Java String Substring

Kumar Jadhav

#SuzyCube #gamedev #indiedev #madewithunity @NoodlecakeGames

What a week!! We are continuing to work hard to wrap things up in time for *redacted*.

Read More :- "Suzy Cube Update: June 1, 2018"

Kumar Jadhav

Colonel St. Jean,

the new commander of the Grey Patriote Brigade, part of the Origawn Republic Army (or Rebel army depending on your POV).

Read More :- "A Warm Welcome Please For"

Kumar Jadhav

We started down the road to manufacturing plastic kits in 2012, a lot has happened since then. I have seen shipping prices nearly double, WGF has ceased to be our distributor and we have taken over that aspect of operations. We now purchase our kits from WGF China directly.

We recently place two restock orders to bring our stock levels back on par, the shipping costs have been an eye opener. In many cases shipping from China to the US was more than the actual cost to manufacture a kit. Some kits needed to be brought in line with their cost of production. This price increase was as minimal as we could make it most items will see an increase of 5% to 8% with some more drastic adjustments to kits that were selling into distribution at a lower than delivered cost to us.

To maintain the health of DreamForge-Games it has become clear that we will need to implement a price increase, effective February 15^th2016

I thank you for your continued support.

Mark Mondragon

DreamForge-Games

Read More :- "DreamForge-Games Price Increase."

Kumar Jadhav

There are a lot of possibilities for a game designer when presented with the challenge of creating a game based on a pre-existing property such as a book, film or TV series. The easiest option (and the one we see the most) is to re-skin an existing game, such as with all the licensed versions of Clue, Risk, and especially Monopoly. This is an easy way to get a tie-in product out there, but it's rarely very satisfying when assessing whether or not the result is a good game. Of course, there are exceptions; Legendary has proven itself to be a very resilient game system, supporting multiple licensed properties such as Marvel Comics, Alien, and James Bond while making each property seem a perfect fit, and I will go to my grave defending The Lone Ranger Shuffle the Deck Card Game as one of the best fits between a licensed property and a pre-existing game system ever.

The design choice that should render much better results is when a game scratch built to fit a particular theme, but while this approach occasionally gives us an amazing game like Firefly, it all to often results in something that is too focused on the nuances of the property it's trying to simulate, to the point that the end result is a game that, while successfully evoking whatever film or TV series it's based on, doesn't actually come together very well as a playable game.

This is definitely the case with Die Hard: the Nakatomi Heist Board Game. According to the designers, the intent of the game was evoke the experience of watching the movie, and it definitely does that. If you're a fan, the game will certainly call to mind most of the film's iconic moments such as John McClane running across broken glass or Hans Gruber plunging to his death.

The game is played out over three acts, with one player acting as McClane and the rest as the thieves (remember, they're only pretending to be terrorists). The McClane player has to use cards and dice rolls to move through Nakatomi Tower completing various objectives starting with finding a gun and a radio, and finishing with pushing Gruber out of the window. The thief players have to work together to slow him down, while at the same time playing cards in the right combination to open the vault and win the game.

In many ways it's similar to Leading Edge's Aliens board game, which asks players to recreate the action from the film, but sets them the challenge of doing better than the characters did in the film (according to the game's victory conditions, they lost). It also allows for several "what if" scenarios outside of what we see in the film.

Die Hard uses cards, dice and playing pieces to provide a framework that lets players re-enact the film, and then asks them to do just that. And this is the problem. While the game mechanics are reasonably entertaining for a lightweight tactical move-and-shoot game, the players are given objectives based on what happens in the movie, and the only way to accomplish them is to do what the characters did in the movie. There's no flexibility to try different strategies, and there are no alternative ways to win. The game forces the players to use their random card draws and dice rolls to recreate the film, which means it plays the same way every time.

With little to no replay value it's not likely that we will play this game very often, but I'm thinking we might lean into the old "is Die Hard a Christmas movie" debate by storing it with our holiday decorations and playing it once a year on Christmas eve...

Rating: 2 (out of 5) More of a simulation than a game, giving players the tools to recreate the movie but no flexibility to do anything beyond that.

Die Hard: the Nakatomi Heist Board Game official website
Die Hard: the Nakatomi Heist Board Game on BoardGameGeek

Read More :- "Die Hard, But Not Any Harder"

Kumar Jadhav

Harlequins are decent at best.

I'm just going to come out and say it: I don't think Harlequins are looking too good from a competitive standpoint. With the book firmly in hand now, I don't see quite as much value from them compared to Dark Eldar when the army first got teased.

Before I completely put them aside, just note that I think there are a few things that Harlequins bring to the table. These are few, they're niche, and they're certainly conditional, but I think Harlequins can have some interesting options that no one else can really pull off. For example, when you look at some of the things that Soaring Spite can do with their Masque Form, you'll know that the army will be able to move 16"+6" and still shoot with 6" Fusion Pistols without penalty for 28" threat range. This awesomeness simply cannot be ignored. Similarly, if you take Faolchu's Talon for your Soaring Spite Warlord, you can move an additional 6" in your movement, and when you blow up, nothing happens. No explosion, no models dying, you just roll out of your drive-by mobile and find another joyride to blow people up in. This is great and all, but it's also very niche. Hell, even their big fancy Webway Gate wants me to drop multiple Talos or a fat unit of Grots out of them instead.

So here's where I have problems with the army: They're melee Horrors. They're melee-based units that cost a ton but still have the same statline as those little pink dudes. You have an army of 1W T3 4++ melee Horrors that desperately want to be relevant in a meta filled with resilience and anti-alpha. Everyone and their mother knows that T3 and 4++ with a single wound just get absolutely murdered by almost any type of shooting and even below-average melee fillers that play much better in attrition simply because of the points. Harlequins are great if you think that killing MEQ with 3+ for almost 30 points is great. You know what else is 30 points? A Grot, and a Grot comes with so much more resilience because a single Grotesque can be T6 with 4 wounds and 4++ with FNP. Speaking of 4W, this is actually much bigger than people realize. It takes 2 D2 shots to kill, out of kill scope of D3 weapons, and makes D6 weapons very nervous. It's pretty much the sweetest spot for being infuriating at 30ppm. When it comes to bashing in a Marine's face, a Grot does just as much damage but can stay alive much longer vs. almost any kind of shooting and any kind of melee. In fact, Harlequin melee stopped being relevant ever since stronger alternatives came out: Genestealers, Grotesques, Dawneagle Shield-Captains, the list goes on and on. Hell, even Wyches are better for the points if you want a melee option. Marines are dead easy to kill with any competitive army worth their salt because single-wound that cost a lot are just not cost-effective in today's meta. Attrition matters and Harlequins play the game the worst out of all the units in the game. Every other army that wants to be in melee does it better for the cost. For me, since I play Dark Eldar in a very shooty manner, why bother being in melee if you can shoot them to death from far away? My T3 5+ AS with an FNP Warrior that cost 6 points is looking a lot more cost-effective next to a 28-point Harlequin with a Fusion Pistol and an Embrace. You are essentially paying a premium for a luxury that's not needed.

Arguably the best Form in the book.

This brings me to match-up. In any given competitive setting, you're going to be looking at your local meta or even the greater meta (GTs or national events) and comparing yourself to all the other armies out there. You have to factor in the fact that Harlequins are not cheap, not in the slightest. Their unit choices are limited already, but what you pay for is a unit that's not very durable but has a ton of bad match-ups. If you run into a Tyranid list with a lot of Genestealers for example, you know for the points that you're going to fight an attrition battle that you're not going to like. If you're fighting a lot of Gaunts, forget about it because you already lost the points game here (anything with Fearless sucks). God forbid you to run into a unit of Wyches, or even worse, a unit of Grots. With Meat Mountain being so popular these days, just running into a unit that you're not going to be able to really hurt while still taking assloads of damage in return is going to suck. The worst part is when you start thinking about this from a points perspective. Having Harlequins killing cheap fodder units is a waste of time and it's only going to get you shot up afterward and killed. A canny opponent is just going to spread out his line so he sets up kill zones for your units afterward (why Midnight Sorrow might be pretty decent). IG carparks are going to be super annoying and so are most armies with cheap armor and plentiful shooting. I feel very confident with my pure Kabal army vs. any army that takes a decent amount of Harlequins for example. When you bleed expensive models, your firepower and melee threat goes down a ton. That's one of the reasons why I prayed to the dice gods that GW was going to give the army -1 To Hit all-around. Alas, this was not to be. Instead, you have to pay up the ass in CPs and bet on Psychic powers or other instances to keep your basic stuff alive long enough to be relevant.

