Thursday, January 24, 2008

I Like Apple Products But I Am Not A MacHead


Monday, January 14, 2008

Another Free MacWorld Platinum Pass? Yes in 2008!

Last year at this time I disclosed an issue with the IDG/MacWorld Expo registration that allowed people Free Platinum Passes (valued at $1,695). I communicated this issue with IDG the week of MacWorld and they removed all the codes, fixed the site, and said thanks. Questions were asked on how to write better code and I gave them a few tips (don't trust user input, don't give your secret codes to everyone, encryption is not one-way, etc). Did they listen?


Why Do I Do This?


Honestly it's academic to me. I didn't even go to the keynote. :P

Getting Your Golden (Well, Blue) Ticket:

This year the cost of Platinum Passes has gone up to $1,895. That's a lot of money but you get a lot of cool things:
  • A free lunch every day
  • Free ticket to the MacWorld Blast
  • Priority Access Line to the Keynote
You can see why the cost. Last year the word "CREDIT" provided a 100% discount on checkout. These are called Application Logic Flaws and aren't new attacks but they can be devastating .

Like last year IDG is passing a long list of MD5 hashes to the client browser and validating them in JavaScript before sending a request to the server -- but that's really only a problem if the codes that give the discounts exist and are easily cracked. Lets see if we can get lucky this year.

Obtaining the codes -- Same as last year:

Step 1. Navigate to the main registration page
Step 2. Submit your initial data and view the source of the main registration page, search for "Priority Code"
Step 3. See the JavaScript "onchange" function? It's calling "check_password()"
Step 4. Search for "check_password()" and you'll find the list of valid codes in MD5

Cracking the codes:

I like John The Ripper for all my hash cracking needs. It's flexible, easy to use and affordable! There are two main methods used to crack passwords in John, using a wordlist or incrementing through a given keyspace. I always begin with a wordlist run just to kick out the quickies. The hash for "NONE" breaks but we already know that doesn't do anything for us.

Incremental mode is our next step but we know lower case letters aren't used so a quick look at the configuration file shows an external mode "Filter_LanMan" that throws everything to upper case. A quick run through doesn't net any cracked hashes unfortunately. There are still over 1,000 hashes to crack so we have to be a bit more intelligent in our cracking (or throw more machines, wait longer, get a PS3, etc).

A Brief Cracking Sidebar:


Changing l for different lengths and the time changes accordingly:


Here Come The Free Codes:

Vendors receive a group of codes each to pass along to their customers, potential customers, friends, family, etc. These typically provide free Expo access but maybe they'll help trim down this mountain to something manageable. These free codes get passed around like candy so finding one takes a few Google searches. 08-G-PC189, 08-G-PC178, 08-G-PC260,
do you see the pattern?

Time To Build An External Filter:


File = $JOHN/lanman.chr
MinLen = 6
MaxLen = 6
CharCount = 69

void filter()
int i, c;
i = 0;

while (c = word[i]) {
// If character is lower case, convert to upper
word[i] &= 0xDF;

// We know the static filter 08-?-?????
// Add or remove word[]s to fit the incremental length
word[9] = word[5];
word[8] = word[4];
word[7] = word[3];
word[6] = word[2];
word[5] = word[1];
word[4] = '-';
word[3] = word[0];
word[2] = '-';
word[1] = '8';
word[0] = '0';
With that, we run and wait...
# john -i=MW -e=MW --format=raw-MD5

Download the High Quality version.




Maybe next year the problem will be fixed? Anyone in a betting mood? :)