TRANSLATE

English French German Spain Italian Dutch
Russian Portuguese Japanese Korean Arabic Chinese Simplified

Tuesday, July 26, 2016

HSM and THALES Basics

Using The THALES Simulator









MasterCard Key using HSM

1 Loading the MasterCard Transport Key using 3 clear components provided by MasterCard

Online-AUTH>FK

Enter key length [1,2,3]: 2
Enter key type: 000
Enter key scheme: U
Enter component type [X,H,T,E,S]: X
Enter number of components [1-9]: 3
Enter component 1: ********************************
Enter component 2: ********************************
Enter component 3: ********************************
Encrypted key: U xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx  (Transport key encrypted)
Key check value: xxxx xx


2 Generating a key (If the key is already in you HSM, this step does not need to be done)

Online-AUTH>FK

Enter key length [1,2,3]: 2
Enter key type: ??? (select correct key type)
Enter key scheme: U
Enter component type [X,H,T,E,S]: X
Enter number of components [1-9]: 3
Enter component 1: ********************************
Enter component 2: ********************************
Enter component 3: ********************************
Encrypted key: U xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx  (CVK encrypted)
Key check value: xxxx xx



3 Exporting the key under LMK to encryption under ZMK using a X schema.

This export utilizes an X scheme encrypting using double length key using ANSI X9.17.

Online-AUTH>KE

Enter key type: ??? - (select type as required)
Enter key scheme: X

X Encryption of a double length key using ANSI X9.17 methods only available for import and export of keys.

This mode is enabled within the Configure Security command

Enter ZMK: U xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx ((Transport key encrypted))
Enter key: U xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx  (CVK encrypted)
Key under ZMK: X xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx (this value must be entered in index 10 of the CSTT file)
Key check value: xxxx xx (this value must be entered in index 11 of the CSTT file)


When you downloaded the CSTT application, the CSTT walkthrough guide should have been automatically downloaded. In this document, you will find a test transport key (3 components). As it is the first time that you generate a key file, I strongly suggest you to use the test transport key for step 1. For step 2 generate a dummy key. No change in step 3.
Generate you key file with the test data. Save the file.  And open it using the CSTT application but select "Test keys". If there is anything in red, it means that there are some mistakes. If nothing in red, that's fine and then you can create the production file.



HSM KEY CVV GUIDE






User Input - Self-explanatory.

Information you Provide as a buyer








Credit Card Services

Using the SCMP API









Monday, July 25, 2016

ETHICAL HACKING 101 How to conduct professional pentestings in 21 days or less!

Understanding the hacker´s mind, making reconnaissance, scanning and
enumeration, exploiting vulnerabilities, writing a professional report and more!
By:
Karina Astudillo B.








Cara Mencuci dan Mewarangi Keris (segala tosan aji)






BREAKING HTTPS WITH BGP HIJACKING

BREAKING HTTPS WITH BGP HIJACKING
By
Artyom Gavrichenkov
Qrator Labs (ag@qrator.net)








Ziarah Kemakam Tuhan

Ziarah Kemakam Tuhan
By 
M. Amin









Understanding and Managing Entropy Usage









INTERNET PLUMBING FOR SECURITY PROFESSIONALS: THE STATE OF BGP SECURITY

INTERNET PLUMBING FOR SECURITY PROFESSIONALS: THE STATE OF BGP SECURITY
By
Wim Remes – Rapid7








Exploiting the DRAM rowhammer bug to gain kernel privileges

Exploiting the DRAM rowhammer bug to gain kernel privileges
Mark Seaborn, sandbox builder and breaker
with contributions by Thomas Dullien, reverse engineer








Exploiting Trustzone on Android

Exploiting Trustzone on Android
By
Di Shen(@returnsme) retme7@gmail.com








Attacking ECMAScript Engines with Redefinition

Attacking ECMAScript Engines with Redefinition
By
Natalie Silvanovich, Google









XXE defence(les)s in JDK XML parsers

XXE defence(les)s in JDK XML parsers
By
Sergey Gorbaty sergey.gorbaty@salesforce.com
Xiaoran Wang xiaoran.wang@salesforce.com
Hormazd Billimoria hbillimoria@salesforce.com
Jonathan Brossard jbrossard@salesforce.com








The Applications of Deep Learning on Traffic Identification

The Applications of Deep Learning  on Traffic Identification
By
Zhanyi Wang (wangzhanyi@360.cn)







ROPInjector: Using Return- Oriented Programming for Polymorphism and AV Evasion

ROPInjector: Using Return-Oriented Programming for Polymorphism and AV Evasion
by G. Poulios, C. Ntantogian, C. Xenakis






BYPASS CONTROL FLOW GUARD COMPREHENSIVELY

BYPASS CONTROL FLOW GUARD COMPREHENSIVELY
by Zhang Yunhai






Saturday, July 23, 2016

Driver License Algorithm

How to calculate the North America (US) Drivers License Number Algorithm

Here is an algorithm based on the Soundex code that you can use to calculate the US drivers license number of individuals for the states of Florida, Illinois, and Wisconsin . This project is a beta. We built an algorithm to show that the power of Soundex is still one of the most powerful and wildly available algorithms today. Soundex is a phonetic algorithm for indexing names by sound, as pronounced in English. The goal is for names with the same pronunciation to be encoded to the same representation so that they can be matched despite minor differences in spelling. Soundex is the most widely known of all phonetic algorithms and is often used incorrectly as a synonym for "phonetic algorithm". Improvements to Soundex are the basis for many modern phonetic algorithms.

History of Soundex

Soundex was developed by Robert Russell and Margaret Odell and patented in 1918 and 1922 . A variation called American Soundex was used in the 1930s for a retrospective analysis of the US censuses from 1890 through 1920. The Soundex code came to prominence in the 1960s when it was the subject of several articles in the Communications and Journal of the Association for Computing Machinery (CACM and JACM). The National Archives and Records Administration (NARA) maintains the current rule set for the official implementation of Soundex used by the U.S. Government. On 2 Apr 1918, Robert C. Russell of Pittsburgh, Philadelphia obtained a patent on a method for indexing which was based on the way a name was pronounced rather than how it was spelled. He did this by coding 8 phonetic sound types with a few additional rules. Together with Margaret K. Odell he obtained a second patent in 1922 with some variations. This they sold to various commercial and governmental organizations. It was taken up in a modified form in the 1930's by the Social Security Administration under a work creation scheme to extract certain data from the US Census and to index its records. It has also been used for immigration records and, more recently for indexing search engines, spell checkers and in fact, a number of variants of the original design have been used over the years.
The Algorithm as an Outline.

Soundex Algorithm

A. Remember the initial letter.

B. Convert each letter (including the first) according to the following table. Ignore punctuation such as apostrophes, spaces and hyphens.

-1 = A, E, I ,O, U, Y (The letters A, E, I ,O, U, Y are not coded.)

-2 = H, W (The letters H, W are not coded.)

1 = B, P, F, V

2 = C, S, K, G, J, Q, S, Z

3 = D, T

4 = L

5 = M, N

6 = R

C. Change all consecutive duplicate digits to a single example. e.g. change 22 to 2

D. Replace the first digit by the letter remembered in step A.

F. Remove all zeros from the string.

G. Adjust to four characters by truncating or padding to the right with zeros.

The resulting 4 character code is the Simplified Soundex for that name.

<--how and="" calculate="" drivers="" fl="" for="" il="" license="" numbers="" of="" others.--="" perhaps="" states="" the="" to="" us="" wi="">

This algorithm is shared by Florida, Illinois, and Wisconsin.

The specific licenses look like the following.


