The Code Files

Full Disclosure vs. Coordinated Disclosure

2014-09-12T00:00:00-06:00

With the exception of the AntiSec movement, most researchers agree that vulnerabilities and exploits should be published eventually so that we can learn from them. But when should we publish them?

Those who practice "Coordinated Disclosure" notify vendors of vulnerabilities privately, giving them time to patch their software and send out an update. They argue that keeping the vulnerability secret from the public makes it less likely that the users running the vulnerable software will be exploited before a patch is released.

Proponents of "Full Disclosure" argue that vulnerabilities (and even exploits) should be published as widely as possible as soon as they are found. One reason is that giving advance notice to any set of people is a risk. People who know about the vulnerability can exploit it while users are still in the dark. When vulnerabilities are disclosed immediately, users can at least make the concious decision to stop using the software until a patch is released. In economic terms, users who don't know about a vulnerability can't user their wallets pressure the vendor into developing a patch, and as a result vendors might leave users vulnerable while they procrastinate the development of a patch.

There are many more arguments and counter-arguments on both sides. It's not always clear which practice is best. It usually depends on the specific case. But in all cases, the right option is the one that reduces the actual count of malicious exploitation. This is something that could be tested empirically for different classes of vulnerability.

"I have nothing to hide."

2014-06-28T00:00:00-06:00

I have nothing to hide.
I have not, nor will I ever, do anything wrong.
I have not, nor will I ever, do anything wrong, as defined by the government.
I have only ever done, and only ever will do, things defined as right by the government.

By stating that you "have nothing to hide", you are admitting your behaviour is constrained by the someone else's arbitrary definition of "wrong." Maybe you're fine with that, but ask yourself two questions:

Do you really know what's defined as "wrong"?
Could the meaning of "wrong" ever change?

Switching to Pelican

2014-06-10T09:56:00-06:00

This blog used to be a Ruby on Rails app that I wrote myself. It was way too time consuming to keep updating Ruby and Ruby on Rails (for security patches), so I gave up. This blog is now just static .html files generated from .rst files with Pelican.

Hopefully I'll find, or create, a better theme soon!

How to Maximize X in Your Life

2013-11-01T00:00:00-06:00

How to maximize X (success, happiness, skill, or whatever) in your life:

Every week, spend at least an hour reviewing what you did the previous week. Think of what you could have done better to increase X even more. Apply the things you find to the next week.
Every month, spend at least an hour reviewing your review process. Are your weekly reviews making you improve X? Think about how you could make your review process better. Do you need more time for the weekly reviews? What other changes to the reviews can you make so they're more effective? Apply these changes in the next month.
Every year, spend at least an hour reviewing your monthly review of review process. Are your monthly reviews improving the effectiveness of your weekly reviews? How can you make your monthly reviews better? Apply these changes in the next year.
Every 5 years, review the yearly reviews in the same way.

If you graph y = X(t) as a curve, the days of your life represent actual increases in the value of X. The weekly reviews represent increases in the slope (first derivative) of X(t), making it increase faster. The monthly reviews increases the rate at which the slope of X(t) increases (second derivative). The yearly reviews increase the rate at which the rate at which the slope is increasing (third derivative). The 5-year reviews increase the fourth derivative, and so on, if you wish to apply more levels of review.

I believe this process to be the best a human being can do to approximate exponential growth of some property of themselves within their lifetime.

Enabling TLS v1.1 on Firefox 23

2013-08-09T00:00:00-06:00

Change the following settings in Firefox's about:config to enable TLS v1.1.

Steps

Open a new tab and type about:config into the address bar.
Search for tls.version.
Set security.tls.version.max to 2. This enables TLS 1.1.
Set security.tls.version.min to 1. This disables SSL 3.0.

Be aware that setting tls.version.max to 3 will enable TLS v1.2 in a future release of Firefox, but setting it to 3 in version 23 actually makes it fall back to using only TLS 1.0. So for now, set it to 2.

The image was contributed by @voodooKobra.

What is DDoS? (Guest Post)

2013-05-12T00:00:00-06:00

This is a guest post by BreShiE.

DDoS attacks are becoming more and more frequent in today's world, with any average person being able to download or purchase such tools from online, public forums. You may have heard about the self proclaimed hacktivist group "Anonymous" and their infamous take-downs of websites such as MasterCard, PayPal and The Bank of America. Well, these websites were taken offline for a period of time by an attack known as "DDoS", but what is DDoS?

DDoS stands for Distributed Denial of Service. DDoS attacks work by collecting multiple infected machines or servers with certain scripts, or malware, intended to send data from the infected server or home connection to a victims. This means the attacker can overload the victim connection, by flooding it with loads and loads of dummy data, eventually causing the victim connection to overload, "knocking" the connection offline and making it unresponsive. See the below diagram for an example of this:

As you can see from the above diagram, the attacker sends a command to the servers/PCs that are under his/her control, which then send the dummy data to the victim connection and overloads the connection, making it hard or impossible for the victim's users to communicate with the victim. There's also what is known as "DoS" which is often not as strong as a DDoS attack, but if the attacker is using a server with a strong connection, this attack can still be devastating. One thing to note would be that there are companies which fight to prevent this exact attack and that is why you never see big sites like eBay, YouTube and Google go down. With this huge scare about "hackers being able to take down the internet", it's baloney. The only way it would be possible, is if the data-centers were to be physically blown up, not DDoS attacks via the internet. If you wish to know more on this subject, visit Wikipedia's page on DDoS

Switching Desktops/Workspaces with Mouse Buttons

2013-04-29T00:00:00-06:00

I had to uninstall compiz today, and I absolutely can't live without being able to switch virtual desktops (also known as workspaces) with the buttons on the side of my mouse. Here's how you do it:

First, install xbindkeys and xdotool:

apt-get install xbindkeys xdotool

Then create a .xbindkeysrc file in your home folder:

vim ~/.xbindkeysrc

Into this file, put the following:

# -- Move Right --
# This is the general command that works with any number of workspaces:
# "xdotool set_desktop $(expr $(expr $(xdotool get_desktop) + 1) % $(xdotool get_num_desktops))"
# This is the optimized command for 5 workspaces:
"xdotool set_desktop $(expr $(expr $(xdotool get_desktop) + 1) % 5)"
    b:8

# -- Move Left --
# This is the general command that works with any number of workspaces:
# "xdotool set_desktop $(expr $(expr $(xdotool get_desktop) + $(expr $(xdotool get_num_desktops) - 1)) % $(xdotool get_num_desktops))"
# This is the optimized command for 5 workspaces:
"xdotool set_desktop $(expr $(expr $(xdotool get_desktop) + 4) % 5)"
    b:9

In the above config, replace "8" with the number of the button you want to use to move right, and "9" with the number of the button you want to use to move left. If you don't know what the button numbers are, run <b>xev</b>, press the one you want while hovering your mouse over the window, and you'll see it in the output.

The command that's uncommented works with a 5-workspace setup. If you want it to work with X desktops either comment that one out and uncomment the general command, or replace "5" with X and "4" with X - 1.

Then add xbindkeys (no arguments) to your startup applications. If you want windows to "edge switch" (switch workspaces when you drag them across the side of your screen), look at brightside.

Note: HOWTO: Mouse buttons to change workspaces in gnome-shell helped me figure out how to do this.

[Ruby] Password Training Script

2013-03-28T00:00:00-06:00

This is a simple Ruby script that helps you memorize a password by making you type it over and over again. It first breaks the password into chunks of 4 characters, helps you to memorize each chunk, then every consecutive pair of chunks, then every consecutive triple... and so on, until you're typing the entire password from memory.

I was able to completely memorize a 131-bit password (20 printable ASCII characters, completely random) in about 20 minutes using this script.

You'll need the 'highline' gem to run this script: gem install highline.

# Ruby Password Trainer

require 'highline/import'

TIMES_TO_TYPE = 5
CHUNK_SIZE = 4

puts "This is a script that helps you memorize a password."
puts "WARNING: Make sure nobody is watching you while you use this script!"
print "\nYour password: "
password = gets.chop
password_chunks = password.split("").each_slice( CHUNK_SIZE ).to_a

def gets_noecho
  ask("") { |q| q.echo = false }
end

def clear
  system("clear")
end

def continue?(round)
  print "Round #{round} finished. Again? [Y/n] "
  return gets =~ /^y$/i
end

def chunks(num_chunks, password_chunks)
  password_chunks.each_cons( num_chunks ) do |portion|
    part = portion.join("")
    # Training
    left = TIMES_TO_TYPE
    while left > 0
      puts "Type \"#{part}\"  #{left} times..."
      input = gets_noecho
      if input == part
        left -= 1
      else
        puts "WRONG! You typed \"#{input}\""
        left += 2
      end
    end
    # Recall test
    left = TIMES_TO_TYPE
    wrong = false
    while left > 0 and not wrong
      clear
      puts "Type the same thing #{left} times..."
      input = gets_noecho
      if input != part
        wrong = true
      else
        left -= 1
      end
    end
    print ">> You got #{TIMES_TO_TYPE - left}/#{TIMES_TO_TYPE} right.\n\n"
    if wrong
      puts "Try again..."
      redo
    end
  end
end

round = 0
begin
  clear
  1.upto( password_chunks.length ) do |num_chunks|
    chunks(num_chunks, password_chunks)
  end
  round += 1
end while continue?( round )

[LaTeX] Typesetting Premise and Conclusion Form Arguments

2013-02-23T00:00:00-07:00

This is the easiest way I have found to typeset premise and conclusion style arguments in LaTeX. First, add this to your preamble:

\usepackage{amssymb}

Then use something like this to typeset the argument:

\begin{itemize}
    \item[1.] Premise One.
    \item[2.] Premise Two.
    \item[3.] Premise Three.
    \item[$\therefore$] Therefore, Your Conclusion.
\end{itemize}

[Ruby] Genetic String Evolver

2013-02-19T00:00:00-07:00

Inspired by Richard Dawkins' weasel program, this is a genetic algorithm, written in Ruby, to evolve the same "METHINKS IT IS LIKE A WEASEL" string. It's really fun to experiment with changing the probability constants (mutation, reproduction) and the algorithm in Evolver#advance, which advances the population of strings to the next generation. Have fun!

