Sunday, August 30, 2020

Reversing Some C++ Io Operations

In general decompilers are not friendly with c++ let's analyse a simple program to get familiar with it.
Let's implement a simple code that loads a file into a vector and then save the vector with following functions:

  • err
  • load
  • save
  • main

Lets identify the typical way in C++ to print to stdout with the operator "<<"

The basic_ostream is initialized writing the word "error" to the cout, and then the operator<< again to add the endl.

The Main function simply calls  "vec = load(filename)"  but the compiler modified it and passed the vector pointer as a parámeter. Then it bulds and prints "loaded  " << size << " users".
And finally saves the vector to /tmp/pwd and print "saved".
Most of the mess is basically the operator "<<" to concat and print values.
Also note that the vectors and strings are automatically deallocated when exit the function.

And here is the code:

Let's take a look to the load function, which iterates the ifs.getline() and push to the vector.
First of all there is a mess on the function definition, __return_storage_ptr is the vector.
the ifstream object ifs is initialized as a basic_ifstream and then operator! checks if it wasn't possible to open the file and in that case calls err()
We see the memset and a loop, getline read a cstr like line from the file, and then is converted to a string before pushing it to the vector. lVar1 is the stack canary value.

In this situations dont obfuscate with the vector pointer vec initialization at the begining, in this case the logic is quite clear.

The function save is a bit more tricky, but it's no more than a vector iteration and ofs writing.
Looping a simple "for (auto s : *vec)" in the decompiler is quite dense, but we can see clearly two write, the second write DAT_0010400b is a "\n"

As we see, save implememtation is quite straightforward.

Related links

Change Passwords Regularly - A Myth And A Lie, Don'T Be Fooled, Part 1

TL;DR: different passwords have different protection requirements, and different attackers using various attacks can only be prevented through different prevention methods. Password security is not simple. For real advise, checking the second post (in progress).

Are you sick of password advices like "change your password regularly" or "if your password is password change it to pa$$w0rd"? This post is for you!

The news sites are full of password advises nowadays due to recent breaches. When I read/watch these advise (especially on CNN), I am usually pissed off for a lot of reasons. Some advises are terrible (a good collection is here), some are good but without solutions, and others are better, but they don't explain the reasons. Following is my analysis of the problem. It works for me. It might not work for you. Comments are welcome!

Password history

Passwords have been used since ancient times.

Because it is simple. When I started using the Internet, I believe I had three passwords. Windows login, webmail, and IRC. Now I have ~250 accounts/passwords to different things, like to my smartphone, to my cable company (this password can be used to change the channels on the TV), to my online secure cloud storage, to full disk encryption to start my computer, to my nude pictures, to my WiFi router, to my cloud server hosting provider, etc etc etc. My money is protected with passwords, my communication is protected with passwords/encryption, my work is protected with passwords. It is pretty damn important. But yet people tend to choose lame passwords. Pretty lame ones. Because they don't think it can be significant. But what is not essential today will be relevant tomorrow. The service you used to download music (iTunes) with the lame password will one day protect all your Apple devices, where attackers can download your backup files, erase all your devices, etc. The seven-character and one capital rule is not enough anymore. This advice is like PDF is safe to open, Java is secure. Old, outdated, untrue.

Now, after this lengthy prologue, we will deep dive into the analysis of the problem, by checking what we want to protect, against whom (who is the attacker), and only after that, we can analyze the solutions. Travel with me, I promise it will be fun! ;)

What to protect?

There are different services online, and various services need different ways to protect. You don't use the same lock on your Trabant as you do on your BMW.

Internet banking, online money

For me, this is the most vital service to protect. Luckily, most of the internet banking services use two-factor authentication (2FA), but unfortunately, not all of them offer transaction authorization/verification with complete transactions. 2FA is not effective against malware, it just complicates the attack. Transaction authorization/verification is better, but not perfect (see Zitmo). If the access is not protected with 2FA, better choose the best password you have (long, real random, sophisticated, but we will get to this later). If it is protected with 2FA, it is still no reason not to use the best password ;) This is what I call the "very high-level password" class.

