Base64 Encoding is NOT Cryptography

I have once again come across an IT department who were/are firmly convinced that the commercial web application that they use is secure and has encrypted user details. What it actually does is Base64 encode the password. This is not encryption and must be treated as plaintext.

So what is Base64 encoding and why do we have it? Well, a large number of popular application layer protocols are ASCII text based, i.e. they transfer plain text over the network. A good example of this is HTTP - the protocol used to transfer HTML (or Web) pages around. Originally, only text pages were sent with markup embedded to style it. However, soon other resources were added to the web including pictures, documents, etc. HTTP is designed to transfer plain ASCII text, so how do you transfer a JPEG photograph? Answer: You convert it into plain ASCII text.

The basic principle of converting a file into text is to use the data to represent an index to the ASCII character, e.g. 'A' is 63, 'B' is 64, 'a' is 97, '8' is 56, etc. So, if the first four bytes of your file are 63, 64, 97 and 56, this can be represented by 'ABa8' without loss. However, ASCII is actually only 7 bits and we usually use 8-bit bytes (because of IBM setting the standard - actually a byte was historically just the number of bits required to store a character). Also, ASCII character 13 is a carriage return, 27 is escape and 8 is backspace. These are non-printable and, worse than that, could corrupt the communications as well as remove other characters. So, we can't just do a straight conversion from bytes to ASCII.

This is where Base64 conversion comes in. We split the file up into 6-bit 'bytes', rather than 8-bit. 6 bits give us 64 possible values. These are then represented by the digits, upper and lowercase letters and a couple of symbols ensuring that they are always printable and don't cause problems. So, the Base64 encoded password is just a 6-bit 'byte' representation of an 8-bit byte password and it is trivial to convert between the two. There is no security in Base64 encoding anything. Perhaps I should repeat that again.

Base64 encoding something is not encrypting it and provides NO SECURITY whatsoever!

I am constantly surprised and disappointed that people think that Base64 encoding something will protect it. I know TLS has its problems, but why aren't all web applications using it?

The little JavaScript tool below will allow you to encode and decode Base64 encoded text to see what it's like and how simple it is. If you find Base64 encoded passwords on your network via sniffing then you can use this to decode them.

Enter Text:


Select Encoding or Decoding:

Encode | Decode

Security Risk is Proportional to Hacker's Skill

There are many factors that influence the risk to your organisation and they are by no means all about hackers. However, we do have to deal with hackers and have to realise that they are a fact of life that won't ever go away. So how much risk are we at from hackers?

The truth of the matter is that the risk your organisation faces from hackers is proportional to the skill of the hacker. There are many different types of hacker, from the person who downloads a free tool, through script kiddies to highly intelligent, technically skilled people who can discover and exploit any vulnerabilities you may have.

The tricky thing is to figure out who you will likely get attacked by. Many organisations have the attitude that they are not a natural target so nobody will attack them and they don't need to worry about security. Unfortunately that just isn't true. Computers are very good at doing repetitive tasks without getting bored. As a test we have standard ADSL line with a web server sitting on it, which is completely non-advertised, yet it gets attacked 4 times a day on average. The problem is that if you have simple vulnerabilities or use the same components and services as others that are targets then they could be discovered on your network and exploited by simple to use tools. The problem is that the exploits are created and distributed in freely downloadable tools for all to use.

It is relatively easy for a hacker to find and exploit your system even if you aren't an obvious target.

True Random Numbers from Random.org

Much of security relies on randomness - encryption keys should be random and random passwords are more secure than dictionary words or predictable sequences. The problem is, how do we generate a random number?

Well, actually, this is a trick question. The answer is that you can't generate random numbers, but you can observe them. Most programming languages give you a random number generator, so why not just use that? Well, it's not actually a random number generator, but a Pseudo-Random Number Generator (PRNG), or more accurately a Pseudo-Random Sequence Generator (PRSG). Given the same seed value, it will produce the same output every time. Try seeding the random number function in your favourite programming language then run your program a few times. You should see the same numbers coming out each time.

The reason for this is the function used to produce random numbers is just a mathematical formula that takes an input and gives an output. To have a random number out, you need a random starting value. Most will seed themselves on the clock, but this isn't random; it isn't even unpredictable. A simplistic example of a PRNG, as given by Knuth in his seminal books, is as follows:

X = (a*X+c) mod m

Random number = X/m for some suitable large prime number m and fixed values a and c both less than m (indeed c is usually a small number <10).

This can be seeded by setting X to the seed value and will give the same sequence of pseudo-random numbers out, as can be seen. However, it isn't random. If I know your seed value I can recreate your sequence of numbers. If you seed it on the clock it is often possible to work out a window of opportunity and obtain a range of seed values. Admittedly, this could be large, but an exhaustive search of these would be quicker than breaking the code that relies on them in many cases. Recently, a large Linux distribution was found to have a flaw in its key-generation that introduced a major weakness into the RSA public-key codes generated on those machines. This was due to predictability of the keys and a lack of randomness.

So, what can we do? We can observe randomness in the natural world. Random.org uses background white noise as a source of randomness. This gives good randomness and distribution of numbers. They offer several options to generate random numbers, sequences or even passwords. An example of their random number service is given below. I'm not saying that they are the best option or the only option, but you must use truly random numbers in your cryptography and secure systems.

HDD Tools & Other Malware Removal

Recently I had someone come to me with their laptop saying that they had a new anti-virus program that they didn't remember installing and that 'other things' on their laptop didn't seem to work any more. The same thing happened to a corporate desktop machine I was asked about a couple of weeks later, that was originally running McAfee. Finally, two days ago I saw another corporate machine running McAfee that was saying that it had a hard drive failure. A tool, called HDD Tools, then automatically ran to diagnose the problem and stated that if they purchased the full HDD Tools product then it could fix the problem.

Each of these was a piece of malware that had infected the machine and was trying to get the user to enter their credit card details into a website so that money can be taken from their account and maybe their card cloned. These malware programs go along with the fake anti-virus software that the APWG have reported a huge rise in recently. These are a collection of programs that purport to be useful software and will fix a problem that you are experiencing. The truth of the matter is that it is that software that is causing you the problems in the first place and paying them the money will just cause more trouble.

The later breed of scams using these supposedly useful tools do one of two things in general - either they cost you money and they may try to clone your card, or they will enlist your machine in a botnet. For a discussion of this type of malware and its proliferation, see this blog post.

Here I wanted to tell you a couple if simple steps to remove this type of software if you do get infected. Obviously, it should go without saying that you should do everything possible to try to avoid getting infected in the first place rather than try to recover from it - the damage may already be done. However, there are many similarities between them and you will need to remove them. A simple procedure can often work to get rid if them as follows (N.B. this will not always work and if you make a mistake you can make things much worse).

1. Detect that you have rogue software (malware) on your system. This isn't always hard as, in the case of HDD Tools, it will keep popping its window up and not allow you access to the C:\ drive of your computer. Other things to look for are if your AV product doesn't work or if you get strange services appearing in the Task Manager. Often the malware will stop Task Manager from running by disabling the Run command and the right-click functionality on the Taskbar. However, sometimes you can still get access to it by pressing Ctrl+Shift+Esc. Look for processes with random names; HDD Tools uses a number like 20418112.exe, that will change with each infected machine.
2. Reboot your machine in Safe Mode by pressing F8 during boot (that's the function key F8, NOT press the F key then the 8 key). If your machine boots up normally then you didn't press F8 early enough - you need to reboot again. You need to go into Safe Mode as the malware will prevent you from deleting it normally by having a background service running. This will not be started in Safe Mode, so you can remove it.
3. Once in Safe Mode, you can begin to remove the malware. First, you need to find out what the malware is and where it's stored. Mostly the malware won't appear in the list of installed programs so can't simply be uninstalled, but that's worth a check. However, sometimes this can be used to reinfect the machine, so be wary. If you have rogue software on your system then it will probably have created some kind of shortcut on the desktop or in the Start menu to make it seem legitimate. Have a look at where this points to and what the name of the file is. Other places to look are in the Startup folder and in the list of services installed on the machine. In the case of HDD Tools, it installs a desktop icon and Start menu folder.
4. Navigate to the path in Windows Explorer to find all the files you are looking to remove, but don't remove them yet. HDD Tools stores its files in your temporary folder, e.g. C:\Documents and Settings\username\AppData\Local Settings\temp, or C:\users\username\AppData\Local\temp. You may need to show hidden files and folders to be able to see this folder in Windows Explorer by changing the settings in Folder Options.
5. Run a file search on your machine to see if there are any other instances of those files anywhere else for you to remove.
6. Run Regedit from the Run... command to open up the registry editor (Warning: messing around with the registry can ruin your machine). Now run a search for the filename in the registry.
7. You will need to go through the registry to remove all references to the malware and any keys that it has created. In general, if the only entries in the key relate to the malware you can remove the key, otherwise just remove the values. These often appear in HKEY_LOCAL_MACHINE or HKEY_CURRENT _USER in the Software\Microsoft\Windows\CurrentVersion key.
8. Once you have deleted these, you can go back and delete the original files.
9. Reboot normally and check your machine.

It is still possible to get infected even if you have a properly managed device with Anti-virus software installed. The problem is that they are not 100% effective. See 'How secure is your AV Product?'

McAfee Secure Short-URL Service Easy to Foil

McAfee have launched a Beta URL shortening service with added security features. As Brett Hardin pointed out they are a little late to the game. However, there are so many abuses of URL shortening services that I commend them for trying.

Basically, what their service does is allow you to create short easy URLs (like any other service). However, unlike other services, when you click on the link, it opens a frames page with the content in the bottom frame and the McAfee information in the top frame. This information includes details about the domain you are connecting to, the type of company it's registered to and a big green tick or red cross to tell you whether the site is safe or not. This is decided by their 'Global Threat Intelligence', which will block known bad URLs and phishing sites. That's good, if it works.

I said above that I commend them for trying to provide this service. There are some obvious failings in their solution though, that render their protections useless other than to make it easier for people to phish users as the page has the McAfee stamp of approval. Below is their site working properly to block a known bad phishing URL.


As you can see, this site was blocked and marked as a phishing URL, which it was. Excellent, it's working! Hold on a minute though. Have a look at the screenshot below where I can access the same URL through their service by embedding it in an iframe. I now get the big green tick and I'm told that it is safe. You can see from the source that the iframe is showing the exact same URL as was blocked before. Incidentally, the page says that the site is a Business Internet Services company, which is extremely misleading as I can assure you that this wasn't put on a domain run by a Business Internet Services company.


Also, what about if I code my page to not accept being in a frames page? Then the service falls down again. The screenshot below is of Twitter accessed through this service. The problem is that I can hide all sorts of other links in the page to fool McAfee and the user won't see them. I know McAfee will block these URLs in time, but they will only be blocking the host page and they will have to block all of them. Also, if you click on a link within the page that directs you to another domain, then that is not checked, so I could just redirect you to a phishing URL and you'll still get the big green tick.


It's a nice idea, but it just doesn't work. Interestingly, other services also have some security in them. TinyURL, for example, wouldn't allow me to create a short URL for this phishing site in the first place as it was recognised as such. McAfee happily let me produce the short URL, they just blocked it later - not such a good strategy in my opinion. I know that a new phishing URL would fool TinyURL as well, but I particularly chose a URL that had been around for the best part of a month to give them a chance and I think TinyURL has done better. Incidentally, TinyURL also allowed me to produce a short URL for my test page. One good thing about TinyURL is the preview facility, but that doesn't protect me against a site that looks like the real thing.

Moral: follow any links at your own risk and don't think that a green tick makes it safe!

IPICS 2010 Network Security Slides

My slides on Network Security and Steganography, presented at the Intensive Programme on Information and Communication Security (IPICS) 2010 can be downloaded below. The topics covered under Network Security are: Access COntrol Devices, Firewalls, Network Protection, Network Authentication Protocols, TLS, VPNs & Remote Access. The Steganography slides cover examples of: Image, Network, HTTP and Twitter Steganography.

A PDF of the Network Security slides can be downloaded from here.

A PDF of the Steganography slides can be downloaded from here.

System Recovery with Comodo's Time Machine

Comodo's Time Machine is a software application that runs on your Windows machine and periodically (either manually or automatically) takes snapshots of your system. You are then able to roll back to any of these snapshots in the future. Indeed you can jump backwards and forwards in the tree and new branches appear as you make changes to the system.

The idea behind it is that if you suffer any problems with corrupted software, malware, etc., then you can roll back to a known good state and start again. You can lock snapshots so that they don't get deleted and then clear out the ones that you don't want to keep any more. This is quite important, especially if you take automatic snapshots. You have to remember that every change made to the computer (i.e. every time you run it or change a file) the changes are stored. When a new snapshot is created, if you change a file you will have a new version on your system as well as the old one. Due to this, it requires a fair amount of space on your system. However, the upsides are fairly obvious.

I have been using it quite a lot recently on test boxes while performing testing of security software against various malware and other attacks. It enabled me to perform a test, roll back to the pre-test state and perform it again or try another attack from a fresh system. It greatly reduced the testing time for certain attacks as I wasn't having to deal with an imaging server, etc. For the normal user, however, this does mean that if you get infected with malware or something else goes wrong with your system, you can very quickly and easily roll back to a previous state and carry on working.

There are a few issues to keep in mind though. Firstly, as I've already mentioned, the space required can be quite large if you keep taking snapshots and don't clear previous ones off the system. Secondly, if you roll back your system, you won't have access to any new files or software that you have put on the system - you will need to roll forward again to get at these. Finally, I did have one or two occasions where the restore failed. When I say the restore failed, I mean one snapshot failed so that I couldn't boot into it. At the boot stage I had to select another snapshot to boot from. I could always find a snapshot the did work, but it is slightly worrying that there were occasions when the one I wanted wouldn't boot. This could be due to the fact that I was installing various service packs, updates and malware onto the system and switching between them many times, but it is still worth noting that you will require a full system backup and you must backup all your data regularly.

Of course there are other products out there that do the same thing and some reviewers say that they are better (e.g. Acronis). However, I found Comodo's Time Machine very easy to use and it is free. I'm not necessarily endorsing Comodo's product; I'm saying that this type of software is worth a look for keeping your systems running.