Harlequins are points-prohibitive. If you take them, you won't have a lot of anything else. If you want to run them in any meaningful way, you will take them as a Battalion. You will already need multiple HQs to get the most of your army like the Shadowseer and Troupe Master, and Troupes just naturally fill in the rest of the core choices. The difficult part here is getting into a points zone where you can still be relevant and be a threat to the enemy without costing an arm and a leg. It's not just the points that matter here, it's about being relevant and a threat to the enemy. What I mean by this is that you need to pack anti-tank in any competitive list as well as being a threat in melee because that's what you're taking Harlequins for. The army, in general, is bi-polar. If you want them to be a strong AT threat, you take Fusion Pistols. If you want them to be a big melee threat, you mix up Caress and Embrace. The problem is that they both go on the same model and when that model dies, he takes both of those upgrades with him. Some people argue saying that you can take them stock, or leave specials off them as extra wounds, but why the hell would you do that? If you're just looking at a few models that can do damage, Wyches can fill that role for much cheaper. Unfortunately, you have this current situation where both ranged and melee special weapons cost a good deal of points on an already expensive model to begin. This is why the attrition factor sucks so much for this army. It's not very durable and every model lost feels like chunks out of the army's total strength compared to other armies. Hell, most would agree with me when I say that Soaring Spite is arguably the best Form right now for Harlequins, but what people talk about but don't consider is how many points a boat filled with Fusion Pistol Troupes really are. If you want to decrease the cost by removing Fusion Pistols, you lose out on the Form's benefits. You cut the melee weapons and you're now a glorified Wych. Grats. More importantly, for how many points you're spending trying to make this clusterfuck work, you're also taking away points from allies who can possibly perform the same role better. Case in point, you can buy an entire Black Heart Spearhead for less than 500 points if you just want something to shoot.

Too much, too little.

So what am I getting at here? It means that if you put a lot of points into Harlequins, you need them to be a decent standalone force. But if you need them to be standalone, in the fact that you need your points to also equate out to the ability to kill tanks and infantry, then you're simply increasing the cost of each Troupe unit. Taking a deeper dive: For 500 points, I can buy a Black Heart Spearhead with 3x Ravagers with Dissies on all of them. What do Dissies do? They can pretty much wreck anything because this buys the army 27 BS3+ S5 AP-3 D2 shots that can threaten GEQ, MEQ, multi-wound, single-wound, high-armor, whatever, you name it. This is just from shooting because you're not counting access to Agents of Vect, Living Muse, Cunning, or FNP on all your vehicles. You put 500 points into a Harlequin force and what do you get? You do the math and get back to me with exactly what firepower you have in shooting and in melee and see if the numbers pay off for you. First, you need to be a certain distance from the enemy to threaten them with AT Fusion Pistols, then you need to be in combat to get the most out of them. To get in, you have to brave the Overwatch, hope none of your 28 point models die, roll to get in, and then you can really shine. You have to play much cleaner, much more precise and pray for some good ol' dice rolls because there's a lot that can go wrong. With Grots, you just push models forward and results happen. With Ravagers, it's the same thing, but you don't need to commit because you're 36" away from your target. With Harlequins, it's all risk, and I hate risk. And so do most competitive players.

You know what else is risky? Conditional effects. When you look at Harlequins, almost everything in the army requires you to be within 6", roll something to enable (Veiled Path), cast a psychic power, drop multiple Strategems across multiple phases, or something else. Most of these things can fail to bad luck, some can be outright countered (Vect, Denied), and others can be counter-played sufficiently to really take the wind out of your sails. The best counter to melee-oriented armies is proper spacing and understanding threat range and averages. A good player with solid understanding of melee threat range and bubble-wraps will be murderous to Harlequins. In general, the army is almost too much fluff and not enough consistency when it comes to a lot of their army mechanics and that is a huge risk to competitive players looking to win a GT. The variables are already great, with matchups and different strength of schedules and players, so you don't need more randomness. It's almost like you're playing Orks, but you're trying to build a competitive army so you took Eldar or Dark Eldar allies and they're all looking at you like WTF, you took up half of my army points? A common theme within competitive armies is that they're consistent in their performance. Just look at some of the discussions around Harlequins being a competitive threat. It always starts with: Oh first you take this, then you do this, then you cast this, then you play this Strategem, and then you shoot and lel you embark back in your transport! Yeah, that's nice, but I play Prophets of Flesh and my entire army has 4++. That's what consistency looks like and that's why it wins games. That's why Meat Mountain is doing so much work right now. That is until people figure out how to beat it.

There is a mild saving grace for the army though, is that they're Battle Brothers with both Dark Eldar and Eldar. I would say that both of these armies are very competitive with a multitude of unit options. Eldar arguably has the best psykers (Doom, Jinx) in the game, Shining Spears, Dark Reapers, Wave Serpents, and both the Hemlock and Crimson Hunter Exarch are insane. Dark Eldar can run Meat Mountain down your throat and cost-effective Kabal units, Ravager Spearheads, Agents of Vect, and CP manipulation up the wazoo. There is a lot of good stuff in both of these armies, but ultimately it comes down to the points question all over again. Is Harlequins competitive enough to share the same points as these armies here if you're trying to build competitive? Only time will tell. Personally, I think the best Harlequin lists will be the ones mixed with either Eldar or Dark Eldar. Cegorach knows that I've been trying to make it work.

