Hello, everyone. I hope you're having a fantastic conference. I wish I could be there with you. Yeah, so I think I'll just start because we have a lot to talk about. So today I'm going to talk about writing secure coding Python. Let me start doing a quick introduction. I just want to explain what is my motivation behind the stock. So I'm sure everyone who's worked with Python or even just messed with the language a bit has heard this before that programming in Python is easy. And this is something I don't disagree. I think it's one of the core strengths of the language. But I believe people sometimes can seem to understand that it's really easy to create a Python program that runs that successfully executes. It's not always so trivial to write a quality code that is both Pythonic and secure. So today, of course, I'm going to focus on the security side because over the years working as a Python developer, I got the chance to see a few patterns with Python code that sometimes we as developers don't think too much about and may end up becoming a security risk and our security vulnerability. So I basically made a list of things that and that is what I'm going to show you today. Some topics are a bit obvious or may seem a bit obvious to those of you who are more experienced. But overall, we got lots of cool things to talk about today. So let's start. The first thing I want to talk about is the function, is about the function evo. So the topic is evo is really dangerous. So let's start. For those who aren't familiar, evo, which is short for evaluate, is a built-in function that evaluates a Python expression and returns its result. So I added a few examples on the side of how the function can be used. And the first two examples are simple mathematical expressions. But in the third example, we can see that with evo, we have access to building functions like some. And in the last example, we see that with evo, we can even access, declare variables outside of evo. So I declare the variable X, and I can access this variable inside of evo. The function can receive two optional parameters, which are globals and locals. They're basically dictionaries that define what would be the global variables and the local variables available from evo. And yeah, we're going to use these parameters. You'll see how. So the danger with this function begins with, well, if a user tries to run a malicious code, a malicious expression, such as this simple expression to remove all the files from the computer using os.system. And yeah, evo evaluates this expression and executes this code. But considering we can control the global variables with the globals parameter, maybe we can manage to securely run this function. If we try to pass an empty dictionary as the globals argument, well, that will work. So we'll get a name error because os is not defined anymore because we cleared the global variables and os was a global variable. But the problem is Python automatically inserts buildings when we don't, when we use, even when we use an empty dictionary as the globals argument. So yeah, we don't have access to the imported os module, but we can import it ourselves using the port built-in function. But then again, we can control the globals so we can specifically clean the buildings. Maybe then we can create a kind of secure evo. And yeah, that again, we work if we, instead of passing an empty dictionary as the globals variable, we pass a dictionary with the, then the built-ins key set to an empty dictionary. Then we are clearing the built-in variables that Python automatically inserts. And then the dunder import function is not available anymore. But maybe we can work it out some way because yeah, we can, we don't have any built-in and we don't have any global variables. But we still can create Python objects using the literal form. So I can create, for example, a tuple using instantiating the class tuple, but I can create a tuple using the literal form, which is the parenthesis, opening, closing the parenthesis, which creates a tuple. So okay, what if I create a tuple with the literal form and access the dunder class attribute? Well, then I got the class tuple. And if I access the dunder base attribute, I got the object class. And we know that everything in Python is an object. So if we call the subclasses method, the dunder subclasses method from the object class, we basically get all loaded classes in our program. And right now we're looking for a specific class that is the built-in importer, because with this class we can import whatever we want. So basically what we need to do is iterate through these subclasses, these object subclasses, look for the one that is called built-in importer and instantiate it and call the its method loadMapModule and then we can import the OSModule and call the system function with the malicious code. But we need to do that in one line, because we're calling in from inside the evolve function. And yeah, the conclusion is, if always really dangerous, we can really create a secure evolve. We can basically do that payload with a least comprehension. This code is from netsec.expert. You can check them all later. It's a good source. And yeah, so what are our alternatives since we can use, or we shouldn't use the evolve function? Well, we have the literal evolve from the AST module and with this function we can basically create a Python object, but only using its literal form. So I have these examples here. So we can create any kind of number. We can create a tuple with different kinds of objects inside. But we can really evaluate an expression. For example, we can do a mathematical expression such as one plus one. It will not run. It's going to be a value error. And if we need something more complex, we can try to parse the string ourselves and implement the code ourselves, which will be of course more secure. So basically, when should we use the evolve? So we have this function available as a built-in and when should we use it? And my answer to this is we should use the evolve. Basically, when there is no other viable way to accomplish a task. And well, when we work with Python for long enough, you realize that this mean basically never, you should never use evolve. There is no really useful, yeah, it's not useful enough to have the security risk. Okay, so let's jump into topic two, which is about arbitrary code execution with Pico. As I said, we have many topics. They're quite different from each other. But yeah, so let's jump into it to manage in time. Okay, so about the Pico module. The Pico module is a way in Python to store a Python object. We serialize this Python object to a sequence of bytes and we can load this object, this serialized object later if we need the object. So we basically do that with the dump function. So we serialize an object with the dump function and we load it when we need to load it using the load function. So on the right I have an example of that. I serialize a set of numbers and I save it to a file and then I load it from this file. So the file is a binary file. I load these bytes and they are deserialized to our Python object, which is the set of numbers. And again, with this function, with the dump function, we have optional parameters we can use. So we have this protocol argument, which is an integer, denoting what protocol is going to be used for the serialization. And we currently have five options for protocols that go from zero, which is the oldest one, and it's basically the human readable one, to five, which is the newest, which is available since Python 3.8. Okay, so what if we need to customize how a class is serialized? Python usually knows how to serialize all kinds of objects, but if we need to customize how a class instance, how an object is going to be serialized, we can do that using this magic method and the reduce. So this method should return a string or a tuple containing a callable and its parameters. And we are going to focus on this second option, which is a tuple containing a callable and its parameters. Yeah, so, okay, so we can create here a class called X, Y, Pico, which implements the done the reduce method. And I'm returning the first, the callable, which is the OS.system, which I'm using as an example. And I'm returning what arguments should be passed to this callable, which is the RMRF code to delete all the files. So yeah, okay, we can serialize it normally. It's going to be serialized to bytes, but when it loaded, if we recall Pico.loads to load the bytes and deserialize it to a Python object, then this is going to run. And if the interpreter has the right permissions, it's going to delete all the files. So this coding side reduce is going to be executed. We can use PicoTools, which is another module available from the standard library, to basically read the Pico and understand what it's doing behind the scenes. So let's just understand what, how can we read a Pico files to maybe create a more complex one? Okay, so using the PicoTools.this function, we can read the row Pico and I'm going to basically go through the Pico code. So the Pico starts with the C character. The C character is used to import, basically import a function. So we have the C character, followed by POSIX, which is the module, align break and system. So to import a function from a module, we have C, the name of the module, align break. So now it's not the main name of the module, it's the name of the function, system. So we're basically calling this function. We're importing this function to our code. Then we have this open parameter. So here when it says 14, the line 14, the column 14, sorry, it's a mark. So it is the argument mark. So we start to provide what arguments are going to be passed to this function we just imported. So the first argument, which is the only argument, is a unique string. And to denote a unique string, we use the uppercase v character and followed by the string itself. So in this case, the string itself is the RMRF code to delete all the files. We then basically close the parameter. So in column 14, we open the list of parameters. And in line 24, we use the T character to close the parameter. So the only parameter we're passing to the function we imported is the unique string RMRF. Then in column 25, we have the uppercase r, which is the reduce itself, which then executes the function with the provided parameters we specified. And on column 26, we have the dot, which is analyzing that the pickle ended. So that's basically what this pickle means. And with that, we're going to try to execute arbitrary code because in the example I showed before, we had a simple OS dot system call. But what if you want to really run any kind of code like a reverse shell? So we have a function here for a reverse shell. We have this import inside the function to... Well, because we want