Disenchant's Blog » security

Incremental Backups of Crypto Containers

Disenchant — Thu, 22 Oct 2009 16:25:14 +0000

If you want to backup your crypto containers, you have mainly two choices:
1.) Open the container on your machine and one on the backup server and than you can start with an incremental backup.
2.) You always transfer the whole crypto container.
From a security point of view it’s not acceptable to open a container on a remote host which is perhaps even not owned by you and of course you don’t want to backup a 1GB container after you’ve just added a small *.txt
Here, I’ll demonstrate how to do incremental backups of crypto containers without even once open them

# backup.sh echo "Creating patch" bsdiff disk_of_last_change.tc disk_to_work_with.tc patch.patch echo "Move patch to server" mv patch.patch serverSide cd ./serverSide echo "Use patch" bspatch disk_on_the_server.tc disk_on_the_server.tc patch.patch cd ../ echo "cleanup" rm ./serverSide/patch.patch rm disk_of_last_change.tc cp disk_to_work_with.tc disk_of_last_change.tc

Unfortunately, this is not as fast as it could be, even if it’s much faster than transfering the whole container all the time but I also found a quiet strange way on how to improve the speed of the whole process. You can just use base64 encoding and the normall diff instead of using bsdiff because you can work much faster on plain text files than on binary files. Here’s how an example could look like:

# backup64.sh # # run once: # base64 disk_to_work_with.tc > disk_of_last_change_64.tc base64 disk_to_work_with.tc > disk_to_work_with_64.tc echo "Creating patch" diff disk_of_last_change_64.tc disk_to_work_with_64.tc > patch64.patch echo "Move patch to server" mv patch64.patch ./serverSide/ cd ./serverSide echo "Use patch" patch disk_on_the_server_64.tc patch64.patch cd ../ echo "cleanup" #rm disk_of_last_change.tc #rm disk_of_last_change_64.tc rm ./serverSide/patch64.patch mv disk_to_work_with_64.tc disk_of_last_change_64.tc base64 -d disk_of_last_change_64.tc > disk_to_work_with.tc

As you’ll see, the patches are slightly bigger than the ones with bsdiff but I think you can accept that when you get such a huge performance improvement by using the base64 version.

I know that I didn’t really explain everything but don’t hesitate to ask me if there are any questions

Teaching John The Ripper how to Crack MD5 Hashes and more

Disenchant — Mon, 05 Oct 2009 10:55:16 +0000

Long time ago, I posted a guide on how to make John the Ripper able to crack MD5 hashes (http://www.disenchant.ch/blog/teaching-john-the-ripper-how-to-crack-md5-hashes/106). In that posting where some errors and also it’s not up to date so I made a small shell script which downloads, patches and compile JtR 1.7.3.4 for you automatically

wget http://www.openwall.com/john/g/john-1.7.3.4.tar.gz
tar xvf john-1.7.3.4.tar.gz
wget http://www.openwall.com/john/contrib/john-1.7.3.4-jumbo-1.diff.gz
gunzip john-1.7.3.4-jumbo-1.diff.gz
cp john-1.7.3.4-jumbo-1.diff ./john-1.7.3.4
cd ./john-1.7.3.4
patch -p1 < john-1.7.3.4-jumbo-1.diff
cd ./src/
make clean linux-x86-any

This patched John the Ripper can attack the following formats:
DES/BSDI/MD5/BF/AFS/LM/NT/XSHA/PO/raw-MD5/IPB2/raw-sha1/md5a/hmac-md5/KRB5/bfegg/nsldap/ssha/openssha/oracle/MYSQL/mysql-sha1/mscash/lotus5/DOMINOSEC/NETLM/NETNTLM/NETLMv2/NETHALFLM/mssql/mssql05/epi/phps/mysql-fast/pix-md5/sapG/sapB/md5ns/HDAA

I hope you enjoy it

Firefox Security Tool Kit – FSTK v4.0

Disenchant — Wed, 03 Jun 2009 13:36:22 +0000

There’s a new version of the Firefox Security Tool Kit (FSTK) online
Download and/or Install the FSTK v4.0 now

You’ll find more information on the FSTK here but the Extensions have changed.

At this point I also wish to thank Kaspar Brand (the developer of Cert Viewer Plus) for letting me know, that there where some licensing problems.

Swiss Cyber Storm II

Disenchant — Wed, 22 Apr 2009 09:56:24 +0000

The last weekend, I was in Rapperswil (Switzerland) for a quiet special event. There, the “Swiss Cyber Storm II” took place, organized by Compass Security. The SCSII is a hacking wargame contest, where hackers, IT security specialists, computer scientists etc. try to solve security related tasks and get points for them. For example there was a crypto attack on Lsrunase.exe, JavaScript Malware analysis, ORACLE DB hacking, DECT sniffing and much more. It was a two day event but the second day wasn’t as productive as on the first. Anyway, I was quiet successful At the end of the first day, I was on the 1. rank from about 150 people participating. On the 2. and 3. ranks was a team (CrypTom and allotria) so I decided to also form a team for the second day and my team-partner was Baboo, who’s also a student at the Bern University of Applied Sciences. At the end we made the 2. rank which I would say is a really good result

Thanks a lot at this point to Compass Security for the great event.

Here you’ll see the final ranking:

PS: Baboo and me had to create a new user called Disenchant_and_Baboo for the second day. As you can see, my user of the first day (Disenchant) is at the end of the second day still on rank 11

CSWD – Certified Secure Web Developer

Disenchant — Sun, 08 Mar 2009 10:20:07 +0000

Too long ago, I wrote a posting about Certified Secure Web (CSW) and announced to post more information on the specific certifications CSWD and CSWT. Because of the official web site is now also available in English it doesn’t make sense to copy&paste it into my blog. You’ll find it at https://www.certifiedsecureweb.com/.

If there are any questions about CSW, don’t hesitate to ask

Certified Secure Web

Disenchant — Thu, 25 Dec 2008 19:29:21 +0000

Hi everyone out there, I know that it was a long time since I wrote my last blog posting but as most of you know, time is always rare. Anyway, I’ll try to write more in the feature, especially because there is really stuff, I think it’s worth to write about. So today I’d like to talk about one big project, I was involved during about the last year at my workplace at Dreamlab Technologies, it’s the CSW certification.

You might ask yourself now: What the hell is CSW? CSW is short for Certified Secure Web, which is a security certification framework for the web. Actually we’ve got two certification types, the CSWT where T is short for Technology which means certification of web applications and we’ve got also a CSWD, which’s thought to stand for Developers. Before I go more into more details, I have to say that the CSW certification framework is thought to be open and not just for Dreamlab Technologies. We’re only a part of the CSW, the real certification is done by an independent party which is in our case a backend, built of educational organizations like for example universities, combined with partners like us. So this is not just poor advertising, we’re really looking for people/companies who’re interested in this all over the world.

Normally I would say, go to https://www.certifiedsecureweb.com/, where you can find all the information you need but unfortunately, the site is still only available in German, even if the English version is afaik ready.

So, what is CSW: “Certified Secure Web is an initiative to increase the overall security of web applications and also to provide a certification for Technology (Applications) and Developers.” (A free translation of the text on the CSW website, from German into English). It’s based on the OSSTMM by ISECOM, the Threat Classification of the WASC and on different resources, provided by the OWASP. With these different resources we think, that we can really provide a certification, which is worth the paper it’s printed on, even if we know that also the CSW certification can’t be perfect at all. Something which is also special on CSW is, that we don’t want to say that an application is secure and “hacker safe” (oops, sorry guys ) but we would like to certify a security baseline for web applications and help companies getting a more secure application.

I could go on with this for hours but I think it’s better to write my next two postings directly on CSWT and CSWD because it will say much more on what we’d like to achieve and in which way.

For specific questions or if you’d like to get involved, please just contact me or leave a comment

… and of course merry Christmas and a happy new year

I’ve got a backlink from example.com – RFC 2606

Disenchant — Fri, 24 Oct 2008 04:00:20 +0000

Many of my readers will know, that example.com, example.net and example.org are reserved for use in documentation, according to RFC 2606. If you surf to any of these sites, there will be just the same information I wrote before and also a link to the RFC 2606. So it’s quiet interesting, why according to my statistics, example.com has a link on it, pointing to my website. I don’t no why this happened but it’s quiet interesting an if somebody can tell me what happened, I’m glad to know.

Here’s a proof (even if it only a line of text ):

hackIt.js – A hidden Phishing Method

Disenchant — Tue, 21 Oct 2008 20:22:48 +0000

It’s much later than I wanted to post this but finally here is my demonstration I’ve done for the Security-Zone 2008. Because there are so much resources about XSS and SQL Injections out there already, this posting is just about the hidden phishing method.

How it works:

Attacker needs a XSS vulnerability at example.com
Configuration of the hackIt.js and include it to example.com by inserting it through a script-Tag
hackIt.js knows because of it’s configuration where the login page of example.com is
The script replaces the content of the infected page at example.com with a copy of the login page which will be loaded through a XML HTTP Request
hackIt.js will automatically find the login form and it’s input fields in “faked” login page
The submit button of the login form will become a normal button without it’s submit functionality but it will now have a onclick-function
As soon as the user clicks on the submit button to login, an image will become dynamically added to the DOM tree, which points to a server side script at evil.com, including the values of the login fields as attributes.
Because of as soon as an image becomes loaded, a HTTP GET request will be sent to the image’s location, the attacked user’s login credentials will be sent to evil.com in cleartext, where an attacker can now store it
Last but not least, the hackIt.js normally submits the login form to it’s originally thought location.
If the user has no Proxy or other tamper mechanism in place, he/she will never find out, that the login credentials have been sent to evil.com

I know it sounds quiet complex but it’s really easy if you get the point. If there are any questions, I’m glad to answer these as a comment or in an email

Because of I’m not sure if it’s a good idea to post the source code (even if it’s really easy to write it on your own), I decided to not make it available through my blog but if you’d like to receive the code, just let me know directly. Anyway, below you can watch a small video which demonstrates the attack, performed by the script.

Security-Zone 2008 – Let’s call it a Success

Disenchant — Wed, 01 Oct 2008 17:58:09 +0000

The Security-Zone is as far as I know, the most important and biggest security event in Switzerland and like last year I was there to present some stuff. Also like the last time, I wasn’t alone, there where Pascal Mittner from Astalavista IT Engineering and Pascal C. Kocher from Defcon Switzerland (I’ll write something about this very soon ). It was the first time, that there was a workshop at a Security-Zone and so we where quiet exited but we also thought, that this would be easy stuff. First, a 20min slot for each of us three to just talk and afterwards, about three hours of really presenting stuff and also let people getting some hand-on experience. Unfortunately, the first part about how to write an exploit for an FTP server by Pascal C. Kocher failed because something I still don’t know about. There where just a few lines of Perl code but for any reason, the final exploit didn’t work. Also the last part about using a security management system to identify and track risks on your systems failed because of the participants weren’t able to test the virtual machines Pascal Mittner brought to the security zone. Even there we’re not sure what was the problem but we think it could have been a problem of by switch or some crappy Ethernet wires. Anyway, this means, that my part was the only one, that worked without any problems (thanks at this point to the FSM ). I was first presenting a simple XSS but not only the standard alert(123) no, I wanted to show the attending people, that you can do much more an so I decided to show a website defacement. Afterwards, I bypassed a login mechanism by a standard SQL Injection and last but not least, I presented something which was quiet a bit complicated (a combination of XSS and CSRF) but I’ll write another blog posting (hopefully) during the next days about this demo.

For me it was good to see once more, that still many people are interested in the basic stuff and it makes me very happy if I’ve got the chance just like at the Security-Zone to help people to understand, what web application security is about and why it’s important.

Counter-Terrorism advertising campaign launched

Disenchant — Fri, 26 Sep 2008 07:20:45 +0000

I totally forgot to click publish for this blog posting but better now then never

The Metropolitan Police Service launched a Counter-Terrorism campaign and unfortunately it seems to be real and not just a joke.

The following is copied from here:

The five-week campaign asks members of the public to report any suspicious behaviour in confidence to the Anti-Terrorist Hotline on 0800 789 321.

Press advertising will appear in London’s major newspapers and on the City’s main commercial radio stations.

Camera posterThe press ads seek to raise awareness of some of the items/activities which may be needed by, or be of use to, terrorists. It asks the public to consider whether they have seen any activity connected with them which may have made them suspicious.

Radio advertising has been devised to complement the press ads and features an individual thinking out loud about concerns she has around some suspicious behaviour. She is reassured that she should call the confidential Anti-Terrorist Hotline on 0800 789 321 and that any information will be considered by specialist officers.

Advertising will also run in the Greater Manchester, West Yorkshire and the West Midlands.

At least there is already an alternative poster: