Business

Attacks on Smart Cards

By Author – Samata Shelare

When hit by an APT attack, many companies implement smart cards and/or other two-factor authentication mechanisms as a reactionary measure. But thinking that these solutions will prevent credential theft is a big mistake. Attackers can bypass these protection mechanisms with clever techniques.

Nowadays, adversaries in the form of self-spreading malware or APT campaigns utilize Pass-the-Hash, a technique that allows them to escalate privileges in the domain. When Pass-the-Hash is not handy, they will use other techniques such as Pass-the-Ticket or Kerberoasting.

What makes smart cards so special?

A smart card is a piece of specialized cryptographic hardware that contains its own CPU, memory, and operating system. Smart cards are especially good at protecting cryptographic secrets, like private keys and digital certificates.

Smart cards may look like credit cards without the stripe, but they’re far more secure. They store their secrets until the right interfacing software accesses them in a predetermined manner, and the correct second factor PIN is provided. Smart cards often hold users’ personal digital certificates, which prove a user’s identity to an authentication requestor. Even better, smart cards rarely hand over the user’s private key. Instead, they provide the requesting authenticator “proof” that they have the correct private key.

After a company is subjected to a pass-the-hash attack, it often responds by jettisoning weak or easy password hashes. On many occasions, smart cards are the recommended solution, and everyone jumps on board. Because digital certificates aren’t hashes, most people think they’ve found the answer.

In this experiment, we will perform the four most common credential theft attacks on a domain-connected PC with both smart card and 2FA enabled.

1. Clear text password theft
2. Pass the hash attack
3. Pass the ticket attack
4. Process token manipulation attack
5. Pass the Smart Card Hash
6. A smart card is a piece of specialized cryptographic hardware that contains its CPU, memory, and operating system.

When authenticating a user with a smart card and PIN (Personal Identification Number) code in an Active Directory network (which is 90% of all networks), the Domain Controller returns an NTLM hash. The hash is calculated based on a randomly selected string. Presenting this hash to the DC identifies you as that user.

This hash can be reused and replayed without the need for the smart card. It is stored in the LSASS process inside the endpoint memory, and its easily readable by an adversary who has managed to compromise the endpoint using tools like Mimikatz, WCE, or even just dumping the memory of the LSASS process using the Task Manager. This hash exists in the memory because its crucial for single sign-on (SSO) support.

This is how smart card login works:

• The user inserts his smart card and enters his own PIN in a login window.
• The smart card subsystem authenticates the user as the owner of the smart card and retrieves the certificate from the card.
• The smart card client sends the certificate to the KDC (Kerberos Key Distribution Center) on the DC.
• The KDC verifies the Smart Card Login Certificate, retrieves the associated user of this certificate, and builds a Kerberos TGT for that user.
• The KDC returns encrypted TGT back to the client.
• The smart card decrypts the TGT and retrieves the NTLM hash from the negotiation.
• Presenting only the TGT or the NTLM hash from now on will get you authenticated.

During standard login, the NTLM hash is calculated using the users password. Because the smart card doesnt contain a password, the hash is only calculated when you set the attribute to smart card required for interactive login. GPO can force users to change their passwords periodically. This feature exposes huge persistency security risk. Once the smart card users computer is compromised, an attacker can grab the hash generated from the smart card authentication. Now he has a hash with unlimited lifetime?and worse, lifetime persistency on your domain, because the hash will never change as long as Smart Card Logon, is forced on that user.

However, Microsoft offers a solution for the smart card persistence problem: they will rotate the hashes of your smart card account every 60 days. But it is only applicable if your Domain functionality level is Windows Server 2016.

Smart cards cant protect against Pass-the-Hash and their hash ever changes.

Pass-The-2FA Hash

During authentication with some third-party 2FA, the hash is calculated from the users managed password. And because the password is managed, it is changed frequently and sometimes even immediately.

In some cases, 2FA managed to mitigate Pass-the-Hash attempts because the hash was calculated using the OTP (one-time password). Therefore, the hash wont be valid anymore, and the adversary who stole it wont be able to authenticate with it.

Other vendors like AuthLite mitigated Pass-The-Hash attempts because the cached hash of 2F sessions is manipulated by AuthLite, so stealing the hash in the memory is useless. Theres still additional verification in the DC, and the OTP must be forwarded to AuthLite before authenticating as a 2FA token.

