codeblog code is freedom — patching my itch

8/29/2005

open source disassemblers

Filed under: Reverse Engineering — kees @ 7:57 pm

Not a lot of OSS folks seem to be interested in reverse engineering, so as a result, there isn’t anything like IDA-Pro for the OSS reverse engineer. There is a very excellent disassembling library, but it has no user interface (yet). It used to have Bastard attached, but that’s pretty out of date now. There is also Lida, but it doesn’t even compile. It was based on Bastard, but I can’t get it to work. It seems to be missing some specific version of the opcode map from Bastard.

Bastard and Lida are both static analysis tools, though. What I really want is a dynamic analyzer. I want to be able to trace the call paths during Porrasturvat’s execution, so I can more easily figure out which function is called when I click “Dismount”. That’ll help me find the Force constant. I’m worried I’m going to have to hack together some unholy Perl script to run “stepi” over and over, waiting for each “call” to take place. That. Would. Be. Very. Slow.

Anyway, I was really impressed with libdisasm, so I built an automake/autoconf setup for it. Even if they don’t want it, I like being able to do a “make install” and having the library end up in the right place. :)

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/28/2005

porrasturvat hacking

Filed under: Reverse Engineering — kees @ 2:14 pm

Three years ago, when I first saw tAAt’s Porrasturvat, I couldn’t stop playing it all day. It’s a really simple game: see how much “damage” you can score to a stick figure that you push down the stairs. It’s basically a physics simulation that tracks force and impact of a body falling down a flight of stairs. So much fun. I hope they make it skinnable. :)

At the time (2002-11-12) I had asked for source code in the hopes of helping to port it to Linux. I got an email yesterday in reply to my request. This sets the record for the longest reply-time on a email, ever. :) Jetro was letting me know it was available for Linux now, so I immediately downloaded it and started playing again. This version is much more stable and lacks any scoring glitches (that I’ve been able to find), so it’s a real challenge to get a high score.

Even in the original game, I had wanted to push the figure backwards off the stairs to see what kind of damage would be done just from having him fall straight down. This time, I’m determined to practice some binary analysis skills and locate the place in memory where the “Force” value is kept so I can tweak it. So far so good, I’ve been able to locate the damage accumulators for the various body parts. Now it’s a matter of just tracing the changes back through the execution paths. Here’s my million-point game:

damage mod

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

cvs camcorder

Filed under: Multimedia,Reverse Engineering — kees @ 12:43 am

I was able to get my hands on a CVS camcorder this past week. The unit is very cool. It doesn’t have any features of a “real” video camera, but I view it like a super-version of my Digital camera which can take 15 seconds worth of video at a time. This one is only limited by available storage (about 20 minutes). The resolution can be turned up to 640×480, too.

Initially I couldn’t get a cable built for it. I had a spare USB cable and a spare Palm Pilot cable to merge, but after soldering it all together, the device wouldn’t take an address (but my laptop noticed it was getting plugged in). After a hint from Linus (“plug-ins are detected via power-draw, everything else is over the data lines”), I realized that perhaps the USB data wires were reversed (the cable has got to flip them on at least one end of the cable… I just got unlucky).

The software for downloading the videos had been ported to Linux, and I worked on some more code to have a one-shot ability to download all the videos from the camera. Now I’ve got autoconf/automake working for it, and have gotten myself added to the Saturn Tools project where we can all work on the code through SourceForge’s CVS. Much easier than endlessly trading patches. :)

So far, I’ve managed to wreck the splash-screen image during camera bootup. Something is busted with the usb_bulk_write calls, and the device stops taking writes after 4k worth of data. Hopefully I can get that repaired so I can be greeted by the Laughing Man. I’ve also got a JPG all ready to replace the logo screen, “powered by pure digital technology”, with my oh-so-clever “powered by pwnd digital technology”.

