Tag Info

Hot answers tagged

77

A malicious hosting provider can do a lot more than simply steal your code. They can modify it to introduce backdoors, they can steal your clients' data, and ruin your whole business. Trust must exist between you and the host. About the source code. If the attacker is trying to gain access to your source code, they will gain access to your source code, ...


41

Much of the work on passwords and keys is related to controlling where they are stored and copied. A password is stored in the mind of a human user. It is entered on a keyboard (or equivalent) and goes through the registers of a CPU and the RAM of the computer, while it is processed. Unless some awful blunder is done, the password never reaches a permanent ...


32

Well, this calls for three comments: You cannot protect secrets with code obfuscation. Not really. Code obfuscation somehow works against unmotivated attackers, but it is not strong. If there is commercial value in breaking through it, then it will happen. If you don't trust your hosting service then look for another hosting service. If the secrecy of your ...


27

No, it isn’t worth it. Nobody wants to steal your code. A thousand million SaaS products have been launched by individuals and companies using third-party hosting of some description or another, and roughly none of them have found themselves to be competing against themselves after having the code for their products stolen by their hosts. So, should you ...


24

There is two explanations as I see it. Fight over the box The different malware types want to single-handedly own the box and not share it with others. It will therefore try to patch the system and remove other malware and leave a backdoor for the creator. Ethical worms Malware that spreads only to patch and remove other malware is often referred to as ...


18

Extending Karrax's answer: Because the more infections a box has, the higher the chanches (at least one of) the infection gets caught are, and if the box is wiped / cleaned up, it's game over for the malware. So, by cleaning up other infections and/or patching the system the malware is trying to preserve its own existence.


14

Testing for ECB / CBC / OFB / CTR mode is fairly straightforward. It's also straightforward to see if the mode has authenticated encryption like EAX / GCM (though it isn't straightforward to see which mode of AE). ECB: have a file with many similar blocks in the plaintext. Do you see identical blocks in the ciphertext? (Yes this is similar to Dan's ...


13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


12

The basic path for exploiting an overflow-related vulnerability is to find a crash (often by fuzzing), evaluate the crash and whether it presents an attack path, and then build something to exploit it. Sometimes where one looks can involve knowledge of the architecture, such as when Charlie Miller noted that iOS 4.3 has a section of memory which will run ...


12

You are correct. App secret should be secret and should not be easily obtained by reverse engineering your client code. Facebook uses OAuth so everything I say here also applies to all the applications that use OAuth to authorize and authenticate. The app secret authenticates your client to facebook. Just like a username/password authenticates a user to a ...


12

For studying malware, you will be doing a lot of reverse engineering to understand what it does as well as a lot of analyzing systems for weaknesses to try to predict which ways malware development might go. A Computer Science degree will be critical and you will want to focus on decompiling and low level development (assembly and C/C++). Understanding ...


12

Obfuscation is ineffective against a determined attacker, it only makes it slightly more difficult. If you have a particular reason to distrust your hosting provider, get another. If you just want to be safe, get a non-disclosure agreement and other legal assurances that allow you to go after your host if they abuse things. If you still don't trust ...


10

Yes, Java class files are easy to reverse engineer. The format is very regular, and very constrained: the VM must be able to verify that the code complies to the strong typing rules of Java code. This is like the output of a C compiler with all optimizations deactivated: the program structure is plainly visible. (In the Java model, optimization happens in ...


10

In many programming languages, initialization of local variables is forced, or the engine will flatly refuse to read uninitialized data. Even in languages where you can read uninitialized variables and thus get a copy of what remained in RAM at that emplacement, you cannot count on it to be "random"; it will have a tendency to contain always the same value, ...


10

Short: Is exploit researching different from penetration testing? Yes. Is exploit researching part of pentesting? Usually not. Good summary of what penetration testing is is here: Wikipedia definition of penetration testing. Simple penetration testing A lot of penetration testing work is actually just running pre-existing, well-known attacks or ...


9

To look at your assumptions: many attack groups have resources vastly bigger than that of companies in a typical company security is a cost centre, so they never have enough staff or money in the black hat world, finding security flaws is a revenue stream fuzzing is done by security engineers and black hats fuzzing is by its very nature fallible. So ...


9

I wouldn't bother. Two reasons: Runtime interpreted languages really cannot be fully protected that way. To completely obfuscate it you would have to obfuscate it from the runtime as well, then there would be no way to execute it. Obfuscation just makes the task slightly more annoying. It can also make debugging and deployment more time consuming for ...


9

Fundamentally you cannot secure your client. At best you can obscure and obfuscate in order to make it more difficult for an attacker to modify the client. You mention that it is not a security issue because the server is properly secured, but merely an annoyance. It may be more annoying to try to obscure your client than to let a few modified clients make ...


8

This is extremely unsafe, to the point of being pointless: Your hash function is not a one-way function. One can instantly (with constant and low runtime) calculate an input producing any given hash if you allow arbitrary 4 character passwords as inputs by undoing the XOR with the initial hash value formed from the password length. With a little ingenuity, ...


7

One possible model for preventing software piracy is Trusted Computing. The hardware platform is "trusted" in that it should be tamper resistant and will refuse to run non-authorized code, or divulge the contents of the RAM. This is the model employed by game consoles, e.g. the PS3. This relies quite heavily on symmetric encryption (so that important code ...


7

Some malware authors are part of groups that don't like other malware authors. It's kind of like one football team which doesn't like another football team; they both want to see furtherance of football, but they don't want that other team to be there when it happens.


7

Keeping your crypto secret is not feasible. You need to have it out there, if it was just so people could test it if it actually works. I don't see any reason to keep crypto secret. You can put a lock on the door everyone can see your lock everyone knows how your lock works and knows that without the key it's useless. The password is your key. Besides all ...


7

To answer your question, I need to cover the full description of how a new process created. There's a great description of this in Chapter 5 of Windows Internals 6th Edition Part 1 (ch. 5 being available freely online on the Microsoft website) which explains exactly how all of this works. I'll paraphrase an overview of what's said in the book, as copying ...


7

Degree-wise, I'd recommend Computer Science with a strong grounding in code development - the average software engineering classes, with extra effort in lower level languages that touch the system more intimately (C,C++, assembly) and compiler theory. As an add on - ways of breaking through higher level web based technologies is also becoming a trend - so ...


7

(Warning: here I am making some "educated guesswork", notably by analogy with what happens in other operating systems.) The behaviour you describe is normal: a .NET executable is actually a kind of script. From the point of view of the operating system kernel, there is no ".NET". The kernel knows of executable files. For the kernel, a file can be accessed ...


7

None. If they don't decompile your app, they will just put it through a proxy with it's own SSL certificate. Your client can't provide security for your backend.


6

Here's an example in x86 assembly: MOV AX, 4Ch MOV [someaddr], AX MOV AH, 30h INT 21 CMP AL, 5 This will take advantage of the instruction pipelining of the processor and the failure of debuggers (as they single step through the code) and can as well be an example of an anti-debug measure. This is so because int 21(DOS interrupt) along with an 30h in AH ...



Only top voted, non community-wiki answers of a minimum length are eligible