The DMZ

MechMK1

8:31 AM

@ITGremlin Yeah, you can do that.

With the obvious caveat that you need LoS to your target machine

MechMK1

10:23 AM

0

Q: Can product keys harm computer?

I downloaded Windows from Microsoft website. Then I type in (or paste) a product key that I bought from an unofficial seller to activate Windows. Can that lead to any security issues?

My first instinct would be to say no, but I don't know for 100% sure

The biggest issue I could think of would be that one key would be sold multiple times, and at some point it would not activate windows anymore

I bought a key from the microsoft store (finally successfully after 6 attempts and 3 conversations with Microsoft support) and the key worked both for my gf's PC and for mine

MechMK1

10:57 AM

Does anyone have a source for the "50% of attacks start internally" factoid?

IT Gremlin

11:19 AM

What useful sounds or vibrations would the case emit though?

Conor Mancone

@MechMK1 I use that a lot. I have read it in a few articles. I'll try to find my usual references sometime this morning

MechMK1

@ITGremlin If you do crypto, you can use that to determine some internal state

Electromagnetic attack

In cryptography, electromagnetic attacks are side-channel attacks performed by measuring the electromagnetic radiation emitted from a device and performing signal analysis on it. These attacks are a more specific type of what is sometimes referred to as Van Eck phreaking, with the intention to capture encryption keys. Electromagnetic attacks are typically non-invasive and passive, meaning that these attacks are able to be performed by observing the normal functioning of the target device without causing physical damage. However, an attacker may get a better signal with less noise by depackaging...

@ConorMancone That would be really cool!

I want to make a question like "What is a Threat Model and how do I make one?"

Conor Mancone

11:34 AM

@MechMK1 This article links to a study from Intel which is where I first heard this statistic. I always summarize it as "About half of data breaches start internally, with half of those being accidental and half on purpose" infosecurity-magazine.com/news/…

However, you can find similar-ish results in a number of articles

The numbers and things being studied vary, but overall it seems pretty safe to estimate that half of all breaches start internally.

Most articles I find focus on the healthcare sector

forbes.com/sites/louiscolumbus/2018/08/31/…

itbrief.com.au/amp/story/…

hcinnovationgroup.com/cybersecurity/news/13030905/…

MechMK1

12:14 PM

@ConorMancone Damn, that's nice

0

Q: What is a Threat Model and how do I make one?

I asked a question on what I need to do to make my application secure, when somebody told me That depends on your threat model. What is a Threat Model? How do I make a Threat Model for my application?

threat-modeling

Filipe dos Santos

1:07 PM

@MechMK1 Great timing for this question, I just finished the Threat Modelling course we have to take as Security Experts in my company, I tried to fit as much information as possible in my answer without being too specific about internal policies that may differ form company to company :)

MechMK1

@FilipedosSantos Thank you very much for your answer. I'm waiting for more answers before nominating one as "accepted"

Filipe dos Santos

@MechMK1 Sure, I also want to see what others have to add.

MechMK1

1:23 PM

Also the "Tables are a result of the table-making process" comment from Schroeder was great :D

Luc

1:54 PM

Soteri is editing a shitload of questions, which I guess is okay so long as they're actual improvements

but then when an edit gets rejected: security.stackexchange.com/review/suggested-edits/149427

they just do it again: security.stackexchange.com/review/suggested-edits/149436

how does one report this kind of thing? I happened to recognize the title from a few hours ago, but the next reviewer won't

this morning Soteri also got an edit through because the post's author approved it in the 20 seconds it took me to write a reject reason. Had to roll that one back...

@Luc I guess just make a meta post?

(hah, I can apparently reference a post of myself and I get a notification and "@luc" and everything)

Luc

2:19 PM

meta post was made: security.meta.stackexchange.com/questions/3348/…

MechMK1

@Luc Who is Soteri?

Luc

see any of these links

not sure what you want me to say, would his user ID help?

MechMK1

Wait, maybe I am dumb

Yes, I looked at the original authors

And those were all different people

Luc

ah, I see the confusion :)

MechMK1

Yes, I am dumb

MechMK1

3:21 PM

Quote of the day before I go offline:

Stack Exchange is here to answer questions, not to solve problems.

Journeyman Geek

BORING :D

WHO SAID THAT?

