CSAW CTF 2013 Qualification Round: Reversing

Each year, the Information Systems and Security Laboratory (ISIS Lab) of the Polytechnic Institute of New York University hosts a Cyber Security Awareness Week, bringing together students and researchers to discuss the latest in cybersecurity.  Cybersecurity has always been the core focus at Digital Operatives and we are looking forward to this year's events in November.  The 2013 CSAW Capture the Flag Qualification Round was held this past weekend with over 1300 participating teams.  Like most Jeopardy-style CTFs, CSAW had several categories of problems, with Reverse Engineering as one of them.  A small team from Digital Operatives participated in this competition; below are write-ups for the Reversing problems.  Congratulations to the winning teams and great job to the organizers of the competition!

Contents

• Reversing 100: DotNetReversing.exe
• Reversing 100: csaw2013reversing1.exe
• Reversing 150: bikinibonanza.exe
• Reversing 200: csaw2013reversing2.exe
• Reversing 300: crackme
• Reversing 400: keygenme32.elf
• Reversing 500: Noobs First Firmware Mod
• Reversing 500: Impossible

Reversing 100: DotNetReversing.exe

We are prompted for a passcode and, upon attempting "a", the program crashes with a System.FormatException by attempting to parse the input as a number.

Upon opening the program in IDA Pro, it is quite clear where the branch between success and failure is, and because we know the program is looking for a numerical input, the constants just above this branch stand out.

We see that the program takes 0xC5EC4D790 and 0xF423ABDB7 and XORs them.

The result is 0x31cfe6a27, or 13371337255 in base ten, so we try this as input and get the flag!

Flag: I'll create a GUI interface using visual basic...see if I can track an IP address.

---

Reversing 100: csaw2013reversing1.exe

When the program is run, it displays a jumbled mess as the flag. Something clearly went wrong.

IDA Pro shows that the program only goes into its decryption routine if a debugger is attached.

We simply run the program with IDA as a debugger and allow it to display the decrypted flag.

Flag: this1isprettyeasy:)

---

Reversing 150: bikinibonanza.exe

This program gives various failure messages when we enter a string, including misleading messages about adding or subtracting 3 to our string input.

Because the program is in .NET IL, we open it with Red Gate's .NET Reflector and find the relevant procedures.  The code takes the string "NeEd_MoRe_Bawlz" and the current hour (plus one), feeds them into another procedure, and compares the result with our input.  If they match, the program will display the flag.

The procedure that operates on the hour and fixed string calls another procedure that substitutes the values, then finally calculates an MD5 sum over the string.

We convert this code into Python so that we can run it over all 24 hours and get the valid inputs.

#!/usr/bin/python

import md5

key_string = "NeEd_MoRe_Bawlz"

def substitute(num2, num1):
    s = [ 2, 3, 5, 7, 11, 13, 0x11, 0x13, 0x17, 0x1d, 0x1f, 0x25, 0x29, 0x2b,
        0x2f, 0x35, 0x3b, 0x3d, 0x43, 0x47, 0x49, 0x4f, 0x53, 0x59, 0x61, 0x65,
        0x67, 0x6b, 0x6d, 0x71 ]
    return s[num1] ^ num2

def get_key(text1, num1):
    t = ''
    for num2 in xrange(len(text1)):
        ch = text1[num2]
        for num in xrange(num1):
            ch = chr(substitute(ord(ch), num+1))
            num += 1
        t += ch;
    return md5.new(t).hexdigest()

for i in xrange(24):
    print get_key(key_string, i)

reversing-150.py

Finally, we feed the correct input for the computer's hour into the program and get the flag.

Flag: 0920303251BABE89911ECEAD17FEBF30

---

Reversing 200: csaw2013reversing2.exe

We initially run the program and nothing happens, so we'll open it in IDA Pro.  We simply start the binary in IDA's local debugger and guide the program to branch to the correct code, then examine memory just before the program terminates.