I really hope I made some solid points here. Don't get me wrong, I own a ton of the little fuckers and I love them to death, but they're definitely more of a fluffy choice than a competitive choice for me. There are just too many good unit choices out there that makes army building with them difficult. I know, I've been trying to design a good army list with Harlequins/DE and/or Eldar for the last couple of days and it's mind-boggling. When I have something good, I'll show it off.

Read More :- "Harlequins: Not Sure If Good"

Kumar Jadhav

Information gathering can be broken into seven logical steps. Footprinting is performed during the first two steps of unearthing initial information and locating the network range.

Footprinting

Footprinting is defined as the process of establishing a scenario or creating a map of an organization's network and systems. Information gathering is also known as footprinting an organization. Footprinting is an important part of reconnaissance process which is typically used for collecting possible information about a targeted computer system or network. Active and Passive both could be Footprinting. The example of passive footprinting is assessment of a company's website, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering. Basically footprinting is the beginning step of hacker to get hacked someone because having information about targeted computer system is the main aspect of hacking. If you have an information about individual you wanna hack so you can easily hacked that individual. The basic purpose of information gathering is at least decide what type of attacks will be more suitable for the target. Here are some of the pieces of information to be gathered about a target
during footprinting:

Domain name
Network blocks
Network services and applications
System architecture
Intrusion detection system
Authentication mechanisms
Specific IP addresses
Access control mechanisms
Phone numbers
Contact addresses

Once this information is assemble, it can give a hacker better perception into the organization, where important information is stored, and how it can be accessed.

Footprinting Tools

Footprinting can be done using hacking tools, either applications or websites, which allow the hacker to locate information passively. By using these footprinting tools, a hacker can gain some basic information on, or "footprint," the target. By first footprinting the target, a hacker can eliminate tools that will not work against the target systems or network. For example, if a graphics design firm uses all Macintosh computers, then all hacking software that targets Windows systems can be eliminated. Footprinting not only speeds up the hacking process by eliminating certain tool sets but also minimizes the chance of detection as fewer hacking attempts can be made by using the right tool for the job. Some of the common tools used for footprinting and information gathering are as follows:

Domain name lookup
Whois
NSlookup
Sam Spade

Before we discuss these tools, keep in mind that open source information can also yield a wealth of information about a target, such as phone numbers and addresses. Performing Whois requests, searching domain name system (DNS) tables, and using other lookup web tools are forms of open source footprinting. Most of this information is fairly easy to get and legal to obtain.

Footprinting a Target

Footprinting is part of the preparatory pre-attack phase and involves accumulating data regarding a target's environment and architecture, usually for the purpose of finding ways to intrude into that environment. Footprinting can reveal system vulnerabilities and identify the ease with which they can be exploited. This is the easiest way for hackers to gather information about computer systems and the companies they belong to. The purpose of this preparatory phase is to learn as much as you can about a system, its remote access capabilities, its ports and services, and any specific aspects of its security.

DNS Enumeration

DNS enumeration is the process of locating all the DNS servers and their corresponding records for an organization. A company may have both internal and external DNS servers that can yield information such as usernames, computer names, and IP addresses of potential target systems.

NSlookup and DNSstuff

One powerful tool you should be familiar with is NSlookup (see Figure 2.2). This tool queries DNS servers for record information. It's included in Unix, Linux, and Windows operating systems. Hacking tools such as Sam Spade also include NSlookup tools. Building on the information gathered from Whois, you can use NSlookup to find additional IP addresses for servers and other hosts. Using the authoritative name server information from Whois ( AUTH1.NS.NYI.NET ), you can discover the IP address of the mail server.

Syntax
nslookup www.sitename.com

nslookup www.usociety4.com

Performing DNS Lookup

This search reveals all the alias records for www.google.com and the IP address of the web server. You can even discover all the name servers and associated IP addresses.

Understanding Whois and ARIN Lookups

Whois evolved from the Unix operating system, but it can now be found in many operating systems as well as in hacking toolkits and on the Internet. This tool identifies who has registered domain names used for email or websites. A uniform resource locator (URL), such as www.Microsoft.com , contains the domain name ( Microsoft.com ) and a hostname or alias ( www ).
The Internet Corporation for Assigned Names and Numbers (ICANN) requires registration of domain names to ensure that only a single company uses a specific domain name. The Whois tool queries the registration database to retrieve contact information about the individual or organization that holds a domain registration.

Using Whois

Go to the DNSStuff.com website and scroll down to the free tools at the bottom of the page.
Enter your target company URL in the WHOIS Lookup field and click the WHOIS button.
Examine the results and determine the following:
- Registered address
- Technical and DNS contacts
- Contact email
- Contact phone number
- Expiration date

Visit the company website and see if the contact information from WHOIS matches up to any contact names, addresses, and email addresses listed on the website.

