• Security of mobile OAuth 2.0

      image

      Popularity of mobile applications continues to grow. So does OAuth 2.0 protocol on mobile apps. It's not enough to implement standard as is to make OAuth 2.0 protocol secure there. One needs to consider the specifics of mobile applications and apply some additional security mechanisms.

      In this article, I want to share the concepts of mobile OAuth 2.0 attacks and security mechanisms used to prevent such issues. Described concepts are not new but there is a lack of the structured information on this topic. The main aim of the article is to fill this gap.
      Read more →
    • The Data Structures of the Plasma Cash Blockchain's State

      • Tutorial


      Hello, dear Habr users! This article is about Web 3.0 — the decentralized Internet. Web 3.0 introduces the concept of decentralization as the foundation of the modern Internet. Many computer systems and networks require security and decentralization features to meet their needs. A distributed registry using blockchain technology provides efficient solutions for decentralization.
      Read more →
    • WAF through the eyes of hackers

        Today we’re going to talk about one of the modern security mechanism for web applications, namely Web Application Firewall (WAF). We’ll discuss modern WAFs and what they are based on, as well as bypass techniques, how to use them, and why you should never entirely rely on WAF. We’re speaking from the pentesters’ perspective; we’ve never developed WAFs and only collected data from open sources. Thus, we can only refer to our own experience and may be unaware of some peculiarities of WAFs.
        Read more →
      • Long journey to Tox-rs. Part 1

          Tox logo

          Hi everyone!


          I like Tox and respect the participants of this project and their work. In an effort to help Tox developers and users, I looked into the code and noticed potential problems that could lead to a false sense of security. Since I originally published this article in 2016 (in Russian), many improvements have been made to Tox, and I lead a team that re-wrote secure Tox software from scratch using the Rust programming language (check out Tox-rs). I DO recommend using tox in 2019. Let's take a look what actually made us rewrite Tox in Rust.


          Original article of 2016


          There is an unhealthy tendency to overestimate the security of E2E systems only on the basis that they are E2E. I will present objective facts supplemented with my own comments for you to draw your own conclusions.


          Spoiler: The Tox developers agree with my points and my source code pull request was accepted.

          Here go facts:
        • What is going to happen on February 1, 2020?

            TL;DR: starting February 2020, DNS servers that don’t support DNS both over UDP and TCP may stop working.

            Bangkok, in general, is a strange place to stay. Of course, it is warm there, rather cheap and some might find the cuisine interesting, along with the fact that about half of the world’s population does not need to apply for a visa in advance to get there. However, you still need to get acquainted with the smells, and the city streets are casting cyberpunk scenes more than anything else.

            In particular, a photo to the left has been taken not far from the center of Thailand’ capital city, one street away from the Shangri-La hotel, where the 30th DNS-OARC organization meeting took place on May 12 and 13. It is a non-profit organization dedicated to security, stability, and overall development of the DNS — the Domain Name System.

            Slides from the DNS-OARC 30 meeting are recommended for everyone interested in how the DNS works, though perhaps the most interesting is what is absent in those slides. Namely, a 45-minute round table with a discussion around the results of DNS Flag Day 2019, which occurred on February, 1, 2019.

            And, the most impressive result of a round table is the decision to repeat DNS Flag Day once again.
            Read more →
          • Even more secret Telegrams

              We used to think of Telegram as a reliable and secure transmission medium for messages of any sort. But under the hood, it has a rather common combination of a- and symmetric encryptions. Where's fun in that? And anyway, why would anyone trust their messages to the third-party?
              Spy vs Spy by Antonio Prohías
              TL;DR — inventing a private covert channel over users blocking each other.

              Read more →
            • Legacy Outage

                Two days ago, May 5 of the year 2019 we saw a peculiar BGP outage, affecting autonomous systems in the customer cone of one very specific AS with the number 721.

