Thursday, May 5, 2011

Snaky Cube


The following is a puzzle that I’ve encountered at the Kubiot (Cubes) restaurant in Tel-Aviv.
The target of the puzzle is to make a 4x4x4 cube out of this snake like shape. The small cubes are connected to each other with a cord so it’s only possible to rotate them, but not to change their position. This puzzle is a larger version of a similar puzzle that makes a 3x3x3 cube.

 Where the target is to get to this:

The guy at the restaurant said that he would give a free meal to anyone who solves it on the spot. Don’t be fooled by the 3x3x3 version of the puzzle, this one is a hard task indeed, given the fact that for a guy who knew the solution beforehand, it took about 15 minuets to set it right. So I decided to go “pirate” on this one, and take the picture that you saw at the top.
My mile stones are:
  1. Writing a script to solve it at home.
  2. Memorizing the solution.
  3. Collecting my ~10$ prize.
 1. Brute-forcing to solution.
Python to the rescue.
I entered all the information about the puzzle has lengths of straight lines that could not be rotated.:
data = [3,1,2,1,1,3,1,2,1,2,1,2,1,1,1,1,1,1,1,1,2,2,1,1,1,1,1,2,3,1,1,1,3,1,2,1,1,1,1,1,1,1,1,1,3,1]
My approach is to build a 4x4x4 array of zeros and try to fill it with squares. I defined a Point3D class for the millionth time. And set-up the cube.
Two small questions that came up during the writing:
1. Does anyone know about a simple implementation of Point3D in Python, so I won’t have to write it again.
2. Does anyone know about a simpler way to define the 4x4x4 cube other then:

cube = []
for x in xrange(4):
    ll = []
    for y in xrange(4):
        l = []
        for z in xrange(4):
           l.append(0)
        ll.append(l)
    cube.append(ll)

Now I define all the valid moves in the puzzle, and include recursively the next valid moves, as it depends on the last move.

XDirectionP = (Point3D( 1,  0,  0), [])
XDirectionM = (Point3D(-1,  0,  0), [])
YDirectionP = (Point3D( 0,  1,  0), [])
.
.
.

XDirectionP[1].append(YDirectionP)
XDirectionP[1].append(YDirectionM)
XDirectionP[1].append(ZDirectionP)
XDirectionP[1].append(ZDirectionM)
YDirectionP[1].append(XDirectionP)
.
.
.

The main recursion is as following:

def nextMove(pos, dataLeft, currentDirections):
    global cube
    global highestLevel

    if 0 == len(dataLeft):
        return True
    length = dataLeft[0]
    for move in currentDirections:
       newPos = pos + (move[0] * length)
       if isValidLocation(newPos):
           if tryToSetCubes(pos, move[0], length, len(dataLeft)):
               if nextMove(newPos, dataLeft[1:], move[1]):
                   return True
               clearCubes(pos, move[0], length)
    return False

Apparently this solution, is good enough it took %d seconds to solve it, no extra improvements were required... That’s sad, I kinda’ hoped for something more advanced.

2.
I’ve translated the result into a string of first letters of the valid moves (Left, Right, Up, Down, In, Out), just to get the 46 letters string “RULODRIULOLILURORIRODLOLUIUODIROUIRDODILDROLUR”.
Next I called my good friend Werner, to manifest a sentence out of the string so it would be easier to memorize. The genius came up with the following:
“Recently, upon learning of dental recovery, Ian Underwood laughed out loud. In laughing, underwood remarked, optimal recovery is realized. ordinarily, during laughing out loud, universal imagery unfolds. Or does it? Regardless of universal imagery, rarely do old dying imbeciles laugh. Don't ruin our laughter, Underwood remarked.”

3.
Here I returned to the restaurant with two of my good friends who helped me with acting like I’m going trail n’ error to solution, and it’s doing very well, but have no clue of what am I doing. On setting the very last move to the solution, a crack sound has echoed the place, leaving me with a baffled look at what had happened.