If so, use Google to search on the employee names or email addresses. You can learn the email naming convention used by the organization, and whether there is any information that should not be publicly available.

Syntax
whois sitename.com
whois usociety4.com

Related word

Read More :- "CEH Practical: Information-Gathering Methodology"

Kumar Jadhav

During our joint research on DTLS state machines, we discovered a really interesting vulnerability (CVE-2020-2655) in the recent versions of Sun JSSE (Java 11, 13). Interestingly, the vulnerability does not only affect DTLS implementations but does also affects the TLS implementation of JSSE in a similar way. The vulnerability allows an attacker to completely bypass client authentication and to authenticate as any user for which it knows the certificate WITHOUT needing to know the private key. If you just want the PoC's, feel free to skip the intro.

DTLS

I guess most readers are very familiar with the traditional TLS handshake which is used in HTTPS on the web.

DTLS is the crayon eating brother of TLS. It was designed to be very similar to TLS, but to provide the necessary changes to run TLS over UDP. DTLS currently exists in 2 versions (DTLS 1.0 and DTLS 1.2), where DTLS 1.0 roughly equals TLS 1.1 and DTLS 1.2 roughly equals TLS 1.2. DTLS 1.3 is currently in the process of being standardized. But what exactly are the differences? If a protocol uses UDP instead of TCP, it can never be sure that all messages it sent were actually received by the other party or that they arrived in the correct order. If we would just run vanilla TLS over UDP, an out of order or dropped message would break the connection (not only during the handshake). DTLS, therefore, includes additional sequence numbers that allow for the detection of out of order handshake messages or dropped packets. The sequence number is transmitted within the record header and is increased by one for each record transmitted. This is different from TLS, where the record sequence number was implicit and not transmitted with each record. The record sequence numbers are especially relevant once records are transmitted encrypted, as they are included in the additional authenticated data or HMAC computation. This allows a receiving party to verify AEAD tags and HMACs even if a packet was dropped on the transport and the counters are "out of sync".
Besides the record sequence numbers, DTLS has additional header fields in each handshake message to ensure that all the handshake messages have been received. The first handshake message a party sends has the message_seq=0 while the next handshake message a party transmits gets the message_seq=1 and so on. This allows a party to check if it has received all previous handshake messages. If, for example, a server received message_seq=2 and message_seq=4 but did not receive message_seq=3, it knows that it does not have all the required messages and is not allowed to proceed with the handshake. After a reasonable amount of time, it should instead periodically retransmit its previous flight of handshake message, to indicate to the opposing party they are still waiting for further handshake messages. This process gets even more complicated by additional fragmentation fields DTLS includes. The MTU (Maximum Transmission Unit) plays a crucial role in UDP as when you send a UDP packet which is bigger than the MTU the IP layer might have to fragment the packet into multiple packets, which will result in failed transmissions if parts of the fragment get lost in the transport. It is therefore desired to have smaller packets in a UDP based protocol. Since TLS records can get quite big (especially the certificate message as it may contain a whole certificate chain), the messages have to support fragmentation. One would assume that the record layer would be ideal for this scenario, as one could detect missing fragments by their record sequence number. The problem is that the protocol wants to support completely optional records, which do not need to be retransmitted if they are lost. This may, for example, be warning alerts or application data records. Also if one party decides to retransmit a message, it is always retransmitted with an increased record sequence number. For example, the first ClientKeyExchange message might have record sequence 2, the message gets dropped, the client decides that it is time to try again and might send it with record sequence 5. This was done as retransmissions are only part of DTLS within the handshake. After the handshake, it is up to the application to deal with dropped or reordered packets. It is therefore not possible to see just from the record sequence number if handshake fragments have been lost. DTLS, therefore, adds additional handshake message fragment information in each handshake message record which contains information about where the following bytes are supposed to be within a handshake message.

If a party has to replay messages, it might also refragment the messages into bits of different (usually smaller) sizes, as dropped packets might indicate that the packets were too big for the MTU). It might, therefore, happen that you already have received parts of the message, get a retransmission which contains some of the parts you already have, while others are completely new to you and you still do not have the complete message. The only option you then have is to retransmit your whole previous flight to indicate that you still have missing fragments. One notable special case in this retransmission fragmentation madness is the ChangecipherSpec message. In TLS, the ChangecipherSpec message is not a handshake message, but a message of the ChangeCipherSpec protocol. It, therefore, does not have a message_sequence. Only the record it is transmitted in has a record sequence number. This is important for applications that have to determine where to insert a ChangeCipherSpec message in the transcript.