Alternatively, we could increment esi before allowing the call to MessageBoxA for the flag.

Flag: number2isalittlebitharder:p

---

Reversing 300: crackme

IDA Pro reveals that the file is an ELF that prompts for a key, hashes it, and succeeds if the hash equals 0xef2e3558.

The hash algorithm is a modified Bernstein hash with 1337 used as the start value instead of 5381.

unsigned int hash(char* s) {
    unsigned int h = 1337;
    while(*s) {
        h = 33*h + *(s++);
    }
    return h;
}

We code up the algorithm and run it through Digital Operatives' constraint solver to generate matching strings.

~}?Jyjx
t~6pKpl
gt7_En;
*,2>bds
2k{].?=
GJJ4GSv
Piqqtoa
...

We send it off to the server and get the flag!

Flag: day 145: they still do not realize this software sucks

---

Reversing 400: keygenme32.elf

This file is an ELF; running it with no arguments gives:

usage: ./keygenme32.elf <username> <token 1> <token 2>

Analysis in IDA Pro shows this program creates a virtual CPU, executes an instruction stream with our provided username, then compares the two tokens to two of the registers within the virtual CPU via a check() function.

Rather than reversing the entire CPU instruction set, we write a GDB script to pull the values from the virtual CPU's registers and then derive the correct tokens.

break *0x804a2a2
run
file ./keygenme32.elf
x/xw $ebp+8
x/xw $ebp+12
kill
quit

script.gdb

#!/usr/bin/python

import socket
import re
import subprocess

server = '128.238.66.219'
port   = 14549

prompt_pattern = re.compile('give me the password for (.*)')
gdb_pattern    = re.compile('0x........:\t(0x........)')
gdb_command    = ['gdb', '--batch', '-x', './script.gdb', '--args',
    './keygenme32.elf', 'WILL_BE_REPLACED', '0', '0']

# connect
s = socket.socket()
s.connect((server,port))

while True:
  # get the prompt
  prompt = ''
  while prompt.find('give me the password for') == -1 and \
   prompt.find('key') == -1:
    prompt += s.recv(65536)
  if prompt.find('key') != -1:
    print prompt
    s.close()
    exit(0)
  prompt = prompt.split('\n')
  prompt = filter(None, prompt)
  print repr(prompt)
  prompt = prompt[-1]
  name = prompt_pattern.match(prompt).group(1)

  # place the name in the command
  gdb_command[6] = name
  
  # run it
  p = subprocess.Popen(gdb_command, stdout=subprocess.PIPE)
  output = p.communicate()[0]
  print 'got output: '+output

  # get values
  output = output.split('\n')
  output = filter(None, output)
  token1 = gdb_pattern.match(output[-3]).group(1)
  token2 = gdb_pattern.match(output[-2]).group(1)
  
  # transform
  token1 = int(token1, 16)
  token1 ^= 0x31333337
  
  token2_1 = token2[2:4]
  token2_2 = token2[4:6]
  token2_3 = token2[6:8]
  token2_4 = token2[8:]
  token2   = int('0x' + token2_3 + token2_1 + token2_2 + token2_4, 16)

  # send the reply
  reply = '%d %d\n' % (token1, token2)
  print 'sending: '+reply
  s.send(reply)

reversing-400.py

We run the Python script and get the flag!

Flag: r3vers1ng_emul4t3d_cpuz_a1n7_h4rd!

---

Reversing 500: Noobs First Firmware Mod

We are given a modified U-Boot firmware.  After setting up QEMU within an Ubuntu server virtual machine, we can use IDA Pro's Remote GDB Debugger to step through the code and analyze.  One of the first things U-Boot does is relocate itself from 0x00010000 to 0x07fd7000.  We can compensate for this in IDA by rebasing the program:

RebaseProgram(0x07fc7000, MSF_FIXONCE);

After digging around, we find a new command has been created, csaw, corresponding to the internal do_csaw function shown below.

The function, as hinted, has a bug in it: it attempts to copy from an empty/invalid memory address, 0x80002013. There is one other reference to this address, in the smc_init function, which tries to copy the string "SUPERSEXYHOTANDSPICY" there.  (The full string in the binary is actually "key!=SUPERSEXYHOTANDSPICY".)

Thus, we replace the two invalid addresses in do_csaw with the appropriate ones.  The remainder of do_csaw is supposed to extract characters from this string to construct the key, but again there is a bug — one of the pointers for the memcpy in its extraction loop is not incremented.  We code up some debugger hooks in IDC to do the work for us.

#include <idc.idc>

static fix_r5_and_r11()
{
    SetRegValue(0x7feac27, "R5");
    SetRegValue(0x7feac4f, "R11");
    return 0;
}

static increment_r10()
{
    SetRegValue(GetRegValue("R10") + 1, "R10");
    return 0;
}

static main()
{
    AddBpt(0x7fd8df0);
    AddBpt(0x7fd8e10);
    AddBpt(0x7fd8e34);
    SetBptCnd(0x7fd8df0, "fix_r5_and_r11()");
    SetBptCnd(0x7fd8e10, "increment_r10()");
}

reversing-500.idc

Flag: SPREYOADPC

---

Reversing 500: Impossible

We get a file, impossible.nds.  Analyzing strings in it reveals it is a Nintendo DS game file.  We load it up in no$gba and notice there are lots of debug strings printed, including "RENDER SHIP" and "RENDER WTF".  By placing read-access breakpoints on those strings, we can get context of the game state while tracing through each frame render.  An analysis of the registers leads us to an area of memory containing game time, score, and enemy HP, shown below.

Killing the enemy by modifying its HP causes the game to render a screen with the key, at which point we search the emulator memory for "key" and find the whole string.

Flag: ou6UbzM8fgEjZQcRrcXKVN

Read More

CSAW CTF 2013 Qualifiers: Crypto 300 Writeup

The CSAW Capture The Flag online qualifiers were held last weekend (9/19/2013 through 9/22/2013). The top 10 undergraduate teams will participate in the CSAW CTF finals in November; however the qualifiers were open to everyone and a small team from Digital Operatives participated. Below is a writeup of one of the Crypto challenges:

The Crypto 300 challenge was contained entirely in a tarball that contains a custom encryption Python script and nine encrypted files. The encryption algorithm reuses a single 256-byte key to XOR each subsequent block of the input file. Simple XOR encryption of uncompressed files often leads to the key sticking out of the ciphertext when the input file contains many zeroes. This is also the case with some rudimentary binary packers that XOR data inside themselves. In the case of Crypto 300, thousands of blocks were given to us in the ciphertext files, providing many opportunities to find (0 XOR key[i]) instances scattered throughout the files. For instance, if at byte offsets 0+blocksize * x (where x is a non-negative integer) in the ciphertexts frequently contains 0x40, it is likely that byte 0 of the key is 0x40.

We created a simple Python script to count the number of times each byte value occurs at each block offset.

#!/usr/bin/python

import os

import sys

blocksize=256

prefix="output/file"

suffix=".enc"

blocks=[]

for x in range(0,9):

        fxname = prefix + str(x) + suffix

        try:

                print "Opening " + fxname

                fx = open(fxname,'rb')

        except:

                print "Failed to open " + fxname

                continue

        moretoread = True

        while moretoread:

                block = fx.read(blocksize)

                if(len(block) < blocksize):

                        moretoread = False

                        print "Last block was " + str(len(block)) + " bytes."

                blocks.append(block)        

print "Extracted " + str(len(blocks)) + " blocks."