Example of a Florida Driver's License:
SSSS-FFF-YY-DDD-N (The last letter is random and cannot be calculated -- see overflow topic below).
B652-104-79-163-0
The above is for Chris D. Branch, (male), born on May 3rd, 1979.

Example of a Illinois Driver's License:
SSSS-FFFY-YDDD
T651-5357-7044
The above is for Lam P. Turnpike, (male), born on February 13th, 1977.

Example of a Wisconsin Driver's License:
SSSS-FFFY-YDDD-NN (The last letters are random and cannot be calculated -- see overflow topic below).
R163-2838-0587-03
The above is for Georget C. Roberts, (female), born on March 7th, 1980.

Convert the name to the form “letter, digit, digit, digit” by adding trailing zeros if there are less than three digits, or by dropping rightmost digits if there are more than three digits. The following examples of names have these corresponding soundex codes:

Case C200 Gauss G200
Smith S530 Smythe S530
Lloyd L300 Bednarczyk B356
Jackson J250


SSSS = Soundex code of your last name



SSSS = Soundex

FFF = Encoded first name and middle initial

FFF = First name and middle initial


Look up your first name on this table:

Name Code Name Code Name Code
Albert 20 Frank 260 Marvin 580
Alice 20 George 300 Mary 580
Ann 40 Grace 300 Melvin 600
Anna 40 Harold 340 Mildred 600
Anne 40 Harriet 340 Patricia 680
Annie 40 Harry 360 Paul 680
Arthur 40 Hazel 360 Richard 740
Bernard 80 Helen 380 Robert 760
Bette 80 Henry 380 Ruby 740
Bettie 80 James 440 Ruth 760
Betty 80 Jane 440 Thelma 820
Carl 120 Jayne 440 Thomas 820
Catherine 120 Jean 460 Walter 900
Charles 140 Joan 480 Wanda 900
Dorthy 180 John 460 William 920
Edward 220 Joseph 480 Wilma 920
Elizabeth 220 Margaret 560
Florence 260 Martin 560
Donald 180
Clara 140



Then look up your first initial on this table:

If you fail to find your name, look up your first initial on this table:
Initial Code Initial Code Initial Code Initial Code
A 0 H 320 O 640 V 860
B 60 I 400 P 660 W 880
C 100 J 420 Q 700 X 940
D 160 K 500 R 720 Y 960
E 200 L 520 S 780 Z 980
F 240 M 540 T 800
G 280 N 620 U 840



Now look up your middle initial on this table:
Initial Code Initial Code Initial Code Initial Code
A 1 H 8 O 14 V 18
B 2 I 9 P 15 W 19
C 3 J 10 Q 15 X 19
D 4 K 11 R 16 Y 19
E 5 L 12 S 17 Z 19
F 6 M 13 T 18
G 7 N 14 U 18



Add together the code for your first name or your first initial to the code for your middle initial.



YY & Y-Y = Year of birth

The two numbers together represent the year of your birth.



DDD = Month and day of birth plus gender

This portion encodes the month and day you were born on. The general equation is:

General: (birth_month - 1) * month_multiplier + birth_day + gender_mod

Florida: (birth_month - 1) * 40 + birth_day + (male:0, female: 500)

Illinois: (birth_month - 1) * 31 + birth_day + (male:0, female: 600)

Wisconsin: (birth_month - 1) * 40 + birth_day + (male:0, female: 500)

birth_month is the number of months into the year, January is 1, December is 12.

month_multiplier varies by state. Illinois uses 31. Wisconsin and Florida both use 40.

gender_mod varies by state. In Illinois men use 0, women use 600. In Wisconsin and Florida men use 0, women use 500.

If the result is less than 100, add zeroes to the left side to make it 3 digits. (So, January 1st is encoded as "001" for men in Illinois.)