The default algorithm works as follows:

Initialize a population of random strings.
Mutate each string with probability 'mutation_probability'.
Breed each string with another random string from the population with probability 'breed_probability', keeping the newborn population separate.
Kill random newborns until the number of newborns is less than 1/4 of the size of the main population.
Select a random half of the main population and replace its weakest (furthest from the target) members with the remaining newborns.
Go back to Step 2.

In about 5000-10000 generations, the strongest member of the population stabilizes to the target string.

The same algorithm can be applied to other problems, like finding the maximum of a mathematical function, by just modifying Weasel.rb.

Sample Output

The left column is the population's strongest member. The right column is the population's weakest member.

YAPXMLHQFORHPPNVWF DISTEBZEK -- vs. -- YZLHUURLMPKITAP ZYVTTSIZZCQV (Gen: 0)
YAPXMLHQFORHPPNVWF DISTEBZEK -- vs. -- CXZWQCVCUAZFDOUSZNRCXDQPNENR (Gen: 1)
YAEBXJFACES FVUTYWTLATTIACDY -- vs. -- CXZWQCVCUAZFDOUSZNRCXDQPNENR (Gen: 2)
YAEBXJFACES FVUTYWTLATTIACDY -- vs. -- J ICBDLWUGASSNRS YENZDLVBJ V (Gen: 3)
YAEBXJFACES FVUTYWTLATTIACDY -- vs. -- NJQPSUPJUBEUQGNEBPRCMHIVBJ V (Gen: 4)
YAEBXJFACES FVUTYWTLATTIACDY -- vs. -- NJQPSUPJUBEUQGNEBPRCMHIVBJ V (Gen: 5)
YAEBXJFACES FVUTYWTLATTIACDY -- vs. --  RQPSUPJUBEUQWSFJTJ OWHRTKIM (Gen: 6)
MDLDIGLMBUJPTV LWEC W FMNINL -- vs. -- ZXZNNKDUGWIVLKARQLMDKCIZ FGW (Gen: 7)
MDLDIGLMBUJPTV LWEC W FMNINL -- vs. -- ZXZNNKDUGWIVLKARQLMDKCIZ FGW (Gen: 8)
...
MDPXKNIS MVHXZ LHCC W ODACEL -- vs. -- MDLDMFQS MVHCZ LHCCGW IQACDY (Gen: 100)
MDPXKNIS MVHXZ LHCC W ODACEL -- vs. -- MDJDIFVS M DAS HHXC W TSACEL (Gen: 101)
MDPXKNIS MVHXZ LHCC W ODACEL -- vs. -- MDJDMNQS MVGXZ LHCC W FQACDL (Gen: 102)
MADIMNQS MVDXZ LHCE W ODACEL -- vs. -- MDJDMNQS MVGXZ LHEC W FMACIL (Gen: 103)
MDPXKNQS MVDAS HHCE W ODACEL -- vs. -- MDJDMNQS MVGXZ LHEC W FMACIL (Gen: 104)
MDPXKNQS MVDAS HHCE W ODACEL -- vs. -- MAPXYNCM MVHXZ LHTC D DQACIL (Gen: 105)
...
METHINIS ITHIS LHKE A VMAQEL -- vs. -- METHINIS IVHWS LHKEXA VMAQEL (Gen: 400)
METHINIS ITHIS LHKE A VMAQEL -- vs. -- METHINIS RVHIS LHKEEA VMAQEL (Gen: 401)
METHINIS ITHIS LHKE A VMAQEL -- vs. -- METHINIS RVHIS LHKEEA VMAQEL (Gen: 402)
METHINIS ITHIS LHKE A VMACEL -- vs. -- METHINIS IVHWS LHKEXA VMAQEL (Gen: 403)
METHINIS ITHIS LHKE A VMAQEL -- vs. -- METHFNIS RVHIS LHKE A VMAQEL (Gen: 404)
METHINIS ITHIS LHKE A VMAQEL -- vs. -- METHFNIS RRHIS LHKE A VMAQEL (Gen: 405)
...
METHINIS IV IS LHKE A WMAQEL -- vs. -- MVTHINIS IV IS QHKE AMVMAQEL (Gen: 800)
METHINIS IV IS LHKE A WMAQEL -- vs. -- METUINIS IV IS LHKE AMVMEQEL (Gen: 801)
METHINIS IV IS LHKE A WMAQEL -- vs. -- METUINIS IV IS LHKE AMVMEQEL (Gen: 802)
METHINIS IV IS LHKE A WMAQEL -- vs. -- METUINIS IV IS LHKE AMVMEQEL (Gen: 803)
METHINIS IV IS LHKE A WMAQEL -- vs. -- METHINIS IVQISKLHKE A VMAQEL (Gen: 804)
METHINIS IV IS LHKE A WMAQEL -- vs. -- METCINIS IV RS LHKK A WMAQEL (Gen: 805)
...
METHINKS IT IS LIKE A WEAWEL -- vs. -- ROTHINKS IT IS LIKE A WEAHEL (Gen: 5106)
METHINKS IT IS LIKE A WEAWEL -- vs. -- MOTHINKS ITSIS VIKE A WEAWEL (Gen: 5107)
METHINKS IT IS LIKE A WEAWEL -- vs. -- MOTHINKS ITSIS VIKE A WEAWEL (Gen: 5108)
METHINKS IT IS LIKE A WEAWEL -- vs. -- METHINKSOIT IS LIKE A WEAWEL (Gen: 5109)
METHINKS IT IS LIKE A WEASEL -- vs. -- METHINKSOIT IS LIKE A WEAWEL (Gen: 5110)

Main.rb

require './Evolver.rb'
require './Weasel.rb'

evolver = Evolver.new( Weasel )
evolver.setup

i = 0
while 1
  print "#{evolver.best} -- vs. -- #{evolver.worst} (Gen: #{i}) \r"
  evolver.advance
  i += 1
end

Evolver.rb

# WARNING: I have never even read `On the Origin of Species` so do not mistake
# this horrible code to be anything like what happens in nature.

class Evolver

  attr_reader :population
  attr_accessor :population_size, :mutation_probability, :breed_probability

  def initialize( klass )
    @entity = klass
    @population = []
    @population_size = 100
    @mutation_probability = 0.07
    @breed_probability = 0.3
  end

  def setup
    @population_size.times do |i|
      @population << @entity.random
    end
  end

  def advance
    @population.each do |subject|
      if rand() <= @mutation_probability
        subject.mutate
      end
    end

    newborns = []
    @population.each do |subject|
      if rand() <= @breed_probability
        newborns << subject.breed( @population[rand(population.length)] )
      end
    end

    # Limit the number of newborns to at most 1/4 of the population size.
    if newborns.length * 4 > @population.length
      newborns.shuffle!
      newborns = newborns.first( @population.length / 4 )
    end

    # Select a random half of the population to be candidates for dying.
    killed = @population.shuffle.first( @population.length / 2 )
    # Sort them by goodness value in increasing order.
    killed.sort! do |a,b|
      if a.goodness < b.goodness
        -1
      elsif b.goodness > a.goodness
        1
      else
        0
      end
    end

    # Replace the weakest death candidates with the newborns.
    newborns.each_with_index do |subj,k|
      idx = @population.index( killed[k] )
      @population[idx] = subj
    end
  end

  def best
    @population.inject do |a,b|
      ( a.goodness > b.goodness ) ? a : b
    end
  end

  def worst
    @population.inject do |a,b|
      ( a.goodness > b.goodness ) ? b : a
    end
  end

end

Weasel.rb

class Weasel
  attr_reader :str

  ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ "
  TARGET = "METHINKS IT IS LIKE A WEASEL"

  def self.random
    str = ""
    TARGET.length.times do |i|
      str << ALPHABET[rand(ALPHABET.length)]
    end
    return Weasel.new( str )
  end

  def initialize( str )
    @str = str
  end

  def mutate
    @str[rand(@str.length)] = ALPHABET[rand(ALPHABET.length)]
  end

  def breed( organism )
    split = rand(@str.length)
    front = @str[0...split]
    back = organism.str[split...organism.str.length]
    return Weasel.new( front + back )
  end

  def goodness
    hamming = 0
    0.upto( @str.length - 1 ) do |i|
      hamming += (@str[i].ord ^ TARGET[i].ord).to_s(2).count("1")
    end
    return -hamming
  end

  def to_s
    @str
  end

end

Windows Magnifier Hack

2013-02-19T00:00:00-07:00

Steps to reset a Windows account password given physical access to the box:

Boot a Linux live cd and mount C:somewhere.
Find magnifier.exe (somewhere in System32) and replace it with cmd.exe.
Boot to the Windows login screen.
Press WinKey + U
Start the magnifier, which should run cmd.exe.
Change the password in the Command Prompt.

Note that this will destroy all data encrypted with EFS.

I'm not sure who thought of this first, but if I knew, I would credit them here.

Factorization Correlation Experimentation Tool

2013-01-25T00:00:00-07:00

Here's a Ruby script to experiment with correlations that may be useful in developing a genetic (evolutionary) algorithm for factoring the product of two primes. The comments explain it:

#!/usr/bin/env ruby
# Let C = F1 * F2, where F1 and F2 are primes.
#
# This script gives a visual aid to help determine if the value of some function
# (specified by the user) on a test integer is correlated with the test
# integer's hamming distance from min(F1, F2).
#
# If such a correlation exists, it may be possible to use that function to
# calculate the 'fitness' of test integers in a genetic (evolutionary) algorithm
# for factoring C.
#
# Of course the function must be efficiently computable without knowing the
# factorization of C.
#
# Set the function by modifying the 'function' method below. Set the F1 and F2
# by modifying the 'F1' and 'F2' variables below. C is calculated from F1 and
# F2.
#
# Some interesting functions are:
#   - The hamming distance between C and the test integer.

# If you don't have the gnuplot gem, run `gem install gnuplot`
require 'gnuplot'

F1 = 8831
F2 = 12479

# Set this to true to make the multiplicity of points visible by adding random
# variations in their horizontal position.
JITTER = false

F_DESC = "HammingDistance(test, C)"
def function( composite, potentialFactor )
  hammingDistance( composite, potentialFactor )
end

# ----------------------------------------------------------------------------

def hammingDistance( a, b )
  (a ^ b).to_s( 2 ).count( "1" )
end

results = []

compareFactor = [F1, F2].min
composite = F1 * F2

1.upto( Math.sqrt( composite ).ceil * 4 ) do |i|
  results << [ function( composite, i ), hammingDistance( i, compareFactor ) ]
  puts i if i % 100_000 == 0
end

Gnuplot::open do |gp|
  Gnuplot::Plot.new( gp ) do |plot|
    plot.title "C = F1 * F2 where F1 and F2 are prime. \\n" +
                "C = #{F1 * F2}; F1 = #{F1}; F2 = #{F2}."
    plot.ylabel "HammingDistance(test, min(F1, F2))"
    plot.xlabel F_DESC
    plot.xrange "[0:]"
    plot.yrange "[0:]"

    x = results.map { |r| r[0] }
    y = results.map { |r| r[1] }

    if JITTER
      x = x.map { |v| v + rand() / 10 }
    end

    plot.data << Gnuplot::DataSet.new( [x, y] ) do |ds|
      ds.with = JITTER ? "dots" : "points"
      ds.notitle
    end

  end
end

Vim: Make Rainbow Parentheses Work in PHP

2012-12-22T00:00:00-07:00

EDIT: What I propose here doesn't actually fix it, it still fails when there's a greater-than sign inside an if statement. I have spent over 8 hours trying to get this to work and that is too much, so I am giving up. If you find a solution, please email it to me.

I use this script to get rainbow parentheses in Vim:

It colors nested parentheses like this:

Unfortunately, it doesn't work with PHP, because the PHP syntax file only allows its own syntax regions to appear inside the <?php and ?> tags. The fix is simple:

Copy the 'system' php syntax file (usually /usr/local/share/vim/vim73/syntax/php.vim) to your personal ~/.vim/syntax folder (create it if it does not exist).

Edit ~/.vim/syntax/php.vim, find the line that starts with syn cluster phpClTop and add level16 to the end of the 'contains' list on that line. If you have set g:rbpt_max in your .vimrc, then you will need to change the "16" to that value.

Encrypted Automatic Backups with Public Key Cryptography

2012-12-16T00:00:00-07:00

Here's how to do encrypted automated backups without having to store the password in the backup script. The script should be self-explanatory (after all, it is 50 lines of comments for just one real line of code).

#!/bin/bash
# File name: backup.sh
# This script automates the process of encrypting a directory for backup.
#
# Instead of using normal password encryption, we take advantage of public-key
# cryptography so that you don't need to include the password in the encryption
# script. This is required if you want to have files automatically encrypted
# with a password remembered only by your biological brain.
#
# It requires a bit of setup:
#
# 1. Generate a public/private key pair (as the user that will run this script):
#   - Run,
#      $ gpg --s2k-cipher-algo AES256 --s2k-digest-algo SHA512 --s2k-mode 3  \
#        --s2k-count 65011712 --gen-key
#   - Choose the "RSA and RSA" key type.
#   - Choose 4096 (or greater) as the key size.
#   - Enter an expiration time of 0 (never expires)
#   - Give the key a name (enter 'invalid@invalid.invalid' for the email).
#   - Enter a password. This is the password that you will need to decrypt the
#     backup files.
#
# 2. Modify the constants in this script:
#   - DIRECTORY:
#       Set this to the folder you want to automatically encrypt.
#   - GPG_RECIPIENT
#       Set this to the ID of the public key generated in step 1.
#       You can find the ID by running
#           $ gpg --list-keys
#       It is the 8-digit hexadecimal number on the 'pub' line corresponding to
#       your key.
#   - OUTPUT_FILE
#       Where to put the encrypted GPG file.
#       If the file already exists, it will be overwritten.
#
# 3. Backup your public key and (encrypted) private key.
#   To decrypt the file that this script generates, you will need the private
#   key and the password you gave in step 1, so it is a good idea to make
#   a backup of your key pair.
#
#   To backup your public key:
#       $ gpg -a --export NAME > public_key.txt
#   To backup your private key:
#       $ gpg -a --export-secret-keys NAME > private_key.txt
#   ...where NAME is part of the name you gave in step 1.
#
#   Because the private key is encrypted with the password, it is safe to store
#   the key backups with the backup file (or even publish them).
#
# DECRYPTING:
#   To decrypt the file generated by this script, run:
#       $ gpg -d -o decrypted.tar <backup file>
#       $ tar xvf decrypted.tar

readonly DIRECTORY=./testing                    # Directory to encrypt.
readonly GPG_RECIPIENT=EAD91475                 # Public key ID.
readonly OUTPUT_FILE=/tmp/encrypted.tar.gpg     # Encrypted file path.

tar cf - -C $DIRECTORY . | \
    gpg -z 9 --batch --yes --encrypt --recipient $GPG_RECIPIENT --output $OUTPUT_FILE

Increasing Collisions in Password Hashing

2012-12-11T00:00:00-07:00

With this post I will try to show how, in a theoretical scenario, deliberately weakening the collision resistance of a password hash function can increase security. This is by no means a formal proof.

Suppose Alice has an account on two computer systems X and Y. She uses the same password on both systems.

Suppose both systems implement the following password hashing scheme: Let t be some positive integer. Given a password P, compute the entropy of the password H(P). Create and store a salted B-bit hash of P where B = H(P) - lg(t). To verify a password, wait for t units of time then check the hash in the usual manner. Here, the entropy of the password is the logarithm base two of the number of guesses it will take an adversary to guess the exact password. Also suppose that it takes one unit of time to compute a hash.

I claim that using this scheme, Alice's accounts are no less secure than if we used 256-bit hashes (if H(P) < 256), and that if System X gets compromised, then her account on System Y is more secure than if we used 256-bit hashes.

To see why, note two things:

The probability of any random string S having the same hash as Alice's password P is 1/(2^B). So if Mallory tries to guess Alice's password using an online attack, it will take about 2^B guesses, so about 2^B * t time. So the effective security against an online attack is B + lg(t). By the construction, B + lg(t) = H(P) so this is no easier than guessing P.
Suppose Mallory roots System X and gets the B-bit hash of Alice's password. It takes Mallory about 2^B guesses to find a preimage. But since B = H(P) - lg(t), Mallory will find about t collisions when she performs the same search she would if it was instead a 256-bit hash (this is not at all a formal argument, but hopefully you see the idea behind it).

By supposition, Mallory has rooted System X, so there is no point trying to secure Alice's account on X anymore. All that remains is the security of Alice's account on system Y. This breaks down if Mallory can get read-only access to the hash database without rooting... but suppose the root password is stored in plain text in the hash database ;) .

Because System Y is using different salts, it is unlikely that any of the t collisions Mallory found, except P itself, can be used to authenticate as Alice to System Y (reader: double check this). So Mallory's best option is to try authenticating to System Y as Alice using the t collisions as passwords guesses, since she knows P is one of those t collisions, and by construction lg(t) < H(P). This will take t * t time, for an effective security of 2 * lg(t) bits.

If, instead, System X was using standard 256-bit hashes, Mallory would have found the exact P and could get into System Y on the first try. Using this scheme it takes about t tries. So by weakening the hash, Alice's account on System Y is more secure than it would have been had the hash not been weakened.

Of course, this system is impractical, since it assumes knowledge of how Mallory would guess P, and thus the entropy of P. It also assumes that if Alice's hash on System X gets compromised, then the security of her account on X no longer matters at all, which is obviously not always the case. It is nevertheless interesting to see how the altruism of the compromised system can increase the security of Alice's account on the other system.

Another problem is that the user must wait t units of time when logging in, so in practice there would be tradeoff between security and log-in wait time. Locking the accounts after significantly less than t attempts might be a better approach.

It doesn't look like it can be made any better than this, since if you decrease B any further, finding collisions with an online attack becomes easier than guessing P, but it is still an online (thus detectable, stoppable) attack so it might still be harder. I would guess that the wait time t would be better spent computing iterations of PBKDF2 or similar.

Why Unsafe State != Deadlock

2012-12-10T00:00:00-07:00

You have a list of processes and a list of resources, and for each process you have:

The number of each resource they will ever need at once.
The number of each resource they are currently allocated.

When a process makes a request for a resource, you only allocate the resource if allocating the resource does not put the system into an unsafe state.

What is an unsafe state?

A system is in a safe state only if there exists an allocation sequence that allows the processes to finish executing. Equivalently, if the system is in a safe state, then there exists an allocation sequence that allows the processes to finish executing. By contrapositive, if there is no allocation sequence that allows the processes to finish executing, then the system is in an unsafe state.

This is not equivalent to the converse: "If the system is in an unsafe state, then there is no allocation sequence that allows the processes to finish executing."

So how can a system be in an unsafe state but have an allocation sequence that allows all processes to finish executing? Remember the assumption that the banker's algorithm makes: It assumes all processes will request all resources they would ever need at once, then terminate, releasing all of the resources they just requested and the ones they held. The assumption that can be incorrect is that processes request all resources they will ever need. There might not be an allocation sequence that allows all the processes to finish executing if they do request all resources they will ever need, but if the processes actually don't request all resources they will ever need (maybe one less, for example), then it might be enough for the system to avoid getting caught in a deadlock.

See the Wikipedia article on Banker's Algorithm for a much better explanation.

Gaussian (Gauss-Jordan) Elimination in Ruby

2012-11-11T00:00:00-07:00

I had to do some Gaussian elimination for an assignment. So here's Gaussian elimination in Ruby:

# Performs an in-place Gaussian elimination on an NxN matrix 'matrix' (2D array
# of Numeric objects) and an N-element vector 'vector.' (array of N Numerics).
def gaussianElimination(matrix, vector)
0.upto(matrix.length - 2) do |pivotIdx|
    # Find the best pivot. This is the one who has the largest absolute value
    # relative to his row (scaled partial pivoting). This step can be omitted
    # to improve speed at the cost of increased error.
    maxRelVal = 0
    maxIdx = pivotIdx
    (pivotIdx).upto(matrix.length - 1) do |row|
    relVal = matrix[row][pivotIdx] / matrix[row].map{ |x| x.abs }.max
    if relVal >= maxRelVal
        maxRelVal = relVal
        maxIdx = row
    end
    end

    # Swap the best pivot row into place.
    matrix[pivotIdx], matrix[maxIdx] = matrix[maxIdx], matrix[pivotIdx]
    vector[pivotIdx], vector[maxIdx] = vector[maxIdx], vector[pivotIdx]

    pivot = matrix[pivotIdx][pivotIdx]
    # Loop over each row below the pivot row.
    (pivotIdx+1).upto(matrix.length - 1) do |row|
    # Find factor so that [this row] = [this row] - factor*[pivot row]
    # leaves 0 in the pivot column.
    factor = matrix[row][pivotIdx]/pivot
    # We know it will be zero.
    matrix[row][pivotIdx] = 0.0
    # Compute [this row] = [this row] - factor*[pivot row] for the other cols.
    (pivotIdx+1).upto(matrix[row].length - 1) do |col|
        matrix[row][col] -= factor*matrix[pivotIdx][col]
    end
    vector[row] -= factor*vector[pivotIdx]
    end
end

return [matrix,vector]
end

# Assumes 'matrix' is in row echelon form.
def backSubstitution(matrix, vector)
(matrix.length - 1).downto( 0 ) do |row|
    tail = vector[row]
    (row+1).upto(matrix.length - 1) do |col|
    tail -= matrix[row][col] * vector[col]
    matrix[row][col] = 0.0
    end
    vector[row] = tail / matrix[row][row]
    matrix[row][row] = 1.0
end
end

# Example usage:
require 'pp'

# A system of equations: matrix * X = vector
matrix =
[
    [1.0, 1.0, 1.0, 1.0],
    [0.0, 1.0, 2.0, 3.0],
    [1.0, 2.0, 4.0, 8.0],
    [0.0, 1.0, 4.0, 12.0],
]
vector = [1.0, 0.0, 2.0, 0.0]

# Create a backup for verification.
matrix_backup = Marshal.load(Marshal.dump(matrix))
vector_backup= vector.dup

# Gaussian elemination to put the system in row echelon form.
gaussianElimination(matrix, vector)
# Back-substitution to solve the system.
backSubstitution(matrix, vector)

# Print the result.
pp matrix
pp vector

# Verify the result.
pass = true

0.upto(matrix_backup.length - 1) do  |eqn|
sum = 0
0.upto(matrix_backup[eqn].length - 1) do |term|
    sum += matrix_backup[eqn][term] * vector[term]
end
if (sum - vector_backup[eqn]).abs > 0.0000000001
    pass = false
    break
end
end

if pass
puts "Verification PASSED."
else
puts "Verification FAILED."
end

The Machine that Alters Votes (2012 USA Election)

2012-11-06T00:00:00-07:00

So there's this video of a voting machine that selects Romney when you try to click on Obama.

To someone who has had some experience with touch screen technology, it looks like the touch system is just out of sync with the UI, which could be fixed by re-calibrating the system. According to the uploader, it is not a calibration issue, because they tried tapping other names and they all worked fine. You can find the uploader's comments in the description of the video. I have no reason to doubt the uploader's sincerity, since according to Mother Jones the machine was actually taken out of service and "recalibrated." So the video is (probably) not fake.

A lot of people are now assuming this was done intentionally to steal votes from Obama in favor of Romney. The mainstream media is picking up on the story as well. The problem with this belief is that if someone did intentionally make the voting machine behave this way, they could have done something far worse. They could have made the system swap the votes invisibly, behind-the-scenes, so that nobody ever notices.

If it was done intentionally, and whoever did it could have made the machine swap votes invisibly, then you have to ask the question: Why did they make it visible? Certainly if a lot of these machines started doing what is seen in the video, a lot of people would notice, and it would be clear that there was some kind of fraud was going on. The election results would clearly be invalid. A lot of vote-altering machines would invalidate the election, but just one is enough to make everyone panic and to get the story covered by the popular news media, giving Romney some potentially bad publicity. So a possibly better explanation, if it was intentional, is that it was done by a supporter of one of the other candidates.

Or, it could just be a bug. I think it is.

Coders, PLEASE STOP inventing your own hash functions!

2012-08-21T00:00:00-06:00

Today, I came across an article on password cracking. In the comment section I saw someone had posted (presumably right after they just read about salting) the following reply:

My solution: don't store hashes as a single SHA1 or MD5 result ...
combine it for further obfuscation. A hash is designed to fall into
enemy hands, so don't make it easy to produce rainbow tables.

SAMPLE - All other password weaknesses still apply!

function generateHash($name, $pass)
{
$salt = '';
for($i = 0; $i < strlen($name); $i++) { $salt = $i . $salt . $name . $i; }
return (sha1($salt . $pass) . sha1($pass . $name . $salt));
}

This code is exactly as secure as sha1( $name . $pass );. It does not make it harder to produce rainbow tables, it is security through obscurity.

I come across an example like this almost ever week. Please stop inventing your own hash functions and use a standard salted and iterated key derivation function.

x86 Stack Diagrams

2012-08-14T00:00:00-06:00

All of the x86 stack diagrams I could find are either cluttered with too much information, can't be read from a distance, or put the high address on top (I'm sure there are people who prefer that but... I'm not one of them). So I made my own.

With low address on top (stack growing up, strcpy going down):

With high address on top (stack growing down, strcpy going up):

Recovering CBC-mode IV via Chosen Ciphertext

2012-08-12T00:00:00-06:00

Suppose a system uses a constant internal initialization vector to encrypt/decrypt data in CBC mode, and you'd like to know what it is. If you can make the system decrypt chosen ciphertexts, this is how you do it:

Make the system decrypt two equal blocks of ciphertext (e.g. all zeroes).
XOR the two resulting blocks of "plaintext" together.
XOR that with the original ciphertext block.

Visually:

The best I can think of for recovering a static IV under chosen plaintext is a meet-in-the-middle attack as follows.

Observation 1: We can specify input directly to the cipher by:

Encrypt a one-block plaintext X, getting the resulting ciphertext C.
Encrypt the two-block plaintext X||(Y xor C), where Y is the block we want to feed directly into the cipher.
The second block of ciphertext will be the result of feeding Y directly into the cipher.

Observation 2: We can encrypt the IV itself and variations of it by varying the first block of plaintext. Formally C = E(V xor IV), when V is the first block of plaintext. We'll call V a "variation vector."

So,

Create a lookup table mapping 2^64 (assuming the block size is 128 bits) random variation vectors from the resulting ciphertext. This lets us look up what variation we made to the IV to result in a given ciphertext block.
Use the method in observation 1 to encrypt random blocks fed directly into the cipher. Look up each ciphertext in the table from step (1). If it's there, then the IV is <the block that was fed directly into the cipher> XOR <the variation vector>

The lookup table from step (1) gives us a 1 in 2^64 chance of finding the IV per known plaintext-ciphertext pair. So it should take about 2^64 iterations in step (2) before we recover the IV.

