« first day (3263 days earlier)      last day (20 days later) » 

3:24 AM
Q: Exploiting vulnerabilities in the C code

Prashin JeevaganthI'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for Buffer Overflow or Integer Overflow that lead to other consequences, but due to the context of the pro...

Anyone here good with seeing vulnerabilities in code? I need some help :)
4 hours later…
7:30 AM
@MechMK1 I continue to be appalled at how many people are unable to form a basic google query. I am shocked at people who spend more time writing out a question here than I spend finding an answer for the question on Google. I can often find answers in under 2 minutes. And many times, using the post's title or a phrase from the post. I don't know what the knowledge gap is, or the conceptual gap, but I am at a loss to understand how to help.
2 hours later…
9:21 AM
@schroeder My basic test is if I can google the title of a question and I get an answer, then I feel like they put in 0 effort
If I need to spend like 30 minutes doing a search of various sources (whitepapers, RFCs, etc.), then it's fine
But yeah...damn....
9:45 AM
@MechMK1 If I can't find a positive route to an answer within 5 minutes, fair enough, asking for direction is fine.
@schroeder Usually what takes me long is to sift through some RFC to find an authoritative answer.
Is it normal that I have more bytes after AES encryption?
#include <stdio.h>
#include <openssl/aes.h>

int main(void)
    unsigned char key[] = {
            0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
            0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f

    unsigned char text[]="hello world!";
    unsigned char enc_out[80];
    unsigned char dec_out[80];

    AES_KEY enc_key, dec_key;

    AES_set_encrypt_key(key, 128, &enc_key);
original:	68 65 6C 6C 6F 20 77 6F 72 6C 64 21
encrypted:	86 25 39 5B 4E 3C 6E 5E B6 B7 4F A8 6E C8 49 55 FF FF FF FF
decrypted:	68 65 6C 6C 6F 20 77 6F 72 6C 64 21
@Rick Depending on the mode: YES
How do I know how many more bytes I would get?
Is there a return value I can get ?
I will look that up
Apparently OpenSSL's aes_encrypt uses AES-CBC
Which means that they prepend the IV to the message
Depending on the length of the message, the maximum overhead is two blocks
The minimum overhead is one block and one byte. The maximum overhead is two blocks
9:59 AM
Thanks. Btw, any basic / elementary encryption tutorial recommended? Maybe something like "symmetic encryption 101"? I have no idea about e.g. what `EVP` or `ctx` are.

I want to encrypt some TCP data with symmetic encryption library. And what should I learn and know? For example, I wouldn't know there would be more data after encryption if I had found this example. I would totally mess up if I send same number of bytes.
EVP is just a subset of the OpenSSL functions, designed to make encryption easier to implement
What it stands for...good question :D
As far as I am aware, EVP has no deeper meaning in cryptography.
Give a man a fish, and you feed him for a day; teach a man to fish , and you feed him for a lifetime.
CTX usually stands for context
How many bytes are there for 2 blocks?
One block is 128 bits
10:04 AM
ok I see. ` AES_set_encrypt_key(key, 128, &enc_key);`
128 as an argument
Let me see
Where did you get that?