Overflow

Looking at this, it may become clear that it is possible for two people with similar names to get the exact same driver's license number. For example, if "Joshua William Smith" and "Jack Wayne Snotty" were born on the same day, they'll get the same Illinois Drivers's License number. This is solved with "overflow" numbers; a simple sequential number can be appended to each duplicate number to resolve the confusion.

Wisconsin prints the overflow number on your license. As a result, the last two digits of your Wisconsin Drivers license number represent the number of people who had the same license number as you (ignoring the last two digits), when you got your license.

Illinois may do this, but if they do the information is not on your driver's license. This means that if Joshua William Smith is wanted by police and his driver's license number is flagged as such, Jack Wayne Snotty may be briefly detained while the police check their records to sort out the shared number. It has been said that Illinois state databases actually include a two or three digit number to distinguish between different people with the same license.

It is also know that Florida adds one extra digit to the end. We have heard of the last digit being a 0, but it may well be another overflow digit, meaning that one should expect to see other numbers there as well.


NOTE: The people mentioned above anywhere in this essay are fictional.



<--us driver="" license="" number="" sequences--="">

AK - driver's license numbers sequentially issued. 7 digits.

AL - driver's license numbers sequentially issued. 7 digits.

AR - uses driver's SSN. Will assign a nine digit sequential number upon request.

AZ - uses driver's SSN. Will assign a nine digit sequential number upon request.

CA - issues an 8 character alpha-numeric driver's license number.

CO - issues a driver's license number of up to 7 characters.

CT - issues a 9 digit number.

DC - uses driver's SSN.

DE - issues a 1 to 7 digit number sequentially.

FL - issues a 13 character alpha-numeric number.

GA - uses driver's SSN. Will assign a nine digit sequential number upon request.

HI - uses driver's SSN. Will assign a nine digit sequential number upon request.

IA - uses driver's SSN. Will assign a nine digit sequential number upon request.

ID - issues a 9 digit number.

IL - issues a 12 or 13 character alpha-numeric number.

IN - issues a 10 digit number.

KS - uses driver's SSN. Will assign a nine digit sequential number upon request. Older licenses consist of six alpha numeric characters.

KY - uses driver's SSN. Will assign a nine or 10 digit sequential number issued upon request.

LA - issues a 9 digit number.

MA - uses driver's SSN. Will assign a nine digit sequential number upon request.

MD - issues a 13 character alpha-numeric number.

ME - issues a 7 digit numeric number.

MI - issues a 13 character alpha-numeric number.

MN - issues a 13 character alpha-numeric number.

MO - uses driver's SSN. Will assign a sequentially issued number upon request.

MS - uses driver's SSN. Will assign a nine digit sequential number upon request.

MT - uses driver's SSN. Will assign a sequentially issued number upon request.

NC - issues a 7 digit numeric number.

ND - uses driver's SSN. Will assign a sequentially issued number for non-commercial drivers upon request.

NE - issues a 9 character alpha numeric number

NH - issues a 10 character alpha numeric number

NJ - issues a 15 character alpha numeric number

NM - issues a 9 digit numeric number. Older licenses use an 8 digit number

NV - issues a 12 character alpha numeric number

NY - issues a 9 character alpha numeric number

OH - issues a 8 character alpha numeric number

OK - uses driver's SSN. Will assign a nine digit sequential number upon request.

OR - issues a 7 digit numeric number.

PA - issues a 8 digit numeric number.

RI - issues a 7 digit numeric number.

SC - issues a 9 digit numeric number.

SD - uses driver's SSN.

TN - issues an 8 digit numeric number.

TX - issues an 8 digit numeric number.

UT - issues a 4 to 8 digit numeric number.

VA - uses driver's SSN. Will assign a sequentially issued number upon request.

VT - issues an 8 digit numeric number or an 8 character alpha numeric number.

WA - issues a 14 character alpha-numeric number.

WI - issues a 14 character alpha-numeric number.

WV - issues a 7 digit numeric number.

WY - issues a 9 digit numeric number.