZXBvc2l0b3J5MR8wHQYDVQQLExYoYykyMDAyIENvbW9kbyBMaW 1pdGVkMSwwKgYDVQQDEyND
b21vZG8gQ2xhc3MgMyBTZWN1cml0eSBTZXJ2aWNlcyBDQTCCAS IwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBALEeYGbgQwaeJ2gvApnHiN+F69tl7NRJZ3 ouH83cFSzWHqzynUY6XQPA
PQUsWhgNWSVCo3LArSjSrTwx4ksH+16Y66gz1mmyWp7qLEmmJi 5M8MyrQNKq3ixOgbW6e7hc
0Hu9R/XABtLA5NdH22JAr6EcUQMY27jQu5THPHnqJWSuJhnhPGZHZ5Kd e1WrNMJ1btknjp2M
8B3aa5yGBKKQteqdjM/7OUOo8BgtnvcZECycL+HQsf/XWcTNQDL514HbURzyQVKBQbGDuMgJ
/pkiR4BPnMuu4CjVHKxwR7Alq6E4Qhdr+mpujV95+PYpAzCkbkb UhV2qQJk4dtseAX3lDKUC
AwEAAaOCAacwggGjMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly 93d3cucHVibGljLXRydXN0
LmNvbS9jZ2ktYmluL0NSTC8yMDA2L2NkcC5jcmwwHQYDVR0OBB YEFPZSIhcVEwgDWb8YlZ9I
tLnp/vhmMIGSBgNVHSAEgYowgYcwSQYKKoZIhvhjAQIBBTA7MDkGCCs GAQUFBwIBFi1odHRw
Oi8vd3d3LnB1YmxpYy10cnVzdC5jb20vQ1BTL09tbmlSb290Lm h0bWwwOgYMKwYBBAGyMQEC
AQMBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vc2VjdXJlLmNvbW 9kby5uZXQvQ1AwWAYDVR0j
BFEwT6FJpEcwRTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD0dURS BDb3Jwb3JhdGlvbjEcMBoG
A1UEAxMTR1RFIEN5YmVyVHJ1c3QgUm9vdIICAaMwKwYDVR0QBC QwIoAPMjAwMjA4MjcxOTA3
MzFagQ8yMDA1MDIyMzIzNTkwMFowDgYDVR0PAQH/BAQDAgHmMA8GA1UdEwQIMAYBAf8CAQAw
DQYJKoZIhvcNAQEFBQADgYEAtqewenGL4LqzgR42MnqGGNbxq0 05CHEGWmegSwHlMEBtibWe
Faqxx/QKxlwO6TfeqJfH3M7Ncft0AgfcXxUnCFMHdtS5BunCd1Aeysmw wkaBgACtRKpc1iDZ
VTK+Vpbx6r2g47wNgDrqzPuaV+14pTY9VurR53TKNMPPsVHp4A wwggV4MIIEYKADAgECAhBY
CXfhRHXSR7F9sCWYMtgnMA0GCSqGSIb3DQEBBQUAMIHcMQswCQ YDVQQGEwJHQjEXMBUGA1UE
ChMOQ29tb2RvIExpbWl0ZWQxHTAbBgNVBAsTFENvbW9kbyBUcn VzdCBOZXR3b3JrMUYwRAYD
VQQLEz1UZXJtcyBhbmQgQ29uZGl0aW9ucyBvZiB1c2U6IGh0dH A6Ly93d3cuY29tb2RvLm5l
dC9yZXBvc2l0b3J5MR8wHQYDVQQLExYoYykyMDAyIENvbW9kby BMaW1pdGVkMSwwKgYDVQQD
EyNDb21vZG8gQ2xhc3MgMyBTZWN1cml0eSBTZXJ2aWNlcyBDQT AeFw0wNDExMjMwMDAwMDBa
Fw0wNTExMjMyMzU5NTlaMIHeMTUwMwYDVQQLEyxDb21vZG8gVH J1c3QgTmV0d29yayAtIFBF
UlNPTkEgTk9UIFZBTElEQVRFRDFGMEQGA1UECxM9VGVybXMgYW 5kIENvbmRpdGlvbnMgb2Yg
dXNlOiBodHRwOi8vd3d3LmNvbW9kby5uZXQvcmVwb3NpdG9yeT EfMB0GA1UECxMWKGMpMjAw
MyBDb21vZG8gTGltaXRlZDEWMBQGA1UEAxMNSmVyb21lIEFUSE lBUzEkMCIGCSqGSIb3DQEJ
ARYVamVyb21lLmF0aGlhc0BmcmVlLmZyMIGfMA0GCSqGSIb3DQ EBAQUAA4GNADCBiQKBgQDe
FVK5Ypmig424i0AwOHJUnSyJA52O+tSBoX0eNdQGxRxz/uA7wbzoEwWbUiiWVvQW2mrPcGEC
lgf+2zzD+CR0maX2QqIQvbuQxITOFdw8H6fKFq1axb8SZw7SOs Xz2kyd2yp9SDXq6VlpQalg
lfwUG2xj8lDtAorSATFBXeF21QIDAQABo4IBtDCCAbAwHwYDVR 0jBBgwFoAU9lIiFxUTCANZ
vxiVn0i0uen++GYwHQYDVR0OBBYEFOKQ5NfIrYBdMgWLKQXwMk Jc/WLHMA4GA1UdDwEB/wQE
AwIFoDAMBgNVHRMBAf8EAjAAMCAGA1UdJQQZMBcGCCsGAQUFBw MEBgsrBgEEAbIxAQMFAjBG
BgNVHSAEPzA9MDsGDCsGAQQBsjEBAgEBATArMCkGCCsGAQUFBw IBFh1odHRwczovL3NlY3Vy
ZS5jb21vZG8ubmV0L0NQUzCBsAYDVR0fBIGoMIGlMDigNqA0hj JodHRwOi8vY3JsLmNvbW9k
by5uZXQvQ2xhc3MzU2VjdXJpdHlTZXJ2aWNlc18yLmNybDA6oD igNoY0aHR0cDovL2NybC5j
b21vZG9jYS5jb20vQ2xhc3MzU2VjdXJpdHlTZXJ2aWNlc18yLm NybDAtoCugKYEnQ2xhc3Mz
U2VjdXJpdHlTZXJ2aWNlc18yQGNybC5jb21vZG8ubmV0MBEGCW CGSAGG+EIBAQQEAwIFIDAg
BgNVHREEGTAXgRVqZXJvbWUuYXRoaWFzQGZyZWUuZnIwDQYJKo ZIhvcNAQEFBQADggEBAH+w
UOqihz0rhfJQoMag9qrpaMyZ/iW+vuOUafk+9AfmVnAIPPFaftQhcppuQMvDdCZwf7+X9J4P
W3KLjGq05ZfJubwSX2u44h706HMEl8g5GXVF0ZcTiH+MczW/btfFHuLNwSJPs+cij21ljmOX
AL/a4v4dSEW5yKxRsQ8yOP6X4/+73LXhKUWVDN7/uuSyIXTYHZwb/Uy3Re7w7UlSc9kb2QPU
eEPDmXH6dO75ekBkjdrIz0pAaO54hTGQTSbVKaUuvQIPb3c4Uq nPMbhcchMLbeo7S1OjDwPF
pxPpNvLSyidMdwW6nthV3QY72EpKcrszEIaiUP9kJynKGZkU/TQwggV4MIIEYKADAgECAhBY
CXfhRHXSR7F9sCWYMtgnMA0GCSqGSIb3DQEBBQUAMIHcMQswCQ YDVQQGEwJHQjEXMBUGA1UE
ChMOQ29tb2RvIExpbWl0ZWQxHTAbBgNVBAsTFENvbW9kbyBUcn VzdCBOZXR3b3JrMUYwRAYD
VQQLEz1UZXJtcyBhbmQgQ29uZGl0aW9ucyBvZiB1c2U6IGh0dH A6Ly93d3cuY29tb2RvLm5l
dC9yZXBvc2l0b3J5MR8wHQYDVQQLExYoYykyMDAyIENvbW9kby BMaW1pdGVkMSwwKgYDVQQD
EyNDb21vZG8gQ2xhc3MgMyBTZWN1cml0eSBTZXJ2aWNlcyBDQT AeFw0wNDExMjMwMDAwMDBa
Fw0wNTExMjMyMzU5NTlaMIHeMTUwMwYDVQQLEyxDb21vZG8gVH J1c3QgTmV0d29yayAtIFBF
UlNPTkEgTk9UIFZBTElEQVRFRDFGMEQGA1UECxM9VGVybXMgYW 5kIENvbmRpdGlvbnMgb2Yg
dXNlOiBodHRwOi8vd3d3LmNvbW9kby5uZXQvcmVwb3NpdG9yeT EfMB0GA1UECxMWKGMpMjAw
MyBDb21vZG8gTGltaXRlZDEWMBQGA1UEAxMNSmVyb21lIEFUSE lBUzEkMCIGCSqGSIb3DQEJ
ARYVamVyb21lLmF0aGlhc0BmcmVlLmZyMIGfMA0GCSqGSIb3DQ EBAQUAA4GNADCBiQKBgQDe
FVK5Ypmig424i0AwOHJUnSyJA52O+tSBoX0eNdQGxRxz/uA7wbzoEwWbUiiWVvQW2mrPcGEC
lgf+2zzD+CR0maX2QqIQvbuQxITOFdw8H6fKFq1axb8SZw7SOs Xz2kyd2yp9SDXq6VlpQalg
lfwUG2xj8lDtAorSATFBXeF21QIDAQABo4IBtDCCAbAwHwYDVR 0jBBgwFoAU9lIiFxUTCANZ
vxiVn0i0uen++GYwHQYDVR0OBBYEFOKQ5NfIrYBdMgWLKQXwMk Jc/WLHMA4GA1UdDwEB/wQE
AwIFoDAMBgNVHRMBAf8EAjAAMCAGA1UdJQQZMBcGCCsGAQUFBw MEBgsrBgEEAbIxAQMFAjBG
BgNVHSAEPzA9MDsGDCsGAQQBsjEBAgEBATArMCkGCCsGAQUFBw IBFh1odHRwczovL3NlY3Vy
ZS5jb21vZG8ubmV0L0NQUzCBsAYDVR0fBIGoMIGlMDigNqA0hj JodHRwOi8vY3JsLmNvbW9k
by5uZXQvQ2xhc3MzU2VjdXJpdHlTZXJ2aWNlc18yLmNybDA6oD igNoY0aHR0cDovL2NybC5j
b21vZG9jYS5jb20vQ2xhc3MzU2VjdXJpdHlTZXJ2aWNlc18yLm NybDAtoCugKYEnQ2xhc3Mz
U2VjdXJpdHlTZXJ2aWNlc18yQGNybC5jb21vZG8ubmV0MBEGCW CGSAGG+EIBAQQEAwIFIDAg
BgNVHREEGTAXgRVqZXJvbWUuYXRoaWFzQGZyZWUuZnIwDQYJKo ZIhvcNAQEFBQADggEBAH+w
UOqihz0rhfJQoMag9qrpaMyZ/iW+vuOUafk+9AfmVnAIPPFaftQhcppuQMvDdCZwf7+X9J4P
W3KLjGq05ZfJubwSX2u44h706HMEl8g5GXVF0ZcTiH+MczW/btfFHuLNwSJPs+cij21ljmOX
AL/a4v4dSEW5yKxRsQ8yOP6X4/+73LXhKUWVDN7/uuSyIXTYHZwb/Uy3Re7w7UlSc9kb2QPU
eEPDmXH6dO75ekBkjdrIz0pAaO54hTGQTSbVKaUuvQIPb3c4Uq nPMbhcchMLbeo7S1OjDwPF
