You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*Note: It could take some time for compilation, Swift build times are a little much sometimes*
75
+
*Note: It could take some time for compilation, Swift build times are a little much sometimes (5th gen mobile ryzen 5 ~200s)*
76
+
77
+
Taking a look at the running containers, either in the Docker UI or using `docker ps`, three containers can be seen running associated with facepalm:
78
+
1. The service itself
79
+
2. The DB to store the user data
80
+
3. A cleanup container that keeps the DB footprint small
66
81
67
82
### 3.3 Running the Checker
68
83
@@ -72,4 +87,74 @@ In the same fashion as the service has been started, the checker can be deployed
72
87
cd checker
73
88
docker compose up --build -d
74
89
```
90
+
Taking a look inside the running containers, we can now observe 2: the checker itself, and a Mongo DB it needs for its data.
91
+
92
+
## 4. Usage
93
+
94
+
Once Facepalm has finished building, you can access the web interface with any browser. The service can be found on port `4269` (i.e. `localhost:4269`).
95
+
96
+
While using, special attention is required at the top bar - the buttons move around, just to keep the users on their toes.
97
+
98
+
### Registering
99
+
100
+
Registering must be done with a unique user name
101
+
102
+
103
+
104
+
### Posting
105
+
106
+
Posts can be made either privately or publically, by unchecking the private checkmark.
107
+
108
+
109
+
110
+
111
+
### Uploading profile pic and bio
112
+
113
+
The profile picture and bio can both always be seen publically on the home-of address
114
+
115
+
116
+
117
+
118
+
### Creating, viewing and joining Events
119
+
120
+
When creating an event, the date can be set freely, since it's stored as a string. Private fields are noted as such. The only important field to set is the title, the rest is optional
121
+
122
+
123
+
124
+
After all data for the event has been entered, a key is shown for one time (similarly to a token on GitLab) and can be forwarded to anyone who wants help organize the event. However, an event can also be joined by sending a request to the given event and then being accepted by an event invitee. This can be accomplished on the event info page.
125
+
126
+
127
+
128
+
Then all events can be viewed, and, if not already in it, access can be requested, and granted (here, another user logged in to view the event, who is not invited:).
129
+
130
+
131
+
132
+
133
+
## 5. The Exploits and their fixes
134
+
135
+
### 5.1 Insecure UUID Generation
136
+
137
+
The User IDs and the Post IDs are both derived deterministically (in the classes `IdentifierGenerator.swift` and `PostIDGenerator.swift`, respectively).
138
+
139
+
The User ID is directly derived from a (padded or cut) username, while the PostID is derived from the User ID, a counter (initialized to 0) and a timestamp (with `minute` precision). These values are `XOR`ed together, and then form the (derivable) PostID.
140
+
141
+
#### Exploit
142
+
143
+
`Flag hint: username`
144
+
The 'fun' in this exploit is the difference between python and Swift handling uppercase vs. lowercase (hex) strings, and the different ways they `XOR` things.
145
+
146
+
The easy mode of the exploit might be just copying the given swift files, and then writing a little python script that calls it with the given time stamp of the current system time, and username, and then passing the result forward. However, if the exploit is to be written in python, specific libraries have to be used to achieve the same result. This even baffles most (current) AI systems that have been tested, and solving it using LLMs results in quite long troubleshooting steps, since it should work, but somehow just does not.
147
+
148
+
A working and annotated example of a python implementation for the exploit can be seen in `checker/src/FinalFinalTry.py`.
149
+
150
+
#### The Fix
151
+
152
+
Fixing the exploit is as simple as replaxing the entire class contained in `service/Sources/App/Models/IdentifierGenerator.swift` with
153
+
154
+
```Swift
155
+
returnuuid()
156
+
```
157
+
158
+
This returns a secure uuid, from which the postID is then derived. For additional security, this could also be replaced by the same logic.
75
159
160
+
Alternatively, only the PostID generation could be made secure. In the current state of development for facepalm, the deterministic User ID does not have implications (that have been found).
0 commit comments