Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CryptoCat iOS Application Penetration Test [pdf]

isecpartners.github.io

Post reply on HN
Print view View original

71–80 of 137 posts

Re: CryptoCat iOS Application Penetration Test [pdf]

#71

Post by orthecreedence »

tptacek wrote: post #64
rcsorensen wrote: post #62

Earlier quoted context omitted.

Have you considered taking people who have passed challenges (and are excited about them) on as volunteer assistants for the challenges?

If anyone has ideas on how we could do that, I'm all ears. We'd have to mitigate the privacy issues somehow, because not everyone has given us permission to reveal that they're working through the challenges, and passing submissions to people outside the firm would be that.

Not sure what you guys are using to track all of it, but maybe a simple web app would help you out. For instance, an email address would be attached to a "level" (so you guys could input your previous members and attach what level they're on so if they sign up with that same email it'd be aligned).

People could sign up and post their solutions, and others would be able to validate entries of levels below them (so someone on level 3 could validate a level 2 submission). Or hell, the webapp may even be able to validate some of it (obviously not entries where you paste code, but things like "Decrypt !4321hj4123$@!#$" could be automated).

This way, you could submit solutions via your login (attached to your email) and people validating the entries wouldn't be able to see the email address, just the answers, and could comment on the submission.

Sorry, this was a bit stream of consciousness. If this was particularly barebones, you might be able to slam it out in not too much time. If you don't mind PHP or Common Lisp in the backend, I might even be able to help out a bit.

Re: CryptoCat iOS Application Penetration Test [pdf]

#72

Post by kaeporan »

tptacek wrote: post #26
kaeporan wrote: post #18

Hi, I'm the lead developer for Cryptocat. I strongly urge you all to please read our blog post regarding this audit: https://blog.crypto.cat/2014/04/recent-audits-and-coming-imp... This audit document alone does not give enough context. This audit was commissioned by us and concerns a pre-release version of Cryptocat for iPhone. Many of the bugs it found are due to the fact that it was reviewing a prototype with debu…

Was it commissioned by you? The audit I saw had the Open Technology Fund's logo on it. OTF is a US Government effort driven by Radio Free Asia and the Broadcast Board of Governors. OTF, again (smartly) using US taxpayer dollars, funds audits of a variety of privacy technologies. For instance, they also funded a good-sized chunk of the Truecrypt audit.

Hi Thomas,

OTF provides a form projects like ours can fill to commission this type of audit. So basically, we asked OTF to commission it for us and they accepted. TextSecure, a great encryption app that I've seen you recommend, also approached OTF and obtained an audit from iSEC via this same process. However, TextSecure decided not to publish their audit results.

You can read about OTF's reaction to these audits here: https://www.opentechfund.org/article/bringing-openness-secur...

Re: CryptoCat iOS Application Penetration Test [pdf]

#73

Post by marshray »

oafitupa wrote: post #58

The good thing about CryptoCat is that everyone wants to trash it, so it's becoming better.

The wisest words I've ever seen office administrative staff post over the FAX machine are:

Everyone's life has a purpose. Consider the possibility that yours is to serve as a warning to others.

Re: CryptoCat iOS Application Penetration Test [pdf]

#74

Post by tptacek »

kaeporan wrote: post #72
tptacek wrote: post #26

Earlier quoted context omitted.

Was it commissioned by you? The audit I saw had the Open Technology Fund's logo on it. OTF is a US Government effort driven by Radio Free Asia and the Broadcast Board of Governors. OTF, again (smartly) using US taxpayer dollars, funds audits of a variety of privacy technologies. For instance, they also funded a good-sized chunk of the Truecrypt audit.

Hi Thomas, OTF provides a form projects like ours can fill to commission this type of audit. So basically, we asked OTF to commission it for us and they accepted. TextSecure, a great encryption app that I've seen you recommend, also approached OTF and obtained an audit from iSEC via this same process. However, TextSecure decided not to publish their audit results. You can read about OTF's reaction to these audits her…

I feel very comfortable recommending TextSecure. TextSecure might be the only secure messaging app I feel that way about.

For whatever it's worth: I have no commercial relationship with the TextSecure team, have never worked with them, have never been paid to audit their code, and am only faintly acquainted with Moxie (I've talked to him in person to know that he's extremely pleasant and surprisingly soft spoken, but not more than that).

Trevor Perrin, who worked with the TextSecure project to help design their cryptography, is someone I know a little bit better; it would be safe to say that Trevor Perrin is the only reason I know anything about cryptography, and, given a few bar napkins, I can outline a pretty convincing story that he is the root of basically every TLS vulnerability discovered after Marsh Ray found the resumption bug.

TextSecure is a great project, and if anyone was debating between it and some other cryptographic messaging application, I hope I've made that decision a little easier.

Re: CryptoCat iOS Application Penetration Test [pdf]

#75

Post by tptacek »

orthecreedence wrote: post #71
tptacek wrote: post #64

Earlier quoted context omitted.

If anyone has ideas on how we could do that, I'm all ears. We'd have to mitigate the privacy issues somehow, because not everyone has given us permission to reveal that they're working through the challenges, and passing submissions to people outside the firm would be that.

