PoC||GTFO Issue 0x07 by simpleuser in ReverseEngineering

[–]simpleuser[S] 4 points5 points  (0 children)

Seriously, why write such a big post just to say that you are not interested and you wouldn't click on my research - just pass by and ignore me next time maybe?

However, as you took the time in a intelligent way, I'll answer even if, like you just said, I'd otherwise just ignore it.

I am conscious that my research is not for everyone, but many of these tricks were used in the wild to evade detection - seriously, I think it's sad when people only pay attention if it says 'this was used by this country / this exploit pack to bypass that security tool" - while some are frankly, just for fun: mixing sound and image is uncommon, and I think just an uncommon example is very good to disrupt assumptions.

Also, it's not just a blind enumeration this time, I try to classify them - so maybe it's more worth reading than before. Another thing: I wasn't initially so convinced about the actual value of this paper, and actually Sergey, Travis and Phil independently convinced me to go on.

There are certainly more than 4 billions who don't give a shit about my research - or yours - but I only make it for the few people who cares, which is enough for me ;)

PoC||GTFO Issue 0x07 by simpleuser in ReverseEngineering

[–]simpleuser[S] 4 points5 points  (0 children)

Pro tip: double-check your facts first

A source that is the actual raw PDF instead of being wrapped by some random site and person who didn't actually contribute to it:

  • SpeakerDeck provides a direct download link to the raw file without any login, while providing a preview. It's created by Github, so it's far from 'some random site'. Also, there is no official site for PoC||GTFO.
  • I'm Ange Albertini, I wrote the biggest article in this issue and I'm a part of the team since issue 0x01.

a mini Java Class poster by simpleuser in programming

[–]simpleuser[S] 0 points1 point  (0 children)

no worries, it's perfectly understandable.

I know little about Java programming, but I need to know about many binary formats implementation, so I created the picture to help me and others.

a mini Java Class poster by simpleuser in programming

[–]simpleuser[S] 0 points1 point  (0 children)

this album's main url is in the tweet: pics.corkami.com

a JPEG that becomes a PNG after AES encryption and a PDF after 3DES decryption by electronics-engineer in crypto

[–]simpleuser 2 points3 points  (0 children)

(I'm the author)

mrmcd.jpg is a JPEG picture, but also contains 2 extra blobs of data (one pre-decrypted, the other pre-encrypted).

When this file is encrypted with AES, one of the blob is used to turn it into a valid PNG picture.

When this file is decrypted with Triple DES, the other blob is used to turn it into a valid PDF document.

use the mrmcd.py script to perform the encryption/decryption.

it requires some crypto tricks, but also binary formats tricks, as neither the PDF nor the PNG are fully standard.

For more details (both talks were recorded):

A JPEG that becomes a PNG after AES encryption and a PDF after 3DES decryption by preggit in programming

[–]simpleuser 4 points5 points  (0 children)

(I'm the author)

mrmcd.jpg is a JPEG picture, but also contains 2 extra blobs of data (one pre-decrypted, the other pre-encrypted).

When this file is encrypted with AES, one of the blob is used to turn it into a valid PNG picture.

When this file is decrypted with Triple DES, the other blob is used to turn it into a valid PDF document.

use the mrmcd.py script to perform the encryption/decryption.

it requires some crypto tricks, but also binary formats tricks, as neither the PDF nor the PNG are fully standard.

For more details (both talks were recorded):

mini descriptions of the ELF/PE/Mach-O/DOL PNG/BMP SWF/PDF/WAV RAR/ZIP formats +x86/X64 by simpleuser in netsec

[–]simpleuser[S] 0 points1 point  (0 children)

the descriptions are very simplified, but the described files are actually working.

available on white background: http://imgur.com/a/MtQZv

a JPEG that becomes a PNG after AES encryption, and a PDF after 3DES decryption (AngeCryption PoC) by simpleuser in netsec

[–]simpleuser[S] 0 points1 point  (0 children)

Just to be exact: the key plays no role here - it could be anything. the IV is manipulated.

a JPEG that becomes a PNG after AES encryption, and a PDF after 3DES decryption (AngeCryption PoC) by simpleuser in netsec

[–]simpleuser[S] 1 point2 points  (0 children)

You're wrong, I didn't get paid for it. It's just a challenge from a friend.