The DMZ

Polynomial

07:31

0

Q: How to decode this runforestrun gootkit

Infected site is hxxp://www.infraredpsi.com/Pluginlab/Scripts/menuscript.js online scan result: http://urlquery.net/report.php?id=141893 I can de-obfuscate the first layer of the code that use the eval(function(p, a, c, k, e, r,) but stuck on the second layer of obfuscation. Can anyone show me...

Too Localized?

@Gilles This question on HTTPS GET and POST should provide a basic understanding of the way SSL wraps things, but it's not a panacea in terms of answering the question: security.stackexchange.com/questions/12531/…

AviD

@Polynomial yeah, I think so. flag it quick now.

and just for morning giggles

323

Q: Simple proof that GUID is not unique

I'd like to prove that a GUID is not unique in a simple test program. I expected the following code to run for hours, but it's not working. How can I make it work? BigInteger begin = new BigInteger((long)0); BigInteger end = new BigInteger("340282366920938463463374607431768211456",10); //2^128 ...

c# guid

Polynomial

07:49

lol

AviD

some of the comments are priceless.

Polynomial

Following on from my answer about obscurity in "less popular software", I have a great example

some guy at InfoSec was giving me some spiel about his product. essentially it's an RSA SecureID token, except it's your smartphone.

so you install an app, and it acts as a SecureID, so you don't need to lug a bunch of tokens around with you.

great idea, except android malware (and iPhone malware for that matter) could just screenshot the phone using the standard API

and then they've stolen your token.

so I asked him about it, and he said "oh, but it'd have to be some very specialised malware, and they'd have to put a lot of work into directly targeting our app. I don't think that'll happen."

to which I said "until I go home and write a PoC."

awkward silence ensues

AviD

in case anyone missed this (I almost did):

1

A: Clarify our stance on black hat questions

After several discussions in chat, most notably ones involving @Gilles, I've learned a couple key points. To sum up, these add up to say that any truly undesirable or inappropriate "black hat" questions should already be getting handled per existing StackExchange policies. For the TL;DR version...

I consider this answer accepted.

@Polynomial nice. and nasty. Good combination.

Polynomial

I didn't actually write the PoC, but his reaction was enough.

he's presenting a security-through-obscurity technique at a hacker conference. what the hell does he expect?

AviD

@Polynomial yeah, now if only he took that reaction back to the office with him, and shared it with product development.

Polynomial

07:58

Of course he didn't :P

but it's going to eat in the back of his brain

AviD

double-guid chance of that happening.

Polynomial

haha

AviD

they would have to scrap the product and start over.

kind of hurts their business model.

Polynomial

just a little.

especially since YubiKey essentially does what they're doing, but properly.

you still get a hardware token, but no batteries, no screen, USB operated, and tiny.

AviD

-ish.

Polynomial

08:00

yeah. but securID on a phone? dumb idea.

AviD

then again, RSA builds the SecurIds properly-ish, too.

@Polynomial actually, I dont think its a dumb idea, I think its a great idea.

not a secure one, but a good one nonetheless.

Polynomial

I agree there.

It's a great idea in theory, from a usability point of view.

AviD

to some extent, it is security theater, but sometimes that has some value too - consider if the actual equivalent security is too expensive.

Polynomial

but the security is flawed.

AviD

and from a business point of view.

Polynomial

08:01

possibly. I dunno.

YubiKeys are cheap.

AviD

so, there are some risks. so what? A much cheaper, easier securid.

Polynomial

he was licensing the software at £10 per app download, plus £35/year subscription.

AviD

the thumbprint scanner on laptops? also not secure. but its cheap biometrics.

Polynomial

whereas YubiKey is a one-time £25 purchase. no license.

AviD

@Polynomial whoa. not cheap for an insecure security app.

Polynomial

08:02

exactly.

and it relied on their servers being up all the time.

and, to some extent, connectivity.

there was a long-winded explanation of their probably-not-secure "corner case" where your phone has no signal.

AviD

@Polynomial wait, this all goes through their own hosted servers?

Polynomial

yes.

AviD

even worse.

Polynomial

exactly.

you can see why I was sceptical.

AviD

I dont think skeptical is the word you're looking for.

Polynomial

08:05

I almost lost it when he mentioned "cloud service".

but basically it was an interesting concept wrapped in bad security, bad reliability and a bad costing model.

AviD

@Polynomial I hate it when totally clueless people don't know they're clueless, but know just enough buzzwords to fool the mostly clueless (and themselves)

Polynomial

Damn. That's my raison d'être out the window then.

:P

AviD

no no, the cluefull playing with the mostly clueless is all in good fun. Besides, we know we're doing it, so that makes it okay.

gtg now, that stupid document is not writing itself. Sadly.

Polynomial

kk, laters :]

Lucas Kauffman

08:27

Is this where all the cool kids hang out?

Polynomial

of course.

AviD

@LucasKauffman thats what we tell the not-so-cool kids, so they dont bother us in our real spot.

Rory Alsop

mornin'

Rory McCune

mornin' all

Lucas Kauffman

Hello Rory's!

Terry Chia

08:35

Afternoon

CodesInChaos

I for one disagree about the phone token issue. I think that the effective security of using PC+yubikey is lower than PC+phone if the phone software is well written.

It's simply an issue of one trojan to KO, or two trojans on separate devices to KO

(But of course I don't claim that the phone application in question was well written)

Polynomial

@CodesInChaos I don't think that's true. You only need one trojan on one device in both cases. You're still typing the token in.

and it's worse in this case, because if you trojan the mobile you get the token before it's used

CodesInChaos

A good phone token displays the transaction details

AviD

@Polynomial be specific: one trojan on one out of two devices. So according this line of thinking, you're effectively doubling your attack surface (at least as far as trojans go).

Polynomial

exactly.

CodesInChaos

08:49

So with phone+PC you need a trojan on the phone to fake the displayed data(and that trojan needs root privs), and you need a trojan on the PC to capture the login password

With yubikey a trojan on the PC is enough, and it doesn't even need root

Polynomial

no, you only need a trojan on the PC for both scenarios.

just have it trick the browser into timing out when you log in

and send the data to the attacker

CodesInChaos

I'm assuming a scenario like online banking

Polynomial

the point is that with an RSA SecurID or a YubiKey you can't infect the device. They're sealed.

CodesInChaos

where you need to confirm a transaction, and not just login

Polynomial

I'm not assuming any specific scenario. Just in general.

CodesInChaos

08:52

If you log into my bank account you can't do any real damage

Polynomial

and what about cases where the attacker already knows the password, e.g. from a dump on a compromised site, and a re-used password?

then you've got an attack surface twice the size.

CodesInChaos

If you assume that that once side has already been compromized, then the risk is higher

But I don't think that's a valid assumption

Of course a specialized hardware device with display would be preferable over a phone

But a phone is still better than a non interactive device like yubikey or RSA tokens

And are root exploits for android really that common? I thought most android malware runs without root

AviD

@CodesInChaos a. yes b. exactly, it doesnt matter.

but you guys are talking about different things.

@Polynomial is talking about 2nd factor user authentication (much like securid or yubikey). @CodesInChaos is talking about the potential for transaction authentication.

different feature set, different use case, different security profile. Different security benefits.

Polynomial

yup.

AviD

transaction authentication is a fantastic twist on authentication, and does provide some very interesting possiblities. however, because its implemented on an insecure, non-closed device, it is open to additional risks.

the basic difference between secure software and security software.

which is part of why I was saying earlier that it's a great idea, just not a secure one.

hmm, does this mean noone else is coming?

chat.stackexchange.com/rooms/info/1380/security-town-hall-chat/…

Polynomial

09:08

I'd forgotten about that.

I'm actually not sure what the whole deal is about. Just doing some talk/discussion about moderator elections?

Or is this more like one of those televised debates they have in the US, where the electorates bitch at each other for an hour?

"I say your 6 cent titanium tax goes too far!" "I say your 6 cent titanium tax doesn't go too far enough!"

AviD

somewhere in between.

its supposed to be like the televised debates, but last year there was (almost) no bitching.

to paraphrase @ThomasPornin, it was just a big Care Bear Love Fest.

he's right, everyone here is a sissy.

Polynomial

:)

AviD

gives those who are not usual on the chat to get to know the candidates.

@AviD hmm, but this year @Iszi is running, so...

Rory Alsop

09:45

how are folks doing with this week's topic?

Polynomial

the native stuff?

it's interesting, but quieter than I expected.

Rory Alsop

Interesting seminar coming up: brighttalk.com/summit/nextgenerationthreatprotection

AviD

@Polynomial I feel that that is exactly what Captain Cook said. Right before they killed him.

Rory Alsop

speakers include Dennis Groves

Steven Furnell

etc

Polynomial

lol

on the same day as 44Con

Rory Alsop

10:02

@Polynomial well, for those of us who can't get to 44Con, it's something...

(jealous, moi?)

Polynomial

:P

yew jelly.

that sounds most unpleasant, actually.

AviD

@Polynomial I read that as jew belly. really couldn't figure out what kind of racial slur you were aiming for.

Polynomial

lolrandom

AviD

unless you're just really bad at slap talk

2

Polynomial

I don't go blue, that's the lazy man's comedy!

AviD

10:20

blue==racist?

AviD

10:30

I dont understand this comment:

@ScottPack ,@Polynomial security.stackexchange.com/questions/19055/… — vignesh 2 hours ago

It's... pretty much pointing at itself. well, the question it's on. but, duh.

Polynomial

nor I.

hence why I flagged.

@AviD Blue = blue-collar comedy. fart jokes, shock comedy, etc.

basically the concept that vulgarity is comedy.

AviD

@Polynomial ah, okay. I know blue collar comedy, wasnt sure you were referring to that.

Figured it was a Britishism.

@Polynomial sometimes it is, but not usually.

Polynomial

It's an Americanism, I believe.

AviD

Adam Sandler can get away with it, but you can't.

Polynomial

@AviD Hence why I prefixed it with the qualifier "basically"... :P

AviD

10:38

@Polynomial yes. but do you mean "blue collar" is an americanism, or "vulgarity"?

Polynomial

haha, good question ;)

blue collar was my intent, but now that you mention it...

I know I probably shouldn't, but I seriously have to promote this kickstarter:

kickstarter.com/projects/659943965/…

a proper RTS game. smashing planets into each other! looks very fun.

Gilles

@Polynomial wait, is it a computer game? I want that IRL

Polynomial

:P

the video was jaw-droppingly awesome

Gilles

@Polynomial if you're reverse engineering malware, is that a blackhat activity?

Polynomial

I wouldn't say so, no.

Gilles

10:45

I guess so: if you were legit, you'd have the source of the malware

Polynomial

huh?

if you were weren't legit, you'd have the source :P

since you'd have written it in the first place.

or you'd be working for the malware guys.

Gilles

I'm trying to follow the point of view of the sissies

Polynomial

you're just coming across as conflictory :P

Gilles

On MSO I've heard several times that reverse engineering is intrinsically bad

CodesInChaos

I don't even consider reversing commercial software blackhat

Gilles

10:47

like on MSF they consider firewall piercing intrinsically bad

Polynomial

The way I see it is blackhat is NOT about WHAT you're doing. It's about your intent.

Gilles

@CodesInChaos as you can guess, I agree with that

Polynomial

blackhat and illegal are independent terms though.

a lot of blackhat stuff is illegal, but some non-blackhat stuff is illegal too.

so just because something isn't blackhat doesn't mean we should allow it.

Gilles

@Polynomial Yup. if I go and murder my neighbor, it's not blackhat

Polynomial

it's RedHat!

oh, wait.

CodesInChaos

10:49

It's blackhat if you do with by hacking his insuline pump

Polynomial

but I meant more along the lines of cracking commercial software.

