I’d pause at this moment to congratulate myself on being aware enough to use a few simple line commands kept ready in my history so any newbie could appear as a kind of Computer ninja but it was short lived, before I could have a shot of celebration, they returned to reboot from a what was something more than a back door

Time was when in encryption trouble ActiveDirectory was helpful and it was when Linux had me essentially locked out of my own machine.I think I was able to use an X509 encryption from another machine on an old network that one had forgot but showed in a network search. It worked and so end of story… Happy ever after, Right??? This hack is several yrs old and in its day the x509 was simple providing more than adequate security at the time. But a decade in computer yrs is an eternity. Configured with LDAP the X509 cert will return a matching key However with the addition of Java things get complicated quick.

SecurityContextHolder.getContext().getAuthentication().getPrincipal(); it’s return type is string rather than userDetails(certificate details used while logging), the string output for getPrincipal() is anonymousUserand authorities it give is ROLE_ANONYMOUS but when the call getAuthentication.isAuthenticated() it returns true. No longer root:) using old tomcat 7, Spring security 3.1

https://stackoverflow.com/questions/16560190/x509-authentication-with-active-directory-using-spring-security

Once into Java 2.0 it handles Classes with only calls to http, no security functions whatsoever a perfect field of mischief https://docs.spring.io/spring-security/site/docs/3.1.1.RELEASE/apidocs/

This then takes us into the actual setup for the replay attack itself and with a special twist. That’s fairly lethal if the code behavior goes unimpeded bound for prime privilege if not root.

Attack Scenario:

• the attack scenario involving a staff member requesting a financial transfer, the interception of the encrypted message, and the potential consequences A replay attack, also known as either a repeat attack or a playback attack, is a type of network attack in which a hacker intercepts a valid data transmission — like a request by a client to access data on a server — and then fraudulently delays or repeats that data transmission. The hacker then steals the valid client’s session ID. In doing this, he or she can masquerade as the valid client to access whatever data the valid client can normally access on the network.

A session replay attack is a passive type of man-in-the-middle attack that fools the network servers into thinking they are communicating with valid clients. When this happens, the server or receiver gets the message twice — once from the true sender and once from the attacker. This is the reason for the name “replay attack.”

• Emphasise the deceptive nature of replay attacks since the captured message appears legitimate to the financial administrator.
  There is of course a call for a function, say for SSL keys, understand if your network is compromised they’re reading your mail and can wait until the situation presents its. In addition there’s a particularly sinister twist that Without SSL protection for your reverse proxy it can be compromised. On the Nginx reverse proxy the hack resets your time to a database that is an archive maintained by Google… So that when you Google your search you’re pulling from content accurately indexed from 3 yrs prior…

This ingenious tho infamous hack was scripted by none other than the Commander of the Punjab and the Kashmir the ever so cunning Samy Kamkar. Now I know many of you may not have heard of Samy but among the under the radar rather serious black hat hackers. Sammy is legendary among the hero’s of hacker land and pulling and placing one in a time loop of sorts does seem like when you’ve been hit you’re dancing through time. It adds a layer of confusion. That’s simply pure diabolical genius.

If you’re caught in this dizzy display of code tomfoolery it is difficult to extract one’s self but, like a riptide of powerful currents that threaten to sweep you out to sea. The solution is simply to relax, and remember it’s just code.