The DMZ - 2019-11-22

« first day (3263 days earlier) ← previous day next day → last day (1605 days later) »

Prashin Jeevaganth

3:24 AM

0

Q: Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for Buffer Overflow or Integer Overflow that lead to other consequences, but due to the context of the pro...

buffer-overflow reverse-engineering secure-coding debugging integer-overflow

Anyone here good with seeing vulnerabilities in code? I need some help :)

4 hours later…

7:30 AM

@MechMK1 I continue to be appalled at how many people are unable to form a basic google query. I am shocked at people who spend more time writing out a question here than I spend finding an answer for the question on Google. I can often find answers in under 2 minutes. And many times, using the post's title or a phrase from the post. I don't know what the knowledge gap is, or the conceptual gap, but I am at a loss to understand how to help.

2

2 hours later…

9:21 AM

@schroeder My basic test is if I can google the title of a question and I get an answer, then I feel like they put in 0 effort

If I need to spend like 30 minutes doing a search of various sources (whitepapers, RFCs, etc.), then it's fine

But yeah...damn....

9:45 AM

@MechMK1 If I can't find a positive route to an answer within 5 minutes, fair enough, asking for direction is fine.

@schroeder Usually what takes me long is to sift through some RFC to find an authoritative answer.

Is it normal that I have more bytes after AES encryption?

#include <stdio.h>
#include <openssl/aes.h>

int main(void)
{
    unsigned char key[] = {
            0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
            0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
    };

    unsigned char text[]="hello world!";
    unsigned char enc_out[80];
    unsigned char dec_out[80];

    AES_KEY enc_key, dec_key;

    AES_set_encrypt_key(key, 128, &enc_key);

original:	68 65 6C 6C 6F 20 77 6F 72 6C 64 21
encrypted:	86 25 39 5B 4E 3C 6E 5E B6 B7 4F A8 6E C8 49 55 FF FF FF FF
decrypted:	68 65 6C 6C 6F 20 77 6F 72 6C 64 21

@Rick Depending on the mode: YES

How do I know how many more bytes I would get?

Is there a return value I can get ?

I will look that up

Apparently OpenSSL's aes_encrypt uses AES-CBC

Which means that they prepend the IV to the message

Depending on the length of the message, the maximum overhead is two blocks

The minimum overhead is one block and one byte. The maximum overhead is two blocks

9:59 AM

Thanks. Btw, any basic / elementary encryption tutorial recommended? Maybe something like "symmetic encryption 101"? I have no idea about e.g. what `EVP` or `ctx` are.

I want to encrypt some TCP data with symmetic encryption library. And what should I learn and know? For example, I wouldn't know there would be more data after encryption if I had found this example. I would totally mess up if I send same number of bytes.

EVP is just a subset of the OpenSSL functions, designed to make encryption easier to implement

What it stands for...good question :D

As far as I am aware, EVP has no deeper meaning in cryptography.

Give a man a fish, and you feed him for a day; teach a man to fish , and you feed him for a lifetime.

haha

wiki.openssl.org/index.php/EVP

CTX usually stands for context

How many bytes are there for 2 blocks?

One block is 128 bits

10:04 AM

ok I see. ` AES_set_encrypt_key(key, 128, &enc_key);`

128 as an argument

Let me see

Where did you get that?

> The minimum overhead is one block and one byte. The maximum overhead is two blocks

That's how AES-CBC works

It's just crypto knowledge

Any elementary tutorial recommended?

For learning how cryptography works or for applying cryptography? That's two different things

10:06 AM

Books are ok as too. Maybe I should look through some basic knowledege?

applying of course...

I don't know how basic "basic" is for you

What do you know about cryptography?

If I say symmetric/asymmetric encryption, does that mean something to you?

Or "mode of operation"?

yes I knowthat

mode of operation, no idea what it is

For exmaple, you said "That's how AES-CBC works". That what I don't know.

Okay, so I assume that you have very basic cryptography knowledge

Let me see

If I remember correctly, my cryptography knowledege mainly comes from this post . blog.cloudflare.com/…

I figured out some basic concepts and how they works.

The details behind that? No.

That's a very practical look

Basically "You don't need to understand any of it, you just need to understand how to use it"

Like how a cab driver doesn't need to know how a car works, just needs to be able to drive one

10:13 AM

For example, I know RSA DH sort of thing are asymmetric encryption and are used for key exchange, and AES, RC4, chacha are for symmetric encryption.

