My GCIA Gold paper was published on sans.org. Also, SANS watermarks

I completed my GCIA Gold paper and it was accepted and published this past week.  Link below:

http://www.sans.org/reading_room/whitepapers/detection/watermarks-prevent-leaks_34087

I wrote it on watermarks and it took me the larger half of the past year to complete.  Boy I really underestimated how difficult it would be. When I read other people's papers I saw a lot of poor grammar and spelling so I didn't take it very seriously and figured I could just knock it out in a leisurely few months.  I couldn't be more wrong.  I spent well over a hundred hours on it, and almost all of the original draft got scrapped.  If you're considering a "gold" level paper for any of the GIAC certifications, be aware it isn't going to be easy.  But when you get it, it's good resume fodder.

I picked the topic of the paper due to the watermarks I noticed on the GCIA practice tests I was taking.  Below are details about SANS watermarks, simply because they were dropped from the paper.  The information was passed along to SANS many months ago so they can act on it if they wanted.  None of this could be exploited in a profitable way, but I found it interesting.

If you look at the monitor at an angle while taking a SANS practice test you can see the watermarks.  On further inspection you may notice it's the exact same number as the exam ID.  You might also notice that the exam ID numbers you get if you purchase multiple tests are sequential.  I collected dozens of numbers from other users and found that this incrementing number is sequential for all users.  You could spawn practice "math tests" to ensure the software worked, and those numbers were also sequential from the same autoincrementing field in their database.  This indicates an inference attack is possible.

Now the purpose of the watermark is most undoubtedly to trace the source of copyright infringement.  The number is unique on a per-test basis and if the test questions were found on p2p networks and the watermark number was carried over, it could be used as evidence against the student that number pointed to.  Since SANS testing costs as about much as a used car, they probably care more about piracy than the average cert vendor.

The problem is that the watermark number is semi-predictable and easily altered.  It isn't apparent that your exam ID is sensitive information and could be used against you as evidence, and I didn't realize it myself when I was asking people for theirs.  If you wanted to frame someone for piracy, it's as simple as asking them for their practice exam ID.

Since the IDs are sequential, you could also spawn many math tests and infer someone else's exam ID numbers when they purchase one.  example:

Exam ID - description
1 - my math test
2 - my math test
3 - my math test
4 - Other person's practice test
5 - Other person's practice test
6 - Other person's exam
7 - my math test
8 - my math test

On my account I would notice a gap between 4 and 7 in my math test IDs and I would know that someone purchased a set of three tests(which is how it goes when they buy the full training, afaik) and #4 and #5 are the practice tests.  Then if I was an awful person I could insert a "4" watermark and release the test question into the wild.  This is a very hit or miss way of framing someone because their practice test is most likely for a different certification than your test question and you can't tell.

Aside from that, one could also infer purchasing statistics from this autoincrement field.  By spawning math tests over time, one could infer how many tests are purchased by observing how many exam IDs were generated by other people.  clusters of 3 are most likely full training purchases, and 1 indicates a single test purchase or a math test.  The math test function is rather obscure on their website and I think it's fair to say that it's rarely used.  SANS doesn't release any information(afaik) about how many tests or trainings are purchased- only how many students pass.  This information isn't very profitable but it is not public either.

Now with all of that said, the real core of this weakness is that they're using their autoincrement field for something important.  It's a convenient field to use because you know it'll be unique and it's always going to be an index and easily searchable.  But it will always be weak to inference attacks, and that class of attacks is very hard to protect against because most of the time it isn't obvious what you could discover with that data.

This attack was inspired by an inference attack I found/reported against a video game years ago.  The account ID was autoincremented and easily obtainable so I could infer secret data like account age and some overall userbase statistics.  In the context of that game it was useful for cheating, so beware of using that field.

And if you ever plan to do evil stuff with this knowledge, this is all i have to say to you.  Spawning tons of math tests on sans exam portal will get you noticed.

Python script used to list out all possible bitflipped domains

Here's the script I used about a year ago to generate every bit flip variant of a domain.  It enabled me to find this domain and some others.  After you generate the list, dump it into Namecheap's bulk domain checker page.  It allows you to check up to 50 domains per page load, which is pretty nifty.

http://micrmsoft.com/puzzlerchallengeh4u3t4enjr8gr94/bitflip.py

Our laser maze from the BrainTank conference

One important detail the
journalist left out: Every
time someone fails, our laser
maze hurls insults at the
unfortunate loser. Click
here to see full size.

Here's a news article from the Sept 15th, 2012 BrainTank mini-conference we had in Providence. My involvement with it was the construction of the laser maze.  The initial design of the challenge was done by me and my friend Megan.  She owned the physical design, I owned the design of the electronics and programming.  There was a lot of crossover as we helped each other through many design challenges.  We also had huge amounts of help from friends on the day of deployment.  The project was a huge success and I am very proud of myself and everyone who contributed.  Next year I hope to build an even better version.

I spent several months beforehand sourcing all the parts I could.
-5mW 650nm lasers(count:100)
-650nm photoresistors(count:70)
-2xAA battery holders with batteries(count:100)
-All the scrap CAT5 and CAT4 cable I could find
-Arduino Mega and assorted resistors

It was a challenge finding the correct part when all the information I had on it was a sheet of specifications and a single photo of the object.  On top of that, I didn't know much about electronics.  I was going to learn with this project.  I had to be careful with my purchases because even though I was buying "samples", I couldn't get any of these companies to deal with me for less than 100$.  I checked, rechecked, and sent off the Western Union money.  A few weeks later, I get a big box in the mail.  LASERS : 100 PIECES

Now we're in business!

Releasing the source code of my puzzler

A couple months ago I released a puzzler on the PaulDotCom podcast and challenged people to complete it.    I designed it to be devious and to foil all automated script kiddie scanners while still being vulnerable.  Today, I got around to putting the source code together in a package so you could run it yourself, or look at the source code if you want to use parts of the challenge to your own ends.  I impose no license restrictions on it.  Do with it as you wish and use at your own risk.

The file is located here:
http://micrmsoft.com/puzzlerchallengeh4u3t4enjr8gr94/package.zip

Here is a copy of the readme file with instructions:

My puzzler.  This is a challenge created and designed to be completed within a day.  It was something I wrote up in a few weekends.  I didn't make the code pretty so it might take a little while to adapt to your own servers if you want to set it up.  If you want to take the time, the instructions are here.  You'll need to change a couple references to domains in some PHP files and a pcap.  You'll also need to set up mySQL, an IRC server, and install Comic Sans which is a nonstandard font on Linux.  I set this up on an Ubuntu box but you can probably make it work on any flavor of Linux.

Old Working Exploits - or how you can log in to vbulletin forums with a user's uncracked hash

This is an issue I reported way back in 12/11/10 (reference SID-1046901-fc4373fb) and they declined to recognize it as a bug, so I'll post it for the benefit of the public.

It requires an uncracked md5 hash of a user's password on vBulletin forums.  When you log in, it doesn't actually transmit the password in plain text - it transmits the md5 hash of the password.  That's great! So any forum software running on http won't be nearly as vulnerable to sniffing plaintext passwords.  There's a problem, though:

md5 is commonly used as a password hashing algorithm, and hacked websites out there commonly have databases full of these accounts.  Typically, md5sum hashed passwords can be cracked 40-50 percent of the time.  Hackers use a lot of password-reuse attacks and the fact that you can pass along a hash instead of the cracked password means that that if you're part of the 50-60 percent of users with an uncrackable password, any accounts you have on a VBulletin forum aren't safe, if you've reused your passwords.  The issue can be mitigated by updating the password sending method to anything that an attacker can't use a known md5sum to log in with.

It's an edge case for sure, but if you're in the business of mass hacking accounts, then perhaps this edge case can net you that many more victims.

Here's an example login request that would be produced from any of the latest VB forums:

username: abcd
password: aaaa
hash: 74b87337454200d4d33f80c4663dc5e5 = aaaa


POST /login.php?do=login HTTP/1.1
Host: forums.forum.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Proxy-Connection: keep-alive
Referer: http://forums.forum.com/
Cookie: bbsessionhash=bbd4f543da0af78506ebe3b185368240; bblastvisit=1353135560; bblastactivity=0; AAJSID=balancer.www1
Content-Type: application/x-www-form-urlencoded
Content-Length: 185

vb_login_username=abcd&vb_login_password=&s=&securitytoken=guest&do=login&vb_login_md5password=74b87337454200d4d33f80c4663dc5e5&vb_login_md5password_utf=74b87337454200d4d33f80c4663dc5e5

Why this domain?

I originally registered this domain back in 2011, shortly after this talk was released:
http://www.blackhat.com/html/bh-us-11/bh-us-11-archives.html
"Bit-squatting: DNS Hijacking without exploitation"

It intrigued me and I attempted to duplicate the results of this experiment.  micrmsoft.com was one of several domains I registered.  I got some variants of paypal, mozilla, and facebook domains as well, but microsoft variants yielded the most misdirected requests.  My conclusion was ultimately that the author of the original talk was not full of BS, and traffic to microsoft was high enough that there will be some misdirected requests going to the domain.  The paypal, mozilla, and facebook domains did not perform nearly as well.

Here's a small example pcap from a day of traffic:
http://micrmsoft.com/smallsample.pcap

example request:

GET /pki/certs/MicrosoftWinIntPCA.crt HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: www.micrmsoft.com
Connection: Keep-Alive


You can see that the vast majority of those requests are from crawlers, but occasionally you'll see a few Microsoft CryptoAPI requesting some certs.  I think this bit flip stuff is really only a concern for the top handful of domains in the world, but it was interesting to see a tiny slice of what Microsoft sees.

Could this be used for evil?  Perhaps this could be used to MITM some poor soul's failing hardware.  We only monitored passively and did not see any personal information.  After the misdirected requests for certificates were given 404 errors, the errant IPs did not come back again.

Edit: This was recently released, and the original author discusses much more in depth information on the subject: http://blog.dinaburg.org/2012/10/a-preview-of-bitsquatting-pcaps.html

First post!!!!

This is the first post of our blog. This blog is to document shenanigans and whatever interesting discoveries.  Current contributors are Allison Nixon(@nixonnixoff) and Brandon Levene(@SeraphimDomain).

First content, here's a link to a Sophos puzzle that we won: http://nakedsecurity.sophos.com/2012/11/05/wall-of-fame-for-skyfall-sophospuzzle/

The challenge was pretty tough, and involved several puzzles as well as cracking a variant of the Vigenère cipher.  But we managed to submit answers in time to get t-shirts.  Horray for us!