The DMZ

ThoriumBR

00:00

I'm more a blue teamer, and that's the bad side of the equation... red teamers have to succeed once, we have to succeed all the time

nobody

10:09

@FireQuacker I hate you. Now I'll be spending the next half hour reading that :)

I mean I hope can finish it in half an hour and it doesn't take up the whole day...

MechMK1

10:39

35

A: Using Encrypt=yes in a Sql Server connection string -> "provider: SSL Provider, error: 0 - The certificate's CN name does not match the passed value."

Your database connection can be configured to encrypt traffic and to accept any certificate from your server. Not a grand solution, but it worked for me. The resulting connection string should look like this: "[...];Encrypt=True;TrustServerCertificate=True"

I love StackOverflow :D

Alice: "Hey, I get a certificate error here. What should I do?"
Bob: "Just disable certificate verification completely"
Charles: "That's insecure"
Bob: "Look, it worked for me"
Alice: "Thanks, works perfectly!"

ThoriumBR

11:43

@MechMK1 and @FireQuacker wishes "Hopefully we can get our networks to a point where it doesn't matter if people have no idea how security works."

MechMK1

There is a relevant XKCD comic

ThoriumBR

@nobody it's worthy it! and takes half an hour...

MechMK1

How could anyone consider themselves a well-rounded adult without a basic understanding of silicate geochemistry? Silicates are everywhere! It's hard to throw a rock without throwing one!

It's the same with security. The average user - hell - even the average programmer, doesn't know shit about security.

ThoriumBR

I started reading, five minutes into that I looked at the scrollbar and said "what? that's gonna be good..."

MechMK1

Give a programmer the choice between spending a couple of hours learning about certificates and adding one small flag to a config file (but risking global annihilation) and I can already tell you what is going to happen.

Hint: It's the one that involves less reading.

djsmiley2kStaysInside

11:47

lol

MechMK1

I mean, I can't blame them. As a pentester, I have no clue how difficult a proposed fix is in someone's codebase

Just from a gut feeling, adding some HTTP header to every response should not be a lot of work - but fuck, I can't guarantee that it's not

The problem is that I have to assume a sane codebase, even though I've never seen one.

ThoriumBR

I was involved on a discussion last week on reddit... there's an issue on how PHP == works, and it makes comparing passwords tricky if you use md5 or sha. and long story short, 0e12345 == 0e54321 is true... the proper fix is to get rid of md5 or sha, use hash_equals or use a proper password management library... the "timeline expired fix" is to replace == with ===, and git commit -m "fixed password storage forever"

MechMK1

Oh yes, I know that vuln :D

ThatÄs really so cool

because PHP is so fucked up

It's like implicit casts except way way way worse

ThoriumBR

OP said it's stupid programmers would do the "timeline expired fix" because it's trivial to git clone something, test, alter the database schema and convert the passwords to use bcrypt or pbkdf2... I reminded him that the proper fix is the way to be done, but it's not easy to find a programmer managing a convoluted code base that is willing to point the issue AND be responsible for the change AND end up responsible when an obscure module breaks three months down the line

MechMK1

@ThoriumBR Yes, because a "proper" fix requires time and effort - time and effort which can't be spent on other stuff

And to most project managers, security is an afterthought, if even that

ThoriumBR

11:55

I like PHP, it gave me my second job, landed me on a sysadmin role that ended up deciding my career and I love that... but for the uninitiated, it's a loaded gun with a hair trigger...

MechMK1

@ThoriumBR Not quite

It's a loaded gun, where touching any part of the gun could cause it to fire

And when it does, some senior PHP dev makes fun of you, telling you that holding the gun that way is obviously wrong

ThoriumBR

it's the opposite of C, C is a good dog that bites your hand if you come home without calling him first. PHP is a guard dog that can let anyone enter unless you tell him not so

MechMK1

Yes

Not even kidding by the way:

You see that line above the trigger? If you touch it, the gun shoots

ThoriumBR

I never properly learned how pointers work in C, and just used the "shotgun method": keep changing * and & and ** until the compiler stops complaining

MechMK1

Please keep doing that

That ensures we stay in business

ThoriumBR

11:58

haha... that's why I don't work with C nor C++

nobody

@ThoriumBR Ok, I'm done with that. What's the next best episode?