Alas!!!, I shouted out loud, realizing that not only am I not going to get a free meal, but I will probably have to buy them a new puzzle. Fortunately, they told me not to worry, and that it happens all the time, they would replace the cord by next week, so I could try again then.

Now three weeks later and they still didn’t fix it! I started to look-up this puzzle to check where they bought it, and I found the following web site:
http://www.gaya-game.co.il/
Or more specifically:
http://www.gaya-game.co.il/?categoryId=31183&itemId=60119

Thursday, March 31, 2011

CruiseControl Reporting, Attention & Posting (CRAP)

Few posts ago, I told the readers of this very blog about a device I bought from Dealextreme (1, 2) for notifying about incoming E-Mails, and how I patched the program that came with it. To freshen your memory, the USB device is a envelop shaped box, that can glow in eight different colors. The device is identified by Windows as a regular HID device, which means that no drivers are required for most OSs. The colors are generated by an RGB LED, that probably supports many other color variations (Requires hardware modifications).


Since then I’ve made a small open source Python project for controlling this device and making it useful.
Someone told me he used this device as a good start for his project of smart home gadget. As a public service, I attach here some images of the device from within.






It seems like, there is some room on this board to add more LEDs or something, please tell me if you manage to figure out more details about it. If you want to use this board to connect it to some external device, you can remove the LED (it's the white square at the middle), and weld something else instead. I couldn't figure out what kind of a chip the black one is, and whether it's possible to reprogram it. I would open another device next week, hopefully to answer few of these questions.

Recently, I’ve made a compiling / building notification system at my workplace, so I would know whom to feed to the sharks, when the build fails. Here’s a picture of the system.


I’ve added the source for this system (Everything but the CuriseControl password ;) under the XP-Dev SVN project (CControlLED.py).
Please feel free to use it, and share your own projects.

BTW, the chip in this LED box is most probably: http://www.sonix.com.tw/sonix/product.do?p=SN8P2212

Friday, March 4, 2011

Looking Into the Eye of the Bits

During the past four years I've been developing tools for research and implementation of a new type of software analysis. I've discussed these tools on a various occasions such as RECon2010, Nullcon2011 and DC9723.
The purpose of these tools is to recover internal implementation details using only passive memory analysis, and without requiring any disassembly.
These tools are now available under GPL license on the following links:
https://github.com/assafnativ/NativDebugging

The latest version of the presentation + WP is available in the SVN of pymint:
https://github.com/assafnativ/NativDebugging/tree/master/docs

For more details on the subject you are more than welcome to visit the websites of the kind conferences which gave me the place to mumble about my work:
http://nullcon.net/speakers/bakkar/
http://recon.cx/2010/speakers.html#memory
http://wiki.dc9723.org/wiki/Meetings

I'm currently looking for more places to spread my word, if you know of such, please contact me.

Thursday, March 18, 2010

Patch like there's no tommorow

On this post I would like to tell the story of three little binary patches I've done recently. I find patching to be the highest form of hacking, it requires decent reverse engineering skills combined with good OS understanding. Every Pirate must have its own eye patch.

1. Gmail Notifier:

Not long ago I bought a USB mail notifier, which is a small LED lamp in the shape of an envelope, that glitters every time I get a new email. About 8 USDs on DealExtreme (http://www.dealextreme.com/details.dx/sku.27062). I didn't quite like the software it came with, so I decided I would add the ability of turning the LED on n' off to some better mail notifier. I've spent some time figuring out how to control it using a C++ tool that I wrote, that did not work whatsoever. After some frustrating long hours of reading on the MSDN, I turned to reverse engineer the C# software that came with the device combing some USB port monitoring. After failing again to turn on this stupid LED, I called Python to the rescue. I found out that there is an HID USB module for Python that makes life so much easier. I must say that the Python module was so good at explaining everything, that after two minutes of playing with it, I instantly got the freaking device on, I understood what was wrong with my C++ code and I gained a better understanding of the entire HID mechanism. And my message for everyone who reads this post is, don't work hard, use Python. Anyhow, now I got a small script that sets the USB device to whatever color I choose. I installed the Gmail notifier that is written by Google, set it up, and almost instinctively loaded it to IDA. Strings like "%d unread mails" or "No new mails" were easy to find, so it became quite clear where the patch should go. Using Ollydbg, I wrote the patch down. Ollydbg has a good assembling option, where one can enter assembly code easily, check the encoding and later copy it into the original EXE file. Easy as one, two, three. If anyone has ideas on ways to improve this process, please do tell.

