eXercise In Messaging and Presence Pwnage - fun with XMPP
Recommend Documents
However in view of the cost of developing fully computerised .... Custom software development was thus commissioned to implement this feature as an add in to ...
Jun 25, 2013 - Asynchronous mobile cloud communication is a two way process which in most cases is managed via REST (from mo- bile to cloud) and push ...
OpenfireEasy step by step guide with ~ 20 images to create your own XMPP Messaging ... connecting15Detailed setup of Ope
Sep 27, 2013 - Facebook â Facebook announced that they would support XMPP for their ..... [6] Using Facebook Chat via Jabber - Facebook Developers Blog.
Sep 27, 2013 - He then waited for his hair to grow back before sending him to. Aristagoras. Through this communication, Histiaeus sparked a revolt against.
the XMPP framework for establishing P2P sessions. ▫ used for VoIP, filesharing,
… ▫ … you might have also heard about this webRTC thing. ▫ doing VoIP in the ...
normally look just like email addresses. Each JID is ... MUST initiate an XML stream by sending an opening
Javascript API in the browser. â« also an ... Uses app engine + jsep style protocol. â« Test it at ... webRTC makes it
The Hype Cycle is a branded graphical presentation developed and used by US Information Technology (IT) research and adv
Page 1 ... free time and play with this environment, and as a by- product of having fun, ... infrastructure of the World Wide Web to post and manage a variety of ...
SIMPLE, JAIN Presence, JAIN Instant Messaging, PAM, JAIN. PAM, etc.). ..... B. Campell, J. Rosenberg, H. Schulzrinne, D. Willis, R. Sparks, C. Huitema, D. Gurle ...
... the apps below to open or edit this item. pdf-1978\mastering-the-xmpp-framework-develop-xmpp- ... ering-ios-framewor
O'Reilly Media, Inc. XMPP: The Definitive Guide, the image of a kanchil mouse
deer on the cover, and related trade dress are trademarks of O'Reilly Media, Inc.
Dec 27, 2014 - Play / Download the Best High-Quality Games | GameHouse. Fun and games definition: You can refer to playf
File: Xmpp pdf. Download now. Click here if your download doesn't start automatically. Whoops! There was a problem loadi
programming skills, that enable them to design, contribute, and refine resources ... A critical issue has been how best to train and motivate students to participate in the .... situations, including word processing [5], desktop operating systems [5]
Amazing Grace TM www.makingmusicfun.net Bible Song for Intermediate Recorder Solo Fun with the Recorder
Oct 2, 2013 ... Walk-a-Thon where the students will be showing their spirit and ... Calling all
ghouls and goblins ... Find your best duds and give us a big smile!
Set up an XMPP Service (northwoodhq.net) on a single-node for 1:1 chat. ◇ ...
You can do this by right-clicking on the program icons and choosing 'Run as.
Jul 14, 2009 - cal Evaluation Tool (HIT) to create and analyse models analytically. Based ... The PFQN is processed by t
and upheld in web-based messaging services such as Facebook Messenger and WhatsApp. The paper examines how users' trust in other people (social trust) ...
Microsoft Windows Mobile Messaging and Applications: Addressing Key
Questions ... of Windows Mobile 5.0 with the Messaging and Security Feature
Pack and ...
... 53117 Bonn, Germany. Email: [email protected] ... ralf/talks.html#T35.) ... Here is a session that illustr
eXercise In Messaging and Presence Pwnage - fun with XMPP
What is XMPP? eXtensible Messaging and Presence Protocol. Formerly the
Jabber project ..... Programming Jabber: Extending XML Messaging. DJ Adams.
.
.
eXercise In Messaging and Presence Pwnage .
.
fun with XMPP
. ..
Ava Latrope
iSEC Partners Defcon 17
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
1 / 32
Introduction
Outline
Outline . . .1 Introduction The basics Common Stanzas . . 2. The victims Clients Servers . . 3. Attack scenarios DoS, DoS, and more DoS XML Parsing File/Image Upload . . 4. Tools Persimmon Proxy XMPP Fuzzer . . 5. Conclusion .
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
2 / 32
Introduction
Who am I?
Who am I?
Security Consultant, iSEC Partners Prior to that, QA automation for various web 2.0 horrors Eats babies
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
3 / 32
Introduction
The basics
What is XMPP?
eXtensible Messaging and Presence Protocol Formerly the Jabber project
Specialized XML-based protocols, used for: content syndication file sharing ...but, well, still mostly IM.
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
4 / 32
Introduction
The basics
Why am I picking on it?