Visual Basic's "With" in Ruby

2012-08-04T00:00:00-06:00

def with( obj )
  yield obj
end

with Math do |m|
  puts m.exp( 1 )
  puts m.exp( 2 )
  puts m.exp( 3 )
end

# Deeply nested modules
module Foo
  module Bar

    module Baz
      A_CONSTANT = 3
      def self.aMethod( x )
        x * A_CONSTANT + A_CONSTANT
      end
    end

    module Biz
      def self.anotherMethod( x )
        "hello #{x}"
      end
    end

  end
end

with Foo::Bar do |m|
  puts m::Baz.aMethod( 5 )
  puts m::Biz.anotherMethod( "bob" )
end

Raspberry PI: Enable MPlayer and VLC audio on Raspbian

2012-08-02T00:00:00-06:00

If mplayer is giving you an error like the following...

AO: [pulse] Init failed: Connection refused
Failed to initialize audio driver 'pulse'
[AO_ALSA] Unable to set hw-parameters: Invalid argument
Failed to initialize audio driver 'alsa'
[AO SDL] Samplerate: 44100Hz Channels: Stereo Format floatle
[AO SDL] using aalib audio driver.
[AO SDL] Unsupported audio format: 0x1d.
[AO SDL] Unable to open audio: No available audio device
Failed to initialize audio driver 'sdl:aalib'
Could not open/initialize audio device -> no sound.
Audio: no sound
Video: no video

... add the following to /etc/asound.conf (create it if it does not exist):

pcm.!default {
    type hw
    card 0
}

ctl.!default {
    type hw
    card 0
}

Then, run:

modprobe snd_bcm2835

Then add the following /etc/modules (unless it's already there):

snd-bcm2835

Source - "ALSA on Raspbian".

Linux: Fix pipe character on ASUS laptops

2012-07-27T00:00:00-06:00

Is your pipe/backslash key not typing pipes and backslashes? Is it typing less-than and greater-than symbols? If so, add...

key <LSGT> { [ backslash, bar, backslash, bar] };

..to /usr/share/X11/xkb/symbols/us in the kxb_symbols "basic" section.

This seems to be a problem with ASUS laptops, I've seen two of them doing this.

Reference: http://forums.fedoraforum.org/showthread.php?t=240415

How to install mod_ruby on Debian Squeeze

2012-07-22T00:00:00-06:00

If you're a PHP developer that's starting to fall in love with ruby (like me), you'll want to know how to write "PHP-style" web applications in ruby, for small web apps that don't need the complexity of Ruby on Rails. You want:

No per-app configuration necessary. Installing the app is as simple as uploading the script files.
Each ruby file you upload is an independent web page, e.g. http://example.com/foo.rhtml.
Scripts are HTML with ruby code inside delimiters (like php's <?php and ?>).
Scripts have easy access to GET and POST data, as well as HTTP headers and cookies.
Scripts can easily send headers, set cookies, etc.

Unfortunately, to get this working on Debian Squeeze, some initial configuration required, but it's a one time thing and quick in comparison to the per-app configuration required by RoR.

First, install mod_ruby:

apt-get install libapache2-mod-ruby

Second, add the following to your site's configuration and read the embedded comments. Note that in order to lower the ruby safe level with the RubySafeLevel directive (default is 1), it must appear outside any "files", "directory", and "virtualhost" blocks. If not, you will get an error like: mod_ruby: can't decrease RubySafeLevel.

<IfModule mod_ruby.c>
    RubyRequire apache/ruby-run
    RubyRequire apache/eruby-run

    # Safe level 1 does taint checking, but also won't let you run .rb scripts
    # from a world-writable folder. I highly recommend keeping this at 1, but
    # in a development environment, you can change it to 0 to make scripts
    # run from world-writable folders (OTOH, you really DO want to develop with
    # taint checking turned on).
    RubySafeLevel 1

    # Override the mime types in /etc/mime.types so the output of the script
    # is displayed in the browser, not sent as a download. Some guides will
    # tell you to comment out the corresponding entries in /etc/mime.types, but
    # don't do that as it will affect the entire system, not just apache.
    AddType text/html .rb
    AddType text/html .rbx
    AddType text/html .rhtml

    # NOTE: To make .rb files execute, you will need to add:
    #  Options +ExecCGI
    # to the <Directory> they are in. You DON'T need to do this for .rhtml.
    <Files *.rb>
        SetHandler ruby-object
        RubyHandler Apache::RubyRun.instance
    </Files>
    <Files *.rbx>
        SetHandler ruby-object
        RubyHandler Apache::RubyRun.instance
    </Files>
    <Files *.rhtml>
        SetHandler ruby-object
        RubyHandler Apache::ERubyRun.instance
    </Files>
</IfModule>

Now, .rhtml files will work like PHP files:

<html>
  <head>
    <title>Hello, world!</title>
  </head>
  <body>
    Even numbers less than 100:
    <ul>
    <%
      1.upto(99) do |x|
        puts "<li>#{x}</li>" if x % 2 == 0
      end
    %>
    </ul>
    <%
      1.upto(50) do |x|
    %>
      This text repeats <b>50</b> times! <br />
    <%
      end
    %>
  </body>
</html>

And .rb files will work like CGIs:

#!/usr/bin/ruby
puts "<ul>"
300.times do
  puts "<li>Some text!</li>"
end
puts "</ul>"

In both types of script, you can use Apache.request to read GET and POST data, set cookies, etc.

<html>
  <head>
    <title>Hello, world!</title>
  </head>
  <body>
   GET data in rhtml mod_ruby!
   <%
   Apache.request.paramtable['count'].to_i.times do |n|
     puts n
   end
   %>
  </body>
</html>

Why?

Writing this post made me realize I'm trying to make ruby do something it doesn't (yet) do well. PHP has so many built-in features for doing web stuff like htmlentities, built-in mysql access, and easy access to GET and POST data through $_GET and $_POST (note that Apache.request.paramtable includes both GET and POST data, which is bad for security), so for now, I think I'll stick with PHP until there's a better zero-config lightweight ruby web framework. Sinatra is the best I have seen so far, but configuring it with Apache is still far too complicated, in my opinion.

Escaping String Literals (for JavaScript) in PHP

2012-07-01T00:00:00-06:00

Use the following code to escape user-supplied input before inserting it into a JavaScript string literal.

<?php

function js_string_escape($data)
{
    $safe = "";
    for($i = 0; $i < strlen($data); $i++)
    {
        if(ctype_alnum($data[$i]))
            $safe .= $data[$i];
        else
            $safe .= sprintf("\\x%02X", ord($data[$i]));
    }
    return $safe;
}

Example:

<script>
var foo = "<?php echo js_string_escape($bar); ?>";
</script>

The standard htmlentities and htmlspecialchars functions don't work because JavaScript will interpret the HTML entities as a part of the literal string (not decode them). addslashes is insufficient because it does not escape other special characters that might convince some browsers that the string literal or script section has ended (for example, the string "]]>" to end a CDATA). To escape integers and floats, use these:

<?php

// returns "0" when given something that isn't an integer.
function js_integer_escape($number)
{
    $cast = (string)(int)$number;
    if($cast != (string)$number)
        return "0";
    return $cast;
}

<?php

// returns "0" when given something that isn't a float
function js_float_escape($number)
{
    if(!is_float($number) && !is_numeric($number))
        return "0";
    return (string)(float)$number;
}

Using 'wmctrl' to Quickly Switch Between Open Applications

2012-06-23T00:00:00-06:00

The wmctrl program allows you to programatically bring a running application to the foreground on Linux. It works even with compiz enabled, and will switch to the virtual desktop that the application is running in before bringing it to the foreground. This makes it a perfect utility for mapping keyboard shortcuts to quickly switch between applications you leave running all the time.

To install wmctrl on Debian:

apt-get install wmctrl

For example, to switch to Thunderbird:

wmctrl -a "Mozilla Thunderbird"

The -a argument makes wmctrl switch to the first window it finds with the provided string in its title. See wmctrl's manpage for more information.

You can map a command like this to a keyboard shortcut using the (in Debian) System -> Preferences -> Keyboard Shortcuts utility.

Disable 'locate' Command Index Databases

2012-06-20T00:00:00-06:00

If you use Truecrypt on GNU/Linux, you will want to stop mlocate (the locate command) from automatically indexing your files and compromising your privacy.

To do so on Debian Squeeze:

apt-get remove mlocate rm /etc/cron.daily/mlocate

The database files are stored in:

/var/lib/mlocate/

Delete them with your secure-delete utility of choice.