MechMK1

My job is to tell you that your code sucks. My job isn't to fix your code.

ThoriumBR

I am learning Go because of that. And all my code that it's on production somewhere is PHP, Java or javascript

MechMK1

Also, do you want to know the most fun obfuscation experience?

ThoriumBR

@nobody I just got this one, I will ask @FireQuacker for other ones later

nobody

12:00

@nobody Alright @FireQuacker, what's the next darknet diaries episode I should read?

MechMK1

@ThoriumBR How much experience with C# do you have?

ThoriumBR

zero... I heard that C# is basically MS-Java, so any Java programmer can take the lunch break and learn to program C#

but I read a lot, and I know theory about it

nobody

@MechMK1 What's the use case for that?

ThoriumBR

"How I safely generate an SSH key? sudo chattr +i /home/"username"/.ssh/id_rsa.pub..."

MechMK1

@nobody There is none. This was done to simplify construction. You're not supposed to touch it there

ThoriumBR

12:03

-2

A: What are ssh-keygen best practices?

For extra protection use chattr on those keys e.g. sudo chattr + /home/"username"/.ssh/id_rsa.pub (Also on /etc/passwd as well as /etc/shadow etc)

not even kidding...

how chattr will do anything on ssh-keygen? I voted to delete this answer

nobody

@MechMK1 So you can't put a loaded one into a holster?

MechMK1

@nobody Yes, you can. You just generally need to be careful with it

If you drop the gun, it's very much possible for it to shoot

@ThoriumBR So, C# has some...interesting features. Some of them exist, but don't see regular use, because most devs don't need them. And others come loaded with some expectations that you don't have to meet

ThoriumBR

@MechMK1 or if you fall, or tumble, or someone gives you an energetic hug...

MechMK1

Let's begin with properties :D

@ThoriumBR All possible, yes. It's a terribly unsafe design

In C#, classes can have fields (variables) and properties (getters and setters)

nobody

I never understood OOP

MechMK1

12:06

Generally, fields should be made private, while properties are public

nobody

Why would you need properties and fields if you can use an array?

or struct?

MechMK1

@nobody The idea is that you can guide users of your class what parts they should touch and shouldn't

You could do it like python and name internal variables _something

Or you could just differentiate between a variable and a property

It also has the neat side effect of making some properties read-only by default, simply by virtue of them not having a setter

But here comes the devilish part

A. Hersean

@nobody There's good OOP, and bad OOP. Bad OOP is overly using design patterns when not useful. Bad OOP is C++ or Java. Good OOP is the Linux Kernel (yes I know it's written in C) or Rust or Go. doc.rust-lang.org/book/ch17-00-oop.html

MechMK1

You expect that a property with a setter to correspond to some internal variable

For example, if you set car.Color = Color.Red, then you expect that car.Color will return Color.Red when subsequently called...

Well...it doesn't have to

Imagine a property called HP in the Player class. Reading the property returns the maximum HP of the player, while writing the property changes the current HP.

So Player.HP = Player.HP is actually code that changes the players HP to maximum.

A. Hersean

The designers or Java now tell NOT to use inheritance, which was at first the go to OOP paradigm: use inheritance whenever possible. This lead to horror that is the Java standard library.

MechMK1

12:11

@A.Hersean Because Java sucks

A. Hersean

It sucks mainly from this

Most of it's slowness comes from this, not from its GC.

MechMK1

The reason this is such a great obfuscation technique is because accessing a property actually means calling a function, but most people think it's just accessing a variable.

And 99.999999% of the time it is...

So they happily call functions, which could do all manners of messed up things, when they just want to read a variable

A. Hersean

Yep.

MechMK1

Another beautiful piece of code, which was basically made for obfuscation, is the implicit operator

A. Hersean

That's Java and C#.

MechMK1

12:14

You see, the idea being an implicit cast is that you can write code like double angle = 90

90 is an integer value, not a double value. But the idea of 90 and 90.0 being equivalent makes sense, doesn't it?

So the .NET library allows you to implicitly cast integer to double. Meaning that whenever an integer value is encountered where a double is expected, it just gets casted into a double.

So...code that gets called "invisibly", just by doing something simple as assigning a value to a variable? SIGN ME UP!