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/25/2005

playing with cars

Filed under: Vehicles — kees @ 5:54 pm

I ordered a vehicle-bus-to-serial converter last year, but never got around to playing with it. This lets me examine all the sensors on my vehicle’s sensor bus. Stuff like RPM, speed, engine load, etc. It also works as a code-scanner if something bad happens. One harmless example is if the gas cap isn’t tightened all the way, it’ll set a code, and my “check engine” light will come on. With this, I can clear the code, tighten the gas cap, and get on with my life. :)

I was really excited to see that the ScanTool folks released their software under the GPL. Someone else had already gotten it compiled under Linux, but his website is down right now. So, impatient person that I am, I went ahead and installed Allegro and DZComm. DZComm needed a little work to be happy with my USB-to-serial converter, but once that was done, I got to drive around with Bryce reading me my engine load off the laptop. Fun!

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/16/2005

art thoughts on aug 16, 2005

Filed under: General — kees @ 7:11 pm

I saw a mention of the Portland Time-Based Art festival. Looks to be a pretty wild mix of all kinds of performance art. I’ve got to check it out, but it looks a bit pricey (minimum: $125).

Portland’s 94.7FM “alternative” radio station is great. (They even have live streaming.) I’ve been especially impressed with the 6PM “Cocktail Mix” by Gustav. His personal collection of electronica is very nice. I’ve never heard Messiah played anywhere other than my stereo or very rarely at clubs. A few weeks ago, he played it. So cool. They’re also running a NIN remix contest I’m pondering entering. I’m not really sure what sort of open software I should use to cook it, though.

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/15/2005

1 second film

Filed under: General — kees @ 3:18 pm

I found the 1 Second Film project today while trying to remember the name of the movie I saw this weekend. All I could remember was the dude was from Hackers. His name turns out to be Jesse Bradford. (The movie was Happy Endings, which I thought was pretty fun.) I was surprised to see Jesse Bradford listed as a Producer on another film, so I followed the link only to discover that everyone is a producer for the 1 Second Film.

Anyone can become a Producer (and get listed on IMDB) by sending them money. The film itself is going to be 1 second of 12 doubled frames of animation (which will be auctioned off after the movie opens). The credits will then roll for 60 minutes, playing next to a “The Making Of” movie. The profits are going to charity, and celebrities seem to have started a bidding war. Their credit-purchasing page is linked to PayPal, so it looks super-easy to support them. Crazy.

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/7/2005

quick guide to encryption

Filed under: Networking,Security — kees @ 11:02 pm

I should qualify my comments from my prior blog entry and say that I’m appalled at Service Providers (not users) that continue to offer insecure services to their clients. Users, however, should be asking their Providers for secure services. Most don’t know to ask this, and that’s why I think the responsibility falls on the Provider.

Here’s my crash-course in simple anti-sniffing techniques.

  • Evaluate your network: if you’re on open Wireless, any one interested can see all communications to/from your computer. Be paranoid. If you’re on a wired network, your communications can still be seen, but it tends to be much less likely.
  • Evaluate your services: do you care about your various services? Do you have a different password for each service? Details below…

Evaluating your services requires creating a short list of all the things you send over the network from your computer. For basic anti-sniffing, there are two types of “encryption” available for most services:

  • Authentication: logging into anything. Checking email, logging into IM, logging into websites, etc. Some services offer “encrypted” authentication. Modern AIM clients, “APOP” POP clients, etc. If your authentication is encrypted people can’t just sniff your account/password off the wire.
  • Communication: all the traffic to any site/service. All services have a fully encrypted counterpart. Almost everything uses SSL for encryption, and appends an “S” to the protocol name. HTTP has HTTPS, POP has POPS, IMAP has IMAPS, SMTP has a TLS mode, Jabber has an SSL mode, good IRC networks have an SSL mode, etc. These SSL-protected services encrypt ALL of your communciation, including the username/password authentication.

It’s best to have fully encrypted communications, but if you can’t, just getting some kind of obfuscated authentication mechanism is better than nothing. Just ask yourself any time you type in a username/password, “How is this being sent to the remote server?”

So, here are some specifics to various common services:

  • Receiving email: POP and IMAP have SSL modes that run on different ports. See if your email Provider offers these services and switch your client to using those instead. If that’s not available, see if POP or IMAP support other authentication modes besides the clear-text “Plain” and “Password”. For example CRAM-MD5, Challenge/Response.
  • Sending email: SMTP has an SSL mode too. This is either called “STARTTLS” or “SSL”. A good Provider will offer SMTP on port 587 with STARTTLS. Hopefully your Provider requires you to authenticate before sending email. Instead of SSL, like POP/IMAP above, they may offer CRAM-MD5, etc.
  • Web sites: only use “https://” for logging into websites. If there isn’t a little lock in the corner of your browser, don’t log in. The browser folks have done a lot to help folks with this part. Ecommerce has caused a huge push to avoid in-the-clear authentication on websites. Unfortunately, some sites will still let you log in without SSL. (Like flickr, it seems.)
  • IM: I’m not sure about ICQ, MSN, etc, but Jabber offers a full SSL mode. The “old” style runs on a separate port (5223). The “new” style gets “turned on” during the initial jabber session setup. This would give you fully encrypted communications. I know AIM has both a Challenge/Response and MD5 mechanism for logging in, so at the very least, use those.

If you’re not sure if your communication is being encrypted or not, it’s very easy to install a network sniffer. Ethereal is available for almost every platform around, via the libpcap libraries. Just start it capturing before you use a service, use the service, and then go find the traffic in the capture log. Ethereal will identify almost all services by name (“HTTP”, “POP”, “IRC”, “AIM”, etc.) To see the traffic, click on the “Analyze > Follow TCP Stream”. This will show you all the communication for a given connection. (Click on “Clear” in the Filter bar to see all your traffic again.)

If you want to browse the traffic more easily, you can type in other filter terms. For example, to make sure your POP password isn’t being sent in the clear, enter “pop.request” in the Filter, and click “Apply”. Pick a packet, and select the “Request” section in the Packet Tree. If you see:

Request: USER omfg

Request: PASS intheclear

Then your “omfg” account is showing it’s password to the rest of the network. :)

Another alternative to all this pain is to have a VPN connection to some other network that you trust. This is the easiest to configure on the client side. If that’s not available, you can also tunnel all your traffic through an SSH connection. This is easiest to configure on the server side (no config). Here is an example of tunneling your POP service through SSH:

ssh -L 2110:pop.example.com:110 account@example.com

That’ll set up a local port 2110 that gets forwarded to “pop.example.com” port 110 (POP) after logging you in to some SSH account. This means you have to configure your POP client to use “localhost” port 2110 instead of “pop.example.com” on the regular POP port. And then you can only POP when your SSH connection is up.

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

oscon 2005 wireless sniffing

Filed under: Networking,Security — kees @ 9:03 pm

OSCON’s wireless network was okay. It didn’t seem to handle the load very well, but generally you could pick out an Access Point that was still responding to DHCP, and it would work well enough.

I feel like I’m beating a dead horse, but I’m appalled at how many people continue to not use encryption. I spent some time yesterday going through my 4.1G of packet capture logs. Generally, I scanned POP, SMTP, IRC, and HTTP traffic. I should probably find better tools than just ethereal, but after finding 45 different POP accounts that were authenticating in the clear, I stopped counting. That put me half way through Thursday, so that’s only a day and a half of OSCON wireless traffic. No one seems to protect their nick on FreeNode, so at least no one’s nick password was sent in the clear. One person logged into Flickr in the clear. One of the accounts was for the speaker I was listening to at one point. I recognized the POP account because it was up on his slides.

What’s really interesting is the number of people that didn’t authenticate in the clear but ran the rest of their traffic in the clear. For example, many people used various challenge/response systems to authenticate to POP, IMAP, SMTP, and AIM, but then all the traffic continued to stay in the clear. All their email and AIM buddy information was out on the wire.

