1 of 100

Stupid Mistakes Made by Smart People

2 of 100

3 of 100

@SkullSpaceWpg

4 of 100

(By the way, I'm @iagox86)

5 of 100

Protocol mistakes

6 of 100

Echo

7 of 100

Echo

8 of 100

Echo

9 of 100

Echo

10 of 100

Echo

11 of 100

Echo demo!

12 of 100

Other vulnerable software

Echo
NTP Mode 7 (CVE-2009-3563)
SQL Server 2000 (we'll be hearing more later!)
etc

13 of 100

Amplification

I was up half the night trying to find this damn image!

14 of 100

DNS Amplification

Hey, guess what? Google's at

74.125.155.103

and 74.125.155.104

and 74.125.155.105

and 74.125.155.106

and 74.125.155.147

and 74.125.155.99

and ...

Tell him all of Google's servers, please!

15 of 100

Smurf Attack

16 of 100

Smurf Attack

Can you say 'hi' to everybody for me?

HI!

17 of 100

NTP Amplification

Tell him about yourself!

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

Tell him about yourself!

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

18 of 100

What's the point?

If you're doing it, you're probably doing it wrong

19 of 100

Data Leakage

20 of 100

NTP again!

Who have you talked to lately?

jim, bob, mary, frank, alice, eve, jim again, .....

21 of 100

Diskpulse...

Step 1: Allocate memory

22 of 100

Diskpulse...

Step 2: Build the message

23 of 100

Diskpulse...

Step 3: Send it

24 of 100

Diskpulse...

Step 4: Read the good stuff

25 of 100

Blinkenlights

26 of 100

“Insecure Direct Object Reference”

27 of 100

Mmm, pizza

28 of 100

Singles.org

29 of 100

Singles.org

221 123456

63 jesus

58 password

46 12345678

36 christ

29 love

27 princess

25 jesus1

24 sunshine

23 1234567

21 blessed

20 angel

19 lovely

17 mother

17 iloveyou

16 blessing

16 angels

16 7777777

16 1234

15 freedom

30 of 100

OpenSSH

Leaking stack data

31 of 100

Crypto

32 of 100

Hashing

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

| Target is synchronised with 129.128.5.210

| Alternative Target Interfaces:

| 172.16.0.1

| Public Servers (4)

| 129.128.5.210 132.214.200.120 142.201.7.148 209.177.106.4

| Private Clients (6)

| 172.16.0.10 172.16.0.63 172.16.0.65 172.16.0.222

| 172.16.0.51 172.16.0.64

| Public Clients (1)

| 195.252.70.37

| Other Associations (11)

| 206.220.193.152 (You?) seen 148 times. last tx was unicast v2 mode 7

| 38.229.1.13 seen 19 times. last tx was unicast v2 mode 6

| 38.229.1.76 seen 3 times. last tx was unicast v2 mode 7

| 184.73.4.64 seen 266 times. last tx was unicast v2 mode 7

| 184.73.29.188 seen 1 time. last tx was unicast v2 mode 7

| 204.236.252.205 seen 1 time. last tx was unicast v2 mode 7

| 204.236.198.25 seen 1 time. last tx was unicast v2 mode 7

| 66.240.222.145 seen 576 times. last tx was unicast v2 mode 7

| 216.75.15.231 seen 8 times. last tx was unicast v2 mode 7

| 208.81.2.52 seen 53 times. last tx was unicast v2 mode 6

|_ 127.0.0.1 seen 12 times. last tx was unicast v2 mode 6

Goals:

Fast
Unique (except when input is the same)

26b9626bef243d122e759923946f20b5

33 of 100

Password hashing

Goals:

Slow
Unique (even with the same input)

5f4dcc3b5aa765d61d8327deb882cf99

password

34 of 100

Attacking password hashes

e10adc3949ba59abbe56e057f20f883e

123456

827ccb0eea8a706c4c34a16891f84e7b

12345

25f9e794323b453885f5181f1b624d0b

123456789

5f4dcc3b5aa765d61d8327deb882cf99

password

f25a2fc72690b780b2a14e140ef6a9e0

iloveyou

8afa847f50a716e64932d995c8e7435a

princess

fcea920f7412b5da7be0cf42b8c93759

1234567

25d55ad283aa400af464c76d713c07ad

12345678

What's the password for 25d55ad283aa400af464c76d713c07ad?

35 of 100

No salt...

Username

Password

(no salt)

Hash

Ron

“password”

(no salt)

5f4dcc3b5aa765d61d8327deb882cf99

Andrew

“password”

(no salt)

Mak

“123456”

(no salt)

Stef

“123456”

(no salt)

Jay

“123456”

(no salt)

5f4dcc3b5aa765d61d8327deb882cf99

e10adc3949ba59abbe56e057f20f883e

36 of 100

Salt...