                Right at the beginning, we need to outline a couple of details for our readers:

                1. All Autonomous System Numbers under 1000 are called “lower ASNs,” as they are the first autonomous systems on the Internet, registered by IANA in the early days (the late 80’s) of the global network. Today they mostly represent government departments and organizations, that were somehow involved in Internet research and creation in 70-90s.
                2. Our readers should remember, that the Internet became public only after the United States’ Department of Defense, which funded the initial ARPANET, handed it over to the Defense Communication Agency and, later in 1981, connected it to the CSNET with the TCP (RFC675)/IP (RFC791) over X.25. A couple of years later, in 1986, NSF swapped the CSNET in favor of NSFNET, which grew so fast it made possible ARPANET decommission by 1990.
                3. IANA was established in 1988, and supposedly at that time, existing ASNs were registered by the RIRs. It is no surprise that the organization that funded the initial research and creation of the ARPANET, further transferring it to another department because of its operational size and growth, only after diversifying it into 4 different networks (Wiki mentions MILNET, NIPRNET, SIPRNET and JWICS, above which the military-only NIPRNET did not have controlled security gateways to the public Internet).
                Read more →
              • Hack the JWT Token

                • Tutorial

                For Educational Purposes Only! Intended for Hackers Penetration testers.

                Issue


                The algorithm HS256 uses the secret key to sign and verify each message. The algorithm RS256 uses the private key to sign the message and uses the public key for authentication.

                If you change the algorithm from RS256 to HS256, the backend code uses the public key as the secret key and then uses the HS256 algorithm to verify the signature. Asymmetric Cipher Algorithm => Symmetric Cipher Algorithm.

                Because the public key can sometimes be obtained by the attacker, the attacker can modify the algorithm in the header to HS256 and then use the RSA public key to sign the data.
                The backend code uses the RSA public key + HS256 algorithm for signature verification.

                Example


                Vulnerability appear when client side validation looks like this:

                const decoded = jwt.verify(
                   token,
                   publickRSAKey,
                   { algorithms: ['HS256'  , 'RS256'] }          //accepted both algorithms 
                )

                Lets assume we have initial token like presented below and " => " will explain modification that attacker can make:

                //header 
                {
                alg: 'RS256'                         =>  'HS256'
                }
                //payload
                {
                sub: '123',
                name: 'Oleh Khomiak',
                admin: 'false'                       => 'true'
                }

                The backend code uses the public key as the secret key and then uses the HS256 algorithm to verify the signature.
                Read more →
              • TLS 1.3 enabled, and why you should do the same



                  As we wrote in the 2018-2019 Interconnected Networks Issues and Availability Report at the beginning of this year, TLS 1.3 arrival is inevitable. Some time ago we successfully deployed the 1.3 version of the Transport Layer Security protocol. After gathering and analyzing the data, we are now ready to highlight the most exciting parts of this transition.

                  As IETF TLS Working Group Chairs wrote in the article:
                  “In short, TLS 1.3 is poised to provide a foundation for a more secure and efficient Internet over the next 20 years and beyond.”

                  TLS 1.3 has arrived after 10 years of development. Qrator Labs, as well as the IT industry overall, watched the development process closely from the initial draft through each of the 28 versions while a balanced and manageable protocol was maturing that we are ready to support in 2019. The support is already evident among the market, and we want to keep pace in implementing this robust, proven security protocol.

                  Eric Rescorla, the lone author of TLS 1.3 and the Firefox CTO, told The Register that:
                  “It's a drop-in replacement for TLS 1.2, uses the same keys and certificates, and clients and servers can automatically negotiate TLS 1.3 when they both support it,” he said. “There's pretty good library support already, and Chrome and Firefox both have TLS 1.3 on by default.”
                  Read more →
                • Free Wireguard VPN service on AWS

                  • Translation
                  • Tutorial

                  Free Wireguard VPN service on AWS


                  The reasoning


                  The increase of Internet censorship by authoritarian regimes expands the blockage of useful internet resources making impossible the use of the WEB and in essence violates the fundamental right to freedom of opinion and expression enshrined in the Universal Declaration of Human Rights.


                  Article 19
                  Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers.

                  The following is the detailed 6 steps instruction for non-IT people to deploy free* VPN service upon Wireguard technology in Amazon Web Services (AWS) cloud infrastructure, using a 12 months free account, on an Instance (virtual machine) run by Ubuntu Server 18.04 LTS.


                  I tried to make this walkthrough as friendly as possible to people far from IT. The only thing required is assiduity in repeating the steps described below.

                  Read more →
                • Zoo AFL

                    image

                    In this article, we're going to talk about not the classical AFL itself but about utilities designed for it and its modifications, which, in our view, can significantly improve the quality of fuzzing. If you want to know how to boost AFL and how to find more vulnerabilities faster – keep on reading!
                    Read more →
                  • The most common OAuth 2.0 Hacks

                      OAuth 2 overview


                      This article assumes that readers are familiar with OAuth 2. However, below a brief description of it is presented below.