MechMK1

Don't remember who said that

Maybe I did and I forgot

Journeyman Geek

I'm here to solve problems. Its more fun :D

MechMK1

Someone said it at some point, probably

Journeyman Geek

OR YOU DID JUST NOW

MechMK1

3:22 PM

No I remember saying it before

But I don't emember when

Journeyman Geek

I'm on to you. Like when I am on to @J.J eating cheese.

MechMK1

I have so much more dirt on me than @J.J eating cheese

Journeyman Geek

you should get that cleaned up, its not hygenic

MechMK1

It's hygienic and hypoallergenic dirt imported from Czechoslovakia

Fire Quacker

5:21 PM

Does anybody have a guess at what this hashing algo is? I was looking through the database of an application and the hashes caught my eye. I'm trying to figure whether it's bad enough to contact the developers about. Here's a list of plaintexts with the hashes right beneath:

aaaa
yOhLRaD5Bho=

aaaaa
NWQ5031WjPU=

AAAA
fYSovAvL99g=

AAAAA
Oqv4DHfVv6A=

aaaaaaa
/treCLN6Ikk=

aaaaaaaa
7wng7bQ2i2r/0xhwEj6++w==

aaaaaaab
u57jg7fTYor/0xhwEj6++w==

aaaabaaa
sp+IHbsLCvT/0xhwEj6++w==

aaabaaaa
ySO63pgdXXX/0xhwEj6++w==

A. Hersean

5:49 PM

It looks like DES or 3DES encrypted data, without IV and without chaining, so maybe in ECB mode or a poorly implemented CTR mode.

But I might be completely wrong. In any case, it's not directly based on a common CRC or truncated hash.

Conor Mancone

6:35 PM

@FireQuacker No modern hashing algorithm makes hashes that are that short. The equals signs at the end are also a sign of base64 encoding data without a fixed byte length. That strongly suggests that this isn't even a hashing algorithm, and certainly isn't an "approved" one

ThoriumBR

base64 does not liked some of them...

Fire Quacker

When I tried base64, it didn't like any of them

@Conor DES puts an = at the end too, doesn't it?

Conor Mancone

@FireQuacker It could be base64 encoded binary data.

@FireQuacker I have no idea. Many encryption and hashing algorithms take the raw binary output and base64 encode it for easy transport. In such cases it is base64 data, but when you decode it you will get gibberish

Fire Quacker

I get zippo when I try to decode this as base64

Conor Mancone

To be clear, I'm not sure if this is base64 encoded or not. I would say the main take away is that the hash is far too short to be a modern algorithm.

Fire Quacker

6:40 PM

What bugs me is that some parts of it remain the same when you change a letter in the plaintext. Just really weird.

Conor Mancone

@FireQuacker Just trying to clarify here - I'm not insisting that this is base64 encoded. However, one of the main uses of base64 encoding is to take binary data and encode it as ascii for easy transport. While sometimes base64 encoding is used to encode data that is already Ascii, and therefore it decodes into something readable, it can also be used to encode binary. In that case decoding it will just give you gibberish.

It looks like it is operating on chunks of data, which is very dangerous

Notice how this:
aaaaaaaaa -> 7wng7bQ2i2oQ3J22PVUDBg==
And this:
aaaaaaaaaaa -> 7wng7bQ2i2qyGAtrQJzK3A==
Share a common prefix:
7wng7bQ2i2

Fire Quacker

Other hashes share a common ending also

Conor Mancone

Which is also shared by aaaaaaaab and aaaaaaaac

That likely means that the string is being separated into chunks and those pieces are being transformed separately. Very dangerous (and not the behavior of any actual hash)

Fire Quacker

baaaaaaa is the weird one. It shares the same ending as aaabaaaa (and everything else with 8 characters)

Conor Mancone

That reminds me of this

It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.

As a quick explanation, adobe also split up long passwords and encrypted the different pieces separately, making it dramatically easier for them to get cracked

ThoriumBR

6:48 PM

I would ask the devs what they are doing... and post back here later

Conor Mancone

Also, there clearly isn't a salt being used. So you can state for sure that this was all done wrong

Fire Quacker

No salt is actually a feature here for some weird reason

ThoriumBR

"weird" is a nice word describing everything here

Fire Quacker

The application has no way (or used to have no way) to reset a password. So... if you forgot your password, they could create a new user on another system, using a simple password, and then copy the hash from that database into this one.

ThoriumBR

@FireQuacker seriously?

Fire Quacker

6:52 PM

Seriously

Hey, quit banging your head on the wall!

ThoriumBR

man, if this is stored on a db, and someone knows how to encrypt (or encode) the passwords, make a python/php/bash script to read the password from the terminal twice (to verify), encode it, and change the database...

creating a password somewhere else, and copying to it is bizarre...

Fire Quacker

Yup

Their whole use of databases is strange to me. When I have database access, I can run queries that finish almost instantly that take several minutes when their application performs the same function. There are also features that (judging from the database) should be simple to implement that they took years to add.

Conor Mancone

@ThoriumBR I've totally used that trick to cheat and reset a password for my boss in our system. He forgot his password and asked me to fix it (rather than using the password reset). I use a modern hashing algorithm with salts, but of course the salt is stored with the password in the database, so if you copy the whole thing over from one account (aka mine) to another account, the password works fine

Requires database access of course...

Fire Quacker

Database access is amazing

If you ever want to make nonprogrammers thing you're some kind of uber genius hacker, database stuff will blow their mind

"Wait, you wrote a program to do that without using the application???"

ThoriumBR

I once saw an application where the WHERE clause were executed on the application side. it would iterate thru every record looking for the required record...

Fire Quacker

7:01 PM

If it passes the tests...

ThoriumBR

apparently it worked very fast on the dev computer before going into production, and got slower and slower with time...

I saw another application (enterprise one!) that on the event of a connection failure between the app and the queue manager would store all records on flat files (one file for each record), and retry connection every second. when the connection got established again, the application would open every file, read the contents, submit to the queue, and truncate the file...

I saw a directory with dozens upon dozens of empty files, and the application opening each one of them every second just to realize they were empty, closing the file... and doing the same again on the next second.

when I was at college, one of my teachers gave us a lot of lessons on optimization, and asked us to think big every time. every function we would have to tell him how it would scale, how we were avoiding unnecessary io, how we were using caches, things like that. but most programmers have no idea. they know the commands, functions, and make a mess integrating them all.

Conor Mancone

The longer I'm in this business the more I wonder how anything works...

ThoriumBR

@ConorMancone bubble gum, electric tape, and faith. lots of faith...

Conor Mancone

8:16 PM

So, I have a question that doesn't fit on the site

I've been thinking about building a tool to help with the automatic discovery of a certain class of "Improper Access Control" vulnerability

Here's the use case: you're performing penetration testing on a site, just browsing around and getting to know it. You're logged in with a test account. You note the credentials for this test account (specifically cookies/session tokens, not username/password). You record these details with the tool

You then create a second account, login to that one, and continue browsing the site like normal.

In the background though the tool is automatically replaying all the HTTP calls that the browser makes, but now using the credentials for your other account.

Therefore automating the process of finding endpoints that don't limit resource access to the owner (which should be relatively simple to detect)

My questions are:

1. Is there already a well-known tool that does something like this?
2. Where would be a convenient "place" to build something like this? I was thinking a browser extension or an OWASP Zap extension, simply because those are things I'm mildly familiar with

I'm happy for any and all input, up to and including, "this is a terrible idea"

My goal is a combination of learning, creating an open source project so I can pretend not to be a newbie to penetration testing, and also (perhaps) finding actual vulnerabilities in bug bounty programs

ThoriumBR

I believe burp can do that already... if you replace the session cookies with another value, you can replay the browsing session

Conor Mancone

8:32 PM

@ThoriumBR Interesting... that's a good way to do it too (I'm still only mildly familiar with such tools, and have only used OWASP Zap, not burpsuite)

Is burpsuite community edition useful? I've always avoided burpsuite because I'm not at a point where I'm ready to shell out $400/year for what is effectively a hobby.

ThoriumBR

community edition is good enough, for starters

if it's a hobby, $400 is too much to pay... even if people pay that on xbox or playstation subscription yearly...

Conor Mancone

11:41 PM

@mechmk1 already making itself useful! security.stackexchange.com/questions/225045/…

Transcript for