Our talk from Hack in the Box Amsterdam 2013.
It’s no surprise that a typical hackers professional path hits against custom crypto protocols from time to time. There are lots of application-specific crypto-hardened protocols written from scratch which could be found in banking, SCADA, and other types of not-so-common hardware and software systems. In this presentation, we propose a methodology for breaking into such systems using a top-down approach with GOST-hardened banking applications as an example. We show how easy it is to bypass complex crypto protections because of developers having inconsistent knowledge of modern application level protocols.