> The minimum overhead is one block and one byte. The maximum overhead is two blocks
That's how AES-CBC works
It's just crypto knowledge
Any elementary tutorial recommended?
For learning how cryptography works or for applying cryptography? That's two different things
10:06 AM
Books are ok as too. Maybe I should look through some basic knowledege?
applying of course...
I don't know how basic "basic" is for you
What do you know about cryptography?
If I say symmetric/asymmetric encryption, does that mean something to you?
Or "mode of operation"?
yes I knowthat
mode of operation, no idea what it is
For exmaple, you said "That's how AES-CBC works". That what I don't know.
Okay, so I assume that you have very basic cryptography knowledge
Let me see
If I remember correctly, my cryptography knowledege mainly comes from this post . blog.cloudflare.com/…
I figured out some basic concepts and how they works.
The details behind that? No.
That's a very practical look
Basically "You don't need to understand any of it, you just need to understand how to use it"
Like how a cab driver doesn't need to know how a car works, just needs to be able to drive one
10:13 AM
For example, I know RSA DH sort of thing are asymmetric encryption and are used for key exchange, and AES, RC4, chacha are for symmetric encryption.
@MechMK1 exactly
Cryptography Engineering: Design Principles and Practical Applications, Ferguson, N. and Schneier, B. and Kohno, T. (ISBN-13: 978-0470474242)
This is a good recommendation
And if you want a starting point (focussed primarily on practical application): bettercrypto.org
Like I asked you just now, how could I program correctly if I don't even know there will be extra byes after AES-CBC?
Ok thanks I am going to take a look.
@Rick The correct answer is: Crypto is a blackbox for you
All you need to know is what the input and the output mean. How the bytes came to be, why something is slightly larger than the input, etc. doesn't matter for practical purposes
But god at least somewhere tell me that I will have extra bytes in output. "You may need to send 2 more blocks bytes to the server"
Don't think about it like this
Think about it like "Send the output of the encryption process to the server"
If you use a good library like libhydrogen, this will be solved for you
@Rick What did you delete?
10:20 AM
@MechMK1 Ok I will check libhydrogen later on. I have a program need to test with some aes encryption.
If you look at this, you will see how the library is designed. Important is that it is high level. What that means is that functions are modeled after what problems they solve, rather than what cryptographic primitives they are based on
@MechMK1 Ah. Didn't delete anyithing. I was going to say that I didn't get the "Send the output of the encryption process to the server" difference. ;
You have to think about it abstractly. Don't think "I need to send the amount of bytes of input plus padding plus IV". Think "I need to put in my key and my data, and send the output"
But don't I need to know the exact bytes to send ..?
Exactly. You get that from the output of the encryption function
Look at the example here
It's simple, and it works.
10:27 AM
I see
One last quick question before meal
Go ahead
Would it be fine if I just do a very simple bitwise operaton for the data? I just want to run a test.
Anyway I will try the simplest bitwise later.
What do you mean with "would it be fine"? What are you worried that could go wrong?
Sorry. Bad question :(
No, it's not
There are no bad questions
But I am replying to your question "Would it be fine if...?" with "What are you worried might happen?"
10:32 AM
No.It's just I want to see if I simply do some bitwise operations and wonder whether the data will pass the firewall.
I would go for a test later.
That depends on the firewall, but in general firewalls care more about where data is from and where it goes to, rather than what is inside
Yes. It blocks me to some places ;)
All traffic to that location?
Anyway, thank for your recommendations. I will come back to take a look after meal.
Then again, it's regarding the source and the destination, not the content
Have a nice meal
10:35 AM
Don't write hearts, please
2 hours later…
12:22 PM
@ConorMancone I hope tonight I get to do a bit more painting. I want to finish those Painboys
12:36 PM
Is anyone here familiar with buffer overflow?
Q: Exploiting vulnerabilities in the C code

Prashin JeevaganthI'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for Buffer Overflow or Integer Overflow that lead to other consequences, but due to the context of the pro...