Depending on the 2FA solution you have, you probably wont be able to Pass-the-Hash.

With their embedded microchip technology and the secure authentication they can provide, smart cards or hardware tokens have been relied upon to give physical access and the go-ahead for data transfer in a multitude of applications and transactions, in the public, corporate, and government sectors.

But, robust as they are, smart cards do have weaknesses ? and intelligent hackers have developed a variety of techniques for observing and blocking their operations, so as to gain access to credentials, information, and funds. In this article, we will take a closer look at the technology and how it is being used for Smart Card Attacks.

Smart Communications

Small information packets called Application Protocol Data Units (APDUs) are the basis of communication between a Card Accepting Device (CAD) and a smart card ? which may take the form of a standard credit card-sized unit, the SIM card for a smartphone, or a USB dongle.

Data travels between the smart card and CAD in one direction at a time, and both objects use an authentication protocol to identify each other. A random number generated by the card is sent to the CAD, which uses a shared encryption key to scramble the digits before sending the number back. The card compares this returned figure with its own encryption, and a reverse process occurs as the communication exchange continues.

Each message between the two is authenticated by a special code ? a figure based on the message content, a random number, and an encryption key. Symmetric DES (Data Encryption Standard), 3DES (triple DES) and public key RSA (Rivest-Shamir-Adleman algorithm) are the encryption methods most commonly used.

Secure, generally ? but hackers using brute force methods are capable of breaking each of these encryptions down, with enough time and sufficiently powerful hardware.

OS-Level Protection

Smart card operating systems organize their data into a three-level hierarchy. At the top, the root or Master File (MF) may hold several Dedicated Files (DFs: analogous to directories or folders) and Elementary Files (EFs: like regular files on a computer). But DFs can also hold files, and all three levels use headers which spell out their security attributes and user privileges. Applications may only move to a position on the OS if they have the relevant access rights.

Personal Identification Numbers (PINs) are associated with the Cardholder verification 1 (CHV1) and Cardholder verification 2 (CHV2) levels of access, which correspond to the user PIN allocated to a cardholder and the unblocking code needed to re-enable a compromised card.

The operating system blocks a card after an incorrect PIN is entered a certain number of times. This condition applies to both the user PIN and the unblocking code ? and while it provides a measure of security against fraud for the cardholder, it also provides malicious intruders with an opportunity for sabotage and locking a user out of their own accounts.

Host-Based Security

Systems and networks using host-based security deploy smart cards as simple carrier of information. Data on the cards may be encrypted, but the protection of it is the responsibility of the host system ? and information may be vulnerable as its being transmitted between card and computer.

Employing smart memory cards with a password mechanism that prevents unauthorized reading offers some additional protection, but passwords can still become accessible to hackers as unencrypted transmissions move between the card and the host.

Card-Based Security

Systems with the card or token-based security treat smart cards with microprocessors as independent computing devices. During interactions between cards and the host system, user identities can be authenticated and a staged protocol put in place to ensure that each card has clearance to access the system.

Access to data on the card is controlled by its own operating system, and any pre-configured permissions set by the organization issuing the card. So for hackers, the target for infiltration or sabotage becomes the smart card itself, or some breach of the issuing body which may affect the condition of cards issued in the future.

Physical Vulnerabilities

For hackers, gaining physical access to the embedded microchip on a smart card is a comparatively straightforward process.

Physical tampering is an invasive technique that begins with removing the chip from the surface of the plastic card. Its a simple enough matter of cutting away the plastic behind the chip module with a sharp knife until the epoxy resin binding it to the card becomes visible. This resin can then be dissolved with a few drops of fuming nitric acid, shaking the card in acetone until the resin and acid are washed away.

The attacker may then use an optical microscope with camera attachment to take a series of high-resolution shots of the microchip surface. Analysis of these photos can reveal the patterns of metal lines tracing the cards data and memory bus pathways. Their goal will be to identify those lines that need to be reproduced in order to gain access to the memory values controlling the specific data sets they are looking for.

Artificial Eye

By Author – Rishabh Sontakke

An artificial eye is a replacement for a natural eye lost because of injury or disease. Although the replacement cannot provide sight, it fills the cavity of the eye socket and serves as a cosmetic enhancement. Before the availability of artificial eyes, a person who lost an eye used to wore a patch. An artificial eye can be attached to muscles in the socket to provide eye movement.