@MechMK1 exactly

Alright

Cryptography Engineering: Design Principles and Practical Applications, Ferguson, N. and Schneier, B. and Kohno, T. (ISBN-13: 978-0470474242)

This is a good recommendation

And if you want a starting point (focussed primarily on practical application): bettercrypto.org

Like I asked you just now, how could I program correctly if I don't even know there will be extra byes after AES-CBC?

Ok thanks I am going to take a look.

@Rick The correct answer is: Crypto is a blackbox for you

All you need to know is what the input and the output mean. How the bytes came to be, why something is slightly larger than the input, etc. doesn't matter for practical purposes

But god at least somewhere tell me that I will have extra bytes in output. "You may need to send 2 more blocks bytes to the server"

Don't think about it like this

Think about it like "Send the output of the encryption process to the server"

If you use a good library like libhydrogen, this will be solved for you

@Rick What did you delete?

github.com/jedisct1/libhydrogen/wiki

10:20 AM

@MechMK1 Ok I will check libhydrogen later on. I have a program need to test with some aes encryption.

If you look at this, you will see how the library is designed. Important is that it is high level. What that means is that functions are modeled after what problems they solve, rather than what cryptographic primitives they are based on

@MechMK1 Ah. Didn't delete anyithing. I was going to say that I didn't get the "Send the output of the encryption process to the server" difference. ;

You have to think about it abstractly. Don't think "I need to send the amount of bytes of input plus padding plus IV". Think "I need to put in my key and my data, and send the output"

But don't I need to know the exact bytes to send ..?

Exactly. You get that from the output of the encryption function

github.com/jedisct1/libhydrogen/wiki/…

Look at the example here

It's simple, and it works.

10:27 AM

I see

One last quick question before meal

Go ahead

Would it be fine if I just do a very simple bitwise operaton for the data? I just want to run a test.

Anyway I will try the simplest bitwise later.

What do you mean with "would it be fine"? What are you worried that could go wrong?

Sorry. Bad question :(

No, it's not

There are no bad questions

But I am replying to your question "Would it be fine if...?" with "What are you worried might happen?"

10:32 AM

No.It's just I want to see if I simply do some bitwise operations and wonder whether the data will pass the firewall.

I would go for a test later.

That depends on the firewall, but in general firewalls care more about where data is from and where it goes to, rather than what is inside

Yes. It blocks me to some places ;)

All traffic to that location?

Anyway, thank for your recommendations. I will come back to take a look after meal.

Then again, it's regarding the source and the destination, not the content

Have a nice meal

10:35 AM

❤️

Don't write hearts, please

2 hours later…

12:22 PM

@ConorMancone I hope tonight I get to do a bit more painting. I want to finish those Painboys

Prashin Jeevaganth

12:36 PM

Is anyone here familiar with buffer overflow?

1

Q: Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for Buffer Overflow or Integer Overflow that lead to other consequences, but due to the context of the pro...

buffer-overflow reverse-engineering secure-coding debugging integer-overflow

My post was answered, but I needed clarifications on what the answer meant as I couldn't replicate it

Sure, let me see

Prashin Jeevaganth

Thank you @MechMK1

Alright, so the first part is the following: READ_QRCODE(m) returns bytes, but treats them like a string.

A string in C is always terminated with \0 (NULL)

So what you can do is you can craft a malicious QR code that is just 100 bytes 0xFF, for example

Prashin Jeevaganth

You mean the QR code itself could be non-null terminating already?

Yes, correct

Prashin Jeevaganth

12:50 PM

so before strcpy is done, the Buffer Overflow already occurred?

Basically, because strcpy would not know where the end of the string is

it might read endlessly, until it tries to read outside the process memory

Prashin Jeevaganth

I mean, where is the line of code that the error happened?

I would say L7

Either L7 or L8

I don't know myself without testing it

Prashin Jeevaganth

I tried making a non terminating array like {'a','a'} and strcpy it to a buffer

doesn't really work for some reason

Let me see

Ah, probably because it would keep reading until strcpy finds s, which defaults to null

Prashin Jeevaganth

12:59 PM

Hmm

The fact that the question states "potentially" may indicate that it may not always work that way

Prashin Jeevaganth

Yea but what I meant is I tried creating a char [] s such that it has {'a','a'} and it doesnt read infinitely

yes, because what follows s may be \0

Prashin Jeevaganth

You mean like the memory location adjacent to the last entry of s?

Like it's relying on luck? And just happens when I tested it, it happens that the adjacent memory contains \0

It depends on what is directly after s in memory

Or in this case, what's directly after m

You may think it's like 100 bytes of m and that directly followed by 200 bytes of s

But it may be that there is a gap. It depends on the compiler. It could be anywhere

Furthermore, it depends on how strcpy is actually implemented

It's completely up to the system you compile on or even your compiler how to implement it

1:26 PM

> The Hydrogen library is a small, easy-to-use, hard-to-misuse cryptographic library.