AviD

27

Q: Is there a word to describe someone who tends to disagree with others only to upset them?

What's the word to describe someone who acts arrogantly and always disagrees with others unreasonably in order to upset people around him/her? [I'm not looking for adjectives like unpleasant, annoying, unfriendly, rude, I'm looking for a more specific term like opinionated, didactic, loquacious,...

single-word-requests adjectives

Polynomial

the irony there is immensely silly.

Deck the halls with pics of goatse, trololololol lolol lolol...

AviD

@Polynomial for that matter, there is some blackhat that is not illegal.

Polynomial

exactly.

but it might be morally unjust.

at which point we leave it up to the answerer.

AviD

10:51

@CodesInChaos or his wifi-enabled pacemaker.

CodesInChaos

Wanted to say that at first, but couldn't think of the English word for it

AviD

@Polynomial well, it depends - if its malicious, then no.

Polynomial

of course.

AviD

I sort of agree about leaving the much more subjective "ethical" out of it. But blackhat is ambiguous, so I'm liking the illegal/malicious.

Gilles

@Polynomial then again, drjimbob was proposing to ban all black box pentesting here

AviD

10:53

@Gilles old meta argument.

Gilles

@Polynomial I'm in a dirty mood today. So: if you break a DRM enforcing software, is that ethical?

Polynomial

@Gilles don't think he was quite advocating that. He was proposing to ban all black box pentesting questions that showed malintent.

AviD

at some point some wanted solutions only, no testing techniques. Ala OWASP's builders, not breakers.

Polynomial

@Gilles Grey area. Let the answerer decide.

Gilles

@Polynomial he was in his revised answer (maybe you only saw the original)

AviD

10:54

@Gilles I agree, very gray. Or rather, specifics matter.

e.g. Sony's DRM was particularly malicious to begin with.

Polynomial

haha, yeah.

Gilles

iphone jailbreaking is another good example

CodesInChaos

I consider breaking DRM ethical

Polynomial

that's just off-topic here.

CodesInChaos

in almost all cases

Gilles

10:55

there's an explicit legal decision that makes it ok (for some purposes)

Polynomial

iPhone Jailbreaking isn't a security topic. unless they're asking about how it works, in terms of exploiting the kernel.

and then it's a grey area depending on the intent.

AviD

@CodesInChaos here's an example that its grayer: copying content, outside of fair use, and posting it drm-free to the internet.

CodesInChaos

DRM in a corporate context can be ok, since there it's the owner of the system who decides to use it

Polynomial

@Gilles Maybe. I think a lot of what he was doing was taking his views to the literal extreme, so that when a compromise was reached he'd get what he really wanted :P

Gilles

so it's decidedly not illegal, and while anyone may argue anything to be ethical, something that the law goes out of its way to allow has a presumption of ethicality

AviD

10:56

or a licensed software, for that matter.

Polynomial

@Gilles That's one way to put it, yes.

but again we rely on the moral compass of the answerer to judge whether something should be answered.

there's plenty of stuff on SO that I just ignore because I suspect that it's a question related to malware.

CodesInChaos

One interesting variant is cheats for games. One of the few times I actually worked on enforcing some kind of DRM

Polynomial

yet it doesn't get downvoted or closed.

AviD

@Gilles the law specifies "fair use" (mainly to limit malicious licenses). Outside of that, its questionable again.

Polynomial

@CodesInChaos Off-topic here, so we'll never have to deal with it.

AviD

10:58

@Polynomial not completely.

Gilles

@AviD I was refering to jailbreaking in that message, and to US law

AviD

there was a q on games dev that I wanted ported here.

CodesInChaos

hmm? A question of how to detect an executable was modified in memory seems on topic here

AviD

it was basically about how to implement some signing on game data.

@Gilles oh, my bad.

Polynomial

@AviD In the context of the game, it's off topic. In the context of breaking the copy protection, it's illegal. In the context of breaking cheat protection, it's partially on topic, but then it's going back to the DRM problem really that's already been answered to death.