2. SWF32.dll. I've written before about my Flash games cheating experience. One of the problems I was telling you about was patching an Action Script byte code at real time, because after the Flash VM loads the code it changes it and optimizes it, and makes it hard for me to find the relevant code in the memory. So I wanted to add an option to patch an SWF file just after the browser is done loading it, but a second before it's loaded by the VM. The SWF file format supports ZLib compression, and most of the games out there take advantage of it. So I thought a good place to patch would be after the file is inflated. On this attempt I wanted to write down a patch that is a bit more complicated; a patch that would load a set of binary alterings for the SWF file from some text file, check that the original bytes match the target (To avoid oopsies) and apply. So for this patch I used the Microsoft Detours Library, published for free, examples included, on the MSDN. I found the detour library to be very intuitive and useful.

3. The Matrix. I found the bug on the Matrix that allows Neo to jump over buildings, I fixed it and banned the user... Ok, I had another real patch, but I think I'll save it for another time.

Friday, November 27, 2009

Generic Game

I like playing card games, and lucky me, there is a huge variety of card games to choose from.
Some of the games I like to play got a PC version as well, Solitary, Harts or even Taki are all very common casual games to play on the computer. I tried to figure out the reason, why it is that all the PC version of the games are so doll, poorly implemented, and generally very limited. For example, there is a local law in the realty version of Taki that if someone is left with only one card in hand he must declare "Last card", or else he have to take another seven new cards. Now the problem with Taki PC implementations is that it does not aware of this law, and there is no way for players to add it to the game. Another example would be the luck of undo in the windows solitary game.

Now it's one thing to say, "Oh, look at all these crappy games", and another to show that it's possible to implement it fairly better with less effort. So, let me explain, what could be done better.
When some people are gathered around for a good game of Munchkin, the only thing that supervise the game, and make sure that everyone are playing by the rules, is the players themselves, and none but them. I suggest the creating of a new gaming system that would replace all other PC card games whatsoever. The new system would have no rules programed into it. That's right no rules. Living back the need for rules would make it much essayer to program. Rules are taking the most time and effort to program, one can compared it to a big state machine, which none likes to write down, and none should. Furthermore, the more options that the game has, such as the "Last card" rule in Taki, the more pain in the ass it is to program it, and the poor developers are doomed to always forget some rules that are found in the real world game. It's time to give the players back the control over the game, and untie the bondage. All we need is a system that supplies a full discloser on what’s going on in the game. In this new kind of system, none would be able to perform a move in the game without everyone else to know about it, but nothing would stop him from performing it. I believe it's cryptographically possible to create such an environment using basic concepts of modern cryptography. Moreover, it would be possible to prove that someone took a random card from a virtual deck of cards, but none would have the information on which card it is, but the player who got it.

Of course, we are still left with the problem of two players join forces to win the game together, but that is a none virtual world problem as well.

I say it's time for us to have a descent card games system, made specifically for card games, but not any one in specific. The platform would allow anyone to load any kind of cards he or she likes as long as that person got the cards pictures in his / her arsenal of cards. It would be possible to take a card and put it on a virtual game table, or to hold it in virtual hand. Any player would be able to see what’s going on the table and to count the number of cards the other players are holding in their hands. Many games got different common move, such as putting a card from your hand on the table sides up in one game and sides down in another, therefor configurability is highly important.

So who wants to write it down with me?

Wednesday, September 2, 2009

Sentrigo Passwordizer

I haven't posted for quite some time as my recent fun project failed to produce any worthwhile results. I hope to find the time to polish it, to be able to publish something.