Credit card data

This system is pretty fucked up bad. Something has to be secret (your credit card number), but in the meantime that is the only thing to identify your credit card. It is like your username is your password. Pretty bad idea, huh? The problem is even worse with a lot of different transaction types, especially when the hotel asks you to fax both sides of your CC to them. Unfortunately, you can't change the password on your credit card, as there is no such thing, but Verified by VISA or 3-D Secure with 2FA might increase the chances your credit card won't get hacked. And on a side note, I have removed the CVV numbers from my credit/debit cards. I only read it once from the card when I received it, I don't need it anymore to be printed there.
And sometimes, you are your own worst enemy. Don't do stupid things like this:

Work related passwords (e.g. Windows domain)

This is very important, but because the attack methods are a bit different, I created this as a different category. Details later.

Email, social sites (Gmail/Facebook/Twitter), cloud storage, online shopping

This is what I call the "high level password" class.
Still, pretty important passwords. Some people don't understand "why would attackers put any energy to get his Facebook account?" It is simple. For money. They can use your account to spread spam all over your Facebook wall. They can write messages to all of your connections and tell them you are in trouble and send money via Western Union or Bitcoin.

They can use your account in Facebook votes. Your e-mail, cloud storage is again very important. 20 years ago you also had letters you didn't want to print and put in front of the nearest store, neither want you to do that with your private photo album. On a side note, it is best to use a cloud storage where even the cloud provider admin can't access your data. But in this case, with no password recovery option, better think about "alternative" password recovery mechanisms.

Other important stuff with personal data (e.g. your name, home address)

The "medium level password" class. This is a personal preference to have this class or not, but in the long run, I believe it is not a waste of energy to protect these accounts. These sites include your favorite pizza delivery service, your local PC store, etc.

Not important stuff

This is the category other. I usually use one-time disposable e-mail to these services. Used for the registration, get what I want, drop the email account. Because I don't want to spread my e-mail address all over the internet, whenever one of these sites get hacked. But still, I prefer to use different, random passwords on these sites, although this is the "low level password" class.

Attackers and attack methods

After categorizing the different passwords to be protected, let's look at the different attackers and attack methods. They can/will/or actively doing it now:

Attacking the clear text password 

This is the most effective way of getting the password. Bad news is that if there is no other factor of protection, the victim is definitely not on the winning side. The different attack methods are:

  • phishing sites/applications,

  • social engineering,
  • malware running on the computer (or in the browser), 
  • shoulder surfing (check out for smartphones, hidden cameras), 
  • sniffing clear-text passwords when the website is not protected with SSL,
  • SSL MiTM,
  • rogue website administrator/hacker logging clear text passwords,
  • password reuse - if the attacker can get your password in any way, and you reuse it somewhere else, that is a problem,
  • you told your password to someone and he/she will misuse it later,
  • hardware keyloggers,
  • etc.

The key thing here is that no matter how long your passwords are, no matter how complex it is, no matter how often do you change it (except when you do this every minute ... ), if it is stolen, you are screwed. 2FA might save you, or might not.

Attacking the encrypted password 

This is the usual "hack the webserver (via SQL injection), dump the passwords (with SQLMap), post hashes on pastebin, everybody starts the GPU farm to crack the hashes" scenario. This is basically the only scenario where the password policies makes sense. In this case the different level of passwords need different protection levels. In some cases, this attack turns out to be the same as the previous attack, when the passwords are not hashed, or are just encoded.

The current hash cracking speeds for hashes without any iterations (this is unfortunately very common) renders passwords like Q@tCB3nx (8 character, upper-lowercase, digit, special characters) useless, as those can be cracked in hours. Don't believe me? Let's do the math.

Let's say your password is truly random, and randomly choosen from the 26 upper, 26 lower, 10 digit, 33 special characters. (Once I tried special passwords with high ANSI characters inside. It is a terrible idea. Believe me.). There are 6 634 204 312 890 620 different, 8 character passwords from these characters. Assuming a 2 years-old password cracking rig, and MD5 hash cracking with 180 G/s speed, it takes a worst case 10 hours (average 5) to crack the password, including upgrading your bash to the latest, but still vulnerable bash version. Had the password been 10 characters long, it would take 10 years to crack with today hardware. But if the password is not truly random, it can be cracked a lot sooner.

A lot of common hashing algorithms don't use protections against offline brute-force attacks. This includes LM (old Windows hashes), NTLM (modern Windows hashes), MD-5, SHA1-2-512. These hashing algorithms were not developed for password hashing. They don't have salting, iterations, etc. out of the box. In the case of LM, the problem is even worse, as it converts the lowercase characters to uppercase ones, thus radically decreasing the key space. Out of the box, these hashes are made for fast calculation, thus support fast brute-force.

Another attack is when the protected thing is not an online service, but rather an encrypted file or crypto-currency wallet.

Attacking the authentication system online

This is what happened in the recent iCloud hack (besides phishing). Attackers were attacking the authentication system, by either brute-forcing the password, or bypassing the password security by answering the security question. Good passwords can not be brute-forced, as it takes ages. Good security answers have nothing to do with the question in first place. A good security answer is as hard to guess as the password itself. If password recovery requires manual phone calls, I know, it is a bit awkward to say that your first dog name was Xjg.2m`4cJw:V2= , but on the other hand, no one will guess that!

Attacking single sign on

This type of attack is a bit different, as I was not able to put the "pass the hash" attacks anywhere. Pass the hash attack is usually found in Windows domain environments, but others might be affected as well. The key thing is single sign on. If you can login to one system (e.g. your workstation), and access many different network resources (file share, printer, web proxy, e-mail, etc.) without providing any password, then something (a secret) has to be in the memory which can be used to to authenticate to the services. If an attacker can access this secret, he will be able to access all these services. The key thing is (again) it does not matter, how complex your passwords are, how long it is, how often do you change, as someone can easily misuse that secret.


Attacking 2FA

As already stated, 2 factor authentication raises the efforts from an attacker point of view, but does not provide 100% protection. 
  • one time tokens (SecurID, Yubikey) can be relayed in a man-in-the-middle attack
  • smartcard authentication can be relayed with the help of a malware to the attacker machine - or simply circumvented in the browser malware, 
  • text based (SMS) messages can be stolen by malware on the smartphone or rerouted via SS7, 
  • bio-metric protection is constantly bypassed,
  • SSH keys are constantly stolen,
  • but U2F keys are pretty good actually, even though BGP/DNS hijack or similar MiTM can still circumvent that protection,
  • etc. 


Beware that there are tons of other attack methods to access your online account (like XSS/CSRF), but all of these have to be handled on the webserver side. The best you can do is to choose a website where the Bug Bounty program is running 24/7. Otherwise, the website may be full of low hanging, easy-to-hack bugs.

Now that we have covered what we want to protect against what, in the next blog post, you will see how to do that. Stay tuned. I will also explain the title of this blog post.

Related articles

  1. Pentest Tools Apk
  2. Hacking Tools Software
  3. Hack Tools For Mac
  4. Pentest Tools
  5. Hacker Tools Apk Download
  6. Hacking Tools For Windows
  7. Hacking Tools And Software
  8. Hacking Tools 2020
  9. Hacking Tools Free Download
  10. Pentest Recon Tools
  11. Hack Tools
  12. Hack Tools Pc
  13. Hacker Tools Online
  14. Computer Hacker
  15. Hack Apps
  16. Pentest Tools Bluekeep
  17. Pentest Tools Windows
  18. What Is Hacking Tools
  19. Hacker Tools 2019
  20. Hacking Tools For Windows
  21. Hacking Tools For Mac
  22. Pentest Tools
  23. Pentest Tools List
  24. What Are Hacking Tools
  25. Hacking Tools Hardware
  26. Pentest Tools Linux
  27. Nsa Hack Tools
  28. Hacker Techniques Tools And Incident Handling
  29. Blackhat Hacker Tools
  30. Hack Tools Pc
  31. Pentest Tools
  32. Pentest Tools For Android
  33. Pentest Tools For Android
  34. Hacking Tools Mac
  35. Beginner Hacker Tools
  36. Pentest Tools Free
  37. Nsa Hacker Tools
  38. Hacking Tools And Software
  39. Hack Tools Download
  40. How To Make Hacking Tools
  41. Hacker Tools Mac
  42. How To Install Pentest Tools In Ubuntu
  43. New Hacker Tools
  44. Pentest Tools Android
  45. Hacker Tools For Ios
  46. Pentest Tools Nmap
  47. Hackers Toolbox
  48. Hacking Tools
  49. Pentest Tools For Android
  50. Hacker Tools Github
  51. Pentest Tools Framework
  52. Hacking Tools For Mac
  53. Hacking Tools Windows 10
  54. Pentest Tools For Windows
  55. Pentest Tools Apk
  56. Hacker Tools 2019
  57. Wifi Hacker Tools For Windows
  58. Hacking Tools Windows
  59. Pentest Tools Linux
  60. Hacker Tools
  61. Hacking Tools Windows 10
  62. Hacking Tools Windows
  63. Pentest Tools Website Vulnerability
  64. Hack Tools
  65. Pentest Tools For Mac
  66. Hacking Apps
  67. Hack Website Online Tool
  68. Top Pentest Tools
  69. Physical Pentest Tools
  70. Hacker Tools Free Download
  71. Hacks And Tools
  72. Hacking Tools For Windows
  73. Hack Tools For Games
  74. Hack Tools Pc
  75. Pentest Tools Url Fuzzer
  76. Hacker Tools Github
  77. Pentest Reporting Tools
  78. Github Hacking Tools
  79. Hackers Toolbox
  80. Beginner Hacker Tools
  81. Nsa Hack Tools Download
  82. Physical Pentest Tools
  83. Hacking Tools Pc
  84. Hacking Tools Free Download
  85. Hacking Tools Windows
  86. Pentest Tools Free
  87. Pentest Tools Alternative
  88. Hacking Tools For Mac
  89. Best Pentesting Tools 2018
  90. Android Hack Tools Github
  91. Hacker Security Tools
  92. Hack Tools
  93. New Hack Tools
  94. Hacking Tools For Windows
  95. Pentest Tools Apk
  96. Hacking Tools Pc
  97. Game Hacking
  98. Pentest Tools Tcp Port Scanner
  99. Pentest Tools For Mac
  100. Best Pentesting Tools 2018
  101. Hack Tools For Games
  102. Hack Tools For Games
  103. Hack Tools Github
  104. Pentest Tools Bluekeep
  105. Hacking Tools Mac
  106. Hack Rom Tools
  107. Hacking Tools Windows
  108. Black Hat Hacker Tools
  109. What Is Hacking Tools
  110. Hack Tools Download
  111. Pentest Tools Tcp Port Scanner
  112. Tools 4 Hack
  113. Hack App
  114. Hacking Tools Download
  115. Hack Tools
  116. Nsa Hack Tools
  117. Hack Website Online Tool
  118. Install Pentest Tools Ubuntu
  119. New Hack Tools
  120. Pentest Tools List
  121. Hacker Tools Linux

Thank You To Volunteers And Board Members That Worked BlackHat Booth 2019

The OWASP Foundation would like to thank the OWASP Las Vegas Chapter Volunteers for taking the time out of their busy schedule to give back and volunteer to work the booth at BlackHat 2019.  It was great meeting our Las Vegas OWASP members and working with Jorge, Carmi, Dave, and Nancy.  
Also, take a moment to thank Global Board Members Martin Knobloch, Owen Pendlebury, and Gary Robinson for also working the booth and speaking with individuals and groups to answer questions on projects and suggestions on the use of our tools to address their work problems.
OWASP can not exist without support from our members.  Related links
  1. Nsa Hack Tools
  2. Hack Tools Github
  3. Pentest Tools Alternative
  4. Install Pentest Tools Ubuntu
  5. Free Pentest Tools For Windows
  6. Wifi Hacker Tools For Windows
  7. Hacking Tools 2019
  8. Underground Hacker Sites
  9. Hacking Tools 2019
  10. Pentest Tools Windows
  11. Pentest Tools Android
  12. Install Pentest Tools Ubuntu
  13. Hacker Tools Free
  14. Hacking Tools 2020
  15. Growth Hacker Tools
  16. Hacking Tools Mac
  17. Hak5 Tools
  18. Hack Tools For Ubuntu
  19. Pentest Automation Tools
  20. Hack Tools Download
  21. Hackrf Tools
  22. Hacker Tools
  23. Pentest Tools For Windows
  24. Computer Hacker
  25. Hackrf Tools
  26. Hacker Tools
  27. Nsa Hack Tools Download
  28. Black Hat Hacker Tools
  29. Hack Tools Pc
  30. Hacker Tools For Windows
  31. Pentest Tools For Windows
  32. Hacker Tools 2019
  33. Hack Tool Apk
  34. Pentest Tools Apk
  35. Hacking Tools And Software
  36. Pentest Tools Bluekeep
  37. Hacker Tools Free Download
  38. Black Hat Hacker Tools
  39. Hacker Techniques Tools And Incident Handling
  40. Kik Hack Tools
  41. Hacking Tools 2019
  42. New Hack Tools
  43. Hacker Tools
  44. Pentest Tools Github
  45. Pentest Tools Website Vulnerability
  46. Tools Used For Hacking
  47. Pentest Tools Alternative
  48. Hack App
  49. Hack Tools Download
  50. Hacker
  51. Hacker Tools Linux
  52. Usb Pentest Tools
  53. Hacking Tools Pc
  54. Hacker Tools Windows
  55. Hacker Tools For Ios
  56. Hack Tools
  57. Tools For Hacker
  58. Easy Hack Tools
  59. Hack Tools For Windows
  60. Pentest Tools Linux
  61. Kik Hack Tools
  62. Hacking Tools And Software
  63. Best Hacking Tools 2019
  64. Hacking Tools And Software
  65. Hacking Tools Name
  66. Nsa Hack Tools Download
  67. Hacker Tools For Windows
  68. Hacking Tools Usb
  69. Hack Tools 2019
  70. Pentest Tools Review
  71. Pentest Tools Open Source
  72. Hack Tools For Pc
  73. Usb Pentest Tools
  74. Pentest Tools For Ubuntu
  75. Hacking Tools Hardware
  76. Best Pentesting Tools 2018
  77. Pentest Box Tools Download
  78. Pentest Reporting Tools
  79. Github Hacking Tools
  80. Hacker Tools For Mac
  81. Hack Tools For Pc
  82. Physical Pentest Tools
  83. New Hack Tools
  84. Hacker Tools Software
  85. Hacker Tools 2019
  86. Pentest Tools Website Vulnerability
  87. Hacker Tools List
  88. Hacks And Tools
  89. Hacker Tools Free Download
  90. Pentest Tools Windows
  91. Pentest Tools Framework
  92. Hacking Tools Windows
  93. Pentest Tools Find Subdomains
  94. Tools For Hacker
  95. Pentest Tools Website
  96. Termux Hacking Tools 2019
  97. Hack Website Online Tool
  98. What Is Hacking Tools
  99. Hack Tools Mac
  100. Beginner Hacker Tools
  101. Bluetooth Hacking Tools Kali
  102. Pentest Box Tools Download