all the necessary code to be inside one function. So this is basically a reverse shell. So the attacker can control the victim's shell from their computer. How can we run this arbitrary code with pickle? Okay, so first we need to serialize this code. Problem is pickle can really serialize code. So we have to use Marshall, which is another module inside the Python Central Library to serialize the code. And yeah, we have the dump and dumps and load and loads functions as we have in pickle, we have in Marshall. And we can serialize the function with Marshall.dump and we will then have the sequence of bytes. And we can just make more readable. We can encode with base64. And then we'll have base64 string, which is basically the code of the function. And if we need to run the function again, we then just reverse the process. We decode with base64. We load with Marshall. And then we need to instantiate it with the function type class to... Yeah, just providing the result of Marshall loads. And then we can call the function as if we implemented the function in the code. So okay, let's create the malicious pickle. I just explained how the pickle works. So let's go through it. We have the C denoting we are importing a function. So it's from model types. It's the function, function type. Why we're importing the function type first, because the function type is what calls the... We want the result of the function type. We want to run the function type result. So inside the function type, what are going to be its arguments? So here we have the D on the right. When we have the column 20, we have the mark to open the parameters. And in column 21, we have another import, which is the Marshall loads. We then have on column 36 another mark for parameters, but then for the Marshall loads function. And for this parameter, we have another import, which is the B64 decode from base 64. And then for B64 decode, we have another parameter in column 55. And now we're not going to import anything more. We're just going to pass the value, which is a new code string. So in column 56, we have the uppercase V denoting a new code string, which is our base 64 encoded function. We then have on column 81 the T to close the arguments to B64 decode. In column 82, we have the uppercase R to execute the B64 decode. In line 83, we have the T to close the argument for Marshall loads. And in column 84, we execute the Marshall loads. And then in column 85... Oh, I'm sorry. I said we didn't have any more import, but we have the building globals import, because as I showed in the previous slide, we have to use for in the function type, we have to pass the globals. So yeah, we use the globals to pass as the second parameter for the function type. The globals is a function. So we have to call the... We have in column 106 and 107, just an empty list of arguments. We then use on column 108 the uppercase R to call the globals. And okay, on line 111, we close the parameters for the function type. And no, I'm sorry. You close the parameter for the Marshall loads. Yeah, I got lost. But in the end, we're in line 115. We execute the function type. And on line 116, we stop the code. So yeah, we have our malicious pickle. And I got a small demonstration to give just to show it how it would work on the right. We have the server code executed and waiting for the connection. And in the left, we are going to open the malicious pickle. And yes, when it loads the pickle, then the reverse shell is connected. And we can execute any comment we want from the server. And okay, how can we prevent that? Well, we can prevent that by signing the pickle with a cryptographically secure hash like HMAC. So here we are creating a digest for the pickle with HMAC on the left. And if we save this digest, we can check when we want to load if the digest is the same. And then if it's the same, then we can trust it. We know it's secure. And we can, we also have alternatives. So instead of using pickle for storing objects, we can maybe use a safer serialization format like JSON, which is really, really simple. Yeah, I have an example here, which is just a string. Yeah, okay, so let's go to our third topic. I'm going to try to be a little fast because we have still a few things to talk about. And now we're going to talk about the power of the peeping stall command. So first we have to understand what happens when we run peeping stall. So I basically divided into four things that happen. It's more complicated than that. But basically, first we have the identification of base requirements and the given parameters. Then we have the resolution of dependencies and the determination of what will be installed. And the third thing that happens is the determination of the installation method. Then after determining what installation method it will use, the package is installed. We're focusing on the third thing which is the determination of installation method. And again, I simplified what really happens. But basically the logic is if a wheel is available, if we have a wheel in the repository to download, people will download the wheel and install from it. If the wheel is not available it will download the package source code. And if it's possible to build the wheel from the source code it will build the wheel and install from it. If it's not possible it will install from setup.py. And this we're going to focus again if the wheel is not available. So if the person who uploaded the package to IPI didn't upload a wheel binary. So when people download the package source code and try to build the wheel or tries to install from setup.py in both cases it will run setup.py. And the thing with setup.py is we're basically having a dynamic metadata. So here is an example of a setup.py file which just reads along description from a readme file and calls the setup function. But, well, it's Python code so we can have things a bit more complex than that. And in the right I just put the comments that would be called so to install the package we would have setup.py installed and to create the wheel we would have setup.py with this wheel. And yeah, so we have the setup.py to create dynamic metadata and how can we execute arbitrary code in the package installation is by, well, just adding code to the file. It's a Python file so we can add the code we want. So I'm adding the same code of the reverse how I showed before. The only difference here is instead of subprocess.run instead of this function we're using subprocess.popen because we want to create a separate process instead of using the same process so that the installation does then freezes and the user will know it freezes. And again, I have a demonstration. We have the server on the right and we're installing the malicious 0.py which is something I uploaded to PyPI and deleted. You can't install it anymore but if you install it it's going to execute the setup.py because I didn't put a wheel. And yeah, we're going to have the reverse shell again. And what is the real-life risk of this? Because you can think that you're not going to install any package you don't know. You're just using standard packages like Django, like Request. But we have a real problem which is typosquadding. So let's say I'm trying to install the Request package and I mistype and type this Request wrong and someone uploaded a malicious package to PyPI with Request spelled wrong and then the code will be executed because of that. And this is a real problem. So in 2021 we had almost 4,000 libraries which got deleted from PyPI because of this because they were malicious. And here on the right upside we have statistics from 2017. So from people trying to install packages that are available from the standard libraries such as JSON, OS, CIS, Platform. So someone uploaded these packages to the PyPI and this can be malicious packages. So if a beginner user, I don't see an example that uses JSON and thinks, oh, I need to install it. They're trying to install it but they're installing the malicious package. And well, another risk is if we use the extra index URL flag because with this flag we can basically use another repository instead of the standard PyPI. And I don't have time to go deep into it but I added a medium article that basically is a guy that made a lot of money by basically doing this. So okay, how can we prevent this? We can use the only binary flag with PyPI installed to only download if we have the wheel. And we can require hashes, use the require hashes flag to verify the hash sum to know we were downloading the right thing. And well, we should never download a package as pseudo or as admin because if you for some reason install a malicious package you'll have the admin permission and can really do some damage. Okay, so let's go to the fourth topic which is about outdated dependencies. Okay, so basically vulnerabilities are found all the time. I have here a screenshot from the, I think it's the latest or no, I think right now we have the 407 but on Django release 406 we fixed a security issue which is a potential SQL injection. And yeah, this happens all the time. Everyone is always finding new vulnerabilities and fixing these vulnerabilities. So it's important to keep up with the releases of the packages we use and it's good if we can keep up with the CVE vulnerabilities list and so we know what are the, I don't know, zero-day vulnerabilities found. Yeah, the fifth topic I want to talk about is basically continuation from the, what I just talked, but it is specific to Python. So outdated Python. And again, vulnerabilities are found all the time. This is a list of some of the vulnerabilities found in Python and when were they disclosure? Yeah, and these are currently unfixed vulnerabilities. So are vulnerabilities that still exist and it's important to understand the status of the Python versions. So we don't end up using an unsupported Python version. So we have this available in the docs. So we know, well, when will this version of Python I'm using stops being, stop having security updates. So right now we have the, from 3.7 that is having security updates to 3.11 which is having bug fixes and 3.6 from, and before it got to the end of life. So we don't have even security updates. So if you find a security bug and we'll fix it for the 3.7 onward but we won't fix for the 3.6 and well, this is going to continue one day we won't update the security bugs from 3.7 and yeah, that goes on. Also you should be cautious with deprecated functions. So if you search the docs you'll find some deprecated functions. I added an example in the temp file module with the make temp function which is obsolete. You shouldn't use it anymore because it can't introduce a security hole because of the race condition that can happen. We have better functions to do what this function used to do. But the functions still exist. So if I, if you call the function it will work. So yeah, you should be cautious with functions that are deprecated. You should look into it. The sixth topic is about solo randomness. So the problem with randomness. I saw this tweet a while ago. I'm not going to show the user. I think it's deleted tweet now. But it was a tweet talking about how to create a secure password generator in four simple lines of Python code. And this is the code. So it's, we have a list of characters, a sequence of characters to choose. We import the rendering and the choice from random, from the random module. And we use the random choice to create the password. This is the code this person presented as secure. And this is a problem because of the random module and the, what I call the infamous seat and the problem with the random module is basically almost all the functions in the random module use a seat. So we can determine what the seat will be with the seat function. So here in line four, I call random dot seat with the seat error Python. And well, when we generate the password with the same method that the person generated, we will always end up with this result. So if you get your computer right now and run this code, even using the random module, which should be random or you think that it's random, it will always end up with the same result because of the seat. So we have lots of alternatives to generate secure passwords or stuff like that. So we have the proper secrets module, which is great. It's simple to use. We have the same functions that the random module has. So on the right, the first example I show is the token acts, which we can create a token and we determine the number of bytes. We then use the secret dot choice to basically do the same thing we, the person was doing, but in a secure way because we're using secrets. So it's not by this predefined seat. We can use the U random function from the OS module, which would be a little bit more complicated, but we can do that. And there is one class in the random module that is secure, which is the system random. It is the only class that uses a cryptographically secure generator, random generator, random number generator. It is this system random class. So the last example on the right is using the system random class to generate the password. Okay. The seventh topic I want to talk about is about bomb files. So yeah, watch out for bomb files. We have... Yeah, we're running out of time. We have five minutes left. Okay. I'm going to speed up to end up in this section. So we have the, we don't have to tag or XML functions are vulnerable to that. We can use the diffuse XML package to secure that. We have a problem also with tar bombs. If we don't expect the tar file we are extracting, we can end up with this path traversal problem. We can prevent this by inspecting the files. Sorry, I'm too speeded this up. So the last thing is about the assert keyword. So what is the purpose of assert? We're using assert now for testing with pytest and stuff like that. But we basically check if a condition is true. And if it's not true, we have assertion error. And people sometimes try to save a line with assert. So we have these two codes in the left. I raise the value error if the password is not what the predefined password was. And in the right, I use the search for this. But the problem is this are not equivalent. Because assert actually checks for the debug constant. And this debug constant is set by the old flag. So if we pass the old flag, it's the optimized flag. Then the debug will be false. And the assert will have no effect. So we shouldn't use assert in our code. I just want to talk about auditing our code. So we have lots of options, lots of programs to audit our code and to check for security vulnerabilities in our code. The one I'm showing an example is Bandit. It's really simple to use. So in this example, it's showing that the code have the random number generator problem I talked before. And yeah, that's it. So just to finish the talk, I want to tell five key points to never forget. So if you want to learn something from this talk, just remember these five points. The first one is to never trust user input. So basically, I think three topics I talk about. The E4-1, the people installing the decode, it's basically about user input. The second point is avoid running Python code as pseudo or admin so we can diminish the damages. Keep your system up to date and your package is up to date. So we have the fixes for the security vulnerabilities that can happen. Read the docs. So I know the docs are not always the most friendly way to learn something, but in the docs, we will have the warnings for dangerous modules. We have the warnings for the targeted functions. And this is why I think it's important to sometimes read the docs and use a static code analysis tool such as Bandit or you have many options to analyze the code and search for security vulnerabilities. And that's it. I think I managed to finish on time. Thank you. And this is my contact information. And yeah, that's it. Thank you, guys. I think we have time for one or two questions. Is there anyone in the audience would like to ask a question if you could use the mic, please? Do we have any remote questions? No. Well, again, thank you, Jan. Another round of applause for Jan, please.


Hello, welcome to NPTEL NOC, an introductory course on points of topology part 2. So we will begin with a new chapter, Metrization. The problem of when an arbitrary topology comes from a metric, probably known as Metrization Theorem. Let us start from the theoretical importance of this question, it is solution play a solutions message, there are many solutions, play a very important role in our understanding of the logical space in general, in this chapter we shall focus on two such solutions, one is Eurydense Metrization, other one is Nagata Smirno Metrization, the same kind of result was proved separately by Nagata as well as Smirno. So here in the Nagata Smirno Metrization, Paracompactness enters into picture, namely with its property of admitting sigma locally finite refinements for every open cover. So we are going to present the proof due to Nagata, for Smirno's proof you can see in the book of Willard for example. So let us make a formal definition, take a topological space, then it is called Metrizable topological space, if there exists a metric on the underlying set X, with the family of all open balls forming a base for tau. In other words some open set is open, if in only for each point inside U, you have an open ball corresponding to the metric contained inside the open set U, contained inside given set U, then only you will get a U as a open set, that is the topology induced by the metric, if that coincides with tau, we will say tau is Metrizable, the difference between a metric space and a Metrizable space is that on a metric space, a metric has been chosen, whereas on a Metrizable space only the topology is chosen and it is possible to choose a metric which gives this particular topology, in fact there may be several topology, several metrics which use the same topology, but we will be interested only in study of the topology there, starting with a topological space, we naturally ask a question when it is Metrizable, any answer to this should be purely in terms of the topological properties, terms of that there are number of very useful answers to this question, rather than some useful characterization which may be used as characterization, often characterization can be merely topologies, that is why if this happens then I am sure kind of theorems are more valuable than if and only if theorems, if and only if part may be as difficult as finding the original you know satisfying the original condition, if not always the case several characterization always help you to find things also in a easy way, so that is not a global remark anyway, so we shall study only two such results here, one is Regions Metrization and the other one is Nagata Smirno as I have told you earlier, so today in module 26 let us concentrate on Regions Metrization theorem, to begin with we have this theorem about product which will be used in the proof of this theorem, Regions Metrization, what is it, take a countable family of metrizable spaces, this countable family is important finite is included of course, then the product is metrizable with the product biology here, whenever you take a product the first thing you do is take product biology, so how do we do that, to begin with you can choose any metric on Xn, there is one which gives you the corresponding tau n, whatever origin, but then I would like to choose it carefully by choosing it to be bounded by some number that you have that you know how to do that, namely if D is a metric you can define capital D as this minimum of distance xy or r for every xy, where r is any fixed number in particular for D and I will do the same thing with taking r equal to 1 by n square, maybe 1 by n will also do something some control for each n you know as the control should be becoming stronger and stronger that is all I need here, so you can take 2 power n also for example, 1 divided by 2 power n also, now once you have chosen that, now for each xn and yn, x and yn inside product space, x and yn are now sequences you can think of that one, we define delta of xy, so this is going to be a metric on the product by just taking the sum of Dn xn yn, so when I take this sum you should know that this is convergent otherwise this would not make sense as an element of r and that is precisely the role of this choosing these nth metric Dn is bounded by 1 by n square, so each element here Dn will be less than or equal to 1 by n square, therefore the sum total less than or equal to sum total 1 by n square which is convergent, so therefore this as a real number it makes sense no problem, moreover I want to claim that this delta is going to be a metric now, so first of all suppose Dx y is 0 that means you get this summation, this summation is sum of all non-negative numbers right, so if the total is 0 each of them must be 0, Dn of xn yn is 0, Dn's are metric therefore xn equal to yn for every n which means x and y are the same element, of course if you look at this one if you interchange xn yn this value does not change because Dn is symmetric therefore delta xy is same thing as delta of yx, the triangle inequality is also valid because each xn yn zn distance between Dn xn yn plus Dn xn yn zn is less than or equal to Dn xn zn okay, so it can take sum that will give you delta xy plus delta yz is less than delta xz is less than or equal to delta xy plus delta yz, so that is also easily valid okay, so what remains is why this metric gives you the topology that we have already chosen namely product topology, giving a metric is not at all difficult there are so many metric you know you can just take a discrete metric also and so on, so now the topology should be the same that is our thing okay, one thing is sure such things we have verified if this family is finite then we know that sum of the metrics is a metric okay, so that is the way we have become bold enough here to do this one and our boldness space here okay, so let epsilon positive be any nx belong to product of xn be any point, first choose a k such that summation 1 by n square after you know n after k bigger than k this is less than epsilon by 2, so this is the remainder term after n after k terms here okay that should be less than epsilon by 2, so I can choose given epsilon can choose k because summation n square is convergent, so now choose r positive such that this 1 by n square k1 to k the first k terms okay that sum into r is less than epsilon by 2, so this may be too large multiply by r such that it becomes less than epsilon by 2 r shall be told okay, so first k terms are controlled by this r, the remaining terms are already controlled here because we have chosen k in that way, so that is the whole idea. Now consider bn set of all yn belong into xn such that distance between xn and yn is less than r by corresponding n square, so this is an open ball inside xn centered around xn little xn okay, now take you to be product of inside product xn or y inside the product space such that yn is inside bn only for 1 less than or n less than or k the rest of the ends there is no condition, so that is a basic open subset see why each bn is an open subset in xn, so this will be a basic open subset in the product apology because conditions are only finitely many here the rest of them y could be anything right yn could be anything, so take you to be such an f after choosing bn like this take you to be this one clearly it follows that x is inside that one because the first x1, x2, xn are inside corresponding bn b1, b2, bn the rest of them there is no condition, so x must be inside u that is no clear that is clear and u is open also clear okay, also if y is inside u what happens the first n term yn and xn is less than less than r by n square right, so for first n to k equal to 1 to k each of term is correspondingly 1 by 1 square 1 by 2 square 1 by 1 by n square I have taken but r is common r times that one, so r is common it is summation 1 to k 1 by n square right the rest of them because k is bigger 1 by n square itself is less than epsilon by 2 this is less than epsilon by 2 so this whole thing okay r by n square has been chosen for that reason that means what distance between any point y and x is less than epsilon means the open ball of radius u is contained is a b epsilon of x for every x it happens right for every y axis inside u then for every y this happens so u is contains a b epsilon this means every open ball in the metric topology is open in the product ball okay, so therefore the metric topology is finer than the product topology so all the open balls here are contained inside that one so for each point so these are open subsets of open subsets in the product topology okay, now to show that an open set in the product topology is open in the metric topology we shall show that this curly m is the metric topology this is the product topology okay suppose I show this is continuous what does that mean take any open set in the product topology this identity map okay so it is open here okay just now we have shown metric topology metric is open here so I have to show that this identity map is continuous this way this way we have already shown that would mean that identity map is a homomorphism which is same here m is equal to tau okay, so how to show this is continuous any map into the product space is continuous if and only if all the coordinate projections of that map are continuous so take projection map pi n from xn to xn product of xn to xn composite with the identity it is just again product only what I get is I have to show that product xn with metric topology to xn with the usual topology whatever topology it comes this is continuous okay so that is what I have to show then this identity map will be continuous since both are metric space is now xn I have chosen metric right such that this topology is given by the metric here I have given already metric and I am looking at the metric topology so both are metric spaces this can be easily checked by sequential continuity suppose is x upper m is a sequence in the product space which converges to x upper 0 that is also an element in the product space what does that mean we must show that every projection map okay xmk or xmn you can put xmk to x0k they are you know convergent xmk is convergent to x0k that is what I would show sequential continuity is enough okay but what is the meaning of this one in the product suppose this sequence converges to this one what is the meaning of this delta xmx upper m to x0 0 can be made to x0 0 can be made less than some epsilon given epsilon all right the delta is here where I have defined this this function okay once that is the k this is sum of positive term non negative term each term will be less than epsilon right so fix one k here that will be less than epsilon something each term will be less than therefore sequence converges to a point in the product here implies each coordinate converges there that is because of our choice of the product metric here so what we have proved here is that countable product of metric spaces is matrizable countable product matrizable space is matrizable okay now every subspace of metric space is matrizable there is no problem right you have seen this one in the in first part itself okay you can take the restricted metric that will give you restricted ball that is from the above theorem it follows that if you take 0 1 raise to a countable product 0 1 raise to this natural number a countable product of copies of the closed interval 0 1 that is matrizable okay in general I can call it Hilbert cube when I am talking about a set topological space there is no problem as a metric space you will have to see what metric you give right here I am taking only product topology it can be given the metric quite often people call it Hilbert cube only after choosing a metric so that is that is why I have said it is matrizable thus we would like to embed a given metric space in a Hilbert cube then it will follow that metric space is also that topological space is also matrizable okay thus it remains to find out which are the spaces that can be embedded in a Hilbert cube okay a topological space is embeddable in a Hilbert cube if and only if it is a second countable T3 space in particular a second countable T3 space is matrizable so this is the final theorem of Eurydense matrization okay what we are going to do we take Hilbert we take second countable T3 space regular and T1 okay we will show that it can be embedded in the Hilbert cube in fact what it says is if you have a subspace of Hilbert cube it has to be second countable T3 space if and only there is no other choice so Eurydense matrization theorem is only if part in the sense that there may be many other metric spaces which are not necessarily second countable right it does not answer those things right so it is only a partial answer but it is a very useful theorem okay proof is very easy now see i power n is compact and every subspace you know of a compact metric space is second countable therefore the necessary condition necessity of the condition in the statement theorem follows okay so subspace compact metric space is T4 also T in fact T5 also so it will be automatic subspace is T3 so T3 has to be there also now conversely let xp a second countable T3 space we have proved earlier that a regular Lindelow space is normal okay second countable implies Lindelow T3 includes regularity therefore our space is automatically normal to show that it is embeddable in i power n we will use Ticknoff's embedding theorem okay so 5.19 it is sufficient to find a countable family of continuous functions from x to 0, 1 which separates points and closed sets if it separates points the corresponding embedding will be corresponding function that we are showing it will be injective if separates closed sets and points it will be open mapping or a closed mapping that is why it is it is embeddable that is how we have proved it so we will only prove this part now that there is a countable family of continuous functions which separates points as well as closed sets automatically separate points because points are closed in our x because x is also the host of space also T1 space also so begin with a countable base B for x it is countable family is now coming because of the second countability of x so start with a countable base for the topology of x okay put f equal to curly f equal to ordered these pairs u comma v inside B cross B such that u bar is contained inside B okay so this kind of things will make sense because of the regularity otherwise such things may be empty that should not happen then this is there are plenty of this capital curly f there are plenty of them nevertheless it is a countable family because B cross B is countable so it is a sub family so it is countable family now for each member u comma v of f let f u comma v from x to 0 1 be such that this f u v suffix here operating upon u bar is singleton 0 operating upon x minus v is singleton 1 so this is where we have used normality you see u bar is closed x minus v is closed they are disjoint because u bar is contained inside B okay for each pair u v you have an f u v which take u bar to 0 and x minus v to 1 this family f u v as u v varies over f is required family that we have to show that it separates points and close subsets given a closed set f and a point outside it we can first find a v belonging to B in the base right such that x is inside v contained inside x minus f x belongs to x minus f and x minus f is open okay f is closed therefore you can find a basic element v x belongs to be contained in x minus f okay then we can find u again inside B such that x is inside u contained inside u bar contained inside B because regularity of x now what we have what is this u comma v is a member of here it follows that corresponding f u v separates x from f over right because the whole of u bar goes to 0 for x goes to 0 and they are complement x minus v goes to 1 and x minus v contains f okay so so our theorem Urizon's matrization theorem is over okay basically because we have already done Tikhonov's theorem and then we just finished the product theorem product of matrizable spaces is countable product of matrizable spaces matrizable so this is the way to remember okay Tikhonov's immunity theorem and this product metric for countable product metric Urizon's theorem so let us do next time thank you.