Today, most artificial eyes are made of plastic, with an average life of about 10 years. Children require more frequent replacement of the Artificial Eye due to rapid growth changes. As many as four or five?Artificial Eye?may be required from babyhood to adulthood.

According to the Society for the Prevention of Blindness, between 10,000 and 12,000 people per year lose an eye. Though 50% or more of these eye losses are caused by an accident (in one survey more males lost their eyes to accidents compared to females), there are a number of genetic conditions that can cause eye loss or require an artificial eye. Microphthalmia is a birth defect where for some unknown reason the eye does not develop to its normal size. These eyes are totally blind, or at best might have some light sensitivity.

Society is an artificial construction, a defense against natures power

?

Some people are also born without one or both eyeballs. Called anophthalmia.

Retinoblastoma is a congenital (existing at birth) cancer or tumor, which is usually inherited. If a person has this condition in just one eye, the chances of passing it on are one in four or 25%.

There are two key steps in replacing a damaged or diseased eye.

–First, an?ophthalmologist?or eye surgeon must remove the natural eye. There are two types of operations.

• The enucleation removes the eyeball by severing the muscles, which are connected to the?sclera?(white of eyeball).
• The surgeon then cuts the optic nerve and removes the eye from the socket.

–Second, An implant is then placed into the socket to restore lost volume and to give the artificial eye some movement, and the wound is then closed.

Evisceration – In this operation, the surgeon makes an incision around the iris and then removes the contents of the eyeball. A ball made of some inert material such as plastic, glass, or silicone is then placed inside the eyeball, and the wound is closed.

Conformer ? Here the surgeon will place an (a plastic disc) into the socket. The conformer prevents shrinking of the socket and retains adequate pockets for the Artificial Eye. Conformers are made out of silicone or hard plastic. After the surgery, it takes the patient from four to six weeks to heal. The artificial eye is then made and fitted by a professional.

Raw Materials

Plastic is the main material that makes up the artificial eye. Wax and plaster of Paris are used to make the molds. A white powder called alginate is used in the molding process. Paints and other decorating materials are used to add life-like features to the prosthesis.

The eyes are the mirror of the soul

?

The Manufacturing?Process

The time to make an optic Artificial Eye from start to finish varies with each ocularist and the individual patient. A typical time is about 3.5 hours. Ocularists continue to look at ways to reduce this time.

There are two types of Artificial Eye.

–The very thin, shell type is fitted over a blind, disfigured eye or over an eye which has been just partially removed.

–The full modified impression type is made for those who have had eyeballs completely removed. The process described here is for the latter type.

1. The ocularist inspects the condition of the socket.

2. The ocularist paints the iris. An iris button (made from a plastic rod using a lathe) is selected to match the patient’s own iris diameter.

3. Next, the ocularist hand carves a wax molding shell. This shell has an aluminum iris button embedded in it that duplicates the painted iris button. The wax shell is fitted into the patient’s socket so that it matches the irregular periphery of the socket.

4. The impression is made using alginate, a white powder made from seaweed that is mixed with water to form a cream. After mixing, the cream is placed on the back side of the molding shell and the shell is inserted into the socket.

5. The iris color is then rechecked and any necessary changes are made.

6. A plaster-of-Paris cast is made of the mold of the patient’s eye socket. After the plaster has hardened (about seven minutes), the wax and alginate mold are removed and discarded.

7. The plastic has hardened in the shape of the mold with the painted iris button embedded in the proper place.

8. The prosthesis is then returned to the cast. Clear plastic is placed in the anterior half of the cast and the two halves are again joined, placed under pressure, and returned to the hot water. The Artificial Eye is finally ready for fitting.

The eyes tell more than the word could ever say

The Future ?

?

Improvements will continue in the optic Artificial Eye, which will benefit both patient and ocularist. Several developments have already occurred in recent years. Artificial Eye with two different size pupils which can be changed back and forth by the wearer was invented in the early 1980s. In the same period, a soft contact lens with a large black pupil was developed that simply lays on the corner of the artificial eye.

In 1989, a patented implant called the Bio-eye was released by the United States Food and Drug Administration. Today, over 25,000 people worldwide have benefited from this development, which is made from hydroxyapatite, a material converted from ocean coral and has both the porous structure and chemical structure of bone. In addition to natural eye movement, this type of implant has reduced migration and extrusion and prevents dropping of the lower lid by lending support to the artificial eye via a peg connection.