Gilles

11:00

@AviD no worries, I realize the conversation was getting very disjointed

Polynomial

i.e. you've given the user the data, and now want to stop them using it as they wish.

AviD

@Gilles so's your face.

I miss @ScottPack.

@Polynomial yeah, pretty much. But there are always some special circumstances and context.

Polynomial

@AviD but then if it's a specific implementation, it's Too Localized.

Gilles

@AviD in that top answer, the last message shouldn't be “why hasn't the universe ended yet?” but “your RNG sucks”

AviD

@Polynomial not necessarily.

Polynomial

11:02

@AviD How so?

Gilles

@AviD it's my reproductory apparatus, actually

AviD

@Gilles I'm not sure I want to know where you're going with that.

Polynomial

That's what she said.

AviD

oo oo! That's what SHE said!

Gilles

@AviD are you aware of the meaning of the word gills that my avatar illustrates?

AviD

11:03

oh man, you ninja'd me. :(

@Gilles ohhh riiiight.

Gilles

Lamella (mycology)

A lamella, or gill, is a papery hymenophore rib under the cap of some mushroom species, most often but not always agarics. The gills are used by the mushrooms as a means of spore dispersal, and are important for species identification. The attachment of the gills to the stem is classified based on the shape of the gills when viewed from the side, while color, crowding and the shape of individual gills can also be important features. Additionally, gills can have distinctive microscopic or macroscopic features. For instance, Lactarius species typically seep latex from their gills. It was...

AviD

@Polynomial given a specific set of circumstances, as my context, that's not too localized, it's what we keep asking for.

Polynomial

o.o;

AviD

how many comments were left on questions "give us some more context" "tell us about what you're doing" etc etc.

Polynomial

indeed.

anyway, lunchtime

AviD

11:05

not the specific implementation, but the specific context.

Polynomial

be back in an hour for the chattage.

AviD

@Polynomial so you can't turn around and say, well now you've given the context so it's too localized ;-)

@Polynomial enjoy.

CodesInChaos

11:26

A brute-force collision on a 128 bit function isn't that far out of reach

In a cryptographic context I'd avoid 128 bit random values if I need uniqueness/no collisions

Polynomial

I dunno. 2^127 operations before an expected collision? granted it'll be less than that in practice, but still...

personally I use SHA256

Scott Pack

@AviD Whaddup sweetness?

CodesInChaos

A 128 bit value only needs 2^64 operations before a collision

AviD

@ScottPack your face, of course.

CodesInChaos

and that's to small for my taste

Polynomial

11:28

@CodesInChaos You sure on that one? :s

AviD

@CodesInChaos no, on statistical average it would be 2^127.

Gilles

@CodesInChaos most applications don't fear collisions, only collisions with known data

Scott Pack

@AviD Don't mind me. I'm eating breakfast.

AviD

@ScottPack mmm, lasagna.

CodesInChaos

@AviD Collisions only need 2^64, pre-images 2^128

Gilles

11:29

@AviD 2^127 if the point is to find a collision with a given value, I think CodesInChaos was refering to the cases where the attacker supplies both values and a collision damages more than the attacker

Scott Pack

@AviD Homemade granola with soy milk. My cholesterol is something for the ages.

CodesInChaos

I generally like 1) 256 bit if collisions are relevant 2) 160 bits if there are multi-target pre-images 3) 128 if there is a single target

AviD

@Gilles ah, right. I was talking about a given value.

Polynomial

shouldn't that mean 2^65 rather than 2^64 then? since we need to compute two hashes per operation.

CodesInChaos

depends on what you consider an operation in this context. I considered creating a value a single operation. But I don't really care about small pre-factors. If those matter, your security margin was far too small in the first case.

Polynomial

11:34

:P

Gilles

@Polynomial especially inexcusable because in most smartphones you should be able to do it right

Polynomial

@Gilles I'd have assumed they'd be using USB-based transfer to send the token.

