crypto - Dave's Blog

Search
My timeline on Mastodon

Retweet of KimZetter

2015 Dec 21, 7:02
"This is the kind of vulnerability that makes applied cryptographers cry tears of joy." - http://bit.ly/1O5VoSR  #JuniperVPNbackdoor
PermalinkComments

Retweet of Pinboard

2015 Dec 13, 2:34
Imagine a world where FBI director Comey talked about guns the way he talks about cryptography
PermalinkComments

Retweet of zeynep

2015 Oct 14, 6:11
Ran into Alex Halderman recently. He casually said "we found a weakness in Diffie-Hellman." My jaw dropped. GO READ. https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/ …
PermalinkComments

Retweet of ncardozo

2015 Apr 11, 10:58
The NSA does not have "an absolute right to gain access to every way in which two people may choose to communicate." http://arstechnica.com/tech-policy/2015/04/nsa-dreams-of-smartphones-with-split-crypto-keys-protecting-user-data/ …
PermalinkComments

David_Risney: "With crypto in UK crosshairs, secret US report says it’s vital". I think the secret is out on crypto.

2015 Jan 15, 10:10
David Risney @David_Risney :
"With crypto in UK crosshairs, secret US report says it’s vital". I think the secret is out on crypto. http://arstechnica.com/security/2015/01/with-crypto-in-uk-crosshairs-secret-us-report-says-its-vital/ …
PermalinkComments

Stripe CTF - Level 7

2012 Sep 13, 5:00

Level 7 of the Stripe CTF involved running a length extension attack on the level 7 server's custom crypto code.

Code

@app.route('/logs/')
@require_authentication
def logs(id):
rows = get_logs(id)
return render_template('logs.html', logs=rows)

...

def verify_signature(user_id, sig, raw_params):
# get secret token for user_id
try:
row = g.db.select_one('users', {'id': user_id})
except db.NotFound:
raise BadSignature('no such user_id')
secret = str(row['secret'])

h = hashlib.sha1()
h.update(secret + raw_params)
print 'computed signature', h.hexdigest(), 'for body', repr(raw_params)
if h.hexdigest() != sig:
raise BadSignature('signature does not match')
return True

Issue

The level 7 web app is a web API in which clients submit signed RESTful requests and some actions are restricted to particular clients. The goal is to view the response to one of the restricted actions. The first issue is that there is a logs path to display the previous requests for a user and although the logs path requires the client to be authenticatd, it doesn't restrict the logs you view to be for the user for which you are authenticated. So you can manually change the number in the '/logs/[#]' to '/logs/1' to view the logs for the user ID 1 who can make restricted requests. The level 7 web app can be exploited with replay attacks but you won't find in the logs any of the restricted requests we need to run for our goal. And we can't just modify the requests because they are signed.

However they are signed using their own custom signing code which can be exploited by a length extension attack. All Merkle–Damgård hash algorithms (which includes MD5, and SHA) have the property that if you hash data of the form (secret + data) where data is known and the length but not content of secret is known you can construct the hash for a new message (secret + data + padding + newdata) where newdata is whatever you like and padding is determined using newdata, data, and the length of secret. You can find a sha-padding.py script on VNSecurity blog that will tell you the new hash and padding per the above. With that I produced my new restricted request based on another user's previous request. The original request was the following.

count=10&lat=37.351&user_id=1&long=%2D119.827&waffle=eggo|sig:8dbd9dfa60ef3964b1ee0785a68760af8658048c
The new request with padding and my new content was the following.
count=10&lat=37.351&user_id=1&long=%2D119.827&waffle=eggo%80%02%28&waffle=liege|sig:8dbd9dfa60ef3964b1ee0785a68760af8658048c
My new data in the new request is able to overwrite the waffle parameter because their parser fills in a map without checking if the parameter existed previously.

Notes

Code review red flags included custom crypto looking code. However I am not a crypto expert and it was difficult for me to find the solution to this level.

PermalinkCommentshash internet length-extension security sha1 stripe-ctf technical web

Stripe Web Security CTF Summary

2012 Aug 30, 5:00

I was the 546th person to complete Stripe's web security CTF and again had a ton of fun applying my theoretical knowledge of web security issues to the (semi-)real world. As I went through the levels I thought about what red flags jumped out at me (or should have) that I could apply to future code reviews:

Level Issue Code Review Red Flags
0 Simple SQL injection No encoding when constructing SQL command strings. Constructing SQL command strings instead of SQL API
1 extract($_GET); No input validation.
2 Arbitrary PHP execution No input validation. Allow file uploads. File permissions modification.
3 Advanced SQL injection Constructing SQL command strings instead of SQL API.
4 HTML injection, XSS and CSRF No encoding when constructing HTML. No CSRF counter measures. Passwords stored in plain text. Password displayed on site.
5 Pingback server doesn't need to opt-in n/a - By design protocol issue.
6 Script injection and XSS No encoding while constructing script. Deny list (of dangerous characters). Passwords stored in plain text. Password displayed on site.
7 Length extension attack Custom crypto code. Constructing SQL command string instead of SQL API.
8 Side channel attack Password handling code. Timing attack mitigation too clever.

More about each level in the future.