My post was answered, but I needed clarifications on what the answer meant as I couldn't replicate it
Sure, let me see
Thank you @MechMK1
Alright, so the first part is the following: READ_QRCODE(m) returns bytes, but treats them like a string.
A string in C is always terminated with \0 (NULL)
So what you can do is you can craft a malicious QR code that is just 100 bytes 0xFF, for example
You mean the QR code itself could be non-null terminating already?
Yes, correct
12:50 PM
so before strcpy is done, the Buffer Overflow already occurred?
Basically, because strcpy would not know where the end of the string is
it might read endlessly, until it tries to read outside the process memory
I mean, where is the line of code that the error happened?
I would say L7
Either L7 or L8
I don't know myself without testing it
I tried making a non terminating array like {'a','a'} and strcpy it to a buffer
doesn't really work for some reason
Let me see
Ah, probably because it would keep reading until strcpy finds s, which defaults to null
12:59 PM
The fact that the question states "potentially" may indicate that it may not always work that way
Yea but what I meant is I tried creating a char [] s such that it has {'a','a'} and it doesnt read infinitely
yes, because what follows s may be \0
You mean like the memory location adjacent to the last entry of s?
Like it's relying on luck? And just happens when I tested it, it happens that the adjacent memory contains \0
It depends on what is directly after s in memory
Or in this case, what's directly after m
You may think it's like 100 bytes of m and that directly followed by 200 bytes of s
But it may be that there is a gap. It depends on the compiler. It could be anywhere
Furthermore, it depends on how strcpy is actually implemented
It's completely up to the system you compile on or even your compiler how to implement it
1:26 PM
> The Hydrogen library is a small, easy-to-use, hard-to-misuse cryptographic library.
I like that
@Rick Exactly, that's why it's good
Why is not on the Comparison_of_TLS_implementations list?
That's what the pit of success is there fore
@Rick Because it's not a TLS implementation
ah stupid me
I see haha
But it doesn't have an official website.
If you need TLS, I recommend bouncycastle
Github is fine enough
1:28 PM
I remember that. You told me last time.
OK I see
One small question, where did you know libhydrogen?
When you do lots of applied crypto you just hear the opinions of lots of people
I searched with keyword "crypto library" on Github and it didn't appear on the first or second page.
haha ok I see
Well, here is the thing: most people don't need a crypto library
Next time when I recommend this to my friends I would tell them your name.
I use crypto on everything and I never needed one
You can, but the better thing to do is to point them at Cryptography
And the Side Channel, the chat there, will usually have an open ear for applied crypto
1:35 PM
Is there a chat for cryptography?
Wow I don't know about that
@MechMK1 What do you mean by you use crypto on everything but never need a library?
There is a chat for every stack exchange site
Well, for example my personal website uses HTTPS
Ah I see
That's crypto, but I didn't need a crypto library for it. Instead, I set up nginx to do it for me
Same for my teamSpeak server, etc...
Yes indeed.
And this is true for the vast majority of scenarios
It's also what @ConorMancone meant when he said he never had to use any crypto library, even if he wrote lots of server software.
I mean, I am not trying to discourage you from becoming a person who can do these things. But what I am trying to say is that if you look for practical things to learn, it's better to know what these algorithms mean, what their benefits and drawbacks are and how to apply them correctly.
1:39 PM
@MechMK1 stackoverflow.com has its own chat site and it's easy to get to it. chat.stackoverflow.com. Just add the chat. prefix. But for other SE sites, you might need to search that on your own, at chat.stackexchange.com
@Rick You can just go to that site and then open the chat
I remember I spent some efforts finding this chatroom. Because it's called DMZ....
Do you see the top right button on security?
The one that looks like a speech bubble with stripes
If you click on it, you see Information Security, followed with "Help", "Chat" and "Log Out"
You can do that on every site
Let me see...
! I see
Well I didn't know that before.
It works everywhere
Also, this may be a good library: github.com/google/tink
1:43 PM
Thanks for telling me that
I have no personal experience with it, but google usually doesn't fuck around when it comes to libraries
Although, given their track record, support may be ended without notice
@MechMK1 Indeed. And with let's encrypt getting an SSL certificate on a website is officially the easiest thing ever.
@MechMK1 Yes I argree with you. I merey want to just learn the practial stuff as you described. I don't care about the things behind.
@ConorMancone Let's Encrypt is hands down one of the best things to ever have happened to security.
@Rick Then bettercrypto.org is the best thing to read.
It really is. It's funny how there are people who legitimately hate it...
1:46 PM
@ConorMancone Just shills for VeriSign :D
Ya I checked it just now. And I noticed the book you recommended is also on the suggest reading list.
But some of those might already have been documented well on the official documents, e.g. Nginx ssl settings.
@Rick Literally anything ever written by Bruce Schneier is a must read for the growing crypto nerd
Ok I will keep his name on my mind as logn as possible.
I've used let's encrypt bot for several times. It's great.
If you are in crypto it'll be hard not to have him on your mind :D
What's your person website btw?
1:48 PM
> Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.
Wanna take a look :)
Not much there
It's mostly for people who see my server when they browse for KF2 servers
Or back then, when I hosted a KF2 server
Good times
:) maybe I can find your personal contact info and disturb you from time to time. :)
Not much luck there, I'm afraid
If you want to find me, the DMZ is your best bet
haha I know
1:50 PM
Here from monday to friday, 09:00-17:30
Btw I ge the Design Principles and
Practical Applications book. 384 pages. I will read it some day.
Yes and I know your schedule ;P .
But as I mentioned earlier, for crypto I can't recommend the Side-Channel enough
Got it.
I am going to read the libhydrogen. See you later
See you
2:27 PM
Today I learned that the Soviet Union spread propaganda that HIV is the result of a US bioweapon program gone awry.
Can I clarify that buffer overflow only occurs when the canary value has been overwritten
A buffer overflow occurs whenever you write more than you allocated.
If you allocate 100 bytes and write 101 bytes, a buffer overflow occured.
if I have a char [80] buffer, now I write a char * of strlen 80 into it using strcpy
is this Buffer overflow?
I get stacksmash sometimes, or seg fault or abort trap
Yes, because strlen does not take the terminator into account, as far as I know
So in order to hold a string with length 80, you would need 81 bytes
So what is so bad about a buffer overflow, like how does a hacker exploit this?
2:39 PM
That depends entirely on the application.
the only bad thing I can think of is stacksmash, but if the code is written such that it only overwrites about 1 byte extra, dont think that will happen
Imagine you have two arrays. One holds untrusted input, the other data upon which is decided how to act
Imagine an attacker can write to both to them
Big problem
I'll be off for 10-20 minutes, gotta catch my train
3:03 PM
Alright, I'm back
I swear
I have no idea why the given code doesnt work the way I think it does
and its affecting my explanation
What's the REAL svg security risks?
Can you be more specific?
3:19 PM
Not really.

SVG poses a security risk, according to a software I'm using (more specifically, a wordpress plugin)
Then I think you need to ask your plugin why it thinks it is a security risk.
I'll let you reflect on your answer/statement for a minute.
lol, I'll let you reflect on your question for a minute :p
Really though: it's a very broad question. I realize this is chat, but narrowing it down a little bit is still helpful. It sounds like your question is: "why does my plugin think that SVG is a security risk?", but it is really only your plugin that can answer that. If you can at least clarify how you are using SVGs, then a start of an answer may be possible
Still mad at mobile games for being trash
Q: Buffer Overflow in the C program

Prashin JeevaganthI'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. Here is the question. Sorry the original condition of my document is badly scanned before it was handed to me. I have several discussions with...

Can someone help me out with this problem I'm facing?
Like try replicating a scenario that strncpy doesn't cause an immediate exception and continues running the next line of code after it
3:38 PM
@PrashinJeevaganth Please take the time to type what's on the page. Large scans of code may draw ire
@ConorMancone No but bro, I checked online and it's like a known thing. It's not "my plugin" also, the plugin doesn't say "we think" or "for our plugin". It broadly says: "SVG poses a security risk" like someone would say: "water is life".
So I was just poking a quick: "Yo, why?"
to my OPSEC nicas
SVG in a few particular contexts can have some additional security risks, but I would hardly classify it as a general security risk. The fact that it isn't "your" plugin doesn't really matter: clearly the authors of the plugin think that SVG is a security risk, but with such a broad statement there's not much more I can say, which is why I suggest that you may be best off trying to figure out why the plugin authors think it is a security risk
It might as well just say, "Browser's are a security risk".
@MechMK1 what is ire?
You may make people grumpy
@PrashinJeevaganth People may dislike it and downvote it
3:44 PM
Oh I see
The code portion is quite small, but the question description is huge
If I had to screenshot, it's for the question description and not for the code
@ConorMancone So, just to confirm, SVG has no particular security risk, with general use?
It has some risks in some specific context's that I am aware of. How are you using SVGs?
4:14 PM
Wow I got different binary output for the same plain text input.
I didn't expect that. I was thinking it should give me the same output as Hash. Now I know they are totally different from practice.
@Rick For your security
Else an attacker can brute force the message
@ConorMancone Wordpress Icon
4:32 PM
@OakSecurity lol, you really want to make me drag this out of you, huh? Is it just a static file that is being displayed on the page? Are you talking about user-generated SVG files?
In general if you have a static SVG file that you generated and is being included on the page in an <img> tag, then there are no security issues
@ConorMancone What's paranoia anyways.
If you are allowing users to upload SVG files and storing them on your server then you may have a problem because scripts inside the SVG file may be executed by the browser (depending on the response type returned by the server) if and only if a victim can be tricked into navigating directly to the SVG file location. However, if an SVG file is loaded in an img tag, scripts in it will never be executed
Perfect answer.
5:24 PM
I'll spend the rest of the day playing vidya, so cheers and have a good evening
Have fun!
5:42 PM
@MechMK1 ^.^
6 hours later…
11:30 PM
Are there any policies for people who make accounts to ask just one question? (and who have made at least two such accounts?)
Nevermind, they're not making multiple accounts; they're unregistered users.

« first day (3263 days earlier)      last day (20 days later) »