With advancements in computer, electronics, and biomedical engineering technology, it may someday be possible to have an artificial eye that can provide sight as well. Work is already in progress to achieve this goal, based on advanced microelectronics and sophisticated image recognition techniques.

Researchers at MIT and Harvard University are also developing what will be the first artificial retina. This is based on a?biochip?that is glued to the ganglion cells, which act as the eye’s data concentrators. The chip is composed of a tiny array of etched-metal electrodes on the retina side and a single sensor with integrated logic on the pupil side. The sensor responds to a small?infrared?laser?that shines onto it from a pair of glasses that would be worn by the artificial-retinal recipient.

Introduction to Java

By Author – Rashmita Soge

Java is a programming language created by James Gosling from Sun Microsystems (Sun) in 1991. The target of Java is to write a program once and then run this program on multiple operating systems. The first publicly available version of Java (Java 1.0) was released in 1995. Sun Microsystems was acquired by the Oracle Corporation in 2010. Oracle has now the steermanship for Java. In 2006 Sun started to make Java available under the GNU General Public License (GPL). Oracle continues this project called OpenJDK. Over time new enhanced versions of Java have been released. The current version of Java is Java 1.8 which is also known as Java 8.

Java is defined by a specification and consists of a programming language, a compiler, core libraries and a runtime (Java virtual machine) The Java runtime allows software developers to write program code in other languages than the Java programming language which still runs on the Java virtual machine. The Java platform is usually associated with the Java virtual machine and the Java core libraries.

What is java?

Java is a General Purpose, class-based, object-oriented, Platform independent, portable, Architecturally neutral, multithreaded, dynamic, distributed, Portable and robust interpreted Programming Language.

It is intended to let application developers “write once, run anywhere” meaning that compiled Java code can run on all platforms that support Java without the need for

History of Java

Java is the brainchild of Java pioneer James Gosling, who traces Javas core idea of, Write Once, Run Anywhere back to work he did in graduate school.

After spending time at IBM, Gosling joined Sun Microsystems in 1984. In 1991, Gosling partnered with Sun colleagues, Michael Sheridan and Patrick Naughton on Project Green, to develop new technology for programming next-generation smart appliances. Gosling, Naughton, and Sheridan set out to develop the project based on certain rules. They were specifically tied to performance, security, and functionality. Those rules were that Java must be:

1. Secure and robust
2. High performance
3. Portable and architecture-neutral, which means it can run on any combination of software and hardware
4. Threaded, interpreted, and dynamic
5. Object-oriented

Over time, the team added features and refinements that extended the heirloom of C++ and C, resulting in a new language called Oak, named after a tree outside Goslings office.

After efforts to use Oak for interactive television failed to materialize, the technology was re-targeted for the world wide web. The team also began working on a web browser as a demonstration platform.

Because of a trademark conflict, Oak was renamed, Java, and in 1995, Java 1.0a2, along with the browser, name HotJava, was released. The Java language was designed with the following properties:

• Platform independent: Java programs use the Java virtual machine as abstraction and do not access the operating system directly. This makes Java programs highly portable. A Java program (which is standard-compliant and follows certain rules) can run unmodified on all supported platforms, e.g., Windows or Linux.
• Object-orientated programming language: Except the primitive data types, all elements in Java are objects.
• Strongly-typed programming language: Java is strongly-typed, e.g., the types of the used variables must be pre-defined and conversion to other objects is relatively strict, e.g., must be done in most cases by the programmer.
• Interpreted and compiled language: Java source code is transferred into the bytecode format which does not depend on the target platform. These bytecode instructions will be interpreted by the Java Virtual machine (JVM). The JVM contains a so-called Hotspot-Compiler which translates performance critical bytecode instructions into native code instructions.
• Automatic memory management: Java manages the memory allocation and de-allocation for creating new objects. The program does not have direct access to the memory. The so-called garbage collector automatically deletes objects to which no active pointer exists.

How Java Works?