As you might see, this whole record sequence, message sequence, 2nd layer of fragmentation, retransmission stuff (I didn't even mention epoch numbers) which is within DTLS, complicates the whole protocol a lot. Imagine being a developer having to implement this correctly and secure... This also might be a reason why the scientific research community often does not treat DTLS with the same scrutiny as it does with TLS. It gets really annoying really fast...

Client Authentication

In most deployments of TLS only the server authenticates itself. It usually does this by sending an X.509 certificate to the client and then proving that it is in fact in possession of the private key for the certificate. In the case of RSA, this is done implicitly the ability to compute the shared secret (Premaster secret), in case of (EC)DHE this is done by signing the ephemeral public key of the server. The X.509 certificate is transmitted in plaintext and is not confidential. The client usually does not authenticate itself within the TLS handshake, but rather authenticates in the application layer (for example by transmitting a username and password in HTTP). However, TLS also offers the possibility for client authentication during the TLS handshake. In this case, the server sends a CertificateRequest message during its first flight. The client is then supposed to present its X.509 Certificate, followed by its ClientKeyExchange message (containing either the encrypted premaster secret or its ephemeral public key). After that, the client also has to prove to the server that it is in possession of the private key of the transmitted certificate, as the certificate is not confidential and could be copied by a malicious actor. The client does this by sending a CertificateVerify message, which contains a signature over the handshake transcript up to this point, signed with the private key which belongs to the certificate of the client. The handshake then proceeds as usual with a ChangeCipherSpec message (which tells the other party that upcoming messages will be encrypted under the negotiated keys), followed by a Finished message, which assures that the handshake has not been tampered with. The server also sends a CCS and Finished message, and after that handshake is completed and both parties can exchange application data. The same mechanism is also present in DTLS.

But what should a Client do if it does not possess a certificate? According to the RFC, the client is then supposed to send an empty certificate and skip the CertificateVerify message (as it has no key to sign anything with). It is then up to the TLS server to decide what to do with the client. Some TLS servers provide different options in regards to client authentication and differentiate between REQUIRED and WANTED (and NONE). If the server is set to REQUIRED, it will not finish the TLS handshake without client authentication. In the case of WANTED, the handshake is completed and the authentication status is then passed to the application. The application then has to decide how to proceed with this. This can be useful to present an error to a client asking him to present a certificate or insert a smart card into a reader (or the like). In the presented bugs we set the mode to REQUIRED.

State machines

As you might have noticed it is not trivial to decide when a client or server is allowed to receive or send each message. Some messages are optional, some are required, some messages are retransmitted, others are not. How an implementation reacts to which message when is encompassed by its state machine. Some implementations explicitly implement this state machine, while others only do this implicitly by raising errors internally if things happen which should not happen (like setting a master_secret when a master_secret was already set for the epoch). In our research, we looked exactly at the state machines of DTLS implementations using a grey box approach. The details to our approach will be in our upcoming paper (which will probably have another blog post), but what we basically did is carefully craft message flows and observed the behavior of the implementation to construct a mealy machine which models the behavior of the implementation to in- and out of order messages. We then analyzed these mealy machines for unexpected/unwanted/missing edges. The whole process is very similar to the work of Joeri de Ruiter and Erik Poll.

JSSE Bugs

The bugs we are presenting today were present in Java 11 and Java 13 (Oracle and OpenJDK). Older versions were as far as we know not affected. Cryptography in Java is implemented with so-called SecurityProvider. Per default SUN JCE is used to implement cryptography, however, every developer is free to write or add their own security provider and to use them for their cryptographic operations. One common alternative to SUN JCE is BouncyCastle. The whole concept is very similar to OpenSSL's engine concept (if you are familiar with that). Within the JCE exists JSSE - the Java Secure Socket Extension, which is the SSL/TLS part of JCE. The presented attacks were evaluated using SUN JSSE, so the default TLS implementation in Java. JSSE implements TLS and DTLS (added in Java 9). However, DTLS is not trivial to use, as the interface is quite complex and there are not a lot of good examples on how to use it. In the case of DTLS, only the heart of the protocol is implemented, how the data is moved from A to B is left to the developer. We developed a test harness around the SSLEngine.java to be able to speak DTLS with Java. The way JSSE implemented a state machine is quite interesting, as it was completely different from all other analyzed implementations. JSSE uses a producer/consumer architecture to decided on which messages to process. The code is quite complex but worth a look if you are interested in state machines.