Username

Password

Salt

Hash

Ron

“password”

“3d388b3a”

15eece938e377700407109783014eae4

Andrew

“password”

“670e9402”

Mak

“123456”

“7d345ff1”

Stef

“123456”

“c1d8c0ba”

Jay

“123456”

“50272971”

b07c11eeb0c46d8b67db192f1953cf50

cba7acf4df606866912a4c9686ea60e4

463244b7b1518c75ef189733a2de1635

5cb0f73c9b4ae9bb405b80e3b86d0a7b

37 of 100

Salt

Bottom line: always use salt.

38 of 100

Work factor

One of the few times when we want to make code *slower*

Linux DES: 25 rounds
Linux MD5: 1000 rounds
BSDi DES: Up to 2²⁴ rounds
Linux SHA1: No round limit
bcrypt: No round limit (also has a complexity of 2ⁿ, where n = number of rounds)

39 of 100

Hashing algorithms

40 of 100

Hashing algorithms

41 of 100

Password demo!

42 of 100

Gawker

Lost 750,000 passwords in December, 2010
How did they store passwords?

43 of 100

Looks like bcrypt! Win?

44 of 100

...almost

45 of 100

If you're typing the letters A-E-S, you're doing it wrong

http://tinyurl.com/aesdoingitwrong

46 of 100

Block vs stream ciphers

47 of 100

ECB vs CBC

48 of 100

ECB (Electronic Codebook)

49 of 100

CBC (Cipher Bock Chaining)

50 of 100

ECB vs CBC

ECB

CBC

51 of 100

Padding

Some encryption happens in fixed-size blocks

(AES, DES, Blowfish, etc)

52 of 100

Padding oracle?

53 of 100

Padding

54 of 100

Padding

55 of 100

Padding

56 of 100

Padding

57 of 100

Padding

58 of 100

Padding oracle

59 of 100

Padding oracle

ASP.net (CVE-2010-3332)
JSP (CVE-2010-4007)
etc.

60 of 100

Birthday paradox

61 of 100

Birthday paradox

62 of 100

Birthday paradox

63 of 100

Birthday paradox

64 of 100

Birthday paradox

351

65 of 100

Stream cipher

PRNG Stream*

(based on the initialization vector (IV))

*PRNG = Pseudo-random number generator

66 of 100

WEP

Wired Equivalent Privacy
RC4 Stream Cipher + CRC32
24-bit IV

67 of 100

WEP

24-bit IV = 16,777,216

Birthday paradox!
(x)(x - 1) = 16,777,217
=> x = 4096

68 of 100

How do I do encryption right?

Use tried and tested libraries/protocols

PGP
TLS
etc.

69 of 100

Randomization

70 of 100

PRNG or RNG?

71 of 100

PRNG - seeding

x' = (x * a + b) mod m
Microsoft: x' = (x * 214013 + 2531011)

2³² states *at best*
x starts off as the seed

Same seed generates the same stream

72 of 100

Example: SQL Slammer

73 of 100

Example: SQL Slammer

31 minutes later...

74 of 100

Example: SQL Slammer

75 of 100

Example: SQL Slammer

What happened?

Used a poorly chosen constant
Didn't clear memory properly

(using old data, essentially)

76 of 100

Example: Debian

77 of 100

Example: Debian

78 of 100

Demo: password resets

79 of 100

Authentication

Remember crypto?
If you're doing it yourself, you're doing it wrong

80 of 100

Example: RDBMS

81 of 100

Example: RDBMS

82 of 100

Example: RDBMS

83 of 100

Example: RDBMS

84 of 100

Example: RDBMS

85 of 100

Example: RDBMS

86 of 100

Example: RDBMS

87 of 100

Example: RDBMS

88 of 100

Example: RDBMS

89 of 100

Example: RDBMS

90 of 100

Example: RDBMS

91 of 100

Example: security camera

92 of 100

Example: security camera

93 of 100

Example: security camera

94 of 100

Example: security camera

95 of 100

Example: security camera

96 of 100

Example: security camera

97 of 100

Example: security camera

98 of 100

Example: security camera

99 of 100

Conclusion

Security is hard

Especially crypto and related stuff

Don't do it yourself unless you have to!

Even experts get it wrong

100 of 100

Contact

Ron Bowes

ron@skullsecurity.net
Blog - http://www.skullsecurity.org
Twitter - @iagox86
Also, http://www.skullspace.ca