XML processor attacks

I have posted a query to the xml-dev mailing list asking about a summary of XML parser attacks.

see: http://lists.xml.org/archives/xml-dev/200701/msg00343.html

So far I only got to hear about the "exploding entity": which is something you'd get when your XML instance contains some DTD declaration which defines entities in a recursive manner such that the final tokens that result from the definition never get recognized due to the left production nature of the definition. This results in a memory usage by the XML processor which might end up crashing it while parsing the XML instance trying to resolve the entity definition. This kind of an attack is usually being referred to as an XML Bomb.

Here's an example, extracted from Hardening Network Security, chapter 5:

<!DOCTYPE foobar [
<!ENTITY x0 "hello">
<!ENTITY x1 "&x0;&x0;">
<!ENTITY x2 "&x1;&x1;">
<!ENTITY x3 "&x2;&x2;">
<!ENTITY x4 "&x3;&x3;">
...
<!ENTITY x98 "&x97;&x97;">
<!ENTITY x99 "&x98;&x98;">
<!ENTITY x100 "&x99;&x99;">
]>
<foobar>&x100;</foobar>


A known buzzword is the XXE (Xml eXternal Entity) Attack: This is a fancy name for an attack on some application which parses XML, as part of its implementation, and is parsing XML data from some untrusted sources, which may lead to a denial of service (DoS) attack, exposure of sensitive information, or some other damage to the application or the infrastructure that it uses. This can happen, for example, when referring to some entity which is being defined as an access to some local file (e.g., some password file...). Processing of file inclusions and other attachments can be considered an XXE.


Another buzzword is XDoS: XML Denial of Service. This is a term to describe attacks on an XML parser which result in causing it to consume too much memory, slow down operations, or just work for nothing. It might also refer to cases where the DoS is on some other component of the application and the XML was the took for facilitating the attack.

Additional attacks are: signature redirects ...

So, you want to implement an XML Schema Processor?

I was recently asked to look into the design and later on the implementation of XML processors that are able to do XML parsing, XML Schema validation, XPath/XQuery queries, WSDL and SOAP analysis and enforcement, and much much more.

When one is required to implement a tool which implements complex and detailed standards, which rely on other complex standards, especially when short in time, one seeks to classify the features into two main categories: "frequently used" and "rarely used". The motivation for this classification is that "frequently used" features get to be considered and implemented first while the "rarely used" ones get time and attention later on.

Starting with XML Schema (of course with the aid of the very useful book Definitive XML Schema), I was faced with the need to perform such categorization. Not having enough time to properly read the standard throughout, read commentary about it in mailing lists such as the xml-dev mailing list, and complement the knowledge with explanations from books and of course from actual practice (examining freely available XML Schemas for example), I was forces to an ad-hoc approach.

I browsed the web for some available summary on XML Schema, hopefully, including the above mentioned categorization. To my happiness, I was successful. I came across the article Profiling XML Schema by by Paul Kiel, which was published on xml.com on September 20th, 2006.

My short term approach will be to try and confirm the results and conclusions that were presented in this article with several examples of WSDLs and XML Schemas available on the wild (e.g., Google's XML based interfaces for its services).

Let's see how it goes.

I made it to the final in תחרות הפאדיחה

Apparently, my story made it to the final stage in the פאדיחה contest in Tapuz.

See: http://www.tapuz.co.il/tapuzforum/main/Viewmsg.asp?forum=149&msgid=93059365

Winter puddle/swamp in Netaniya

We drove to Netaniya's Winter puddle/swamp.

It is a nice area with Eucalyptus trees which, during rain season, becomes swampy.

There are ducks there, some parrots, some crows, and very nice wild flowers. Next to it there are several amusement facilities where the kids can play. We had fun.

See what I wrote about the place and about out good time there on a forum in Tapuz: חוויות בשלולית החורף כפי שפורסם בפורום הורים בתפוז
See pictures at: http://yeda.cs.technion.ac.il/~yona/aviv/2007/1.2007/

Perl::Critic static code for Perl based on Perl Best Practices

Check out the Perl::Critic module.
It claims to do "Critique Perl source code for best-practices ".
The best-practices are a-la Damian Conway's book "Perl Best Practices"

There's also a web service at: http://perlcritic.com/

FireBug for FireFox

There's a nice addon/plugin for FireFox called FireBug, which can be used in order to get a nice view on the source of the current page that you're viewing, including HTML, CSS, JS, network statistics, including debugging, and a few more features.

See: http://www.getfirebug.com/

Added a new book review on Amazon

I just finished writing a book review to Definitive XML Schema by Priscilla Walmsley.

You can read it along with other reviews I wrote at: http://www.amazon.com/gp/pdp/profile/A10UA4V0Z4691N

NIST announces competition for new cryptographic hash algorithm

NIST announces competition for new cryptographic hash algorithm. This sounds like a nice opportunity to go public with ideas you have for a new cryptographic hash function.
See: http://www.networkworld.com/news/2007/012307-nist-cryptographic-algorithm.html

A nice introduction to Finite-State Automata and Regular Expression with Critique about Regular Expression Engines' implementations

Russ Cox explains and demonstrates how good old theory put to practice results in good computer programs while ignoring good theory leads to bad programs.

See: Regular Expression Matching Can Be Simple And Fast (but is slow in Java, Perl, PHP, Python, Ruby, ...) by Russ Cox


His regexp page contains more interesting information and implementations.

Weekly sys-admin tips for Linux and Windows

Martin Kroser, a friend of mine, opened a blog with weekly sys-admin tricks for Windows and Linux. See: http://windowsandlinuxweeklytips.blogspot.com/

I announced the February meeting of the Israel.pm (Israeli Perl Mongers).
See: http://perl.org.il/pipermail/perl/2007-January/008376.html

I just added a few new books reviews on Amazon

Check out my book reviews on Amazon: http://www.amazon.com/gp/cdp/member-reviews/A10UA4V0Z4691N/ref=cm_pdp_reviews_see_all/002-1178222-6558416

Nice article about how to auto-test web applications for security

http://www.net-security.org/dl/articles/Crawling_Ajax_driven_Web_2.0.pdf