                      1. The application requests authorization to access service resources from the user. The application needs to provide the client ID, client secret, redirect URI and the required scopes.
                      2. If the user authorizes the request, the application receives an authorization grant
                      3. The application requests an access token from the authorization server by presenting authentication of its own identity, and the authorization grant
                      4. If the application identity is authenticated and the authorization grant is valid, the authorization server issues the access and refresh (if required) token to the application. Authorization is complete.
                      5. The application requests the resource from the resource server and presents the access token for authentication
                      6. If the access token is valid, the resource server serves the resource to the application

                      The are some main Pros and Cons in OAuth 2.0


                      • OAuth 2.0 is easier to use and implement (compared to OAuth 1.0)
                      • Wide spread and continuing growing
                      • Short lived Tokens
                      • Encapsulated Tokens

                      — No signature (relies solely on SSL/TLS ), Bearer Tokens
                      — No built-in security
                      — Can be dangerous if used from not experienced people
                      — Too many compromises. Working group did not make clear decisions
                      — Mobile integration (web views)
                      — Oauth 2.0 spec is not a protocol, it is rather a framework — RFC 6749

                      Read more →
                      • +16
                      • 13.6k
                      • 2
                    • How to Set Up Your Own VPN Server in 15 Minutes

                      If you use Habr, chances are, you’re conscious about privacy on the web. As governments and corporations tighten their grip on people’s online activities, the issue of keeping your browsing data to yourself becomes more and more relevant.


                      Numerous tech websites say VPN is no longer a geek-only thing, and regular people should use it, too (Fast Company, Mashable, PCMag). But as a tech-savvy person, you know there isn’t a service you can trust as much as the one you host and manage yourself.


                      With this post, you’ll deploy your own instance of Outline VPN on AWS.

                      Read more →
                    • Google+ is Dead. So what?

                        Google shut down their social media platform Google+ on April 2, 2019. It’s hard to find some technical article that hasn’t mentioned the end of Google’s social network era. But, a high level of consistency in connectivity within services of the company had received scant attention. In this article I would like to share my thoughts on the internal way of Google services consistency and what it means for Google API users when it comes to a Google+ shutdown.

                        Read more →
                      • Bad news, everyone! New hijack attack in the wild

                          On March 13, a proposal for the RIPE anti-abuse working group was submitted, stating that a BGP hijacking event should be treated as a policy violation. In case of acceptance, if you are an ISP attacked with the hijack, you could submit a special request where you might expose such an autonomous system. If there is enough confirming evidence for an expert group, then such a LIR would be considered an adverse party and further punished. There were some arguments against this proposal.

                          With this article, we want to show an example of the attack where not only the true attacker was under the question, but the whole list of affected prefixes. Moreover, it again raises concerns about the possible motives for the future attack of this type.
                          Read more →
                        • BGP perforating wound

                            It was an ordinary Thursday on 4.04.2019. Except that at some point of the midday timeline an AS60280 belonging to Belarus’ NTEC leaked 18600 prefixes originating from approximately 1400 ASes.

                            Those routes were taken from the transit provider RETN (AS9002) and further announced to NTEC’s provider — RU-telecom’s AS205540, which, in its turn, accepted all of them, spreading the leak.

                            image
                            Read more →
                          • Wireshark 3.x: code analysis under macOS and errors review

                              Picture 1

                              Wireshark Foundation released the final stable-version of the popular network traffic analyzer — Wireshark 3.0.0. The new release fixes several bugs, it is now possible to analyze the new protocols, apart from that the driver on Npcap WinPcap is replaced. Here is where quoting of the announcement ends and our note about bugs in the project starts off. The projects authors definitely haven't done their best in fixing bugs before the release.

                              Let's collect hotfixes right now to give a motive in doing a new release :).

                              Introduction


                              Wireshark is a well-known tool to capture and analyze network traffic. The program works with the vast majority of known protocols, has intuitive and logical graphical interface, an all-powerful system of filters. Wireshark is cross-platform, works in such OSs, as: Windows, Linux, macOS, Solaris, FreeBSD, NetBSD and many others.

                              To do the source code analysis, we used PVS-Studio static code analyzer. To analyze the source code, first we needed to compile the project in an OS. The choice was wide not only due to the cross platform nature of the project, but also because of that of the analyzer. I chose macOS for the analysis. You can also run the analyzer under Windows and Linux.
                              Read more →