So what is the bug we found? The first bug we discovered is that a JSSE DTLS/TLS Server accepts the following message sequence, with client authentication set to required:

JSSE is totally fine with the messages and finishes the handshake although the client does NOT provide a certificate at all (nor a CertificateVerify message). It is even willing to exchange application data with the client. But are we really authenticated with this message flow? Who are we? We did not provide a certificate! The answer is: it depends. Some applications trust that needClientAuth option of the TLS socket works and that the user is *some* authenticated user, which user exactly does not matter or is decided upon other authentication methods. If an application does this - then yes, you are authenticated. We tested this bug with Apache Tomcat and were able to bypass ClientAuthentication if it was activated and configured to use JSSE. However, if the application decides to check the identity of the user after the TLS socket was opened, an exception is thrown:

The reason for this is the following code snippet from within JSSE:

As we did not send a client certificate the value of peerCerts is null, therefore an exception is thrown. Although this bug is already pretty bad, we found an even worse (and weirder) message sequence which completely authenticates a user to a DTLS server (not TLS server though). Consider the following message sequence:

If we send this message sequence the server magically finishes the handshake with us and we are authenticated.

First off: WTF
Second off: WTF!!!111

This message sequence does not make any sense from a TLS/DTLS perspective. It starts off as a "no-authentication" handshake but then weird things happen. Instead of the Finished message, we send a Certificate message, followed by a Finished message, followed by a second(!) CCS message, followed by another Finished message. Somehow this sequence confuses JSSE such that we are authenticated although we didn't even provide proof that we own the private key for the Certificate we transmitted (as we did not send a CertificateVerify message).

So what is happening here? This bug is basically a combination of multiple bugs within JSSE. By starting the flight with a ClientKeyExchange message instead of a Certificate message, we make JSSE believe that the next messages we are supposed to send are ChangeCipherSpec and Finished (basically the first exploit). Since we did not send a Certificate message we are not required to send a CertificateVerify message. After the ClientKeyExchange message, JSSE is looking for a ChangeCipherSpec message followed by an "encrypted handshake message". JSSE assumes that the first encrypted message it receives will be the Finished message. It, therefore, waits for this condition. By sending ChangeCipherSpec and Certificate we are fulfilling this condition. The Certificate message really is an "encrypted handshake message" :). This triggers JSSE to proceed with the processing of received messages, ChangeCipherSpec message is consumed, and then the Certifi... Nope, JSSE notices that this is not a Finished message, so what JSSE does is buffer this message and revert to the previous state as this step has apparently not worked correctly. It then sees the Finished message - this is ok to receive now as we were *somehow* expecting a Finished message, but JSSE thinks that this Finished is out of place, as it reverted the state already to the previous one. So this message gets also buffered. JSSE is still waiting for a ChangeCipherSpec, "encrypted handshake message" - this is what the second ChangeCipherSpec & Finished is for. These messages trigger JSSE to proceed in the processing. It is actually not important that the last message is a Finished message, any handshake message will do the job. Since JSSE thinks that it got all required messages again it continues to process the received messages, but the Certificate and Finished message we sent previously are still in the buffer. The Certificate message is processed (e.g., the client certificate is written to the SSLContext.java). Then the next message in the buffer is processed, which is a Finished message. JSSE processes the Finished message (as it already had checked that it is fine to receive), it checks that the verify data is correct, and then... it stops processing any further messages. The Finished message basically contains a shortcut. Once it is processed we can stop interpreting other messages in the buffer (like the remaining ChangeCipherSpec & "encrypted handshake message"). JSSE thinks that the handshake has finished and sends ChangeCipherSpec Finished itself and with that the handshake is completed and the connection can be used as normal. If the application using JSSE now decides to check the Certificate in the SSLContext, it will see the certificate we presented (with no possibility to check that we did not present a CertificateVerify). The session is completely valid from JSSE's perspective.

Wow.

The bug was quite complex to analyze and is totally unintuitive. If you are still confused - don't worry. You are in good company, I spent almost a whole day analyzing the details... and I am still confused. The main problem why this bug is present is that JSSE did not validate the received message_sequence numbers of incoming handshake message. It basically called receive, sorted the received messages by their message_sequence, and processed the message in the "intended" order, without checking that this is the order they are supposed to be sent in.
For example, for JSSE the following message sequence (Certificate and CertificateVerify are exchanged) is totally fine:

Not sending a Certificate message was fine for JSSE as the REQUIRED setting was not correctly evaluated during the handshake. The consumer/producer architecture of JSSE then allowed us to cleverly bypass all the sanity checks.
But fortunately (for the community) this bypass does not work for TLS. Only the less-used DTLS is vulnerable. And this also makes kind of sense. DTLS has to be much more relaxed in dealing with out of order messages then TLS as UDP packets can get swapped or lost on transport and we still want to buffer messages even if they are out of order. But unfortunately for the community, there is also a bypass for JSSE TLS - and it is really really trivial:

Yep. You can just not send a CertificateVerify (and therefore no signature at all). If there is no signature there is nothing to be validated. From JSSE's perspective, you are completely authenticated. Nothing fancy, no complex message exchanges. Ouch.