I like that

@Rick Exactly, that's why it's good

Why is not on the Comparison_of_TLS_implementations list?

That's what the pit of success is there fore

@Rick Because it's not a TLS implementation

ah stupid me

I see haha

But it doesn't have an official website.

If you need TLS, I recommend bouncycastle

Github is fine enough

1:28 PM

I remember that. You told me last time.

OK I see

One small question, where did you know libhydrogen?

When you do lots of applied crypto you just hear the opinions of lots of people

I searched with keyword "crypto library" on Github and it didn't appear on the first or second page.

haha ok I see

Well, here is the thing: most people don't need a crypto library

Next time when I recommend this to my friends I would tell them your name.

I use crypto on everything and I never needed one

You can, but the better thing to do is to point them at Cryptography

And the Side Channel, the chat there, will usually have an open ear for applied crypto

1:35 PM

Is there a chat for cryptography?

Wow I don't know about that

@MechMK1 What do you mean by you use crypto on everything but never need a library?

There is a chat for every stack exchange site

Well, for example my personal website uses HTTPS

Ah I see

That's crypto, but I didn't need a crypto library for it. Instead, I set up nginx to do it for me

Same for my teamSpeak server, etc...

Yes indeed.

And this is true for the vast majority of scenarios

It's also what @ConorMancone meant when he said he never had to use any crypto library, even if he wrote lots of server software.

I mean, I am not trying to discourage you from becoming a person who can do these things. But what I am trying to say is that if you look for practical things to learn, it's better to know what these algorithms mean, what their benefits and drawbacks are and how to apply them correctly.

1:39 PM

@MechMK1 stackoverflow.com has its own chat site and it's easy to get to it. chat.stackoverflow.com. Just add the chat. prefix. But for other SE sites, you might need to search that on your own, at chat.stackexchange.com

@Rick You can just go to that site and then open the chat

I remember I spent some efforts finding this chatroom. Because it's called DMZ....

Do you see the top right button on security?

The one that looks like a speech bubble with stripes

If you click on it, you see Information Security, followed with "Help", "Chat" and "Log Out"

You can do that on every site

Let me see...

! I see

Well I didn't know that before.

It works everywhere

Also, this may be a good library: github.com/google/tink

1:43 PM

Thanks for telling me that

I have no personal experience with it, but google usually doesn't fuck around when it comes to libraries

Although, given their track record, support may be ended without notice

@MechMK1 Indeed. And with let's encrypt getting an SSL certificate on a website is officially the easiest thing ever.

@MechMK1 Yes I argree with you. I merey want to just learn the practial stuff as you described. I don't care about the things behind.

@ConorMancone Let's Encrypt is hands down one of the best things to ever have happened to security.

@Rick Then bettercrypto.org is the best thing to read.

It really is. It's funny how there are people who legitimately hate it...

1:46 PM

@ConorMancone Just shills for VeriSign :D

Ya I checked it just now. And I noticed the book you recommended is also on the suggest reading list.

But some of those might already have been documented well on the official documents, e.g. Nginx ssl settings.

@Rick Literally anything ever written by Bruce Schneier is a must read for the growing crypto nerd

Ok I will keep his name on my mind as logn as possible.

I've used let's encrypt bot for several times. It's great.

If you are in crypto it'll be hard not to have him on your mind :D

What's your person website btw?

1:48 PM

> Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.

Wanna take a look :)

Not much there

It's mostly for people who see my server when they browse for KF2 servers

Or back then, when I hosted a KF2 server

Good times

:) maybe I can find your personal contact info and disturb you from time to time. :)

Not much luck there, I'm afraid

If you want to find me, the DMZ is your best bet

haha I know

1:50 PM

Here from monday to friday, 09:00-17:30

Btw I ge the Design Principles and
Practical Applications book. 384 pages. I will read it some day.

Yes and I know your schedule ;P .

schneier.com

But as I mentioned earlier, for crypto I can't recommend the Side-Channel enough

Got it.

I am going to read the libhydrogen. See you later

See you

2:27 PM

Today I learned that the Soviet Union spread propaganda that HIV is the result of a US bioweapon program gone awry.

Prashin Jeevaganth

Hey

Can I clarify that buffer overflow only occurs when the canary value has been overwritten

A buffer overflow occurs whenever you write more than you allocated.

If you allocate 100 bytes and write 101 bytes, a buffer overflow occured.