Meanwhile some interesting stuff has happened at my work which is worth writing about.
I have found some security flaw in the all mighty SQL Server database, all versions included.
My company, Sentrigo, has asked me to write a Proof Of Concept which later we decided to make into a tool which mitigates the problem. We published the tool for free download on our web site http://www.sentrigo.com/passwords.
The tool created some buzz (We call it buzzwordizer), so I decided to write down what exactly stands behind it.

It appears that SQL Server is saving in memory all plain text passwords of any user that is currently logged in with a specific kind of authentication called native SQL authentication (enabled only in mixed mode). The passwords are saved intentionally in an internal data structure containing log-in information. That data structure is kept allocated in memory, it's not just some memory left-overs wandering around the free blocks in the heap. I know this for sure, because I have succeeded in writing a tool to jump through some pointers in constant offsets in memory, to get from the global sessions table to all passwords. Needless to say, I have never seen these passwords vanish from memory for as long as the user is still logged in.

There are only two ways to log in to SQL Server. One is this method and the other is Windows authentication, which lets Windows perform the entire process of logging in. The latter method is not flawed. Microsoft suggest that you use the Windows authentication method, and even refers to the other one as deprecated in some cases. Despite that, Sentrigo has learned that many users still use the less recommended method, because it is easier to configure.

Now, one may ask what is so wrong in saving plain passwords in memory? Every trained Ninja knows that a highly privileged log-in is required to gain access to process memory. And once such log-in is obtained, the sky is the limit for what the user can do with it. On the other hand, up until SQL Server 2008 there had been a SQL command called DBCC BYTES that allowed a privileged user to read the local process memory remotely. Notice that being a database privileged user does not necessary mean being a local machine administrator, on the contrary - some organizations separate the two for security reasons, which is violated by this flaw.
Furthermore, the flaw could be combined with some other flaw which provides only memory leaking, to create a remote passwords dumper, although I'm not familiar with any such flaws at the moment.

To summarize it I would like to quote my CTO Slavik Markovich, from one of the posts published about this bug:
"Developers go to great lengths to ensure passwords are not even transmitted in clear text (for example at the time of login), let alone stored in a readable form. Users have come to expect that their personal passwords, are exactly that –personal – and that not even administrators can see them. Exploiting this vulnerability, an administrator will be able to see the passwords of users and applications that have connected to SQL Server, all the way back to the last restart. We respectfully disagree with Microsoft’s view that since it requires administrative privileges, the risk is mitigated. Even if you trust your admins, there are plenty of hackers capable of gaining escalated privileges, who could now easily access other systems across the network using these passwords."

After all, I would not consider this as major security problem as remote code exploitation, but it does indicates low security considerations, and could lead to bigger problems.

The thing I have found the most amazing about it is the way the Microsoft Security Response Team downplayed it. I have met more than one guy from the team in the past, and I must say that the team includes some well trained Ninjas that really should be adored for their good understanding of technical and low level details. They are all well familiar with every security aspects, and they have done some miraculous work in the past. On the other hand, from my point of view, they got a big fail on bureaucracy. They were quoting stuff from their books about how you should always trust your Administrators, and by that, they have failed to address this bug in the correct manner. And last and not least, the bug is still there. Bruce, to me you are still a phenomenal Ninja.
Relevant links:
http://www.sentrigo.com/
http://www.sentrigo.com/passwords
http://www.slaviks-blog.com/
http://www.businesswire.com/portal/site/google/?ndmViewId=news_view&newsId=20090902005149&newsLang=en
http://searchsecurity.techtarget.com/loginMembersOnly/1,289498,sid14_gci1366853,00.html
http://www.securitypronews.com/insiderreports/insider/spn-49-20090902PasswordFlawFoundInMicrosoftSQLServer.html
http://www.eweek.com/c/a/Security/Microsoft-Downplays-SQL-Server-Database-Vulnerability-893487/

Friday, August 7, 2009

Anti Theft


Welcome to my 2nd post, and for this post I already would like to introduce a guest, so please welcome him with cheers and rise your cups of Grog for The Raven Shkol.
All Ideas and stories for this entry are credited to both me and Shkol all the same.