#Calculate the number of times each byte value occurs at each position in a block

histogram = [[0 for i in range(blocksize)] for j in range(blocksize)]

for block in blocks:

        for b in range(0, len(block)):

                val = ord(block[b])

                histogram[b][val] = histogram[b][val] + 1

#Get the most used byte value for each position in the block

maxvals=[0 for i in range(blocksize)]

for hidx in range(0, len(histogram)):

        bytearr = histogram[hidx]

        cur_max_pos = 0

        cur_max_count = 0

        for idx in range(0,len(bytearr)):

                count = bytearr[idx]

                if count > cur_max_count:

                        cur_max_count = count

                        cur_max_pos = idx

        maxvals[hidx] = cur_max_pos

f = open("newsecretkey.dat","wb")

f.write(bytearray(maxvals))

f.close()

print "Done"

With the key in our newsecretkey.dat we are then able to decrypt all of the files from the challenge output folder using our new secret key and some simple Python borrowed from onlythisprogram.py.

#!/usr/bin/python

import os

import sys

import argparse

blocksize=256

parser = argparse.ArgumentParser(description="Decryption")

parser.add_argument('--infile', metavar='i', nargs='?', type=argparse.FileType('r'), help='input file, defaults to standard in', default=sys.stdin)

parser.add_argument('--outfile', metavar='o', nargs='?', type=argparse.FileType('wb'), help='output file, defaults to standard out', default=sys.stdout)

parser.add_argument('--secretkey', metavar='s', nargs='?', type=argparse.FileType('a+'), help='output file, defaults to secretkey.dat', default='secretkey.dat')

args = parser.parse_args()

counter=0

args.secretkey.seek(0)

keydata = args.secretkey.read(blocksize)

print "Using secret key: "

print keydata

while 1:

        byte = args.infile.read(1)

        if not byte:

                break

        args.outfile.write(chr(ord(keydata[counter % len(keydata)]) ^ ord(byte)))

        counter+=1

sys.stderr.write('\nSecret keyfile: %s\nInput file: %s\nOutput file: %s\nTotal bytes: %d \n' % (args.secretkey.name, args.infile.name, args.outfile.name, counter))

Use the following commands with the above decrypt.py:

./decrypt.py --infile=output/file4.enc --outfile=file4.enc.gz --secretkey=newsecretkey.dat

gzip -d file4.enc.gz

vim file4.enc

:set nowrap

After decryption we have nine plaintext files.  The fifth file (file4.enc) is a gzip compressed ASCII file that contains a message and the key: BuildYourOwnCryptoSoOthersHaveJobSecurity

For Hackers nostalgia, play the MIDI file0! 

Read More

Krave Beef Jerky Review

First off I have to say i was very excited to review this product, Krave Beef Jerky is right up my ally. I love meat, what can I say. I've tried not eating meat, it lasted about a week then I broke down and ate some delicious bacon. So when the wife (Aimee) came to me and said eat this meat and write a review for it I said "thank you." 

Krave jerky is awesome. They have a great variety of cool flavors that use all natural ingredients. I use to think that all jerky was dry and leathery strips of meat and that's how it was supposed to be. Man was I wrong, Krave Jerky is so moist and beautiful and tender. Oh how I wish there were more words in the dictionary, that I could think of at this moment, to explain the taste of this Jerky. It almost melts in your mouth, and you don't feel like you just ate something that was sitting in a vat of salt. Or something that was attached to a shoe at some point in time like some of the gas station Jerky I have had. The only time I have had something like this was when I have had home made jerky. But even then I have never had any with these flavors (Black Cherry Barbecue, Basil Citrus, Chili Lime, Garlic Chili Pepper, Lemon Garlic, Pineapple Orange, Grilled Sweet Teriyaki, and Sweet Chipotle) you can order them from KRAVE.

If you like jerky you will love this jerky, heck if you don't like jerky (like Aimee) you will more than likely love this jerky (like Aimee) it's just that good. 

