GNU bug report logs - #29528
Add blacknurse

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 29528 in the body.
You can then email your comments to 29528 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: ng0 <ng0 <at> n0.is>
To: guix-patches <at> gnu.org
Subject: Add blacknurse
Date: Thu, 30 Nov 2017 19:42:27 +0000

[Message part 1 (text/plain, inline)]

A package from my pen-testing repo.
-- 
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://c.n0.is/ng0_pubkeys/tree/keys
  WWW: https://n0.is

[0001-gnu-Add-blacknurse.patch (text/plain, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 29528 <at> debbugs.gnu.org (full text, mbox):

From: Ricardo Wurmus <rekado <at> elephly.net>
To: ng0 <ng0 <at> n0.is>
Cc: 29528 <at> debbugs.gnu.org, ludo <at> gnu.org
Subject: Re: [bug#29528] Add blacknurse
Date: Mon, 04 Dec 2017 00:00:08 +0100

Hi ng0,

> +(define-public blacknurse
> +  (let* ((commit "d2a2b23544295844714ebf8d2d78af37fe5770c9")
> +         (revision "1"))
> +    (package
> +      (name "blacknurse")
> +      (version (string-append "0.0.0-" revision "." (string-take commit 7)))
> +      (source
> +       (origin
> +         (method git-fetch)
> +         (uri (git-reference
> +               (url "https://github.com/jedisct1/blacknurse")
> +               (commit commit)))
> +         (file-name (string-append name "-" version))

This should be “(file-name (string-append name "-" version "-checkout"))”.

> +         (sha256
> +          (base32
> +           "1w7zmcrnrs4p4naj3i6h1wcmd56dgrfd7myx0ljhw162sg0134nz"))))
> +      (build-system gnu-build-system)
> +      (arguments
> +       `(#:make-flags (list "CC=gcc")
> +         #:tests? #f ; No tests
> +         #:phases
> +         (modify-phases %standard-phases
> +           (delete 'configure) ; No configure script
> +           (replace 'install
> +             (lambda* (#:key outputs #:allow-other-keys)
> +               (let* ((out (assoc-ref outputs "out"))
> +                      (bin (string-append out "/bin")))
> +                 (install-file "blacknurse" bin)))))))

This should end on #t.

> +      (home-page "https://github.com/jedisct1/blacknurse")
> +      (synopsis "Proof of Concept for the Blacknurse attack")
> +      (description
> +       "Simple Proof of Concept for the Blacknurse attack.
> +Blacknurse is a low bandwidth ICMP attack that is capable of doing denial
> +of service to well known firewalls.")

The first fragment is not a full sentence.

Looking at this package I wonder why it should be part of Guix as it is
merely malware.  I don’t see any reason why this should be installable
through Guix.  We are not in the habit of providing packages for
exploits.  Putting it in “networking” makes it seem like this would be a
useful networking application, but it really is not.  It just
demonstrates a bug in networked devices.

@Ludo: what do you think?

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net

Message #11 received at 29528 <at> debbugs.gnu.org (full text, mbox):

From: ng0 <ng0 <at> n0.is>
To: Ricardo Wurmus <rekado <at> elephly.net>
Cc: 29528 <at> debbugs.gnu.org, ludo <at> gnu.org, ng0 <ng0 <at> n0.is>
Subject: Re: [bug#29528] Add blacknurse
Date: Sun, 3 Dec 2017 23:49:10 +0000

[Message part 1 (text/plain, inline)]