Question: What does the line Email email = "[email protected]"; do?

Answer: Whatever the fuck I want it to. Open a database connection, send out an email, delete every file in %TMPDIR%, mine bitcoin, etc.....

ThoriumBR

hahaha!

A. Hersean

How to hide code 101: implicit cast (instead of proper typing), operator overload (instead of clear operation), reflection and factories (the banes of debugging).

MechMK1

Oh yes, operator overloading

A. Hersean

I HATE C++ for this

MechMK1

You see, we expect that + does some kind of addition or concatenation, right?

A. Hersean

12:19

Every user of C++ wants to overload...

MechMK1

We expect that 6 + 9 returns 15, we expect that "foo" + "bar" returns "foobar"

But...it doesn't have to :D

Also, protip: Just add // DO NOT EDIT THIS FILE at the beginning of a file and it essentially becomes read only

4

ThoriumBR

@MechMK1 when I see that, I usually edit the file... if changes reverted I chattr +i on the file and see what program was messing with the file

MechMK1

@ThoriumBR Well, most programmers wouldn't

ThoriumBR

@MechMK1 I know

MechMK1

Also, add documentation which is slightly wrong

Also, function overloading also has an implicit assumption that the function is going to do a similar thing with the different variables or types

But what if print(int) prints to stdout, print(double) prints to a log file, print(float) physically prints a new page, print(object) orders a new business card with the object's .ToString() printed on it

A. Hersean

12:24

@MechMK1 That why when auditing cryptographic code, we (at my work) never trust the documentation. Is it really compliant with the RFC? Most likely not.

MechMK1

Sure, that may seem excessive, but imagine a function like DB.GetConnection(), which fetches an existing connection from a connection pool, and DB.GetConnection(string), which creates a new connection from the string, and closes a connection from the connection pool.

@A.Hersean Mhm, but most people don't have time for that

A. Hersean

@MechMK1 We take the time, and charge it to the customer.

MechMK1

The goal is to make your code as side-effect laden as possible, while at the same time depending on those very side effects.

ThoriumBR

@MechMK1 your instructions look like an article I read 20 years ago on how to get a job forever as a programmer...

MechMK1

So if someone just patches out the side effects, the code no longer works.

@ThoriumBR Oh, I'm sure I'm not the first to come up with these ideas

ThoriumBR

12:25

function DO_SOMETHING and D0_SOMETH1NG do different things

MechMK1

@ThoriumBR Want to know the magnum opus? :D

ThoriumBR

variables fooooooo and fooooo and FOOOOOO and F000OO0...

A. Hersean

@ThoriumBR Looks like the PHP standard library.

MechMK1

Header files, which do different things, depending on how often you include them :D

ThoriumBR

@MechMK1 what?

MechMK1

12:27

OHHHHH this is going to be a good one

ThoriumBR

a chain of #ifdef?

MechMK1

Yes

ThoriumBR

I never thought of that!

that's... sinister...

MechMK1

Imagine your code working fine

And you create a new file and just add #include <stdio.h> and #include "SomeFile.h"

And all of a sudden everything breaks

A. Hersean

Well... C is crap. So many undefined behaviors. It's just way less crappy than C++, so it appears nice.

MechMK1

12:29

Well, this one is very nicely defined~

A. Hersean

Yes.

MechMK1

All of these obfuscation tips boil down to user expectation

We expect that #include'ing a file will not break something else

A. Hersean

It is #ifdefined.

ThoriumBR

real world example. last week I was dissecting an REXX exec and saw something like this: IF UPPER(USER) = "sOMEUSER"... and I asked the senior sysadmin about that and said that this IF will always return false, looked that the programmer pressed the Shift one char too late.

he said this is how they add debug stops on the code... when the code works, they mess a little on the if condition but let the code there

MechMK1

We expect that calling a property like list.Count won't have side effects

A. Hersean

12:31

so wrong...

MechMK1

To quote JonTron: "Follow your dreams. But don't follow them so hard that this happens."

A. Hersean

@ThoriumBR If you want to do it, just add a "and false" to the condition and ADD A FUCKING COMMENT!