To understand the primary advantage of Java, you’ll have to learn about platforms. In most programming languages, a compiler generates code that can execute on a specific target machine. For example, if you compile a C++ program on a Windows machine, the executable file can be copied to any other machine but it will only run on other Windows machines but never another machine. A platform is determined by the target machine along with its operating system. For earlier languages, language designers needed to create a specialized version of the compiler for every platform. If you wrote a program that you wanted to make available on multiple platforms, you, as the programmer, would have to do quite a bit of additional work.? You would have to create multiple versions of your source code for each platform.

Java succeeded in eliminating the platform issue for high-level programmers because it has reorganized the compile-link-execute sequence at an underlying level of the compiler. Details are complicated but, essentially, the designers of the Java language isolated those programming issues which are dependent on the platform and developed low-level means to abstractly refer to these issues. Consequently, the Java compiler doesn’t create an object file, but instead it creates a bytecode file which is, essentially, an object file for a virtual machine.? In fact, the Java compiler is often called the JVM compiler. To summarize how Java works, think about the compile-link-execute cycle. In earlier programming languages, the cycle is more closely defined as “compile-link then execute”. In Java, the cycle is closer to “compile then link-execute”.

Future of Java

Java is not a legacy programming language, despite its long history. The robust use of Maven, the building tool for Java-based projects, debunks the theory that Java is outdated. Although there are a variety of deployment tools on the market, Apache Maven has by far been one of the largest automation tools developers use to deploy software applications.

With Oracles commitment to Java for the long haul, its not hard to see why Java will always be a part of programming languages for years to come and will remain as the chosen programming language. 2017 will see the release of the eighth version of Java-Java EE 8.

Despite its areas for improvement, and threat from rival programming languages like.NET, Java is here to stay. Oracle has plans for a new version release in the early part of 2017, with new supportive features that will strongly appeal to developers. Javas multitude of strengths as a programming language means its use in the digital world will only solidify. A language that was inherently designed for easy use has proved itself as functional and secure over the course of more than two decades. Developers who appreciate technological changes can also rest assured the tried-and-true language of Java will likely always have a significant place in their toolset.

GPS aircraft tracking

By Author – Samata Shelare

GPS aircraft tracking is used in both commercial and personal aircraft, and it comes along with a variety of benefits both to safety and convenience. What a GPS does on an aircraft in terms of tracking is a lot different than what a GPS may do in your car. GPS tracking can help to ensure your position in the sky and keep you safe while going about a day of flying.
In order to understand the benefits of GPS aircraft tracking, one will first need to understand just how it works. A device with a GPS sensor is fixed into the aircraft, and it is able to transmit real-time GPS positions of any plane to a server board located on the ground. This sensor may be placed in a number of different areas or positions on the plane depending on the specific make and model, but all sensors work similarly in tracking a planes current position at any time. These positions can then be picked up on by air traffic controllers on the ground that will be able to locate airplanes of all sizes and at all elevations, within any given area and at any given time.
GPS aircraft tracking can provide a number of benefits, even outside of the obvious benefits involving safety. The use of this type of technology can help to calculate flight times to and from any number of destinations so that pilots can get a better understanding of their time of departure compared to the time of arrival, and it can also support in the finding of an aircraft in the instance of an accident. Additionally, GPS aircraft tracking can even be used in flight schools to allow pilots in training to follow a certain path or flight plan laid out by an instructor.
There are actually about 100 air traffic facilities already using the ADS-B, which is why they are able to give such a firm estimation of 2020. This is nearly half of the 230 air traffic facilities in the world. Aviation experts believe 2020 is a good estimate for when every one of these facilities will be using the technology, with more and more adding the technology over the next 16 years. The hardest part is simply equipping the planes with the new system.
Tracking planes during their flight isnt the only thing the ADS-B GPS tracking system can do. It also has the ability to provide weather and other pertinent information to pilots in real-time, so they have an as advanced warning as possible about the current environmental conditions that might impact their flying decisions.
One of the big issues in the past with the other 130 air traffic facilities is that it is easy to lose radar in certain areas of the world. As is most likely the case with the recent missing Malaysian Airlines plane, it was likely over water or in another location not easily tracked by the ground-based radar. This makes it difficult to track and almost impossible to find out what happened to it.
Feith also mentioned that some flights require the new GPS tracking technology because of flying over the Atlantic or the Pacific Ocean and being more at risk for becoming lost during their flight.
GPS aircraft tracking is quite a bit different from the GPS technology we may use during our everyday lives in a car, but it provides the same amount of benefits when it comes to convenience, safety, and ease of navigation.