Awesome Desktop Calculator using Ruby's IRB

2012-06-09T00:00:00-06:00

Ruby is an awesome programming language. Its metaprogramming capabilities make it easy to turn the interactive ruby interpreter (irb) into an awesome desktop calculator. To do so, we can make irb execute a ruby script, containing some calculator extensions before it starts, with the following command:

irb -r /path/to/the/file.rb

Of course, you will want to make an alias or keyboard shortcut for this. In bash, this can be done by adding something like the following to ~/.bashrc:

alias rcalc='irb -r /path/to/the/file.rb'

Here's a link to my custom ruby calculator script. Here's what it does:

+----------------------------- RUBY CALCULATOR -------------------------------+
|  0b - Binary    .b - To Binary      Constants: E, PI                        |
|  0x - Hex       .h - To Hex         _ gives last result                     |
|  0  - Octal     .o - To Octal       q quits                                 |
+-----------------------------------------------------------------------------+
|  Window closes after 10 minutes of inactivity. Type 'keepalive' to disable. |
+-----------------------------------------------------------------------------+
irb(main):001:0> 0b11111111
=> 255
irb(main):002:0> _.h
=> "ff"
irb(main):003:0> PI
=> 3.14159265358979
irb(main):004:0> E
=> 2.71828182845905
irb(main):005:0> 2**256 / 3**5
WARNING: Integer division with remainder.
=> 476510655297597512031156316908180690754197467759837712096533267522276253662
irb(main):006:0> 6/3
=> 2
irb(main):007:0> 5.0/2
=> 2.5
irb(main):012:0> sin(PI/2)
=> 1.0
irb(main):008:0>

I will be adding functionality to this script as I need it. Some things I'm planning are:

Unit conversions
Easier way to convert strings in different bases to integers
Efficient factorial function
Common sequences such as Fibonacci
Common formulas
Common constants (c, G, etc.)

If you have any ideas, please leave a comment and I'll add it to the list.

Cracking eHarmony's Unsalted Hashes with CrackStation

2012-06-09T00:00:00-06:00

This week, LinkedIn, eHarmony, and last.fm have all confirmed that their password hash databases have been breached. In all three cases, passwords were stored as an unsalted hash. I've already reported the results of cracking LinkedIn's password hashes with CrackStation, now it's eHarmony's turn.

eHarmony stored their users' passwords as an unsalted md5 hash. The leaked file contains 1,516,877 hashes. You can download the original file from one of either of the following links:

There are no repeated hashes in the file, so presumably the party that leaked them removed the duplicates. Because there are no duplicates, I can't provide any "most common passwords" statistics, but I can report how many CrackStation was able to crack, and how fast it did so.

The cracking process took 23.47 hours and recovered 275,860 (18.2%) of the passwords. CrackStation processed the hashes at an average rate of 17.94 hashes per second. All passwords are upper case, so I suspect that eHarmony was converting passwords to upper case before hashing them to implement case insensitivity (another big no-no).

CrackStation uses two dictionaries. One, which I call the "medium" dictionary, has 1,493,677,782 entries. The other, which I call the "huge" dictionary, has 15,171,326,912 entries. 250,122 of the cracked passwords are present in the "medium" dictionary, 97,419 are in the "huge" dictionary, and 71,380 passwords are in both.

If eHarmony had used salt in their hashes like they should have been, I wouldn't have been able to run this attack. In fact, salting would have forced me to run a dictionary attack on each hash by itself, and that would have taken me over 31 years.

I'm very glad the LinkedIn, eHarmony, and last.fm breaches all went public at nearly the same time. The stories are have been covered by nearly every tech news website, and the issue of inadequate server-side password protection is finally being addressed. I hope other companies will learn from these breaches and start using salted hashes if they aren't already doing so.

Unsalted hashes are bad, but storing passwords in plain-text is even worse. Visit my Password Policy Hall of Shame for a list of websites that are probably storing your password in the clear.

You probably came here wanting to see passwords, so I won't disappoint. Here's a random sample:

39007e310acd5cc5582c34c408ebf4cc :: RAWANN
c69f24b431852eb5b2db419860387dad :: SHELDURAY88
713f6fcbeeacbd3a78401382f88f5d1f :: KJ1017
86fc184cabcf0626c479927cc4e5e998 :: PUSSY310
c075be959b6831fb01d52591963d12b7 :: KARAAGE4
6c058fea843d5bff058c939fde3a6eb8 :: TH3EMPRESS
2dfecece2bf00698dd5fbae90e2f0860 :: ELLEGRA
e720578393bb68956f079c3db426d6ec :: 81PIRTER73
b0963f1a7fd94698a6e76e402daffcef :: KORRESHI
026d29ad37c6c672315e5a9c358d0a7c :: CLC47
7d01d8893e7ddbb18ceb40c59ef384c2 :: ROMELP
bf1a688689f82ba39b9efa236d09c539 :: OFTROY
dfcd9ad16c5358c1c420343a7b2b683b :: MVN2006
14f6609d95e3830b14709bce165041af :: MIKYONE
2b1841891df6de05b163d8dbbe79036c :: JAMFILE
9fe44d8eb7fbc5217fad2e54d09871ed :: TRIATA
961887ee6a084c02619f22f6b2e8a852 :: IAMTHATIS
fd9d9fa433c0d9385345355c17be13f4 :: PEACHKA1
fa22376fe0782fe9313385846e66b979 :: JAHAAD
095614e5971ad8a81d4f232c00bbf33d :: SARAHMIA1
f14c92dd1b2281cdf0f5999e595442de :: LEBIN
6e0f9ff4606b41705ea25bcbff1ac94b :: WINGK2
49cacc76a288058b68ded69f0c804269 :: CHARLIEXX
cbc7f37615111efe8e246d3316e24408 :: MB1229
81fc99cc34d28eec3c90109cab7ddfbe :: EMETI
e838f7db8ef56faa9b49e8215dfbbee7 :: KITABLAR
02ae65a2f3dac98a54290f09c39758ed :: JENGARY
3a7edcb86afee6b0853fba0a16672bcd :: GODSPELL2
22d541659b917e40146f4d4256b2a2e2 :: LETSTALK2
4e953e9a0a0f2503e8b8269b2c4a8057 :: 1MEMO1

Cracking LinkedIn's Hashes with Crackstation

2012-06-08T00:00:00-06:00

LinkedIn's user database has been breached. The passwords were hashed with SHA1, but salt was not used. 6 million of them have been published to the internet. You can download them via torrent or via HTTP from defuse.ca's mirror. 3.5 million of them have had their first 5 hex digits replaced with zero -- some suspect this was used as a way to mark which have been cracked by another party (source).

A bit of googling reveals that LinkedIn has about 120 million registered accounts, so the 6,143,150 hashes represent about 5% of LinkedIn users Correction: Since duplicates were removed from the hash list, it must represent a much larger portion of LinkedIn users. Since passwords are so often re-used, I wouldn't be surprised if it was the entire database. 3,521,180 have been cracked by an unknown third party. That leaves 2,621,970 for me to try to crack with CrackStation.

What is CrackStation?

CrackStation is basically a giant lookup table -- a sorted list of hashes, mapped to their corresponding plaintext. To crack a hash, all I have to do is run a binary search through the hash index file to get the location of the plaintext in the wordlist file. This process is very efficient; a 200GB index file (15 billion hashes) can be searched in only a fraction of a second, even on a standard 7200rpm hard disk.

CrackStation Results

It took 31.8 hours to process all 2,621,970 not-yet-cracked hashes. That's an average of 22 hashes processed per second. In the end, I was able to crack 31,831 hashes -- about 1.2%. CrackStation's "medium" dictionary, which has 1,493,677,782 entries, cracked 23,529 (0.8%) of them. The "huge" dictionary, which has 15,171,326,912 cracked 10034 (0.3%) of them. These figures are not exclusive -- 1732 hashes were cracked by both dictionaries (I did not optimize).

Duplicates were removed from the original list of hashes, so I cannot provide "most common passwords" statistics. Here's a random sample of what I cracked (I will not be releasing the full list):

6764dcf2d9c84b9d66fd5c8a78691affde1045e1 :: sangeetalahiri
d6b3ebab49bd83a60de4f5b84d9fe61eff5cba73 :: DualPhone
c79b146f16d3442bb2adb00cf9a6e456aacdb877 :: juan.rondon
777bb3743c7424b477ae95f0b002cffc3a6d8f57 :: Charlcombe1
a567e183044b8a881a8aec41387614f7963b60be :: hydroworx1
7f97cd544c2937e494265a6a5a4ae3edf6a391e8 :: Jetravaille
87f11d9ccda89e463cf92e3f84dbf1f5b9b5f84a :: Nangiya1
1168caf06e26fb82642b069dc306b9a849e9448f :: kab@las
3722fd3f3cded4dc1231df6b16190364eaf71184 :: grasmachien
5a61c766bb6ea7294a6a0e6e2ccbda8c4eed0ebc :: Eidner4

These results aren't really meaningful, since I only tried to crack the set of hashes that were not already cracked by someone else, but it was a fun exercise to test the strength of CrackStation's password dictionaries. It is also a great demonstration of why salt is crucial to password security. If we assume that all of the previously-cracked hashes could have been cracked by CrackStation, then I would have been able to crack 3,553,011 (57.8%) in only 78 hours, or 19 hours if cracked them in parallel on a quad-disk quad-core system. That figure is consistent with other bulk cracking jobs CrackStation has done in the past.

The reason I cannot crack the ones that had their first 5 hex digits set to 00000 is because CrackStation's indexes are sorted on the first 48 bits of the hash, with the first bits being the most significant. Without all of those bits, I can't do a binary search through the index file. I could rebuild the index using the last 48 bits of the hash, but that would take days and hundreds of gigabytes of hard drive space. I don't want LinkedIn users' passwords that bad. If there is significant public interest in the results, then I will consider doing it.

Conclusion

This kind of attack wouldn't work if the hashes were salted. If they were salted, I'd have to run a dictionary attack on each hash individually, which can take upwards of an hour per hash for a similar-quality attack. So if you run a website that stores user passwords, please make sure they are hashed with salt. If they aren't, (LinkedIn, are you listening?), then you are an irresponsible webmaster.