Ricardo Wurmus transcribed 2.1K bytes:
> 
> Hi ng0,
> 
> > +(define-public blacknurse
> > +  (let* ((commit "d2a2b23544295844714ebf8d2d78af37fe5770c9")
> > +         (revision "1"))
> > +    (package
> > +      (name "blacknurse")
> > +      (version (string-append "0.0.0-" revision "." (string-take commit 7)))
> > +      (source
> > +       (origin
> > +         (method git-fetch)
> > +         (uri (git-reference
> > +               (url "https://github.com/jedisct1/blacknurse")
> > +               (commit commit)))
> > +         (file-name (string-append name "-" version))
> 
> This should be “(file-name (string-append name "-" version "-checkout"))”.
> 
> > +         (sha256
> > +          (base32
> > +           "1w7zmcrnrs4p4naj3i6h1wcmd56dgrfd7myx0ljhw162sg0134nz"))))
> > +      (build-system gnu-build-system)
> > +      (arguments
> > +       `(#:make-flags (list "CC=gcc")
> > +         #:tests? #f ; No tests
> > +         #:phases
> > +         (modify-phases %standard-phases
> > +           (delete 'configure) ; No configure script
> > +           (replace 'install
> > +             (lambda* (#:key outputs #:allow-other-keys)
> > +               (let* ((out (assoc-ref outputs "out"))
> > +                      (bin (string-append out "/bin")))
> > +                 (install-file "blacknurse" bin)))))))
> 
> This should end on #t.
> 
> > +      (home-page "https://github.com/jedisct1/blacknurse")
> > +      (synopsis "Proof of Concept for the Blacknurse attack")
> > +      (description
> > +       "Simple Proof of Concept for the Blacknurse attack.
> > +Blacknurse is a low bandwidth ICMP attack that is capable of doing denial
> > +of service to well known firewalls.")
> 
> The first fragment is not a full sentence.
> 
> Looking at this package I wonder why it should be part of Guix as it is
> merely malware.  I don’t see any reason why this should be installable
> through Guix.  We are not in the habit of providing packages for
> exploits.  Putting it in “networking” makes it seem like this would be a
> useful networking application, but it really is not.  It just
> demonstrates a bug in networked devices.
> 
> @Ludo: what do you think?
> 
> --
> Ricardo
> 
> GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
> https://elephly.net

To some extent I agree, I'm just probing where we draw the
line in pen-testing software.
I have a repository for those, and I'll add a comment to
get an idea for what we decide on. blacknurse for me
was a grey area in a new class of pen-testing software
I haven't sent before.
Software written with malicious intentions or such that
can be interpreted / used with those has a broad range,
some of it will be okay for us in Guix, some of it won't
be okay.
I draw the line at explicitly malicious. Blacknurse was
kinda okay for me, but I think your comment is enough
to let me put it in the case-by-case 'malicious' category.
Runs an PoC exploit targeted at launching an attack against
unpatched firewalls -> bad.

Eventually this should help getting a list of example
software we will not accept in Guix, if someone else
tries.
-- 
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://c.n0.is/ng0_pubkeys/tree/keys
  WWW: https://n0.is

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 29528 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Ricardo Wurmus <rekado <at> elephly.net>
Cc: 29528 <at> debbugs.gnu.org, ng0 <ng0 <at> n0.is>
Subject: Re: [bug#29528] Add blacknurse
Date: Mon, 04 Dec 2017 09:41:31 +0100

Hi,

Ricardo Wurmus <rekado <at> elephly.net> skribis:

>> +      (home-page "https://github.com/jedisct1/blacknurse")
>> +      (synopsis "Proof of Concept for the Blacknurse attack")
>> +      (description
>> +       "Simple Proof of Concept for the Blacknurse attack.
>> +Blacknurse is a low bandwidth ICMP attack that is capable of doing denial
>> +of service to well known firewalls.")
>
> The first fragment is not a full sentence.
>
> Looking at this package I wonder why it should be part of Guix as it is
> merely malware.  I don’t see any reason why this should be installable
> through Guix.  We are not in the habit of providing packages for
> exploits.  Putting it in “networking” makes it seem like this would be a
> useful networking application, but it really is not.  It just
> demonstrates a bug in networked devices.
>
> @Ludo: what do you think?

Indeed.  I see two issues here:

  1. a “proof of concept” is typically something for experts of the
     field to study, rather than generally useful software;

  2. it’s a tool whose purpose is to perform DoS attacks on routers, and
     I find it questionable to provide it in Guix (not to mention that
     there’s no shortage of such programs that we could add!).

So overall I’m reluctant to including it in Guix.

Thoughts?

Ludo’.