PermalinkCommentscode-review coding csrf html internet programming script security sql stripe technical web xss

Crypto breakthrough shows Flame was designed by world-class scientists | Ars Technica

2012 Jun 7, 9:12

So this is another Stuxnet by Israel/US?

The analysis reinforces theories that researchers from Kaspersky Lab, CrySyS Lab, and Symantec published almost two weeks ago. Namely, Flame could only have been developed with the backing of a wealthy nation-state. … “It’s not a garden-variety collision attack, or just an implementation of previous MD5 collisions papers—which would be difficult enough,” Matthew Green, a professor specializing in cryptography in the computer science department at Johns Hopkins University, told Ars. “There were mathematicians doing new science to make Flame work.”

PermalinkCommentstechnical security web internet md5 cryptography flame

Telex

2011 Jul 18, 2:38Neat idea: "When the user wants to visit a blacklisted site, the client establishes an encrypted HTTPS connection to a non-blacklisted web server outside the censor’s network, which could be a normal site that the user regularly visits... The client secretly marks the connection as a Telex request by inserting a cryptographic tag into the headers. We construct this tag using a mechanism called public-key steganography... As the connection travels over the Internet en route to the non-blacklisted site, it passes through routers at various ISPs in the core of the network. We envision that some of these ISPs would deploy equipment we call Telex stations."PermalinkCommentsinternet security tools censorship technical

Lifetimes of cryptographic hash functions

2011 Jun 20, 11:25A cautionary tale in chart form: lesson is make sure you can always upgrade your hashing algorithm or don't have security dependencies on hashing algorithms.PermalinkCommentsreference hash encryption security table technical humor

RFC 5854 - The Metalink Download Description Format

2010 Jun 1, 6:46"Metalink describes download locations (mirrors), cryptographic hashes, and other information. Clients can transparently use this information to reliably transfer files."PermalinkCommentstechnical internet download web url xml metalink

Android App Aims to Allow Wiretap-Proof Cell Phone Calls « The Firewall - Forbes.com

2010 May 27, 8:53
PermalinkCommentsandroid cellphone security encryption privacy cryptography technical google

RFC 5843 - Additional Hash Algorithms for HTTP Instance Digests

2010 Apr 21, 6:51Adds SHA 256 & 512 to HTTP instance digest: 'The IANA registry named "Hypertext Transfer Protocol (HTTP) Digest Algorithm Values" defines values for digest algorithms used by Instance Digests in HTTP. Instance Digests in HTTP provide a digest, also known as a checksum or hash, of an entire representation of the current state of a resource. This document adds new values to the registry and updates previous values.'PermalinkCommentshash cryptography http instance-digest sha security technical ietf rfc standard

The Essential Message: Claude Shannon and the Making of Information Theory

2010 Apr 20, 9:34PermalinkCommentstechnical pdf information-theory cryptography history system:filetype:pdf system:media:document

Yahoo Issues Takedown Notice for Spying Price List | Threat Level | Wired.com

2009 Dec 7, 5:15"Yahoo isn’t happy that a detailed menu of the spying services it provides law enforcement agencies has leaked onto the web." ... "Cryptome also published lawful data-interception guides for Cox Communications, SBC, Cingular, Nextel, GTE and other telecoms and service providers. But of all those companies, it appears to be Yahoo’s lawyers alone who have issued a DMCA takedown notice to Cryptome demanding the document be removed."PermalinkCommentsprivacy security copyright yahoo dmca internet web surveillance

Compact E-Cash

2009 Aug 14, 6:20"This paper presents efficient off-line anonymous e-cash schemes where a user can withdraw a wallet containing coins each of which she can spend unlinkably."PermalinkCommentsmoney future reference research economics cryptography technical system:filetype:pdf system:media:document

Cryptography and the Law... - sci.crypt | Google Groups

2008 Oct 27, 1:39Rubber-hose cryptanalysis is first defined by Marcus J. Ranum on Oct 15 1990: "..unless you resort to the rubber-hose technique of cryptanalysis. (in which a rubber hose is applied forcefully and frequently to the soles of the feet until the key to the cryptosystem is discovered, a process that can take a surprisingly short time and is quite computationally inexpensive)"PermalinkCommentshumor cryptography rubber-hose security

obstcp - Google Code

2008 Oct 14, 11:14Similar in concept to the Pirate Bay suggestion of encrypting all TCP/IP connections if both server and client support it: "Obfuscated TCP is a transport layer protocol that adds opportunistic encryption. It's designed to hamper and detect large-scale wiretapping and corruption of TCP traffic on the Internet."PermalinkCommentsinternet tcp encryption security google privacy opensource cryptography network ssl

Pirate Bay wants total network encryption, but does anyone else?

2008 Jul 10, 4:44More on IPETEE w/ some of the politics and commentary. "The Pirate Bay has ambitious plans to bring end-to-end encryption to all network activity..."PermalinkCommentsarticle encryption privacy security ip cryptography

Technical Proposal (IPETEE) - TFR Wiki

2008 Jul 10, 4:43"The goal is to implement IP-transport encryption in a way that is transparent both to the IP-layer (including nodes in the network path) and to the applications that benefit from the encryption." Seems like a good idea to me.PermalinkCommentscryptography encryption internet privacy security ip wiki
Older Entries Creative Commons License Some rights reserved.