Gilles

I think all high-end phones have Trustzone, I don't know what proportion of them have the associated machinery that let you have secure boot and secure access to the screen

Polynomial

but they weren't. so... derp.

Gilles

@Polynomial if done properly, you should be able to do it all on the phone

CodesInChaos

11:36

Can non root applications take screenshots of other applications? WTF

Polynomial

@CodesInChaos Yeah, apps continue to run in the background. They can take screenshots at any point.

CodesInChaos

Being able to take a screenshot of other applications should require a special privilege

Gilles

@CodesInChaos isn't the usual assumption that malware can root the phone anyway?

many vendors don't provide updates for Android, so you end up accumulating the known vulnerabilities

CodesInChaos

no idea how often root exploits turn up

Gilles

@CodesInChaos I dunno, it's harder to keep track with Android because sometimes the exploit is in vendor-specific configuration or drivers

CodesInChaos

11:40

I'd expect quick fixes when using a good android distribution

Gilles

with iPhones most of the relevant data points are on Wikipedia

CodesInChaos

(most vendor specific distributions don't count as good)

Gilles

@CodesInChaos sure, but most users use whatever their vendor provides

Iszi

11:51

@ScottPack You awake in here? Gonna come join the THC?

Scott Pack

@Iszi Just got to the office

That's creepy. Someone just text me about it.

Iszi

@ScottPack Ah. Had a feeling that might have been it.

@ScottPack You're welcome.

Scott Pack

Where's the room?

Oh, that was you!

/me fixes his contacts list

Iszi

@ScottPack Over here: chat.stackexchange.com/rooms/1380/security-town-hall-chat

Scott Pack

danke

Gilles

12:01

@Polynomial Hey, it's starting!

Scott Pack

Sshh!

@AviD That's "smack talk" dear.

AviD

@ScottPack no, that was the gay version of it.

not that there's anything wrong with it.

Scott Pack

But I don't wunna be a pirate.

AviD

@ScottPack shush, you need to concentrate.

yknow, so you dont say something stupid about rape victims.

Scott Pack

Boiler plate, boiler plate, blah blah

Define "stupid"

AviD

12:04

@ScottPack your face.

I am not supposed to answer, right....?

Terry Chia

@AviD what do you think? :P

AviD

@TerryChia I feel like I'm being interrogated! I want to be helpful! :D

oo @ScottPack is talking about his own face!

2

Rory Alsop

heh - @AviD - Stanley :-)

AviD

@RoryAlsop been reading up on it, since it's been mentioned here a while ago. Luvving it.

Scott Pack

@AviD Cuz my face is awesum.

Rory Alsop

12:19

@AviD I hadn't heard of it before, but it has become timesink

Terry Chia

@ScottPack mods need to be able to spell right.

there, i said it! :P

AviD

oh snap @Iszi started with the mudslinging. This is gonna get fun!

Terry Chia

12:41

Has anyone heard of Nicter?

awesome tech, i saw a presentation on it today.

Scott Pack

@TerryChia That's true. Moderators, on an ostensibly English site, should have a strong grasp of spelling and grammar.

Terry Chia

@ScottPack waddya syaing nwo?

Rory Alsop

@ScottPack I thot this waz a Scottish site, ye ken!

2

Scott Pack

English language. My sincerest apologies for any unintended implications.

Terry Chia

@RoryAlsop Contrary to popular believe, the scottish DO NOT run the world.

Rory Alsop

12:53

@TerryChia eh, wot now?

shurely shome mishtake

Terry Chia

@RoryAlsop Sorry for the cold, hard truth... Bacon?

Rory Alsop

mmm - bacon

Scott Pack

@TerryChia LIES

Rory Alsop

bacon cookies?

Scott Pack

Well, I suppose the Scots don't run the world. They just invented it.

Terry Chia

12:57

@ScottPack No, the martians did.

Rory Alsop

@ScottPack oh, we leave others to do the admin - sure

Scott Pack

@RoryAlsop Admin duties cuts into drinking and being awesome time.

3

Transcript for