Design Flaw in Security Product - ALLES! CTF 2021

In this video we are exploring a theoretical security product that automagically encrypts user data securely. But it has a fundamental design flaw which can be exploited.

00:00 - Intro
01:33 - Background Story
02:55 - What is CryptoWAF?
04:16 - Implementing Encryption
05:06 - Encryption Challenges
06:59 - Implementing Decryption
07:02 - Design Flaw
08:26 - Exploiting the Design Flaw
09:06 - Leaking Database
10:04 - WAF Bypass
11:04 - Conclusion
12:07 - Outro

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

[tunatuncer]

Oh wow, ALLES CTF21 was my first CTF and I was expecting this video for a while :D

[trieulieuf]

I like how he analyzes how BugBountyReportExplained got his mad skills.

[svenvancrombrugge]

This is awesome. I've been following your channel for years now.
In that time the amount of security related channels I watch rose and fell. Currently it's on a low point, as I'm learning heavily on the Dev and Ops side, less on Sec.
However there are two channels left. I had no idea you would ever have contact with each other, but the other Sec channel I still follow is actually BugBountyReportsExplained.
The world is small!
Beste Grüße!

[martinc.]

Now that we are good on the lightning situation... we can focus our effort onto improving that hoodie lacking problem, shall we ?

[rogervanbommel]

Question, what crypto attack do you find the most interesting/unexpected, mine are the AES-CBC padding Oracle and the ECDSA private key recovery because of k being constant

[FedoraRose]

Thank you so much for your content I always learn something new :)

[cleightthejw]

@Liveoverflow

Good vid like so many of your vids.

Thank you for making them

[BDBD]

I see you channeling your inner admin.

[trieulieuf]

And yet, this challenge is marked EASY in this CTF competition.

[agowa]

Ok, but how many serious offers from companies have you received that wanted to have this implemented?

[VectorAlphaSec]

Hey LiveOverflow you ever thought about making a YouTube programming tutorial series??

[unurenkh]

@LiveOverFlow your eyes are red. Please rest sometimes.

[seanwatts]

Military grade isn't always a good thing. With encryption some times civilians have access to better encryption because we're not locked down to contracts. I'm Into guns and I avoid military grade parts when modifying or adding parts military grade parts for guns are usually cheaply made and I will get 3rd party parts that are more expensive and hold up longer.

[reastle]

I heard us gonna ban sale's of hacking gadget is hat true ?

[georgehammond]

Ubuntu 20.04 is hacking me. How to stop them now??
not even 32 bit password was able to kick them out of PC.
any help is welcome.?

[JohnDoe-uqei]

Bu..Bu..But.. Actual skills.. No anon mask every other thumbnails.. I thought these kind of pratices were ban long time ago.. How dare u

[allurbase]

Injectin coments would still work/**/right?

[aronpill]

"Automagically" dear god, I hate that buzzword so much.

[abdulx]

Why you don't bug hunting? With have great knowledge Im confused 😕 you are insane.

[InfiniteQuest]

Yeah this is why I pretty much guarantee any company that advertises military-grade encryption has an insecure product. That's the least relevant thing in security and literally the only thing they are focused on or advertising. With that mindset, there's no way you did it right.