MechMK1

Or just don't do this

A. Hersean

even better

ThoriumBR

a comment would be fine... I almost "fixed" this code

A. Hersean

12:33

But sometimes it is easier to let people mess the stuff the way they want to mess it, because it will happen anyway when you are not looking. So teaching how to mess cleanly is a lesser evil.

nobody

Honestly, I don't remember ever using a comment as a comment

I only ever use it to remove some blocks of code for debugging purposes

ThoriumBR

// this IF is intentionally broken for debug purposes

A. Hersean

12:55

@nobody Comment for yourself in 6 months. Would you rather read your block of 10 lines to understand what it does, or would you prefer to read a one-line comment? See comments as post-it notes saying "don't forget that the point of this code is to do this". Comment the purpose, not the actions. The actions are in the code, the purpose is not, so comments fill the gap. Proper naming of functions and data structures can be enough, but sometimes it is barely enough: then it's time to comment.

MechMK1

@A.Hersean I love (hate) when programmers do this

nobody

@A.Hersean Good advice, but I have this problem where I don't follow best practices for no good reason

MechMK1

You see this especially with novices. they add comments, explaining what the code does, but not why it does that

like byte lrestmp = inp & 0x0F // gets the lower 4 bits of inp

ThoriumBR

$a++ ; // increments a

MechMK1

I can tell you from experience how bad this is

ThoriumBR

13:01

if (is_null($a)) { // $a is null

MechMK1

I had to write code, which parses a proprietary file format,

While there was documentation, the documentation did not match the actual file format

So I had to include file maps as ascii tables in comments

And explain what each field did

So we had lovely comments like "// Even though the official documentation claims animations were added in version 4, support for animations was actually implemented in version 3, but remained unused"

Or, my favourite: "// The documentation (version 2011-08) on page 58 claims that having both X and Y set is invalid and results in a crash. However, many official sprites have exactly X and Y set, and I'm sure it means something, but I have no idea what"

djsmiley2kStaysInside

13:16

lol

Any documentation that says something will result in a crash, is horrible, imo

MechMK1

13:27

Except "undefined behavior can result in anything, including crashing"

Fire Quacker

@nobody If you like physical pentesting, check out darknetdiaries.com/transcript/6 darknetdiaries.com/transcript/21 darknetdiaries.com/transcript/36 darknetdiaries.com/transcript/40 and darknetdiaries.com/transcript/41

darknetdiaries.com/episode/15 and darknetdiaries.com/episode/53 are interesting also

Really, the whole show is pretty solid. You could just start at the beginning

Also, I want to see what happens when you ask for a single episode and I give you an array<episode>

It's hard to pick a favorite episode

nobody

I'm just interested in good stories :)

@FireQuacker Hopefully no memory corruption occurs...

But assuming it does, the return address on the stack would get overwritten with a pointer to a darknet diaries episode. Shit, I don't know what would happen after that

A. Hersean

14:45

Hanlon's razor, version 2021: "Never attribute to malice that which is adequately explained by a bug."

Fire Quacker

...what if the bug was placed there maliciously?

ThoriumBR

15:09

the underhanded C contest is a great example of malicious bugs

A. Hersean

15:26

@FireQuacker Same thing with the original version of Hanlon's razor.

nobody

17:33

0

A: Admin keeps deleting my comment on why I voted to close

If the project in question was not an anti-adblocker, the question would be fine on its own. That you do not like the project is moot. Expressing yourself that you do not like the project is fine, if not distracting from the topic at hand. My actions were to maintain focus on the question and not...

Can't see why schroeder got two downvotes on this

Oh I see. It was just the OP and this guy. Also, looks like he won't be satisfied until @RoryAlsop weighs in.

schroeder

18:46

@nobody sometimes the downvote button has a logical, merit-based model behind it, sometimes it's just smite

djsmiley2kStaysInside

20:54

don't argue with people tbh

it just looks crass.

let another mod deal with it.

nobody

@djsmiley2kStaysInside Our problem is that we have something like only 1.5 active mods. So most of the time, schroeder just has to deal with stuff himself.

I guess we might need an election...

Fire Quacker

21:26

@nobody Rory is the .5?

nobody

Yep

Fire Quacker

21:37

To be fair, schroeder is super active, so we almost don't need other mods, unless schroeder needs a break or edge cases like this (which don't come up very often)

We're pretty lucky that schroeder never quit

Transcript for