Downclimb

2015.05.10

RSS feed

Downclimb: Summit Route’s Weekly Infosec News Recap
2015.05.03 – 2015.05.10: https://SummitRoute.com

Quotes

“Wingdings is what the Germans used during WWII. The enigma machine was actually just a wingding typewriter.” TheEconomist1

 

“OH: ‘you should totally buy him 2 copies of the Mythical Man Month so he can read it twice as fast’” @sigje

Top stories

Automated Reverse Engineering of Cryptographic Algorithms

Analyzing crypto implementations is becoming increasingly relevant. This post shows how to use Data Flow Graph’s (DFG) to create signatures for algorithms to identify them, instead of the more commonly used technique of using crypto constants. They apply this to 7-zip as an example. This would be relevant for those times when people change the constants in an algorithm, or when the constants end up being obfuscated.

  • http://blog.amossys.fr/Automated%20Reverse%20Engineering%20of%20Cryptographic%20Algorithms.html

Dumb Crypto in Smart Grids

This paper analyzes the crypto in the Open Smart Grid Protocol (OSGP), which uses a non-standard composition of RC4 and a homebrewed MAC (Message Authentication Code). They discovered three different key recovery attacks in the protocol. This protocol is used in 4 million devices.

  • https://eprint.iacr.org/2015/428.pdf

A git horror story: faking provenance with a loose nonce

This post[1] describes a crypto related vulnerability in the git protocol when using signed pushes that allows a malicious server to trick a client into signing any commit. The basic problem here comes down to the git protocol having tried to invent it’s own protocol to do signing, or an HMAC. We’ve all heard that you shouldn’t try to invent your own crypto, but that doesn’t mean just your own encryption algorithm. It means don’t invent your own crypto primitives, and unfortunately it’s knowledge of what crypto primitives exist and how to use them that aren’t well-known, resulting in people inventing their own. The protocol did got many things right, but it’s almost always implementation caveats that cause the vulns. In this case, not including a size check, as they allowed an arbitrary size for the nonce.

Further, the code confuses some crypto concepts, making it harder to read and understand. Here is the original commit[2] for the commit signing, where you can read in the commit message the confusion on what a nonce is. Specifically, they are concerned that an attacker might “forge a nonce”, but that doesn’t make sense, because a nonce is just a random number, and should be used for no other reason than in cases where random is needed. The “nonce” they create is not exactly random because they are using it additionally as an authentication mechanism. Just as Heartbleed put blood in the water for OpenSSL, I expect more crypto issues to be found with this codebase.

  1. https://developer.atlassian.com/blog/2015/05/git-horror-story-loose-nonces/
  2. https://github.com/git/git/commit/b89363e4a5277038629491f8765c0598f366326c

Claws Mail leaks plaintext of encrypted emails to IMAP server

Continuing with the crypto fail theme for the week, the Claws mail client in Tails (the OS that is supposed to provide maximum privacy) sends plain-text emails that are meant to be encrypted, to the IMAP server, before encrypting them.

  • https://tails.boum.org/security/claws_mail_leaks_plaintext_to_imap/

Business

  • Rapid7 acquires NT OBJECTives: The Boston based Rapid7, most famous for their ownership of Metasploit, has bought Irvine, California based NT OBJECTives, which makes a product to analyze web applications for vulnerabilities.
  • CoreSec acquires iSecure: Coresec provides Managed Security Services (MSS), and iSecure provides a SIEM. Both are based out of Sweden.
  • Cybereason raises $25M: Cybereason has raised $25M in a Series B, bringing their total funding since their start in 2012 to $30M. Their HQ is in Cambridge, MA, but their engineers are all in Tel Aviv, Israel. This is a common theme amongst Israeli companies, to have a US HQ for sales and marketing, but doing the real work back in Israel.
  • Health living metaphors for infosec: To keep you up-to-date with thought-leadership and marketing fads, there has been an increased focus on describing infosec in terms of healthy living. Specifically, things like keeping up with patches is like exercising daily and eating right. You can see this is Pariza Tabriz’s presentation on chrome, and in the A16Z podcast with the CTO from Tanium. Specifically, the message is that we all know we should eat right and exercise, but we often don’t, and likewise most organizations know some of the basics they should be doing for infosec, but aren’t. It’s our job in security to make it easy for people to do the right things.

Tools

  • Relyze debuts: Stephen Fewer, who has been actively pushing out open-source security projects and research for a long time, has debuted a new company and product called Relyze which is a proprietary disassembler (like IDA) for x86 and x64 Windows software. The software itself works only on Windows, and no pricing info is available, but a free trial is. At first glance, it looks much prettier than many of the other reversing options that have come along and has a fairly unique look to it. Although only the first release, it already has plug-in support (plugins are written in Ruby), theming, and it has it’s own graph visualization for code paths. One big selling point, at least for the trial, is the ability to disassemble x64 code, as IDA’s trial does not allow that.
  • Microsoft Advanced Threat Analytics: Microsoft announced a new product called Advanced Threat Analytics (ATA)[1], based on Aorato which was a company Microsoft acquired in November, 2014. No pricing information is available, but a 90-day trial is. It analyzes Active Directory-related traffic and receives events from your corporate SIEM to enrich the attack story to detect attacks such as Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, Forged PAC (MS14-068), Golden Ticket, and Remote Execution on the Domain Controllers, Skeleton Key Malware, Honey token activities and more. It additionally uses machine learning to detect anomalous logins, abnormal resource access, and unusual working hours. Scroll down mid-way in the link to see the interesting screenshots of the products. Relevant for understanding the value of this product is a presentation from CanSecWest by Matt “scriptjunkie” Weeks of Root9B on some of the issues of Windows credentials and how they have played an important role in large attacks.
  • Price and Feature Comparison of Web Application Scanners: An evaluation of all the popular web application scanners including price and testing of the features.
  • Introducing FIDO: Automated Security Incident Response: Netflix has open-sourced their system for automatically analyzing security events and responding to security incidents.
  • Binary Ninja: An open-source disassembler and hex editor, and other tools. It works for x86, PPC, and ARM, and interestingly/oddly uses it’s own disassembly code, as opposed to using Capstone.
  • opmsg: A GPG alternative with integrations for the mail client mutt, and uses PFS (Perfect Forward Secrecy). This is not using any new crypto algorithms, but instead is mostly a rethinking of the usability of crypto, by automatically doing “the right thing” for common tasks (security paternalism), as opposed to GPG’s more openness of providing ample freedom and footguns.

Other reads