Scott Granneman looks at the virtues and pitfalls of browser fuzzing and the overwhelmingly positive impact it has on the security community.
Pockets of criminals already know about this stuff, so if Moore's actions finally embarrass the browser makers into fixing their problems, then we're all better off.
Weegee had the almost uncanny ability to appear on the scene just after - or just as - something dramatic, crazy, violent, or catastrophic happened, even before the police arrived (hence the name: Weegee as in "Ouija," like the board game). He'd hop out of his car, take the photos that brought him fame and cash, develop the film in his car's trunk slash darkroom, and then drive the fresh prints to the papers that bought his work: The Daily News, The Daily Mirror, and PM.
Weegee's photos still have an astonishing power today, well over half a century after they were taken. Murdered citizens and gangsters (this one's kinda graphic, so you've been warned), victims of fires and car accidents, folks sleeping on fire escapes to beat the sweltering heat, lovers kissing passionately while watching a 3D movie, overwhelming massess of humanity at Coney Island, an interesting mix of city dwellers on New Year's Eve, Harlem church-goers, bums. And criminals. Always criminals. Criminals in the paddy wagon, getting booked, parading into the station, and sitting in the pokey. For more Weegee, check out Naked City, Weegee's New York Photographs, 1935-1960, or Weegee's World. You won't be disappointed.
Weegee showed the world the New York of heat, sweat, crime, and death. His photos weren't always pretty, but they revealed the real city, and they told the truth. Sometimes people don't want to hear the truth - it's ugly, or it's unpleasant, or it damages the business interests of certain individuals. But that truth needs to be published, and people need to see it.
Which brings me to HD Moore and the Month of Browser Bugs Project. Moore is one of the brightest guys working in the security world right now, especially in the area of vulnerability research. He's responsible for the awesome Metasploit Project, an "advanced open-source exploit development platform ... for legal penetration testing and research purposes" that currently contains 143 exploits and 75 different payloads (for more on the Metasploit Framework, check out previous SecurityFocus articles of interest). After his interest was piqued by the work of others, Moore began creating his own fuzzers. A fuzzer basically sends randomized data to a program's inputs. If something weird happens - a crash, for example - then the fuzzer has done its job. Moore's fuzzers first looked for flaws in Internet Explorer's implementation of ActiveX (unsurprisingly, a rich source of bugs and issues). From there he spread out to a fuzzer that tests various browsers' methods for DHTML.
On July 2, Moore wrote the following in his blog:
Over the last few months, I have taken an interest in web browser security flaws. This interest has resulted in my collaboration on a few fuzzing tools ... The vendors have been notified and the time has come to start publishing the results. I will publish one new vulnerability each day during the month of July as part of the Month of Browser Bugs project. This information is being published to create awareness about the types of bugs that plague modern browsers and to demonstrate the techniques I used to discover them.As of this writing, Moore is up to number 22 in his list of bugs, with several to come. The majority (19 out of 22) are found in the "known to be armed and dangerous" Internet Explorer 6; most exist on a fully patched Windows XP Service Pack 2 box, but a couple can be found on a Windows 2000 Service Pack 4 machine, and a few even require the presence of Office 2003 or Outlook. One bug each can be found on Firefox 18.104.22.168 on Linux (it's been fixed in 22.214.171.124, however), Safari on Mac OS X 10.4.7, and Konqueror 3.5.1 on Linux. None for Opera 9 have been found so far, so if you're looking for a browser that appears to withstand fuzz testing, that may be the one.
Moore warned the browser makers about the bugs he had found, so why the Month of Browser Bugs project? Because the response of several vendors seemed too slow to him. By publicly releasing information about the bugs he has found, Moore hopes to create public awareness, certainly, but also undoubtedly the result would shame Microsoft (mostly) and Apple and KDE (a little) into fixing their problems.
Microsoft doesn't like what Moore is doing, that much is certain. The company criticized Moore's apparent failure to engage in what the company calls a "responsible disclosure of vulnerabilities." I would imagine that Apple isn't too happy either, given the hyper-paranoid atmosphere of that company. As for KDE, like most open source projects, I have the feeling that the developers pretty much said, "Another bug? OK, let's roll up our sleeves and fix it!"
What are we to make of Moore's Month of Browser Bugs? Is he a thoughtless miscreant, exposing flaws to the world that can now be used by bad guys while failing to give the software makers enough time to fix their mistakes? Should we pilory him for exposing too much dirty laundry, and castigate him for irresponsible behavior by a so-called security professional?
Not in my book.
Moore deserves praise from the security community for helping educate us about fuzzers and their applicability to the world of web browsers. The problems he's detailing will hopefully aid more security people, IT managers, and even users to realize that it's long past time to dump Internet Explorer for something safer and more reasonably coded, maintained, and updated.
In addition, the fact that security issues have gotten so rampant and out of control paradoxically mandates just the actions that Moore is taking. We've all been patient for far too long. The neverending flood of security issues that we've seen over the last few years - a deluge that shows no signs of abatement - has long since passed the scary stage, sailed right on by the anger phase, and is now approaching grotesque farce. How are we supposed to take Microsoft's claims that it "has made fuzzing part of its Software Development Lifecycle and runs the tools, not just against browsers, but its other software as well"? As what? A sick joke? If the company - which just posted sales of $11.8 billion for the last quarter, up more than $1.5 billion from last year - is using fuzzers against IE, then why is HD Moore consistently finding flaws in that same software using those same tools? Give me a break.
And if you think that the bad guys were clueless about these vulnerabilities until Moore started publicizing them, well, you sadly underestimate the intelligence and work ethic of the black hats out there. Moore himself reports that he's already received an email from someone in Russia complaining that he revealed a hole that the Russian cracker had been exploiting. Pockets of criminals already know about this stuff, so if Moore's actions finally embarrass the browser makers into fixing their problems, then we're all better off.
If Microsoft (and Apple and KDE and the Mozilla Project too ... but mostly Microsoft) can't get its act together enough to find these flaws using free and open source tools, then I say to Moore, more power to you. Moore is our modern Weegee for the age of software flaws, using the tools of immediate publishing on the Web to reveal to the world the truth about security in modern web browsers. That truth sure is ugly and unpleasant at times, and it certainly damages the business interests of companies (who perhaps deserve to have their business interests damaged), but the world needs to hear it. Weegee used to tell people to "Credit Photo by Weegee the Famous." Maybe it's time to start labeling vulnerabilities the same way: "Credit Hole by HD Moore the Famous." He deserves it.