Review by Cody Tate

Disclaimer: I was sent these products for free from KRAVE to review for my honest opinion. I only recommend products or services I use personally and believe will be good for my readers. Your opinions may vary from my opinions.

Read More

Defending Your E-Mails from Surveillance … Conveniently

With the recent and ongoing disclosures of what appear to be widespread Internet surveillance programs, the public is becoming increasingly aware of the privacy risks in sending plaintext E-mail.  Even connecting to one's E-mail service provider using a cryptographically secure protocol like HTTPS provides a false sense of security, because one cannot ensure the trust or privacy of any intermediary servers/connections used to route the message to its recipient.  As such, there are many excellent tutorials—and even entire web campaigns—that empower average users to protect their online communications via free tools like OpenPGP.

Since day one, Digital Operatives has employed strong cryptography to protect all of its internal E-mail communications.  This works extremely well, and, for all intents and purposes, is currently very secure.  There are some downsides, however.  The number one complaint about using public key cryptography to secure all E-mail communications is that there really isn't a good way to search through the bodies of the E-mails in your inbox (since the message bodies are encrypted, a simple search for a term like "cat" or "meeting" won't match any of the E-mails it otherwise should have).  In fact, the second bug ever reported for the popular EnigMail GPG plugin for the Thunderbird mail client was a feature request asking for the ability to search through encrypted E-mail bodies.  That bug was opened in 2003 … and it is still open today.

The trouble is that the decryption step is too computationally expensive to decrypt all of the message bodies on the fly during the search.  The alternative would be to temporarily decrypt the message bodies of new E-mails as they arrive and add them to a search index.  The trouble is that this invites a security vulnerability, since sensitive message data would therefore be included in the search index.

Given that over 90% of the E-mail in our inboxes at Digital Operatives is encrypted, we decided to scratch our own itch and develop a solution to this problem.  We took the second approach mentioned above: We incrementally build a search index to search across the encrypted message bodies.  To mitigate the aforementioned security risk with this approach, we encrypt the entire search index using the same private key used to decrypt one's E-mails.  Therefore, the only risk would be if an adversary got access to one's private key, but that of course would have even worse security implications since he or she could then read all of the original E-mails anyway.

Our proof-of-concept solution is a tool called Magiic.  Magiic Allows for GPG Indexing of IMAP on the Command-line.  It is a Python script that uses GnuPG for encryption/decryption and Whoosh for full-text indexing.  It acts as a standalone mail application, connecting directly to an IMAP server and creating a local index off of the contents.  It has a simple ncurses interface so all interaction can take place on the command line.  We are releasing the code using a version of the Creative Commons BY-NC-SA 3.0 license that has been modified slightly to be more applicable for software licensing.  It is free for non-commercial use.  The code is available here.

Read More

How to debug Android Native Code with Eclipse

This blog summarizes the steps needed to set-up your Eclipse environment to support the debugging of an Android native application written in C/C++. It's taken from Carlos Suoto's web page at http://www.eclipse.org/sequoyah/documentation/native_debug.php.

1. Pre-Requisites

• Make sure you compile your C/C++ with the "-g" option (or use -DCMAKE_BUILD_TYPE:STRING="Debug" if you use cmake).
• Make sure APP_OPTIM is set to "APP_OPTIM:=debug" in Android.mk and Application.mk.
• Make sure build/core/build-binary.mk in Android NDK doesn't strip executables. For example patch android-ndk-r8e/build/core/build-binary.mk to the following:
  
  --- build/core/build-binary.mk.orig     2013-08-21 11:06:39.818329442 -0400
  +++ build/core/build-binary.mk  2013-08-21 11:13:11.877214361 -0400
  @@ -485,10 +485,16 @@ $(LOCAL_INSTALLED): PRIVATE_DST       :=
   $(LOCAL_INSTALLED): PRIVATE_STRIP     := $(TARGET_STRIP)
   $(LOCAL_INSTALLED): PRIVATE_STRIP_CMD := $(call cmd-strip, $(PRIVATE_DST))
   