Not sure what you guys are using to track all of it, but maybe a simple web app would help you out. For instance, an email address would be attached to a "level" (so you guys could input your previous members and attach what level they're on so if they sign up with that same email it'd be aligned). People could sign up and post their solutions, and others would be able to validate entries of levels below them (so som…

We actually do have a web application we use to track the challenges (the mail is all done through Mailgun).

Two things complicate managing the challenges:

* We have to actually read the code people send us (if you get things wrong, there's a pretty good chance we'll catch it). We try hard not to move people forward a level until they've gotten the previous challenges right.

* We don't dictate any particular format for submissions. Some people paste code into their email messages; some people attach lots of little files; some people attach archives. Some languages let you stick all that code in 1 file; others, like Java and C#, have complicated directory hierarchies.

Re: CryptoCat iOS Application Penetration Test [pdf]

#76

Post by ph0rque »

tptacek wrote: post #35
sliverstorm wrote: post #9

Earlier quoted context omitted.

I wish I knew how to find my way into security as a hobby. Such a fun topic.

Why find your way in as a hobby? Are you a professional developer now? Do you like low-level code? Are you OK with jumping directly into the deep end of the pool and maybe drowning a little bit? Why not reach out and talk to us about working on a professional security team? We have gotten very, very good at taking low-level devs and turning them into terrifying killing machines, and if you don't mind having all your…

...if you don't mind having all your flesh removed and your skeletal musculature replaced by pistons and servomotors...

Ah, but have you pen-tested the pistons and servomotors to make sure they're secure against attacks?

Re: CryptoCat iOS Application Penetration Test [pdf]

#77

Post by kaeporan »

anologwintermut wrote: post #52
kaeporan wrote: post #14

Earlier quoted context omitted.

Fixes and improvements to this, and more, are covered in our blog post. I strongly urge you to read it. This audit alone doesn't give enough context. https://blog.crypto.cat/2014/04/recent-audits-and-coming-imp...

What's your fix for the man-in-the-middle attack on all platforms (including deployed ones) the audit identifies and your blog acknowledges? In your blog post there seems to be little context that can excuse such a mistake and nothing that explains how you fix it? Am I correct in reading your blog post that right now there isn't a fix? I.e. it's an open attack assuming someone compromises a CA or a cryptocat server?…

Hi there,

The fix for the MITM bug is to offer proper notice via the user interface when a user re-keys with a different public key. There's a demonstration of the user interface element in the blog post.

Re: CryptoCat iOS Application Penetration Test [pdf]

#78

Post by tptacek »

ph0rque wrote: post #76
tptacek wrote: post #35

Earlier quoted context omitted.

Why find your way in as a hobby? Are you a professional developer now? Do you like low-level code? Are you OK with jumping directly into the deep end of the pool and maybe drowning a little bit? Why not reach out and talk to us about working on a professional security team? We have gotten very, very good at taking low-level devs and turning them into terrifying killing machines, and if you don't mind having all your…

... if you don't mind having all your flesh removed and your skeletal musculature replaced by pistons and servomotors ... Ah, but have you pen-tested the pistons and servomotors to make sure they're secure against attacks?

We only care about their ability to inflict harm, not their ability to withstand it. :)

Re: CryptoCat iOS Application Penetration Test [pdf]

#79

Post by kaeporan »

tptacek wrote: post #74
kaeporan wrote: post #72

Earlier quoted context omitted.

Hi Thomas, OTF provides a form projects like ours can fill to commission this type of audit. So basically, we asked OTF to commission it for us and they accepted. TextSecure, a great encryption app that I've seen you recommend, also approached OTF and obtained an audit from iSEC via this same process. However, TextSecure decided not to publish their audit results. You can read about OTF's reaction to these audits her…

I feel very comfortable recommending TextSecure. TextSecure might be the only secure messaging app I feel that way about. For whatever it's worth: I have no commercial relationship with the TextSecure team, have never worked with them, have never been paid to audit their code, and am only faintly acquainted with Moxie (I've talked to him in person to know that he's extremely pleasant and surprisingly soft spoken, but…

I agree! TextSecure is an excellent project. We're actually very lucky to be able to bring in Trevor Perrin this month to contribute to Cryptocat.

Re: CryptoCat iOS Application Penetration Test [pdf]

#80

Post by kaeporan »

natdempk wrote: post #47
mandalar12 wrote: post #19

Earlier quoted context omitted.

Has anyone done the same level of analysis on TextSecure ? I feel like their model/seriousness is better but there might be flaws in the implementation (or protocol) and being audited might highlight some of them.

I don't believe they've had an independent security audit. I think their team however is comprised of more respected cryptographers like Moxie Marlinspike, who introduced the concept of SSL stripping, one of the issues that was found in the CryptoCat app. I mean no disrespect to CryptoCat, and more eyes can always find something someone overlooked, but I think the Open Whisper Systems (TextSecure) team is stronger an…

iSEC also audited TextSecure, but TextSecure chose not to publish the audit.
Post reply on HN