Crypto Challenge: lurking..
You have gotten past the outer barriers. You have installed a network sniffer. You were able to get access to some key-files. Full of hope you analyze the traffic of past days. Will you be able to break their code?
Will you spot the weaknesses?
the
files you grabbed are:
central.ref:
02 02 04 04 07 07 10 11 21 24 26 30 31 33 34 35
36 40 43 45 45 45 50 50 51 56 62 63 65 71 72 74
user.smith.ref:
01 01 05 07 12 12 13 13 16 16 23 26 27 35 36 37
40 41 44 45 46 47 50 53 54 60 60 60 61 64 71 77
role.smith.clerk.ref:
01 02 04 13 16 16 16 17 21 24 25 31 33 34 35 36
37 44 47 52 53 56 64 65 67 67 70 70 71 71 72 72
maybe you will: have the log of a black-hat-session that is denied get logs that leak more information, because of a thoughtless server-update .. in the next days.
at the moment there seems to be a TAN-generator. the client sends the init for the generator, the server selects which TAN to see. but what are the *.ref files good for? why are there five TAN-transactions before login suceeds? maybe you have to take a closer look and rethink your presumptions.
if
you think you can take the risk, than start a session by posting a comment that
includes your transmission. please make a new topic per session, i
will post the servers answers. one session per NO-member maximum! if you
make it to the prompt you win. here are the logs:
---8<-----[sniffer started]
S: hello, this is broken-tin.neverbank.co.uk
S: localtime: 07:51:37 Nov/01/2006 (GMT)
C: login user=smith role=clerk
C: 03 03 05 05 07 07 10 11 12 14 16 17 20 22 32 35
37 41 45 46 52 54 57 60 60 62 64 70 71 76 76 76
S: 2
C: 73405261
S: OK
C: 00 07 10 15 16 20 24 27 27 30 32 33 34 36 37 42
43 45 50 54 56 62 62 62 63 67 71 71 75 75 76 76
S: 1
C: 72045361
S: OK
C: 01 05 06 11 14 20 21 25 31 34 34 36 40 40 42 42
45 45 53 53 53 54 57 60 63 67 71 73 74 75 76 77
S: 0
C: 21750463
S: OK
C: 00 05 12 15 17 17 17 20 21 22 23 25 27 32 34 37
40 41 43 51 51 54 54 56 56 60 61 64 70 73 75 75
S: 0
C: 14362075
S: OK
C: 02 04 07 07 10 10 10 13 17 22 27 30 31 32 33 34
37 40 43 45 51 52 54 61 62 65 71 71 75 75 76 76
S: 2
C: 61435207
S: OK
S: welcome Mr Smith!
S: /usr/local/clerk/bin/smith>
---8<-----[sniffer started]
S: hello, this is broken-tin.neverbank.co.uk
S: localtime: 07:52:39 Nov/02/2006 (GMT)
C: login user=smith role=clerk
C: 02 05 07 10 10 12 12 15 15 21 24 26 26 26 34 35
36 41 42 43 44 46 47 52 53 57 61 61 63 67 71 77
S: 2
C: 07153264
S: OK
C: 02 02 03 03 06 06 10 11 20 24 24 24 27 31 32 35
40 40 41 45 53 54 57 61 62 63 70 71 72 74 75 77
S: 0
C: 01425673
S: OK
C: 02 02 03 03 04 04 10 11 12 15 16 17 20 21 25 25
25 32 34 36 42 46 47 50 50 56 57 60 66 71 74 75
S: 1
C: 14623075
S: OK
C: 00 01 03 04 05 07 10 13 17 17 17 21 24 26 31 31
32 32 36 36 43 44 50 56 57 61 64 65 73 73 74 75
S: 1
C: 46217530
S: OK
C: 01 01 02 02 04 04 12 14 17 24 26 27 30 30 36 37
40 43 43 43 45 50 53 54 55 56 57 62 63 65 70 77
S: 2
C: 70261354
S: OK
S: welcome Mr Smith!
S: /usr/local/clerk/bin/smith>
---8<-----[sniffer started]
S: hello, this is broken-tin.neverbank.co.uk
S: localtime: 07:59:07 Nov/03/2006 (GMT)
C: login user=smith role=clerk
C: 04 05 07 10 10 12 12 15 15 20 25 27 31 31 34 37
40 43 46 51 53 53 53 56 61 63 64 65 66 67 71 77
S: 2
C: 27065134
S: OK
C: 01 01 02 02 03 03 12 13 15 20 24 24 24 26 32 35
37 40 40 45 47 50 55 60 62 64 65 66 67 73 74 76
S: 2
C: 70126435
S: OK
C: 03 04 05 15 15 16 16 17 17 21 22 30 31 31 32 40
41 42 43 44 46 50 52 56 61 63 63 63 64 72 75 76
S: 0
C: 60153247
S: OK
C: 03 03 04 04 05 05 12 13 17 20 20 21 26 31 35 36
43 45 46 50 52 52 52 57 60 66 70 71 72 75 76 77
S: 2
C: 75620143
S: OK
C: 00 06 10 15 17 20 23 26 26 32 34 35 40 42 43 44
46 47 50 53 57 61 61 65 65 67 67 72 72 72 74 76
S: 0
C: 17563204
S: OK
S: welcome Mr Smith!
S: /usr/local/clerk/bin/smith>
---8<-----[sniffer started]
S: hello, this is broken-tin.neverbank.co.uk
S: localtime: 07:54:07 Nov/04/2006 (GMT)
C: login user=smith role=clerk
C: 02 03 06 10 10 12 12 15 15 21 24 27 27 27 31 33
41 42 43 44 46 47 50 52 53 60 64 67 71 71 73 76
S: 2
C: 27143056
S: OK
C: 01 01 04 07 12 12 13 13 16 16 23 24 27 30 30 30
31 35 40 42 45 50 51 53 54 55 57 62 63 67 71 77
S: 1
C: 01365427
S: OK
C: 01 01 01 02 05 12 12 14 16 20 20 23 23 27 27 30
36 37 41 45 47 50 51 52 54 55 56 62 66 70 74 76
S: 0
C: 45076312
S: OK
C: 03 04 04 04 06 10 12 15 22 26 30 32 33 34 35 36
42 45 46 46 51 53 54 60 60 61 61 67 67 70 71 72
S: 0
C: 42135607
S: OK
C: 00 05 10 14 15 15 20 21 22 24 25 27 30 34 37 41
42 43 53 53 56 56 57 57 60 63 67 71 71 71 72 75
S: 2
C: 46325701
S: OK
S: welcome Mr Smith!
S: /usr/local/clerk/bin/smith>
---8<-----[sniffer started]
S: hello, this is broken-tin.neverbank.co.uk
S: localtime: 07:53:02 Nov/05/2006 (GMT)
C: login user=smith role=clerk
C: 03 03 06 07 14 16 17 20 22 23 24 26 27 31&n