pxPpNvLSyidMdwW6nthV3QY72EpKcrszEIaiUP9kJynKGZkU/TQxggRbMIIEVwIBATCB8TCB
3DELMAkGA1UEBhMCR0IxFzAVBgNVBAoTDkNvbW9kbyBMaW1pdG VkMR0wGwYDVQQLExRDb21v
ZG8gVHJ1c3QgTmV0d29yazFGMEQGA1UECxM9VGVybXMgYW5kIE NvbmRpdGlvbnMgb2YgdXNl
OiBodHRwOi8vd3d3LmNvbW9kby5uZXQvcmVwb3NpdG9yeTEfMB 0GA1UECxMWKGMpMjAwMiBD
b21vZG8gTGltaXRlZDEsMCoGA1UEAxMjQ29tb2RvIENsYXNzID MgU2VjdXJpdHkgU2Vydmlj
ZXMgQ0ECEFgJd+FEddJHsX2wJZgy2CcwCQYFKw4DAhoFAKCCAr 8wGAYJKoZIhvcNAQkDMQsG
CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDUxMDA1MjIwNz M2WjAjBgkqhkiG9w0BCQQx
FgQUFg3miF4HXm/QVEU15QTE30NvuTQwUgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9 w0DBzAO
BggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAg cwDQYIKoZIhvcNAwICASgw
ggECBgkrBgEEAYI3EAQxgfQwgfEwgdwxCzAJBgNVBAYTAkdCMR cwFQYDVQQKEw5Db21vZG8g
TGltaXRlZDEdMBsGA1UECxMUQ29tb2RvIFRydXN0IE5ldHdvcm sxRjBEBgNVBAsTPVRlcm1z
IGFuZCBDb25kaXRpb25zIG9mIHVzZTogaHR0cDovL3d3dy5jb2 1vZG8ubmV0L3JlcG9zaXRv
cnkxHzAdBgNVBAsTFihjKTIwMDIgQ29tb2RvIExpbWl0ZWQxLD AqBgNVBAMTI0NvbW9kbyBD
bGFzcyAzIFNlY3VyaXR5IFNlcnZpY2VzIENBAhBYCXfhRHXSR7 F9sCWYMtgnMIIBBAYLKoZI
hvcNAQkQAgsxgfSggfEwgdwxCzAJBgNVBAYTAkdCMRcwFQYDVQ QKEw5Db21vZG8gTGltaXRl
ZDEdMBsGA1UECxMUQ29tb2RvIFRydXN0IE5ldHdvcmsxRjBEBg NVBAsTPVRlcm1zIGFuZCBD
b25kaXRpb25zIG9mIHVzZTogaHR0cDovL3d3dy5jb21vZG8ubm V0L3JlcG9zaXRvcnkxHzAd
BgNVBAsTFihjKTIwMDIgQ29tb2RvIExpbWl0ZWQxLDAqBgNVBA MTI0NvbW9kbyBDbGFzcyAz
IFNlY3VyaXR5IFNlcnZpY2VzIENBAhBYCXfhRHXSR7F9sCWYMt gnMA0GCSqGSIb3DQEBAQUA
BIGAD/IUtdCvK6drVhfCsKFNEA1UF4Ja8KYo+ZxNqev4pBOUUNEdRn8m gN1weWyswms9/n1H
i34TufF9NTJlSgHTDnYdNGzN2EtlxDLSixVlBGGb5exGKO/oSwDL7XtyCm41B5NRrptMSdfX
e61NycpwnIx6bzkPK+crlE1FtVOeHwYAAAAAAAA=
--------------ms000808010309040809050805--