Hi, everyone. Welcome to Man in the Middle Made Easy. Today we're going to be talking to you about the sub-refuge attack framework. First, we're going to go into a little bit about what each of us did in this project. My name is Chris Shields, and I worked on a lot of the ARP attack tools and just the custom attack tools. A good chunk of my work was actually done debugging and ensuring that our new tool actually worked effectively against as many devices as possible. Besides that, I wrote my tools in Python and was often integrating Linux operating system command output using regex as back into our tool. Other than that, I kind of did the project management side of the house. So in terms of the direction, the priorities for the project, and just Google code site updating the issues and making sure that our latest ideas were up there. Right. So I'm Matt Toussaint. I did a little bit of the interface design and development, so you have me to blame for all the interface problems you're going to have. It's also a web front end, so I did a lot of work on making sure we had browser compatibility, making sure it worked well on both Firefox, Google Chrome, Safari, and I'm sorry for all you Internet Explorer users out there, but you're on your own. I'm also to blame for all the framework development, so all the pooling things together and making it something that's extensible, really easy to use and really easy to put different places. Right. So this is a quick overview of what we're going to talk about. I know a lot of you already know mandeminal attacks, especially ARP cache poisoning, which we're going to focus on a little bit. We're just going to do a really brief overview, so for those of you who don't know, you can fill in the blanks, for those of you who do know, maybe a little bit of a refresher, then we're going to get started on the framework. We're actually going to talk a little bit about how Sudderfuge splits off a mandeminal attack into two big different parts, a little bit of a dichotomy of the attack, the getting man in the middle portion, and then the actually leveraging that position to do something worthwhile. And Sudderfuge abstracts those. Then we're going to do a little bit of demonstration, jump right in, give a little example of how it works, how easy it is to use it, and then we're also going to talk a little bit about countermeasures. So now that you know how dangerous the network is and how easy it is for really anybody to do it, a little couple ways to look out, to know when you're being exploited and to keep yourself from being owned. Then we're going to talk a little bit about future work, just because Sudderfuge is still a live project, it's still in beta right now, and where we're going to extend it in the future and what it's going to really become. So before we go into the talk about the basic man in the middle attack process, we just want you to keep in mind that we are talking about arping and not larping. So anyway, here we have the anatomy of the attack. We have, this is a basic network poison diagram, and so the clients on the right hand side, they're the users, soon to be victims. They're sitting there, they're doing whatever they're doing on the network, and in comes an attacker. He happens to be using Sudderfuge. Now as soon as he activates Sudderfuge, using the ARP vulnerability that we're going to talk about, it pretty much gets on the network and it tells all the different devices, hey, I'm the router, so you can send all of your stuff to me now. And due to the inherently trusting nature of the ARP protocol, everyone says, sure, okay, why not? You're a good guy, right? And so that's where the problem all starts.  You can sit and monitor traffic, you can see credentials as they're going through. You can actually modify and slap on some extra funness on their information as it's going from the actual legitimate source to the end user.  So as you can see, it's a pretty devastating position to be in. And this is the vulnerability which has been out there for quite a long time now. We're going to go kind of high speed at this because it's not a new attack and we don't want to bore anyone who really knows about ARP. But this is an example of a poison packet that Subrefuge sends out. So at the top arrow where it says broadcast, it's being sent to the broadcast MAC address. So that's just saying every single device in the network is going to receive this packet. Then below that is the attacker's MAC address. Now below in the address resolution protocol, the ARP reply area, you can see that the router's IP address is actually spoofed in here. So this is where the magic is. This packet's going to go out and say, hey, I'm really from the router, but this is my MAC address. So it actually updates all of the ARP tables on the victim's client machines and says that the attacking machine is now the router. So the problem is when ARP goes to broadcast, everybody on there, so all the computers connected to the network are going to see that packet and go, oh, this is for me. It's an ARP packet and it says, hey, here's the MAC address to the router. And since I want internet, I'm going to go ahead and update my table so that I can continue to have internet. The problem is that there's really no accountability and we just automatically trust ARP, which as we all know is not necessarily a good thing to do anything. Right. So moving on, as you can see here, we've got a Windows 7 machine just displaying its ARP tables. And we've got the same MAC address that's associated with two different IP addresses. And that's because that ARP packet got sent out. This Windows 7 machine adjusted its ARP table and now it's routing any traffic to either those IP addresses to the same MAC address, which is the hackers computer. Beneath that, we've got a trace route from a MAC OSX Lion machine. And as you can see, it's now routing its traffic through the hackers machine, <IP_ADDRESS>, instead of the router. And the attackers machine is forwarding it onto the router. It becomes transparent because the attackers machine fords that traffic on, takes the response and sends that back so that the victim can never really tell, at least not easily, that he's been victimized. Right. So the project and our motivation. We always get asked, why did you do this? What's your motivation for the project?  So, you know, in answering that, I like to start with talking a little about history. A fellow named Doug Song over 12 years ago released a toolkit called DSNF. In that toolkit was a program called ARP Spoof. And what ARP Spoof did was, you know, ARP cache poison network, make the computer man in the middle and the point was to demonstrate exactly how vulnerable people on a local network were. And then hopefully, you know, bring about some kind of fix or at least some kind of awareness. Here we are 12 years later and your average consumer router, still vulnerable to the exact same attack, archaic, nothing special. So we thought we'd go ahead and bow it a little bit different of a way. So subterfuge, it makes it obvious to anybody, no matter how tech-savvy or non-tech-savvy you are, just how vulnerable on the network you are and exactly what you're getting. So rather than just, oh, somebody's man in the middle, he's seeing my traffic, what does that mean? We actually display, you know, here's what you got, here's something else you got and, you know, there's a real risk and here's the threat. So hopefully that's going to make consumers demand some kind of protection in their routers. And those protections do exist. Router companies just haven't given them out to consumer level routers. So hopefully when consumers start demanding that, router companies like Belkin and Cisco and, um, what? Got them. It says Nick here, I don't know what you're talking about. So anyway, about four months ago we took subterfuge and we decided to put it online. We put it on Google code and it was really just to help us code better and, you know, project management side of the house, just keep track of everything. And since we did that, there have been a slowly growing community that I've actually stumbled upon our site and our project. And the response has been pretty positive so far. So we've been, you know, continuing to program and keep this project alive. We've already had, you know, thousands of people download the code and our white paper. We've had thousands of people view videos on it, et cetera. And apparently our wallpaper is even cool enough that hundreds of people have downloaded that. So I'm not quite sure about that. We've also had people from the community contribute small portions of code, volunteer to be hardcore beta testers. And just recently we actually were approached by Backbox Linux because they wanted to include our tool into their security distribution. So now let's actually talk about subterfuge. So subterfuge has a couple improvements over most mandamental tool you see out there. The first and foremost is that it's got a very intuitive interface that's extremely easy to use. For instance, whenever I'm trying to use cane, yeah, I know, right? Cain. Whenever I'm using cane, I can never find the button to pull up that menu to do that thing I'm trying to do that one time. It's just, it's just busy. Subterfuge is not that. So subterfuge is there to demonstrate the vulnerability, to exploit the vulnerability and, you know, to get what you're trying to get and know if ands or buts about it. It's also a very point shoot. There's a start button in the right hand corner. You click the start button. It asks you if you want it to do everything for you.  It's also really silent and subversive. Unlike most mandamental tools where it's spamming, just it's spamming ARP, particularly for ARP cash poisoning tools, subterfuge actually has a couple innovations, if you will, that we're going to talk about in a little bit when it comes to poisoning a network that really allow it to be a lot more silent. A couple of the things that we've integrated into subterfuge, we'll also talk about just a little bit, let us subvert the user and make it really transparent and very hard for the victim to actually realize that they're being exploited. And finally, best, subterfuge is open source.  So actually editing there, editing that, building a little bit of an addition to it is very simple, very easy, and you can see everything that it does. So let's talk about the framework. This is really what makes subterfuge a bit different than most mandamental attack tools. It's got a server client architecture, which means that you can actually collaborate with this. Most of the time when you're having a mandamental attack, you know, you've got one person who can do it, because there can't ever be two men in the middle, that's kind of difficult. If you try that, the network is going to go down, nobody's going to get traffic, and you know, your idea of transparency, completely gone, nixed by the fact that you've got two people struggling to be that man in the middle, and the network just can't handle it. So with subterfuge, there's one person who's doing that man in the middle, that's the subterfuge server, and you've got clients who can connect to that server and they can all use it at the same time. We also went ahead and split apart the two pieces of a mandamental attack. You've got your actual attack, so your exploit on the network, where you get your mandamental position and then you actually leverage that attack to do something, right? So if we get this position, then what do we do with it?  We also have a lot of configuration options, which means that if you're coming up with a new attack that really needs to have a little bit of nitpicky man in the middle positioning, you can go ahead and configure and set that all up yourself, and we'll get a little bit more into that in the demo when we actually touch on it. All right, so I'm gonna go through a comparison of just some of the other tools that are used for a man in the middle attacks right now, and then we're also gonna touch on what's new and different with subterfuge. So other tools, you know, we already touched on it, are spewing out our packets all the time. If you're on a network that's being poised and you could pull up Wireshark and actually watch the sheer number of ARPs coming through and see, hey, this is probably, you know, a man in the middle attack. The other thing is there's some unacceptable periods of middle loss, where just due to basic traffic, clients will lose that man in the middle position, and the attacker will not be able to do anything. And in general, a lot of these tools actually, after running for even a short period of time, can just completely overload the network and make it crash, and that completely goes away from your stealth and transparency, because obviously no internet, they're gonna start complaining. So subterfuge, Python, it's open source. That's a pro. The other thing is it also has what we like to call intelligent poisoning and dynamic poison retention. Now, intelligent poisoning is what allows you to change the throttle of how fast the ARP poison packets are coming out. Now, on that threshold, there's only one packet being sent out. So instead of constantly doing ARP scans, seeing who's there sending out poison packets, or just spamming every single IP address, it's intelligent in that it sends out one packet on a certain threshold, and that's it. Now, dynamic poison retention is really unique to subterfuge, where it actually listens for those basic ARP communications between the router and the clients or the clients on the router that would typically make you lose that man-in-the-middle situation. So there's often times that Windows, for example, when it first turns on and connects to the internet, even if its ARP cache is full, it'll say, hey, router, where are you again? You know, just checking. Now, that would normally make you lose the man-in-the-middle position if you were a attacker, because that communication, the router would say, here I am, and the client would be like, oh, there's the real router. But now, subterfuge actually monitors the network, listens for those types of communications, and is instantly right there. So the second that router is sending the response, subterfuge has already sent out a packet and is saying no. Please remind them kindly who the real router is. And then we also have what's called ARP block. When you're in that man-in-the-middle position, we use ARP block to prevent any kind of communication from the router to the client. So it forces all of the clients and now victims to communicate directly through us, and the router can't come in and kind of steal the show. So it just prevents once it's in that man-in-the-middle position, it kind of, you're in charge, and so we can say, you know, what our packets go back and forth. Right. So something else we actually used, a big backbone component of subterfuge is SSL strip. So Moxie Maron Spike at Black Hat in 2009 released SSL strip, and it runs in HTTPS downgrade attack. So when we first came across SSL strip and started looking into the code, we almost felt like we died and went to heaven because it's written in Python for one. For two, it also acts a little bit like an intercepting proxy. So we went ahead and customized it to actually use those features to log basically everything. Because really everything that goes through the network has some kind of use to us as, you know, the man-in-the-middle, or the attacker, or the penetration tester. So that traffic is now all routed through the intercepting proxy and logged in subterfuges database. Now after we log it, well, when it's coming back through, we can pretty much do anything we want to it, right? So we figured here's a great place to start injecting things or modifying traffic on the fly. We do that through something we like to, or through a little bit of a smart injection. So, you know, you browse to yahoo.com.  You go there and it pulls in 20 external sites every time you go just because it's got so many news articles. Well, if you were just slapping on an injection to every single site that you went to, when somebody browsed to somewhere like yahoo.com, you'd inject that site 20 times. So with smart injection, it knows when that's happening and only injected once. And it also lets you really control the rapidity of your injection, especially if you're looking for very specific modifications to somebody's browsing session. Here are some of the plugins that we're going to briefly talk about. We actually have three of these up here we have demonstrations of, so I'm going to only talk briefly about them. But the credential harvester is the main module or plugin in subterfuge and what it does is it uses all the backend tools, the art poisoning tool that we wrote, it uses SSL strip, puts it all together in one spot, configures it without bothering you or you having to do any kind of text file editing and just works. And so what happens is you click start and it'll start intercepting any kind of web login traffic. Code injection is actually, we're able to intercept the traffic as it's going between the legitimate source and the host and we're able to slap something on in the end. And we'll talk more about what you can do with that.  Denial of service, there's many different uses of it and an ARP denial of service attack is very effective as we found in development. There are constantly times where we were developing this, something went wrong and I had a really fast internet connection and he didn't have any. Denial of service, you could use it for multiple different things. You can just say, I don't want this individual to have internet or I really need to use all the internet right now. I'm sorry everyone, go sit in the corner because I'm going to use all of it. Yeah. Then another plug-in tunnel block actually is brought up in the development of subrefuge. A friend of mine, a fellow computer scientist, he said, well, even if you have the man in the middle, if I have a VPN or some other kind of tunneling encryption protocol, you're not going to see what I'm doing, right? I said, hmm, well, if I'm in the middle, I can do whatever I want. So with tunnel block, the module, all it does is it blocks the standard protocols and tunneling services on the standard ports. So PPTP, Cisco VPN, L2TP, OpenVPN, SSH, all that stuff. If you want to, you can enable it. So by default, those things will be blocked.  I'm going to log into my VPN. When they pull up their VPN, hit connect. Because I'm man in the middle, I'm dropping all those packets. So it will just hang. They'll never connect. And they're probably busy, so they're going to continue on their way regardless. And we're also going to actually have a demonstration of network view. It's a really unique feature to subrefuge. It's a whole new way of visualizing the attack as it's happening. It's a dynamic view that updates and lets you visually see the network as you're attacking and who exactly you're man in the middle. So here is the demonstration of the credential harvesting module. So as you see, when you start subrefuge, it's pretty simple. Up in the upper right-hand corner, there's a start button.  And you're going to be like, sure. So it's going to go and get the network adapters, IP addresses, all those things. You're going to be like, okay, cool, that's awesome. So I'm just going to click okay. I click start, now I'm clicking okay. Here it goes. It's off. Now in the background, it's using SSL strip, all these other things, and everyone's getting poisoned in the background. Now these people, unfortunate people, you know, Facebook, eBay, Amazon, LinkedIn, they're all visiting the site thinking that they're secure and here's their plain text password. Now I don't think we could demonstrate an easier way of seeing how vulnerable people are to these attacks than this easy to understand interface. I mean, you got the source, the username, the password, the date and time when it happened. Clear code right there. You can see just how devastating it is because there's everyone's passwords. And that's kind of one of the big things that we want to demonstrate. We also got the opportunity to just give a little bit of a demonstration of subterfuge at the undergraduate level before coming here. And we just pulled this specific piece up, let those undergraduate students who weren't necessarily computer science majors just get a look at this, see that they could click the start button, click them. And that really opened their eyes and kind of did what we built subterfuge to do, to make it really obvious no matter how technical, tech-savvy you are or how tech-savvy you are not, just how easy it is to get your credentials. And I don't think they'll be doing their banking on Chase anytime soon. Right, so subterfuge just more than just the harvest credentials. We built that, we built subterfuge around credential harvesting specifically because we thought it was the way you were every time you did anything online. But subterfuge is a framework, which means we want it to be able to do just about anything. So here at the plug-in menu, if you were to click on credential harvester, you just give it a short description on the right-hand side of what the credential harvester does. If we click apply, it will take us there. In this case, we're going to go ahead and click on HTTP code injection and look at that top right-hand corner, gives a short description of what subterfuge is integrated directly with metasploit. So we can use browser auto-pone to inject people if we'd like to. Or we can inject them with our own custom special sauce. So if we were to pick metasploit, we could go down to payload and pick the type of injection that it would do. We could do iframe injection, which is hidden and the user wouldn't actually experience or see or the victim, excuse me, wouldn't actually experience or see anything. There's also window redirection and we could also pop up really an exploit in the pop-up. This is really good because not all browsers like it. So if we pick custom injection here, we can go ahead and type in anything that we want slapped onto the bottom of anybody's page. In this case, just to demonstrate, we're going to do a real quick script tag. It's just going to inject an alert that says osmosis was here into the victim's browsing session. It's as simple as just typing out whatever you want to have added and clicking apply and now it's being injected. So now the next person who's been man in the middle on the network to browse to anything is going to receive that injection. So here we've got a victim running Windows XP. Lord knows why. Also with the Google Chrome browser, he's just going to browse to Google.com and now he's got our little special sauce, a little nugget of joy. It says the page at Google.com says osmosis was here. This is actually a really good way of demonstrating another little tidbit about what makes man in the middle attacks and the man in the middle position so powerful because the user sees the page at Google.com said this. Because it's coming through us before it reaches them, we can pretty much make anything we can possibly think of look like it came from whatever the source was. So I can send them anything I want to and they think it came from Google.com. So this is the network view. This is really what makes Subterfuge a little bit unique. It's a whole new way of interacting with a man in the middle position. Every single person who comes up here, so for instance we just got a client 1921681.19 is man in the middle. So that means that all of their traffic is being routed and displayed to people that we have victimized. And it is also integrated directly with Metasploit. So if you hit the scan button it will automatically do a Metasploit, or excuse me, not Metasploit, endmap. If you hit the scan button it will automatically do an endmap host identification scan and pull in that information and put it to Subterfuge's database. It will then automatically upload or reload the specific pieces of the page to keep it up to date. So now we can see we can tell what open ports there are so we might be able to derive what kind of services they're running. The network view really just gives us a really quick and easy way to see everything that's going on in the network. Everybody who we've got doing anything on the internet through us. And it also lets us control that. So here we're actually going to interact with HTTP code injection through the network view. If we go ahead and click that and we check the running box then everybody on the network is now being used with Metasploit so we can pick the vector as browser auto-pwn and our payload. In this case we're going to go ahead and use iframe injection simply because iframe injection is just really transparent and works really well. Some browsers don't like it which is why we have other options but that's what we'll go ahead and do. Now if we just hit apply it starts it up. So that runs a Metasploit script which is run dynamically through Subterfuge. It will grab your IP address and start injecting that in a hidden iframe into users browsing sessions. So that there we go we got somebody who browsed on the internet anywhere and that's running a payload through Metasploit trying to exploit into that victim's browser. And we just got a session. In this case it was a session that was generated on Windows 7 box running the Google Chrome browser and since Metasploit stays very well updated and browser auto-pwn is run through directly through Metasploit you can also guarantee that this attack is going to stay applicable and that you're going to continue to be using the latest exploits that are in Metasploit's database as long as you update Metasploit. So this really just demonstrates a new way to interact with the man in the middle position, a new way to really control the network and to own peeps. Right. So it's a framework, right? And it does some things now but what if you came up with your own little network exploit or a plug-in to actually do something with that, you know position. Well what do you do, right? You could build your whole own tool that just gets man in the middle, uses man in the middle to do whatever cool thing it is you came up with and you know it's got whatever interface you also built for it. But with Subterfuge you can actually go ahead and build any program you'd like in Python and you can use the Subterfuge module builder to generate everything else for you. So if it's a network exploit you can use that or if it's a way to leverage a man in the middle of the module builder and configure it. Subterfuge will automatically generate you all the graphical user interface code that you need rather than having to do any of that yourself rather than having to touch nasty JavaScript and it can be really nasty especially if you want to have really good graphical user interface interactions that happen, you know statefully on a stateless protocol Subterfuge will go ahead and do all of that for you. And finally we've also got our settings. Subterfuge will attack a tool for the most part settings are done through configuration files or at the very least they tend to be a pain in the rear and if you do something wrong everything just doesn't work and you can bring down the network and if you're doing a penetration test that's just unacceptable. You can't really ever bring down some corporations network when they brought you in just a test to see if it was secure. I mean it's a database and reload to display to the hacker how new the data is which is really important especially with server client architecture for instance if you're running old routing equipment that can't really handle too much traffic and you're collaborating with 10 people at the same time through one Subterfuge server and you use the default and you're refreshing that every single second then all of that old system might not really like it too much with Subterfuge you can go ahead and control that you can dial it up you can dial it down really the sky's the limit and the same thing is true of injection rates so if I'm injecting say a Metasploit a link to Metasploit into a browser so I'm owning them with Metasploit well you know we had the other talk earlier who had 1400 shells something ridiculous if I want and then it gives me the chance to get my shell turn HB code injection off and remain as transparent on the network as possible it also allows us to control really how the art poison works though through dynamic poison retention that might mean that we want to dial down or it means certainly that we can dial down how often we send arts on the network without actually losing the poison so we might want to check really silent on the network with subterfuge it's really easy to do okay so now we talked a lot about subterfuge and in the end we really want the router companies to be fixing this at the consumer product level but let's talk about some of the countermeasures and how you can protect yourself in the meantime I'm just going to go in a quick explanation of a quick fix that I thought of that I'm calling gateway self aware of its own network adapters like if it knows its own LAN MAC address and its own LAN IP address that can prevent all these attacks from happening because the router is what sends all the packets around so if a router gets a packet that says hey this is the router's IP address but that's not my MAC address it drops the packet the attack is thwarted it would never go through protection there's enterprise level protections obviously with DHCP snooping and Cisco magic and they can bring that down to consumer level too but I think that it should be demanded by the consumers that they be protected from this at polar cot spots or other just consumer routers but in the meantime I'm going to go over some of the things that we found through our development and one thing that we saw was just the way it organizes how it displays a webpage so with Google Chrome the favicon is displayed the favicon of the website is actually displayed on the top of the tab now SSL strip has this really nasty feature where you can inject a lock icon into someone who's had that HTTPS downgrade attack so if you're browsing somewhere and that lock will show up which will be a further way that people be like okay I'm secure I'm going to keep going however with Chrome there's a specific icon built into the browser that says I'm secure or I'm not secure and that's what's next to the URL and the favicon is on the top so it's just easy to see the other thing is the handshake because that would set up some certificate errors it wouldn't be as stealthy and transparent to the users that's not what we wanted so if you ever look at the URL bar it actually will always say HTTP the only way SSL strip works is it banks on you saying I'm going to www.google or facebook.com not typing HTTPS colon slash slash so you're safe that way but even if you're just browsing clicking on links because SSL strip goes through pages and takes the S out of all the links if you're just browsing if you look up and you don't see an S you're not secure so always look for that S just recently we actually had the idea and I built a proof of concept program that can actually only it's written in Python and like I said it's a proof concept but you connect to a network you run this thing and it'll sit there and if there's ever an attacker it will pop up and tell you and all it does is it compares the ARP tables and make sure there aren't two IP addresses mapping the same connection and tunneling protocol that's obviously going to help you too so those are just a couple of things that you can do to help yourself out excuse me so we're also looking at future work Subrefuge is still in beta and it's a work in progress can you do yours too first time excuse me I'm going to skip down to mine I'm doing collaboration support one of the server client architecture so we really just wanted to work on the conflict resolution and make it more usable in a collaborative environment and one idea we were actually given was to have Subrefuge as a payload delivery for a Metasploit payload there's something in the future like that we talked a much about trying to figure out future work but pretty much man in the middle attacks right now do it so we're thinking about somehow packaging up Subrefuge as a remote deployable tool so that you can own a box on a foreign remote network have a pivot deploy a Subrefuge server and start man in the middle of a foreign and remote network without having to be there and we thought that would be pretty devastating in terms of penetration testing and what kind we're looking at Subrefuge is a future project it's still in beta and we're really working on what Subrefuge is going to be rather than what it just is right now and that really includes other mechanisms of gaining a man in the middle position as well as other ways to use it for instance we're looking at other ways to get a man in the middle position exploiting DHCP race conditions in order to this would do something kind of like what karma tends to do where it would start up a Wi-Fi server or excuse me a Wi-Fi access point as Subrefuge and Subrefuge would go ahead and do this for you so if we go to say the Las Vegas airport over here we'd see free public Wi-Fi it's everywhere and it's always real always but aside from that we'd also find people who actually think that it's secure is just absolutely astounding so Subrefuge would then be able to set up an access point like this for you you'd basically type in the name of the access point that you wanted and people would connect to it you're not really exploiting anything except for the fact that people just think they're secure when they really should know better but it's another mechanism gaining man in the middle Subrefuge and still use everything else without having to redo anything we're also looking at different ways to actually excise said position for instance two years ago so I think Defcon 2010 there was a tool released called Evil Grade and if you've got a man in the middle position it'll go ahead and pretend that there are updates for any given application out there used to that so they're going to click install updates if Subrefuge is man in the middle and Evil Grade plug-in is running you'd be able to iTunes would go out and it would look for a new update Evil Grade would say hey, here's one and it would automatically give it to you and that all within Subrefuge's interface which is really an idea or an example of how extensible Subrefuge tends to be because it's there you can use the GUI you can use the mechanisms of gaining man in the middle and you can use really everything else we're also looking at OS compatibility because Subrefuge is really supposed to be a tool that spreads awareness about how bad the threat and the risk of somebody being man in the middle to you is we're but the point is we'll be able to extend it and port it to different applications so that consumers of routers who really don't necessarily know how vulnerable they are will have the ability to really see it everywhere or even pull it down themselves before they go out and buy a router and really realize how bad things really can be so in summary so far we've learned that apparently my co-developer was a little bit about man in the middle attacks just our framework getting versus leveraging our position and just that split we had a couple demonstrations and talked about the counter measures to keep yourself safe in the meantime and we also talked about our future work so here's a link to our site where you can get the code we just wanted to thank you guys all