Ubiquity Open standard RFC Process
Many implementation details are at the discretion of the developer ...anyone who’s met a developer should be worried by that sentence
As much fun as you’d expect with regular XML parsing
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
5 / 32
Introduction
The basics
How it works
Decentralized Addressing via JIDs of the format user@server
TLS encryption and SASL authentication HTTP binding XML stream
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
6 / 32
Introduction
The basics
Common Attributes
to - recipient JID from - sender JID id Optional Generated for tracking purposes Scope of uniqueness is flexible
type Specifies purpose of the stanza Each stanza variety has its own list of acceptable types
xml:lang Only affects presentation to humans
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
7 / 32
Introduction
Common Stanzas
Info/Query
Request info/receive response Child element determines data content Requester tracks by id Patterned exchange < i q t y p e = ” r e s u l t ” i d = ” p u r p l e c e 8 3 7 c f a ” to = ” a k l −p c 1 / a c c 4 5 8 8 7 ” >< bind xmlns = ” u r n : i e t f : p a r a m s : x m l : n s : x m p p −bind ” >< j i d > t e s t 2 @ a k l −p c 1 / a c c 4 5 8 8 7 < / j i d >< / bind >< / i q >
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
8 / 32
Introduction
Common Stanzas
Presence
Publish/subscribe Many receive updates from one - ’to’ usually omitted Seen most frequently in IM applications as contact status updates < p r e s e n c e from = ’ t e s t 2 @ a k l −p c 1 / a c c 4 5 8 8 7 ’ to = ’ a v a r i c e @ g m a i l . com ’ > away < / show> < p r i o r i t y >0< / p r i o r i t y > < photo / > < / x> < / presence >
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
9 / 32
Introduction
Common Stanzas
Message Fairly self-explanatory concept so long as you’ve ever, say, used email.
< message t y p e = ’ c h a t ’ i d = ’ p u r p l e c e 8 3 7 d 8 3 ’ to = ’ t e s t 1 @ a k l −p c 1 / f 9 e 5 4 d ’ from = ’ t e s t 2 @ a k l −p c 1 / acc45887 ’ > < composing / > < / x> < a c t i v e xmlns = ’ h t t p : / / j a b b e r . o r g / p r o t o c o l / c h a t s t a t e s ’ / > ?OTR:AAIDAAAAAAEAAAABAAAAwEgF/ 9 5 + kxlcd8Z7I3jdNZtw8d8baZIg5uq0FV3JymhEXf5qJV / 6 P46yjwABFt4UmUqN8BwK7WnWGHlcxsrAvN / FJ4oxS0wLYcKRzI / eZ0edIFyhlyZBT17Ou1V2 +67 nnczJOGRq+ A6wjz0ayoT1iRm1Dx1ZFLvKfRT3uiwbi8AfNG7uCtQAolGKBBp2h7RBVR95NfOrfx8G5Oh6BacdhslcssY0kC3Lwmo29rNOn /GVX+9CY0phs8kT+ O5cLedhjI8y / +udYAAAAA. < / body > < html xmlns = ’ h t t p : / / j a b b e r . o r g / p r o t o c o l / xhtml−im ’ > ?OTR:AAIDAAAAAAEAAAABAAAAwEgF/ 9 5 + kxlcd8Z7I3jdNZtw8d8baZIg5uq0FV3JymhEXf5qJV / 6 P46yjwABFt4UmUqN8BwK7WnWGHlcxsrAvN / FJ4oxS0wLYcKRzI / eZ0edIFyhlyZBT17Ou1V2 +67 nnczJOGRq+ A6wjz0ayoT1iRm1Dx1ZFLvKfRT3uiwbi8AfNG7uCtQAolGKBBp2h7RBVR95NfOrfx8G5Oh6BacdhslcssY0kC3Lwmo29rNOn /GVX+9CY0phs8kT+ O5cLedhjI8y / +udYAAAAA. < / body > < / html > < / message >
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
10 / 32
The victims
Clients
Pidgin
The IM client formerly known as Gaim Needed something based on libpurple Obvious choice with 3 Million users ...especially since it’s my default File transfers XMPP console http://www.pidgin.im/
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
11 / 32
The victims
Clients
Spark
Complement to openfire server Voice integration Representative of no-frills clients http://www.igniterealtime.org/projects/spark/index.jsp
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
12 / 32
The victims
Clients
Gajim
GTK+ File transfer Multi-protocol transports http://www.gajim.org/
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
13 / 32
The victims
Clients
Gtalk
Skynet Google’s pet XMPP project Jingle Mobile versions Offline Messaging http://www.google.com/talk/
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
14 / 32
The victims
Servers
Openfire
Formerly known as Wildfire Popular on corporate networks User-friendly, easy to configure Admin web interface http://www.igniterealtime.org/projects/openfire/
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
15 / 32
The victims
Servers
JabberD14
Modular, certain features can be installed independently Written in C/C++ Complex configuration requires messing directly with XML Waning in popularity http://jabberd.org/
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
16 / 32
The victims
Servers
JabberD2
Different codebase from JabberD14 Appear to have kept the project name just to be confusing Main distinction seems to be that they’re compliant with more RFCs than the original http://codex.xiaoka.com/wiki/jabberd2:start
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
17 / 32
Attack scenarios
DoS, DoS, and more DoS
DoS
Excessive presence traffic makes for high overhead Endemic scalability issues in XMPP Parser errors tend to be ungraceful
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
18 / 32
Attack scenarios
DoS, DoS, and more DoS
DoS Demo
[DoS demo goes here]
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
19 / 32
Attack scenarios
XML Parsing
XML Parsing
Stanza-specific requirements Control characters Affects on DoS
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
20 / 32
Attack scenarios
XML Parsing
XML Parsing Demo
[XML parsing demo goes here]
.
Ava Latrope (iSEC Partners)
eXercise In Messaging and Presence Pwnage
.
.
.
.
Defcon 17
.
21 / 32
Attack scenarios
File/Image Upload
File/Image Upload
No restrictions on file type Relatively new to most feature sets Image insertion