I know there was at least one other person doing network sniffing, since I saw him running EtherPEG (which makes a live collage of all the incoming HTTP images on the wire). I started up a heavy download of images just for him, but I think he had bored himself with enless slashdot and oreilly GIFs and never looked back to see the fun I had sent over the air for him. :)

(If you don’t have a Mac and you want EtherPEG functionality, there is also DriftNet.)

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/5/2005

defcon 13 patch round-up

Filed under: Networking — kees @ 7:38 pm

In (useless) preparation for DefCon 13′s CTF this year, I hacked at ettercap and Snort. Since the TTL filtering trick was out of the bag, I figured I’d implement the other idea I had. Since the score bot generally is a short-lived connection to a service in CTF, it would be great if Snort-inline rules could be written to detect how long a conenction had been around for. Initially I hacked at ettercap, but that was mostly so I could build a quick-and-dirty TTL statistics gatherer. In ettercap, I had to add session time tracking, but in Snort, it was actually already there. There just wasn’t anything that could be matched against in the rules section. I lifted the TTL matcher from Snort and just used the existing connection timers to do the work and created the “age” rule. Works like a charm. I hope they take my patches.

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/4/2005

oscon 2005 doppelganger

Filed under: General — kees @ 10:52 am

Wednesday I met my doppelganger. I had people walking up to me all day saying, “Hi Zak!” and I’d look at them and explain that I was someone else less famous, named Kees. Normally I think I’m just being paranoid thinking people are looking at me all the time. However, today, it seemed to be true. People would kind of slowly orbit me, trying to get a look at my face and my name badge. Eventually I started telling people “Hi! I’m not Zak.” By the end of the day, I had finally met him, and we had a good laugh. There is also Dan at the LTC that shares similar features, and all three of us had our picture taken together. (I hope they read this blog and send me photos!)

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/3/2005

oscon 2005 mid week report

Filed under: General — kees @ 9:33 pm

Day 1 of OSCON was spent recovering from DefCon. I didn’t go to either of my scheduled tutorials. I really wish I could have gotten to see Conway present his Presentation Aikido, since the notes for it are terrific. I also really wish I could have spent some more time with Snort, especially given all the attention I gave to Snort Inline over the last few weeks.

Day 2 of OSCON was spent in the RT and Aterisk tutorials. The RT one was very interesting, but more geared towards people wanting to do something MORE than ticket tracking. I was glad to see that 3+ has a much better commandline query tool. That’ll speed up autokees’s “-rt” responses. (“autokees” is my IRC bot that reports OSDL’s open — and closed — RT tickets for the Core Services group.) The Asterisk presentation was fantastic.

Capouch really knows his stuff, and his Asterisk demo was very impressive. For the last part of his demo his showed off his home X10 turning on a light in his living room that triggered a motion detector running against his webcam, watching his prized Robert Crumb original, which dropped an Asterisk call file into the server and called him. Time between “X10 on” and his phone ringing: 2 seconds, if that. That tutorial was well organized, and detailed. I think I could probably set up an Asterisk server right now if I didn’t need to go to bed so badly.

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

8/1/2005

Plan B sucked!

Filed under: General — kees @ 5:16 pm

Well, our team of 3 didn’t do so well at CTF this year (4th in teams). But, I guess, holding our own against teams with 20+ people on them is kind of good. The game’s network was organized very differently from years past, and we had no way for inline Snort to work. They held the machines locally (in a FreeBSD jail), and we just got a network drop so we could share the network with our server. That was pretty disappointing, but I think it made the game much more pure. This year’s focus was on code auditing and binary analysis.

Both of my basic goals were achieved though:

  • Not come in last
  • Modify the token scoring tool to play victory WAVs any time we scored a point. That worked very well and was a great motivator.

I guess I’m going to have to really get cracking with some gdb programming work. Jesse’s auto-stack-overflow-detector rocks, and I think that can be seriously expanded, if not hooked up to Metasploit directly.

© 2005, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Creative Commons License

Powered by WordPress