Are these binding attacks applicable to Nettalk?

[anon23294430]

@Bruce

Since NetTalk does not integrate JavaScript into the program, it’s outside the scope of this. (It serves site JavaScript (not user-injected JavaScript) and uses this pre-ordained JavaScript in the UI. But the JavaScript does not interact at the Exe level.

So the word “integrate” doesnt give away much, and most websites/webserver use javascript but also other languages like CSS to control the webbrowser. Its possible to use CSS to fingerprint a webbrowser ( CSS Fingerprint (csstracking.dev) ) so the question becomes how much/far does the integration go?

I didnt know if you have some sort of table that matched up the limited javascript data types to the clarion (or whatever its written in) nettalk webserver data types, in much the same way the Clarion Data Type Conversion Rules exist (see Clarion Help Data Type Conversion Rules).

This tool called Cooper is based on another called Favocado favocado-ndss21.pdf (asu.edu)

In the Cooper paper this assertion is made

As commercial software is usually written in low-level languages like C/C++, a binding layer is necessary for transferring the arguments and transforming the representation for the high level scripting languages. However, since the software and the script are developed independently, the binding layer is prone to produce inconsistent representations or miss security checks, which lead to tons of severe security vulnerabilities

So when you make the point its different, and yet the paper is saying what it says above, how exactly is Nettalk precluded from this situation?
Can you do a ELI5?

@Bruce

I’d be happy to set up a test server for you.

From a sales perspective, I think the best sales people are the one’s who lets others go try to beat its features, AFAIK even the likes of MS, Google, Apple, Apache, NgInx dont put webservers up for anyone to hack and yet, thats the best form of selling imo.

I dont think I would be the only one who might want to have a go, so I’d be happy if you set up a webserver, it can be invite only to avoid the DDOS and bandwidth burn and then see if any red teams can capture the flag so to speak.

It will give you something to talk about for your next devcon or clarion live meeting.

@Bruce

For a while we ran regular pen tests ourselves (100 000 test requests are not uncommon in these situations) and it’s a little anti-climactic to spend $1500 and get a report that says “all ok”.

So what do you use for your pen test then? Here is one of Google’s fuzzer’s GitHub - googleprojectzero/domato: DOM fuzzer
so why not run this between your firewall and nettalk webserver or even internally on your own lan?

I assume you have instructions for clarion dev’s to help them setup fuzzer’s like the google one above to make sure they havent made a mistake somewhere before they deploy their website, at least that way internally testing on a lan will eliminate the $1500 affirmation.

@Bruce

We got a professional security expert to do an assessment of one of our servers - he wasted 2 weeks of his life, and again the report had nothing to say.

Did he give you a certificate I just wondered if he is any good, maybe you’d want to post it on the nettalk website?

@Bruce

Of course, as you know, security is a process, not an event. Keeping servers reasonably up to date is important. (Not every build, but every year or two is a good idea.) Climbing with that 20 year old rope is not necessarily ideal

Its why fuzzer’s handle the low level fruit for testing webservers.

Edit.
I could refer you to this post Is it possible to store template symbols in a template so they can write out their value in the clw? - #4 by anon23294430 which highlights what seems to be a new way of accessing the template symbols. I say new way, because I think I was clear in my post what I was trying to achieve but I am also aware American English, or South African English has different meanings in British English, I see this even within the UK like the Scottish version of Wikipedia Wikipedia:Spellin an grammar - Wikipedia
but its not exactly the same use of evaluate as the %Stripling function demonstrates in the shipping templates. And there does some to be some undocumented features in the clarion language and template part of the language, which is what fuzzer’s can be good at finding especially when error messages are not thrown.