What is Security Through Obscurity

2012-06-04T00:00:00-06:00

Today a member of GRC's Newsgroups posed a question about security through obscurity:

It seems to me that ALL digital security is EXACTLY "security through obscurity". Take, for example, AES... It isn't that the possible range of keys is unknown, it is just a cleverly hidden needle in an enormously HUGE haystack. It could actually be possible to arrive at the correct key on the first guess. However, I wouldn't bet anything you care about on that, since it would be about as likely as me saying, "I'm thinking of a particular atom somewhere in the universe. Can you guess which one?" Nevertheless, in set notation, it would be trivial to describe the set which includes the correct key. It is simply obscured by all the wrong keys.

So, by your definition, what is real security?

It's a very interesting question, and it made me realize that in all of the research I've done on cryptography, I've never seen a formal definition of security through obscurity. It took me a while to come up with a reasonable response (something other than "I know it when I see it."). My first thought was anything that doesn't follow Kerckhoffs's principle is security through obscurity, but I wanted something more general. After a bit more thinking, I decided that measurability is the main distinction between something that isn't security through obscurity, and something that is. Here's what I wrote:

Informally, I would define security, with respect to cryptography, as something that requires a well-defined and measurable amount of resources to break in a specific scenario.

For example, if a message is encrypted in AES-256 in CBC mode, with a random key, and the adversary knows the plaintext is english, but doesn't know anything about the key, then the security factor is 2^256 i.e. the adversary has to do on average 2^255 operations to successfully decrypt the ciphertext.

Note that this means that even if the key is just one bit, it is still "real" security, as long as the adversary knows that the key is either "1" or "0". It is very weak security, but the difficulty of cracking it is still well-defined and computable.

Security though obscurity is anything that doesn't have a well-defined and computable "security factor" in at least one scenario.

For example, if you are trying to smuggle pirated software across the U.S. border, you may choose to encode the data into the least significant bits of the RGB values in an image file. There is software for doing (and un-doing) this, so it would not be hard for the border patrol officer to extract the data, if he knew it was there. Your security rests on whether or not the officer will know to look in the least significant bits for hidden data. This is not well-defined and cannot be computed into a "security factor" like above.

A real-world example is if you just won the lottery and you are looking for a place to hide your money (supposing banks don't exist):

You could choose to buy a safe, rated to withstand 60 minutes of attack with blow torches. This is "real" security, the amount of work an adversary has to do to break into the safe is well-defined and computable.

You could also choose to hide your money inside the door of your car (between the interior panel and the exterior metal). It would not be at all difficult for an adversary to steal your money, if they knew it was there. The security provided by "Will the adversary ever think that I am hiding the money in the door of my car?" is not well-defined nor computable, so this is security through obscurity.

This is just my opinion on the matter. Cryptography texts and/or experienced cryptographers may disagree.

This definition can be applied to the idea of trying to keep an encryption algorithm secret. If the security of the algorithm depends on it's secrecy, then it is security through obscurity, because the amount of work an adversary (who can run chosen plaintext and chosen ciphertext attacks) has to do to reverse engineer the algorithm is not well-defined and cannot be computed.

Ruby Obfuscation

2012-05-28T00:00:00-06:00

Just having fun...

Obfuscated #1

This evaluates to the string "?".

??????????????:????????:??:??:??:??:?????:?? # => "?"

Obfuscated #2

$i=0;[$c="[$s=['p '],[$s<<[*1?3??'+?<+?3:?y:?]],$s+=[?b],$s|=[*?y+?'],$s[2,0]=5??r+?u:?$],($i+=1)<30?eval($s.join<<?;<<$c):nil]",eval($c)]

Output

"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"
"<3ruby"

Ruby Maze Solver

2012-05-27T00:00:00-06:00

Here's a recursive-backtracking ASCII maze solver I wrote to practice ruby. The o's are the solution.

Output

$ ruby maze.rb maze.txt
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++oooooooo  ++++++++++++++++++++++ ++++++++++++++++++++++++        ++++ ++++++
+oooo++ +++o++++++++++++++++++++++++ ++++ +++++++++++++++++++ +++ +++++++ ++++++
++++ ++   oo+++++++++++++++++++ ++++ ++++                 +++ +++ +++++++ ++++++
++++ ++ ++o++++++++ooooooo+++++ ++++ ++++ +++++++++++++++++++ +++         ++++++
++   +++++o++++++++o+++++o+++++           ++++ ++++++++++++++ ++++++++ +++++++++
++++++++++o++++++++o+++++o+++++ +++++ ++++++++ +++oooooooooooooo++++++ +++++++++
++++++++++o+oooooooo+++++ooooooo+++++ ++++++++ +++o++++++++ +++o++++++ +++++++++
++++++++++ooo++++++++++++ +++++o+++++ +++++++++   o++++++++++++o++++++ +++++++++
+++++++++++++++++++++++++      o++++++++++++++++++o      ++++++o       +++++++++
+++++++ +++++++++++++++++++++++o++++++oooooo++++++o+++++ ++++++o++++++++++++++++
+++++++ +++++++++++++++++++++++o++++++o++++o++++++o+++++ ++++++o++++++++++++++++
++      ++++++++++oooooooooooooo++++++o++++o++++++o+++++ ++++++oooooooo+++++++++
+++++++ ++++++++++o+++++++++++++++++++o++++oooooooo+++++++++++++ +++++o+++++++++
+++++++           o+++++ooooooooooooooo+++++++ +++++++           ++Xooo+++++++++
++++++++++++++++++ooooooo+++++++++++++++++++++ ++++++++++++++++++++F++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Code

#!/usr/bin/env ruby

# ------------------------------ Example Maze ------------------------------------
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# ++++          ++++++++++++++++++++++ ++++++++++++++++++++++++        ++++ ++++++
# +X   ++ +++ ++++++++++++++++++++++++ ++++ +++++++++++++++++++ +++ +++++++ ++++++
# ++++ ++     +++++++++++++++++++ ++++ ++++                 +++ +++ +++++++ ++++++
# ++++ ++ ++ ++++++++       +++++ ++++ ++++ +++++++++++++++++++ +++         ++++++
# ++   +++++ ++++++++ +++++ +++++           ++++ ++++++++++++++ ++++++++ +++++++++
# ++++++++++ ++++++++ +++++ +++++ +++++ ++++++++ +++              ++++++ +++++++++
# ++++++++++ +        +++++       +++++ ++++++++ +++ ++++++++ +++ ++++++ +++++++++
# ++++++++++   ++++++++++++ +++++ +++++ +++++++++    ++++++++++++ ++++++ +++++++++
# +++++++++++++++++++++++++       ++++++++++++++++++       ++++++        +++++++++
# +++++++ +++++++++++++++++++++++ ++++++      ++++++ +++++ ++++++ ++++++++++++++++
# +++++++ +++++++++++++++++++++++ ++++++ ++++ ++++++ +++++ ++++++ ++++++++++++++++
# ++      ++++++++++              ++++++ ++++ ++++++ +++++ ++++++        +++++++++
# +++++++ ++++++++++ +++++++++++++++++++ ++++        +++++++++++++ +++++ +++++++++
# +++++++            +++++               +++++++ +++++++           ++    +++++++++
# ++++++++++++++++++       +++++++++++++++++++++ ++++++++++++++++++++F++++++++++++
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

def main
  printUsage unless ARGV[0]

  begin
    maze = File.open(ARGV[0], 'r') { |f| f.read }
  rescue
    puts "Cannot read file."
    printUsage
  end

  solver = MazeSolver.new(maze)
  puts solver.solve ? solver : "Maze has no solution"
end

def printUsage
  puts "USAGE: ruby maze.rb <mazefile>"
  exit
end

# A recursive backtracking maze solver.
# The maze is specified as an ASCII grid (each line is one row), where:
# - 'X' marks the starting position of the player.
# - 'F' marks the goal.
# - ' ' (space) marks the area where the player is allowed to move.
# - Everything else marks area where the player is NOT allowed to move.
# The maze string must not contain the character 'o' (lowercase oh) since it is
# used to mark the solution path.
class MazeSolver

  PLAYER_CHAR = 'X'
  TRACK_MARKER = 'o'
  FINISH_CHAR = 'F'
  SPACE_CHAR = ' '

  DELTA_ROW = 0
  DELTA_COL = 1

  # Movement directions are specified internally by a 'delta', which is an
  # array where [0] is the change in row and [1] is the change in column.
  # The player is only allowed to move up, down, left, and right.
  DIRECTIONS = [ [0, -1], [0, 1], [1, 0], [-1, 0] ]

  def initialize(maze)
    # Split the maze string into an array of arrays of characters.
    @maze = maze.split("\n").map { |row| row.split('') }
    findPlayer
  end

  # Find the player on the maze grid and check that the maze is valid.
  def findPlayer
    playerFound = false
    finishFound = false
    @maze.each_with_index do |row, rowIndex|
      row.each_with_index do |col, colIndex|
        case col
          when PLAYER_CHAR then
            raise 'More than one player' if playerFound
            playerFound = true
            @playerRow = rowIndex
            @playerCol = colIndex
          when FINISH_CHAR then finishFound = true
          when TRACK_MARKER then raise 'Track marker playerFound in maze'
        end
      end
    end
    raise 'No player' unless playerFound
  end