PoC

A vulnerable java server can be found _*here*_. The repository includes a pre-built JSSE server and a Dockerfile to run the server in a vulnerable Java version. (If you want, you can also build the server yourself).
You can build the docker images with the following commands:

docker build . -t poc

You can start the server with docker:

docker run -p 4433:4433 poc tls

The server is configured to enforce client authentication and to only accept the client certificate with the SHA-256 Fingerprint: B3EAFA469E167DDC7358CA9B54006932E4A5A654699707F68040F529637ADBC2.

You can change the fingerprint the server accepts to your own certificates like this:

docker run -p 4433:4433 poc tls f7581c9694dea5cd43d010e1925740c72a422ff0ce92d2433a6b4f667945a746

To exploit the described vulnerabilities, you have to send (D)TLS messages in an unconventional order or have to not send specific messages but still compute correct cryptographic operations. To do this, you could either modify a TLS library of your choice to do the job - or instead use our TLS library TLS-Attacker. TLS-Attacker was built to send arbitrary TLS messages with arbitrary content in an arbitrary order - exactly what we need for this kind of attack. We have already written a few times about TLS-Attacker. You can find a general tutorial __here__, but here is the TLDR (for Ubuntu) to get you going.

Now TLS-Attacker should be built successfully and you should have some built .jar files within the apps/ folder.
We can now create a custom workflow as an XML file where we specify the messages we want to transmit:

This workflow trace basically tells TLS-Attacker to send a default ClientHello, wait for a ServerHelloDone message, then send a ClientKeyExchange message for whichever cipher suite the server chose and then follow it up with a ChangeCipherSpec & Finished message. After that TLS-Attacker will just wait for whatever the server sent. The last action prints the (eventually) transmitted application data into the console. You can execute this WorkflowTrace with the TLS-Client.jar:

java -jar TLS-Client.jar -connect localhost:4433 -workflow_input exploit1.xml

With a vulnerable server the result should look something like this:

and from TLS-Attackers perspective:

As mentioned earlier, if the server is trying to access the certificate, it throws an SSLPeerUnverifiedException. However, if the server does not - it is completely fine exchanging application data.
We can now also run the second exploit against the TLS server (not the one against DTLS). For this case I just simply also send the certificate of a valid client to the server (without knowing the private key). The modified WorkflowTrace looks like this:

Your output should now look like this:

As you can see, when accessing the certificate, no exception is thrown and everything works as if we would have the private key. Yep, it is that simple.
To test the DTLS specific vulnerability we need a vulnerable DTLS-Server:

docker run -p 4434:4433/udp poc:latest dtls

A WorkflowTrace which exploits the DTLS specific vulnerability would look like this:

To execute the handshake we now need to tell TLS-Attacker additionally to use UDP instead of TCP and DTLS instead of TLS:

java -jar TLS-Client.jar -connect localhost:4434 -workflow_input exploit2.xml -transport_handler_type UDP -version DTLS12

Resulting in the following handshake:

As you can see, we can exchange ApplicationData as an authenticated user. The server actually sends the ChangeCipherSpec,Finished messages twice - to avoid retransmissions from the client in case his ChangeCipherSpec,Finished is lost in transit (this is done on purpose).

Conclusion

These bugs are quite fatal for client authentication. The vulnerability got CVSS:4.8 as it is "hard to exploit" apparently. It's hard to estimate the impact of the vulnerability as client authentication is often done in internal networks, on unusual ports or in smart-card setups. If you want to know more about how we found these vulnerabilities you sadly have to wait for our research paper. Until then ~:)

Credits

Paul Fiterau Brostean (@PaulTheGreatest) (Uppsala University)
Robert Merget (@ic0nz1) (Ruhr University Bochum)
Juraj Somorovsky (@jurajsomorovsky) (Ruhr University Bochum)
Kostis Sagonas (Uppsala University)
Bengt Jonsson (Uppsala University)
Joeri de Ruiter (@cypherpunknl) (SIDN Labs)

Responsible Disclosure

We reported our vulnerabilities to Oracle in September 2019. The patch for these issues was released on 14.01.2020.

Java String Substring

Tuesday, 22 September 2020

Suzy Cube Update: June 1, 2018

Monday, 21 September 2020

A Warm Welcome Please For

Saturday, 12 September 2020

DreamForge-Games Price Increase.

Die Hard, But Not Any Harder

Thursday, 3 September 2020

Harlequins: Not Sure If Good

Sunday, 30 August 2020

CEH Practical: Information-Gathering Methodology