Message #19 received at 29528-done <at> debbugs.gnu.org (full text, mbox):

From: ng0 <ng0 <at> n0.is>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: Ricardo Wurmus <rekado <at> elephly.net>, guix-devel <at> gnu.org,
 29528-done <at> debbugs.gnu.org, ng0 <ng0 <at> n0.is>
Subject: Re: [bug#29528] Add blacknurse
Date: Mon, 4 Dec 2017 16:18:00 +0000

[Message part 1 (text/plain, inline)]

Ludovic Courtès transcribed 1.4K bytes:
> Hi,
> 
> Ricardo Wurmus <rekado <at> elephly.net> skribis:
> 
> >> +      (home-page "https://github.com/jedisct1/blacknurse")
> >> +      (synopsis "Proof of Concept for the Blacknurse attack")
> >> +      (description
> >> +       "Simple Proof of Concept for the Blacknurse attack.
> >> +Blacknurse is a low bandwidth ICMP attack that is capable of doing denial
> >> +of service to well known firewalls.")
> >
> > The first fragment is not a full sentence.
> >
> > Looking at this package I wonder why it should be part of Guix as it is
> > merely malware.  I don’t see any reason why this should be installable
> > through Guix.  We are not in the habit of providing packages for
> > exploits.  Putting it in “networking” makes it seem like this would be a
> > useful networking application, but it really is not.  It just
> > demonstrates a bug in networked devices.
> >
> > @Ludo: what do you think?
> 
> Indeed.  I see two issues here:
> 
>   1. a “proof of concept” is typically something for experts of the
>      field to study, rather than generally useful software;

Hm... We have some proof of work implementations of software in Guix
I think. In addition I'd think that there are many more professionals
only software. So PoC as an issues is a non-issue to me as long as it
works.

>   2. it’s a tool whose purpose is to perform DoS attacks on routers, and
>      I find it questionable to provide it in Guix (not to mention that
>      there’s no shortage of such programs that we could add!).

And this is the real issue. I fully agree with the statements and
views on this software made by Ricardo and yourself.
I'm taking most of these software from BlackArch, Kali and
other distro-builder distros targeted at pen-testing professionals
in addition to the commercial solutions.
Some of these don't even have license statements, I had chats with
BlackArch to correct a large batch of their own script'ish software.

> So overall I’m reluctant to including it in Guix.
> 
> Thoughts?
> 
> Ludo’.

I haven't read the Documentation in a while, but do we define anything
besides the requirement that a software needs to fit into the GNU FSDG?
I mean more specifically, do we want to come up with a definition for
software (such as this) that won't be included at all, or do we decide
individually per case?
I myself now know what we have agreed upon here, I just don't know if
it would make more sense to define it in the Handbook.
There's a whole lot of software similar to this out there.
For example:
I have a collection of isolated viruses somewhere that is intended for
study only. Of course I know this is definitely not something we should
distribute in master, but there are certain cases where people wouldn't
know wether this is okay to distribute from the official side or not.

In addition to my main projects I'm lowkey working on some kind of
pen-testing repository, so that it can serve as a base for a flavor
of my mechanism for custom distro building automation. Based on the
general mechanism of creating official flavors I could test the ability
to extend on this with for example the theme of pen-testing.
Some of the software can find it way into Guix (some already has),
a large amount of it won't (for obvious reasons).

I'm CC'ing devel and closing this bug, so that we can discuss - if
necessary - the problem of pointing out software like this in and their
restriction in the Handbook.

Thanks,
N.
-- 
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://c.n0.is/ng0_pubkeys/tree/keys
  WWW: https://n0.is

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 29528 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: ng0 <ng0 <at> n0.is>
Cc: Ricardo Wurmus <rekado <at> elephly.net>, 29528 <at> debbugs.gnu.org
Subject: Re: [bug#29528] Add blacknurse
Date: Mon, 4 Dec 2017 13:24:28 -0500

[Message part 1 (text/plain, inline)]

On Sun, Dec 03, 2017 at 11:49:10PM +0000, ng0 wrote:
> To some extent I agree, I'm just probing where we draw the
> line in pen-testing software.

Okay, that makes sense. I think the best approach is to simply start the
discussion instead of sending a patch to add a package.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.