Prashin Jeevaganth

if I have a char [80] buffer, now I write a char * of strlen 80 into it using strcpy

is this Buffer overflow?

I get stacksmash sometimes, or seg fault or abort trap

Yes, because strlen does not take the terminator into account, as far as I know

So in order to hold a string with length 80, you would need 81 bytes

Prashin Jeevaganth

So what is so bad about a buffer overflow, like how does a hacker exploit this?

2:39 PM

That depends entirely on the application.

Prashin Jeevaganth

the only bad thing I can think of is stacksmash, but if the code is written such that it only overwrites about 1 byte extra, dont think that will happen

Imagine you have two arrays. One holds untrusted input, the other data upon which is decided how to act

Imagine an attacker can write to both to them

Big problem

I'll be off for 10-20 minutes, gotta catch my train

Prashin Jeevaganth

ok

3:03 PM

Alright, I'm back

Prashin Jeevaganth

I swear

I have no idea why the given code doesnt work the way I think it does

and its affecting my explanation

What's the REAL svg security risks?

Can you be more specific?

3:19 PM

Not really.

SVG poses a security risk, according to a software I'm using (more specifically, a wordpress plugin)

Then I think you need to ask your plugin why it thinks it is a security risk.

I'll let you reflect on your answer/statement for a minute.

lol, I'll let you reflect on your question for a minute :p

Really though: it's a very broad question. I realize this is chat, but narrowing it down a little bit is still helpful. It sounds like your question is: "why does my plugin think that SVG is a security risk?", but it is really only your plugin that can answer that. If you can at least clarify how you are using SVGs, then a start of an answer may be possible

Still mad at mobile games for being trash

Prashin Jeevaganth

0

Q: Buffer Overflow in the C program

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. Here is the question. Sorry the original condition of my document is badly scanned before it was handed to me. I have several discussions with...

buffer-overflow c secure-coding

Can someone help me out with this problem I'm facing?

Like try replicating a scenario that strncpy doesn't cause an immediate exception and continues running the next line of code after it

3:38 PM

@PrashinJeevaganth Please take the time to type what's on the page. Large scans of code may draw ire

@ConorMancone No but bro, I checked online and it's like a known thing. It's not "my plugin" also, the plugin doesn't say "we think" or "for our plugin". It broadly says: "SVG poses a security risk" like someone would say: "water is life".

So I was just poking a quick: "Yo, why?"

to my OPSEC nicas

SVG in a few particular contexts can have some additional security risks, but I would hardly classify it as a general security risk. The fact that it isn't "your" plugin doesn't really matter: clearly the authors of the plugin think that SVG is a security risk, but with such a broad statement there's not much more I can say, which is why I suggest that you may be best off trying to figure out why the plugin authors think it is a security risk

It might as well just say, "Browser's are a security risk".

Prashin Jeevaganth

@MechMK1 what is ire?

You may make people grumpy

@PrashinJeevaganth People may dislike it and downvote it

Prashin Jeevaganth

3:44 PM

Oh I see

The code portion is quite small, but the question description is huge

If I had to screenshot, it's for the question description and not for the code

@ConorMancone So, just to confirm, SVG has no particular security risk, with general use?

It has some risks in some specific context's that I am aware of. How are you using SVGs?

4:14 PM

user image

Wow I got different binary output for the same plain text input.

I didn't expect that. I was thinking it should give me the same output as Hash. Now I know they are totally different from practice.

@Rick For your security

Else an attacker can brute force the message

@ConorMancone Wordpress Icon

4:32 PM

OK

@OakSecurity lol, you really want to make me drag this out of you, huh? Is it just a static file that is being displayed on the page? Are you talking about user-generated SVG files?

In general if you have a static SVG file that you generated and is being included on the page in an <img> tag, then there are no security issues

@ConorMancone What's paranoia anyways.

If you are allowing users to upload SVG files and storing them on your server then you may have a problem because scripts inside the SVG file may be executed by the browser (depending on the response type returned by the server) if and only if a victim can be tricked into navigating directly to the SVG file location. However, if an SVG file is loaded in an img tag, scripts in it will never be executed

Perfect answer.

5:24 PM

I'll spend the rest of the day playing vidya, so cheers and have a good evening

Have fun!

5:42 PM

@MechMK1 ^.^

6 hours later…

11:30 PM

Are there any policies for people who make accounts to ask just one question? (and who have made at least two such accounts?)

Nevermind, they're not making multiple accounts; they're unregistered users.

« first day (3263 days earlier) ← previous day next day → last day (1605 days later) »

Transcript for

Nov '1922

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile