Inspecting HTTPS traffic on iOS simulator running iOS 8 with Burp or Charles

I had some problems installing the Burp or Charles CA certificate in the iOS simulator running iOS 8. I tried following various tutorials I found, but to no success. In particular I tried to combine a tutorial which said to extract the CA certificate using Firefox and install it to the TrustStore.sqlite3 keystore in the simulator directory. My failure to get that particular line of attack working lead me to a more successful path involving the iosCertTrustManager tool.

The solution is to download the iosCertTrustManager tool, export the CA certificate from Burp or Charles and then install the tool.

1. Download the iosTrustCertManager Python script from:
   https://github.com/ADVTOOLS/ADVTrustStore
   


2. Get the CA certificate
   
   
   
   • For Burp
     
     
     
     • Go to Proxy -> Options -> CA certificate
     
     
     • Export the certificate in DER format, and store it in some location
       
     
     
     • Convert the certificate to pem format using OpenSSL:
       openssl x509 -inform der -in ~/tmp/burpca.der -out ~/tmp/burpca.pem
     
     
     
     
   
   
   • For Charles
     
     
     
     • Download the CA certificate for Charles from this page under MAC OS X or IOS Devices or download directly form this link
     
     
     
     
   
   
   
   


3. Run iosCertTrustManager:
   python iosCertTrustManager.py -a ~/tmp/burpca.pem

Happy hacking!

URL-Encoding

I recently ran into the problem of doing proper URL-Encoding between an IOS app and a Java server. I have found this explanation very useful.

Installing git-completion.bash on Mac OS X

If your don't want to use MacPorts or similar then I recommend this approach.


mkdir -p ~/opt/git/completion
cd ~/opt/git/completion
curl -o ~/opt/git/completion/git-prompt.sh https://raw.githubusercontent.com/git/git/master/contrib/completion/git-prompt.sh
curl -o ~/opt/git/completion/git-completion.bash https://raw.githubusercontent.com/git/git/master/contrib/completion/git-completion.bash

Insert this into ~/.bash_profile:

# Set git autocompletion and PS1 integration
if [ -f /Users/REPLACE-USERNAME-HERE/opt/git/completion/git-completion.bash ]; then
. /Users/REPLACE-USERNAME-HERE/opt/git/completion/git-completion.bash
fi

if [ -f /Users/REPLACE-USERNAME-HERE/opt/git/completion/git-prompt.sh ]; then
. /Users/REPLACE-USERNAME-HERE/opt/git/completion/git-prompt.sh
fi
GIT_PS1_SHOWDIRTYSTATE=true

PS1='\[\033[32m\]\u@\h:\W\[\033[00m\]:$(__git_ps1)\[\033[00m\]\$ '

Tomcat keystore from openssl signingrequest.

Last weekend I spend an extreme amount of time figuring out how to create a keystore which i acceptable to Tomcat from a certificate and keyfile I got from Thawte. It turned out to more difficult to find a workable solution than I had ever dreamed it would be. So to hopefully prevent others from waste the time on the same subject I will now tell you how I solved it.

However, first I will give you a good number of hints to how it should be done in theory... If you like or don't like my advice, then go and have a look at these ideas. They all looks very attractive, and I would have loved if they solved my problem. But they didn't.

http://stackoverflow.com/questions/10090263/ssl-intermediate-certificates

 

http://stackoverflow.com/questions/10091928/is-it-possible-to-install-existing-private-key-and-ssl-certificate-in-a-new-keys/10095674#10095674

 

http://mail-archives.apache.org/mod_mbox/tomcat-users/200409.mbox/%3C4150C297.8030802@ddai.net%3E

 

http://www.agentbob.info/agentbob/79-AB.html

 

http://stackoverflow.com/questions/8120690/tomcat-doesnt-deliver-intermediate-certificate-https

What solved the problem for me was the following mail, which basically tells you to use IE. Yes that is right. As a primary Mac and Linux user, I haven't found IE particularly useful since... well never. Until now. Now IE is my best friend, but nobody ever told me that IE was a bloated key manager... ;)

So go and follow the link and read:

http://openssl.6102.n7.nabble.com/FWD-Intermediate-certificate-chain-not-included-when-exporting-as-pkcs12-td11892.html

 

Frameworks and Languages for SMC

• SMCL: J. Nielsen and M. Schwartzbach. A domain-specific programming language for secure multiparty computation. In PLAS ’07: Programming languages and analysis for security, pages 21–30. ACM, 2007.


• PySMCL: S. Meldgaard, CACE project deliverable D4.5.


• EDSL in Haskel: A domain-specific language for computing on encrypted data
  A.M. Bain, J.C. Mitchell, R. Sharma, D. Stefan and J. Zimmerman.


• Fairplay: Dahlia Malkhi, Noam Nisan, Benny Pinkas, and Yaron Sella. Fairplay - Secure Two-Party Computation System. In USENIX Security Symposium, pages 287–302. USENIX, 2004.


• FairplayMP: Assaf Ben-David, Noam Nisan, and Benny Pinkas. FairplayMP: a system for secure multi-party computation. In Peng Ning, Paul F. Syverson, and Somesh Jha, editors, ACM Conference on Computer and Communications Security, pages 257–266. ACM, 2008.


• VIFF - The Virtual Ideal Functionality Framework. I. Damgaard, M. Geisler, M. Krøigaard, and J. B. Nielsen. Asynchronous multiparty computation: Theory and implementation. In Public Key Cryptography, pages 160–179, 2009.


• Sharemind: D. Bogdanov, S. Laur, and J. Willemson. Sharemind: A framework for fast privacy-preserving computations. In ESORICS, pages 192–206, 2008.


• SMCR: Peter Bogetoft, Ivan Damgaard, Thomas Jakobsen, Kurt Nielsen, Jakob Pagter, and Tomas Toft. Secure computing, economy, and trust: A generic solution for secure auctions with real-world applications. Technical Report RS-05-18, BRICS, June 2005. 37 pp.


• FastGC: Y. Huang, D. Evans, J. Katz, L. Malka. Faster secure two-party computation using garbled circuits. In USENIX Security’11, pages 539–554. USENIX, 2011.


• GMW protocol: S. G. Choi, K.-W. Hwang, J. Katz, T. Malkin, D. Rubenstein. Secure multi-party computation of Boolean circuits with applications to privacy in on-line marketplaces. In Cryptographers’ Track at the RSA Conference (CT-RSA’12), volume 7178 of LNCS, p. 416–432. Springer, 2012.


• HEKM: Faster Secure Two-Party Computation Using Garbled Circuits, https://www.cs.umd.edu/~jkatz/papers/usenix2011.pdf


• VMCrypt: Modular Software Architecture for Scalable Secure Computation, https://eprint.iacr.org/2010/584.pdf


• SALUS: S. Kamara, P. Mohassel, and B. Riva. Salus: A sys- tem for server-aided secure function evaluation. In Proceedings of the ACM conference on Computer and communications security (CCS), 2012.

Commiting only parts of a file in Mercurial

Let say you have a file and by accident changed two unrelated part of the file. Now it would be nice if one could commit each of the changes in their own changeset.

The solution for Mercurial is an extension called record.

You enable the extension in your hgrc file. You would properly want to do it in the ~/.hgrc file to make it system wide.
Just add:

hgext.record =

Then you just write:

hg record

You might also consider these other extensions:

hgext.fetch =
hgext.churn =
hgext.mq =
hgext.patchbomb =
hgext.graphlog =
hgext.highlight =
bfiles = ~/path_to_bfiles

Installing ec2-ami-tools on AWS Ubuntu 10.04 image

I have just spend a disproportionate amount of time solving this simple question.

It is actually pretty easy: Enable the multiverse reposity, update, and install.

The multiverse repository is enable by editing /etc/apt/sources.list

sudo nano /etc/apt/sources.list

Change:

deb http://eu-west-1.ec2.archive.ubuntu.com/ubuntu/ lucid main universe
deb-src http://eu-west-1.ec2.archive.ubuntu.com/ubuntu/ lucid main universe
deb http://eu-west-1.ec2.archive.ubuntu.com/ubuntu/ lucid-updates main universe
deb-src http://eu-west-1.ec2.archive.ubuntu.com/ubuntu/ lucid-updates main universe
deb http://security.ubuntu.com/ubuntu lucid-security main universe
deb-src http://security.ubuntu.com/ubuntu lucid-security main universe

to:

deb http://eu-west-1.ec2.archive.ubuntu.com/ubuntu/ lucid main universe multiverse
deb-src http://eu-west-1.ec2.archive.ubuntu.com/ubuntu/ lucid main universe multiverse
deb http://eu-west-1.ec2.archive.ubuntu.com/ubuntu/ lucid-updates main universe multiverse
deb-src http://eu-west-1.ec2.archive.ubuntu.com/ubuntu/ lucid-updates main universe multiverse
deb http://security.ubuntu.com/ubuntu lucid-security main universe multiverse
deb-src http://security.ubuntu.com/ubuntu lucid-security main universe multiverse

Now run:

sudo apt-get update

and install:

sudo apt-get install ec2-ami-tools