So, it all started not so long ago, when I got to become a victim to a crime activity. Someone broken to my apartment, while I was away, and stole my work's laptop. Actually he also took my lock-picking kit (Look at the Irony, my lock-picking kit got stolen)
Luckily me, I had backups of everything, and the laptop was not an expensive piece of hardware.
But, this incidence got me thinking on what could I do better to make sure this would never happen again.
Soon enough I called Shkol to the rescue, because he got quite a wide experience in getting robbed, mugged or strangled to death.
We found out that there are many really cheap and simple solutions, to make it much harder for someone to break to your flat.
But, this is not what we would like to discuss here. What we really would like to go over is the ideas we had gathered for protecting either computers or the information on them form physical thefts.

Some of the ideas we got were simple and wired at the same time such as:
Example (For desktop computers only) Buying heavy weights at the local sports store, I got me about 10kg. Put the weights inside the computer case. Make sure the weights are well tied to the case and invisible from out side. Hope, no one would be determined enough to steal such a heavy piece of metal.

While other ideas were as trivial as locking the computer to something with a chain or so, for most computers cases got a place to put a lock on. Although, these locks are so easy to overcome for the trained ninja, in my case a burglar would find the lock-picking tools in the drawer next to the computer (and if that is not enough, there is a beginners lock picking guide next to it).

Some solutions were involving software solutions to make sure no one can access your information even if he get to put his hands on your precious hardware.
Either by encryption, Yes, I know it's quite a dull one. Anyway here are some links to good implementations we found:
Another approach to the problem would be using a data bomb. Its seems like there are programs to erase all the information on the disk once someone is giving a wrong password 3 times or so.
Or a better way to get the same effect would be to change your login account to be hidden, and create a "honey-pot" user with no passwords and a startup script which makes a fresh new brick out of your box.

The clothing store solution; using a two small devices that starts an alarm once the distance between the two is more then an apartment length (which is very small, in my case). I would recommend putting one of the devices inside the computer case and the other buried under the tiles. Very good and cheap such devices could be bought from DealExtreme:
If we are looking for some sensors to monitor any move of the computer, one common device that is packed with sensors would be a cell phone. Even the simplest phone with camera has an accelerometer in it. The accelerometer could be used to identifying the computer is pulled up. And once the situation is recognized sending an SMS or performing a call to 911 with pre-recorded message could be nice (But try not calling 911 on false positives, ok).

But, lets just say that we deal with quite a determined scum, which was able to pass all of our defense systems (And was strong enough to carry 15kg computer, down the road). Is there a way now, to find the new location of our precious? Well in case you thought about it in advance, there are some. One can buy some kind of a GPS device to send in a Beacon once in a while, just hope the signal would be strong enough, and that it wont be pointing to location in the middle of the ocean.
I tend to think that a solution using an IPhone with the "Find My IPhone" app could give out good results, quick and simple.
The thing is that these days I tend to think it's possible to achieve same results using just WiFi. Cell phones with WiFi and GPS became very popular lately, and if someone would establish a project for volunteers to map the locations of most WiFi hotspots / home routers, it would be possible to identify the location of devices with just identifying which WiFis are around it. Unfortunately, someone told me http://www.wefi.com/ thought about it before me.

And now for a bit less practical solutions:
A really awsome project could be, to write a new BIOS firmware to hold a true password protection, one that is not as simple to overcome as removing the battery from the mother-board. Most of the complicated work has already done in projects such as OpenBios, and this could be really nice extra feature to add to it. Of course, it won't protect the information found on the disk (unless you add some kind of encryption to it), but it sure could make an untrained ninja to think he just stole a 10+ kg brick.

You can train your computer to remember which WiFis are found around it, and to ask for password to approve any work in a new WiFis environment.

Finnaly, here are some links to relevant websites, that are worth a better page rank:
http://www.bzeek.com/
http://www.loki.com/
http://www.wigle.net/

So, that's what we had to say on the subject, I would love to hear any new solutions to the problem, so feel free to drop me a message.
Assaf Nativ
(and The Raven Shkol)