  # Solve the maze. Returns true if it has been solved, false if it cannot be solved.
  def solve
    possibleMovements.each do |delta|
      moveBy delta
      break if solve
      undoMoveBy delta
    end
    adjacentToFinish?
  end

  # Return an array of valid movement deltas (to SPACE_CHARs) from the current position
  def possibleMovements
    deltas = []
    DIRECTIONS.each do |delta|
      deltas.push(delta) if canMoveBy? delta
    end
    deltas
  end

  def moveBy(delta)
    raise "Invalid movement" unless canMoveBy? delta
    @maze[@playerRow][@playerCol] = TRACK_MARKER
    @maze[@playerRow += delta[DELTA_ROW]][@playerCol += delta[DELTA_COL]] = PLAYER_CHAR
  end

  def undoMoveBy(delta)
    reverse = delta.map { |x| -x }
    @maze[@playerRow][@playerCol] = SPACE_CHAR
    @maze[@playerRow += reverse[DELTA_ROW]][@playerCol += reverse[DELTA_COL]] = PLAYER_CHAR
  end

  def adjacentToFinish?
    DIRECTIONS.each do |delta|
      return true if @maze[@playerRow + delta[DELTA_ROW]][@playerCol + delta[DELTA_COL]] == FINISH_CHAR
    end
    return false
  end

  def canMoveBy?(delta)
    delta[DELTA_ROW] != delta[DELTA_COL] and
    @maze[@playerRow + delta[DELTA_ROW]][@playerCol + delta[DELTA_COL]] == SPACE_CHAR
  end

  def to_s
    @maze.map { |row| row.join('') }.join("\n")
  end

end

main

My Favorite 'Rubyisms'

2012-05-16T00:00:00-06:00

I've been using Ruby at work to write watir tests, and I am constantly amazed at how elegant it is. Here are some of my favorite techniques:

Pass a default value block to Hash.new to implement a memoized recursive function:

fibonacci = Hash.new do |h,k|
    h[k] = k >= 2 ? h[k-1] + h[k-2] : 1
end
0.upto(100) { |i| puts fibonacci[i] }

Use an anonymous array to perform some operation on a constant set of things without repeating yourself:

['golf', 'baseball', 'hockey'].each do |sport|
    play(sport)
    stopPlaying(sport)
end

Instead of:

play('golf')
stopPlaying('golf')
play('baseball')
stopPlaying('baseball')
play('hockey')
stopPlaying('hockey')

Use an anonymous array to check of some variable is equal to any of a set of things:

raise 'Invalid sport' unless ['golf', 'baseball', 'hockey'].include? sport

Instead of:

raise 'Invalid sport' if sport != 'golf' && sport != 'baseball' && sport != 'hockey'

Initialize an array using a range and map, and use rand() with to_s to generate random strings:

randomStrings = Array.new(100) { rand(2**64).to_s(36) }
users = (30..50).to_a.map { |x| "testUser%d" % x }

The Economics of Password Cracking

2012-05-05T00:00:00-06:00

We know that it's possible to come up with a password that no computer on earth can crack. Use true random data to generate a sequence of 20 characters from the full ASCII printable set, spend an hour memorizing, and you're good. We also know that most people don't do that. What we don't know (or at least often forget) is that people don't need to do that.

We estimate our password strength by the amount of time it would take the fastest imaginable supercomputer to search through the set of all passwords of equal or less length and find ours. What we often forget is that the bad guys don't have those kinds of resources, and they rarely ever crack passwords via brute-force search.

Why not? Because most bad guys won't build a billion-dollar supercomputer to crack one password, and most people with billion-dollar supercomputers aren't willing to rent out their processing power for password cracking. It isn't profitable, and those supercomputers can be used for better things like scientific research.

The Bitcoin network is currently computing 11.74 trillion sha256 hashes per second (see here for current stats). The network will compute 3.702x10^20 hashes in one year if it continues at it the same rate (my guess is that it will grow, but it's already over 10 times as powerful as the fastest known supercomputer). That may seem like a lot of hashes, but if you do the math, you'll see that its not even enough to do a brute-force search through the set of all 11-character ASCII passwords. log(3.702x1020)/log(95) = 10.40

Read it again: The Bitcoin network is made up of millions of dollars worth of hardware and is 10x faster than the fastest known supercomputer, but it can not brute-force guess an 11-character password in a year.

There is no business model that makes brute-force password cracking profitable. To see why, consider the following argument:

If the password can't be cracked with good quality dictionaries or rainbow tables, it is long and complex.
Since the fastest distributed computing network on earth can barely search through the set of all 10-character ASCII passwords in a year, the probability of cracking a long and complex password via brute-force search in a reasonable amount of time is low.
Since the probability of successfully cracking a password via brute-force is low, to make any money, you must charge the customer even if you cannot crack it.
Since the probability of successfully cracking a password via brute-force is low, and the customer must pay even if you cannot crack it, the customer will not be willing to pay very much.
A decent brute-force attack requires a lot of time on an expensive supercomputer, so you must charge a lot.
(4) and (5) are incompatible with each other, so it is impossible to run a profitable brute-force cracking business.

Of course (4) may not hold true when the customer is a government and the password is the key to winning a war, but most passwords don't have that much value.

What this tells us is that we don't need to worry about brute-force attacks. They always succeed (by definition), but rarely in a reasonable amount of time and there is rarely ever a password valuable enough to justify one.

So ironically, the most profitable kind of password cracking requires very little computational resources (a single 6-core system satisfies crackstation.net's needs). The key to being profitable in the password cracking industry is to be clever and do as much as you can without a supercomputer. That means implementing extremely fast look-up tables and constructing extremely effective dictionaries -- going after the low-hanging fruit.

That's exactly what the bad guys do, and that's exactly what my hash cracking service does. If you want your password to be secure, don't worry about comparing its strength to a hypothetical supercomputer, just make sure it's not a low-hanging fruit, and make brute-force search the only option for your adversary. Then they probably won't even bother trying.

The easiest way to get out of the low-hanging fruit zone is to make your password long. Take a look at GRC's Password Haystacks page for some good advice.

Here's a tip: My hash cracking service is backed by the largest known password cracking dictionary, which has just over 15 billion entries. There are over 7 billion possible 5-character ASCII strings. So if you include 5 random ASCII characters in your password and pad it out to at least 12 characters with something memorable (not a word!), you can be pretty sure that your password isn't a low-hanging fruit.

Random .vimrc Tips

2012-04-29T00:00:00-06:00

Here are some of my favorite .vimrc lines.

Save quickly from any mode by pressing CTRL+:

imap <C-\> <Esc>:w<Cr>
map <C-\> <Esc>:w<Cr>

Make indenting and de-indenting in visual mode preserve the selection:

vnoremap > ><CR>gv
vnoremap < <<CR>gv

Quick case insensitive search with double slash or double question mark:

map // /\c
map ?? ?\c

Make the j and k keys move up by a line on the screen rather than a line in the file (very useful when navigating a long line that has wrapped many times):

map j gj
map k gk

Highlight column 80 (Vim 7.3+ only):

if v:version >= 703
    set cc=80
    hi ColorColumn ctermbg=Gray ctermfg=Black guibg=#404040
    command Skinny set cc=73
    command Wide set cc=80
endif

Don’t show the splash screen:

set shortmess+=I

Keep the cursor 4 lines away from the top or bottom to automatically preserve context when editing near the top or bottom of the window:

set scrolloff=4

Make CTRL+u and CTRL+d less confusing:

map <C-u> 10<C-Y>10k
map <C-d> 10<C-E>10j

Scroll the screen with ALT+{j,k}:

map <A-j> 2<C-E>
map <A-k> 2<C-Y>

Easy paste toggle:

" Allow middle-click pasting of large texts in terminal
set pastetoggle=<F5>
" Clear paste mode when going back to normal mode
au InsertLeave * set nopaste

Switch windows quickly with CTRL+{h,j,k,l}:

" This breaks backspace in a terminal, but I never use backspace in normal mode
map <C-h> <C-W>h
map <C-j> <C-W>j
map <C-k> <C-W>k
map <C-l> <C-W>l
" This would break in a terminal where ^H is backspace.
if has("gui_running")
    imap <C-h> <Esc><C-W>h
endif
imap <C-j> <Esc><C-W>j
imap <C-k> <Esc><C-W>k
imap <C-l> <Esc><C-W>l

Click here for my entire Vim configuration.

Clipboard over SSH with Vim

2012-04-28T00:00:00-06:00

The following is a simple and easy way to get clipboard sharing with Vim working between two Linux installations (specifically a desktop and remote server).

First install xclip on both your local machine and the server:

apt-get install xclip

Installing xclip will bring along some dependencies like x11-common, but don't worry, you don't need to run an X server on the server to get this working.

Next, enable X11 forwarding on the server. Add the following to /etc/ssh/sshd_config:

X11Forwarding yes

Then add the following to the server's ~/.vimrc:

vmap "+y :!xclip -f -sel clip
map "+p :r!xclip -o -sel clip

This will remap the "+y (copy) and "+p (paste) commands to use xclip.

Now you're done. SSH into the server with ssh -X, fire up vim, and see if it works. If you don't want to type -X every time, you can add ForwardX11 yes to /etc/ssh/ssh_config on your local machine to make it always try to forward X.

Source: http://vim.wikia.com/wiki/GNU/Linux_clipboard_copy/paste_with_xclip