Mark Thornton has a special offer for fans of minor issues, a free copy of Murray Rothbard's famous work, Anatomy of the State. This is a limited time offer, so act fast. Get yours today at Mises.org slash Issues Free. Hello and welcome to another episode of the Minor Issues Podcast. I'm Mark Thornton at the Mises Institute. Inflation. What is it? Where is it going? And how will it impact our lives in 2024? Well, the definition of inflation historically and within the Austrian school is an artificial rise in the supply of money by government or central banks by a fractional reserve banking system. Yes, of course, this theoretical definition does expect prices to rise, but how prices will rise or when or what prices will rise the most, we have less to say about, but we do have something to say. Mainstream economics takes a very statistical point of view. They view inflation simply as the increase in prices or more specifically the increase in the price level, such as measured by the consumer price index. With respect to the causes of this overall increase in prices, mainstream analysis in the public eye remains very mute, crickets in other words. And that's basically what you would hear in the media. They never talk about the cause. They're really only talking about the effect in their definition. With respect to their definition of a statistical rise in the overall level of prices and the consequent falling of the value of our monetary unit, the dollar, their view is that this inflation, especially at the Fed, would be transitory. In other words, it was only going to be here for a short period of time and then it would vanish. And then, of course, we heard once that myth was dispelled, then we started hearing about the Fed, the central bank, keeping interest rates higher for longer. And this was designed to reduce our expectations of higher prices politically and economically. And ever since, they've been telling a story that inflation is down, down, down, and that rate cuts are on the way. My view, as I've expressed on this podcast on many episodes, is that empirical things are hard to predict with any kind of precision and that economic charts tend to be very squirrely or squiggly lines rather than straight lines up and down or sideways at an angle. It's only when you get to long-run trend lines that things seem to straighten out, especially with a lot of government intervention in the economy. We've also expressed that consumer price index inflation is not dead. Even the government statistics indicates that it's still very high, relative to expectation and policy goals. Some of these statistics have been fairly stable. And in more recent times, they're actually ticking upward in the United States, Canada, Europe, and elsewhere. In contrast to the mainstream view that interest rates have been high lately in response to this inflation, we've suggested that interest rates really aren't that high. They're only high or higher than they used to be when the Fed policy rate was zero, corporations could borrow it 2 percent, and 30-year fixed mortgages were at 3.5 percent, all historically way out of line with any past experience. And also, we've expressed that interest rates are not high enough to kill off inflation, or necessarily even to get back to 2 percent inflation. We've also suggested that the Fed has been using other means than their traditional policies to keep a lot of liquidity in the system. And then, of course, there's the Fed pivot. The Fed pivot was when they talked about lowering interest rates. They were talking about a bond market that had seen rates rise very significantly, had scared financial markets and bond markets and credit markets, and essentially was trying to talk down markets, and it succeeded in doing so. We described it as a fire extinguisher to address the problem, but I don't think it actually put out the fire. Michael Oliver is actually called what we saw in the bond market last year a nuclear event. So if he's right and I'm right, we got a fire extinguisher trying to address a nuclear event. At the same time, the global economy and the U.S. economy are sinking, not doing well, pushing towards recession in many, many countries, including China. And then, of course, 2024 holds a lot of political ramifications as 50 percent of the developed world economy voters go to the polls. A lot of uncertainty there, especially for certain political elites, given the widespread rise of right-wing populism in many countries around the world. Now, with a proper understanding of what right-wing populism is rather than the mainstream media view, this is actually probably a good thing, but it is something that the worldwide elites who are socialist and globalist plus environmentalists should fear. So in some, we don't think that their kind of inflation is dead. And as a matter of fact, unfortunately, we don't think our kind of theoretical inflation as an increase in the money supply is dead or even off the boards going into the future. So what this brings for the Fed and central banks and what that brings for you and me is still a giant question mark for the year 2024.


Now, what are the remedies that we can have to protect ourselves? So now remedies can happen at different levels. So let's let's talk about say network layer security. So on the network, you can have securities by securing your Wi-Fi access points, then securing your management, managing devices like you can secure your router switches or you can use a centralized system to manage the security of the entire network. And then the other things are all the communication that your that happens on the network has been secured. By that we mean we communicate privately, we use things like Internet protocol security suit, which is IPsec these days. By encrypting the information, we will be able to ensure that it does not it is not readable in the human form by someone who is not authorized to read it. Then we have something called the multi-factor authentication. So we talked about multi-factor authentication, now if the data or the particular area that you are looking at is highly confidential or secure, you could use multi-factor, for example, you could have a pin and also the biometric data, both of them to authenticate the person. So after multi-factor authentication, we also have something called security tokens which can be used to securely access certain applications and even physical spaces. And we also talk about electronic mail security. Now most of the communication that we do happens over email. So there are ways that you can encrypt your emails and there are services so that the emails that are sent over the network are sent in an encrypted form so that if the information is tapped at certain place because it all travels through a public network, it is not in the human readable form. Then finally then we have things like firewalls in place. Now firewalls are more of a defensive measures. So what firewalls can do is they can filter packets based on certain properties. For example, packet has a property of IP addresses of source and destination. So if we know that this particular IP has been known to be sending malicious communication, we could block that particular IP or if there are certain ports which are not being used and could be a vulnerability to our system, we could block those. Then we have firewalls which can do a stateful packet inspection. That means they can not just look at the source and destination information, they can also look at the kind of data that is going in through or the kind of applications that are communicating through the data like we saw port numbers. So port numbers determine which applications that we are using and say for example, certain company wants to block certain social networking websites. So it can actually inspect that communication and see if it belongs to a social networking website and block that.


the other player who's yet to score in the league this season. Surely it won't belong, as here's Locky Wales early ball forward, cross to the back post off the crossbar. Charlie Diamanti with another shot and he must be wondering what he has to do to find the back of the net. Just two yards out, still no goal for the wonderful Italian triore. Brides the challenge of Brisbane. He's done well. Adama triores ball in for him and that wasn't far away. And the home side after a nervy start that's two in two minutes. As Aquilina has it with Troisi again. Troisi tries it. And Jamie Young who has been outstanding so far this season did not move there. No that was a good attempt from James Troisi. Certainly making a run with purpose. Now ball straight back in. Prijevic, what a chance! And Prijevic with the invitation to fire point blank at goal and he took it gratefully. He just blasted past Thomas Macias and the visitors have the lead as we approach the half hour by a goal to nil. Western Sydney switched off again. We see the Harvey Norman replay. The first ball comes in, Ziggy Gordon. Away it goes in it comes back to Prijevic. He's standing free as a bird. Square ball for Macias. Tries his luck from distance on and squeezes through the fingers of Jamie Young. Macias and Gordon both leaping. It's their switch of play. That's a great ball for Ogoa who sprung the offside track close. So unlucky but it should be 1-1. Absolutely it should be 1-1. Fantastic run to spring the offside trap there by Ogoa. Great way to pass there from Macias. Look at that. He looks up, seizes the opportunity, seizes the opportunity, puts it perfectly into the path of Ogoa. These two sides and these two coaches, nobody here likes losing. Here's Conor Payne into the area. The cross for D'Amansi and it's another great chance for the Italian. Nine goals in his first season. Just one last year but a bucket full of assists and for the moment, 0-0.