  +ifeq ($(APP_OPTIM),debug)
  +$(LOCAL_INSTALLED): $(LOCAL_BUILT_MODULE) clean-installed-binaries
  +       @$(HOST_ECHO) "Install        : $(PRIVATE_NAME) => $(call pretty-dir,$(PRIVATE_DST))"
  +       $(hide) $(call host-install,$(PRIVATE_SRC),$(PRIVATE_DST))
  +else
   $(LOCAL_INSTALLED): $(LOCAL_BUILT_MODULE) clean-installed-binaries
          @$(HOST_ECHO) "Install        : $(PRIVATE_NAME) => $(call pretty-dir,$(PRIVATE_DST))"
          $(hide) $(call host-install,$(PRIVATE_SRC),$(PRIVATE_DST))
          $(hide) $(PRIVATE_STRIP_CMD)
  +endif

1.1. Install the Eclipse Sequoyah plugin

1. In Eclipse go to Help -> Install New Software
2. Click on the Add button
3. Enter 'Sequoyah Metadata Repository' in the Name field
4. Enter 'http://download.eclipse.org/sequoyah/updates/2.0/' in the Location field
5. If you still see the "There are no categorized items" message, uncheck the "Group items by category" radio button
6. Select "Sequoyah Android Native Code Support" and install the plugin

1.2. Convert The Android Java Application into C/C++ Project

You must convert your Java project to C/C++ using the Sequoyah plugin or else you won't be able to see the configuration options to set the proper debugger settings.

1. In Eclipse select the Android Java project you need to convert
2. Right click with the mouse and select Android Tools -> Add Native Support

1.3. Other Pre-Requisites

1. The platform must be Android 2.2 (android-8) or later
2. The ndk version must be r4b (it contains bugfixes to ndk-gdb that are necessary) or later
3. Eclipse CDT 7.0 or newer must be installed
4. The AndroidManifest.xml must have the property of the application node android:debuggable="true"
5. The build must have been done with the ndk-build (if using the Sequoyah Android components, it will be automatic)

2. Configurations

• 01) Create a debug configuration for an Android application (can be done with Eclipse or MOTODEV Studio)
• 02) Create a debug configuration for a C/C++ application
• 03) Set the following properties:
  
  
• 04) The process launcher must be the Standard Process Launcher. This is selected at the bottom of the Main tab:
  
  
• 05) On the "Main" tab:
  the Field C/C++ Application: $PROJECT_PATH/obj/local/armeabi/app_process
• 06) On the "Debugger" tab:
  
  • field Debugger: gdbserver
  • On the "Main" subtab:
    
    
  • 07) GDB debugger: $NDK_PATH/build/prebuilt/$ARCH/arm-eabi-$GCC_VERSION/bin/arm-eabi-gdb
  • 08) GDB command file: $PROJECT_PATH/obj/local/armeabi/gdb2.setup
    [Windows users] Uncheck the "Use full file path to set breakpoints" option
  • On the "Connection" subtab:
    
    
  • 09) Type: TCP
  • 10) Hostname or IP address: localhost
  • 11) Port number: 5039 
  
  

  3. Instructions

• Open the ndk-gdb script that came with the android NDK and comment the last line (we are not calling the usual gdb client, but we will attach an Eclipse gdb session instead):
  
  

  •     # $GDBCLIENT -x $GDBSETUP -e $APP_PROCESS
    

• Insert a breakpoint in your Java code, preferably after all System.loadLibrary() calls. (To make sure that the debugger is correctly attached to the Java process)
• Launch the android debug and wait for it to reach the breakpoint
• From a Terminal session, in the project folder, run the modified ndk-gdb command. It should not attach to an gdb client, but call the gdbserver on the emulator and open a TCP port for connection (or in alternative if you have an Android device connected to your USB port, the ndk-gdb script will run gdbserver on the device itself).
• In the $PROJECT_PATH/obj/local/armeabi/, modify the gdb.setup file, removing the target remote:5039 statement. (For some reason, the Eclipse GDB session does not like this statement being done in the commands file). Rename this new file to gdb2.setup. This step need to be run just once, on the first debug session.
• Launch the C/C++ Application debug and wait for the Eclipse GDB session to fully connect to the emulator's gdbserver instance.

After following these steps, one can continue to debug the application as usual, using the "continue" option to let the execution flow until the next breakpoint is hit or by using the usual "step-in" to execute each statement individually. Setting a breakpoint on a Java statement that calls a native function through JNI and stepping into will place the user at the beginning of the native code.
Another way to set breakpoints in the C/C++ code is from Eclipse to click on File -> Open File and browse to the location of your source code. Then double-click on the line where you want to set the breakpoint.

Read More

DermOrganics Review

"DermOrganic^® products are made using ingredients that are synergistic to your hair and skin to replenish from the outside what your hair and skin need inside for health and vitality. From the shampoo cleansers made from EFA lipids and amino acids, to conditioners blended with vegetable proteins, to treatments rich in natural moisture factors and all based on a proprietary lipid-rich emulsification systems, DermOrganic products outperform standard hair and skin care formulations to deliver exceptional results to salon treated hair." - from the DermOrganic website

I was pleasantly surprised with these products. First we'll talk about the hair products. Of late, I've been having issues with my hair.  I have to sleep with a CPAP machine and the straps make my hair flat and causes breakage. I started wearing a cap and that has solved the breakage issue, but its still flat.  After just one use of their hair products (shampoo, masque, and leave-in treatment), my hair already looked thicker. It left my hair feeling silky smooth after I washed it and its not so flat on top So I differently recommend these products. Another small notes, the smell of the hair product have a great scent to them.

Now about the facial products. Occasionally I get breakouts so I was excited to see how these products work. They have a soapless facial cleanser, facial moisturizer, and a hand & body moisture lotion. I was very happy with the results. My acne started clearing up almost immediately and it didn't leave my face dried out. And the lotion left my skin feeling soft and smooth. I definitely recommend these products. You can find their products at DermOrganic

Review by Aimee Tate

Disclaimer: I was sent these products for free from DermOrganic to review for my honest opinion. I only recommend products or services I use personally and believe will be good for my readers. Your opinions may vary from my opinions.

Read More

CaseApp Review

Ok I have to say that I love personalizing stuff with things I like, I mean who doesn't. So if you like that and you don't have a tendency of dropping your phone, then you need to check it out HERE.  If lack of protection is an issue for you on your phone then this may not be the case for you. That's why this case is great for me but not for Aimee, she drops her phone a lot.This case will keep the back of your phone from minor scratches but not sure how safe it would be to drop it and I'm not going to test it. As you can see from the pictures this case is more for the look and you can pretty much customize it with any picture, including ones uploaded from your owe computer.Their website is very easy to navigate and picking a picture is easy. I got the case pretty quickly after picking the image, took less than a week.

So let's get to this...

Style : Love it, it doesn't add anything to the phone bulk or weight and you can personalize it as you can see I picked my favorite wrestler CM Punk.

Protection : Very little so if you are a person that drops your phone a lot this is not for you but if you are like me and are very aware of your phone safety you should be good but just be careful, this case is very thin and has no protection for the front of the phone.

Price : $34.00 I guess this is for the personalization process, it's a bit much for my taste.

Overall : I love it, but I am very careful with my phone. The personalization is what attracted me to it, the price makes me second guess it, but if you want something personalized its a good deal. 

Review written by Cody Tate.

Disclaimer: I was sent these products for free from CaseApp to review for my honest opinion. I only recommend products or services I use personally and believe will be good for my readers. Your opinions may vary from my opinions.

Read More