Heartbleed Debugged – Openssl & CVE-2014-0160
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Libressl Presentatie2
Birth of LibreSSL and its current status Frank Timmers Consutant, Snow B.V. Background What is LibreSSL • A fork of OpenSSL 1.0.1g • Being worked on extensively by a number of OpenBSD developers What is OpenSSL • OpenSSL is an open source SSL/TLS crypto library • Currently the de facto standard for many servers and clients • Used for securing http, smtp, imap and many others Alternatives • Netscape Security Services (NSS) • BoringSSL • GnuTLS What is Heartbleed • Heartbleed was a bug leaking of private data (keys) from both client and server • At this moment known as “the worst bug ever” • Heartbeat code for DTLS over UDP • So why was this also included in the TCP code? • Not the reason to create a fork Why did this happen • Nobody looked • Or at least didn’t admit they looked Why did nobody look • The code is horrible • Those who did look, quickly looked away and hoped upstream could deal with it Why was the code so horrible • Buggy re-implementations of standard libc functions like random() and malloc() • Forces all platforms to use these buggy implementations • Nested #ifdef, #ifndefs (up to 17 layers deep) through out the code • Written in “OpenSSL C”, basically their own dialect • Everything on by default Why was it so horrible? crypto_malloc • Never frees memory (Tools like Valgrind, Coverity can’t spot bugs) • Used LIFO recycling (Use after free?) • Included debug malloc by default, logging private data • Included the ability to replace malloc/free at runtime #ifdef trees • #ifdef, #elif, #else trees up to 17 layers deep • Throughout the complete source • Some of which could never be reached • Hard to see what is or not compiled in 1. -
Arxiv:1911.09312V2 [Cs.CR] 12 Dec 2019
Revisiting and Evaluating Software Side-channel Vulnerabilities and Countermeasures in Cryptographic Applications Tianwei Zhang Jun Jiang Yinqian Zhang Nanyang Technological University Two Sigma Investments, LP The Ohio State University [email protected] [email protected] [email protected] Abstract—We systematize software side-channel attacks with three questions: (1) What are the common and distinct a focus on vulnerabilities and countermeasures in the cryp- features of various vulnerabilities? (2) What are common tographic implementations. Particularly, we survey past re- mitigation strategies? (3) What is the status quo of cryp- search literature to categorize vulnerable implementations, tographic applications regarding side-channel vulnerabili- and identify common strategies to eliminate them. We then ties? Past work only surveyed attack techniques and media evaluate popular libraries and applications, quantitatively [20–31], without offering unified summaries for software measuring and comparing the vulnerability severity, re- vulnerabilities and countermeasures that are more useful. sponse time and coverage. Based on these characterizations This paper provides a comprehensive characterization and evaluations, we offer some insights for side-channel of side-channel vulnerabilities and countermeasures, as researchers, cryptographic software developers and users. well as evaluations of cryptographic applications related We hope our study can inspire the side-channel research to side-channel attacks. We present this study in three di- community to discover new vulnerabilities, and more im- rections. (1) Systematization of literature: we characterize portantly, to fortify applications against them. the vulnerabilities from past work with regard to the im- plementations; for each vulnerability, we describe the root cause and the technique required to launch a successful 1. -
Crypto Projects That Might Not Suck
Crypto Projects that Might not Suck Steve Weis PrivateCore ! http://bit.ly/CryptoMightNotSuck #CryptoMightNotSuck Today’s Talk ! • Goal was to learn about new projects and who is working on them. ! • Projects marked with ☢ are experimental or are relatively new. ! • Tried to cite project owners or main contributors; sorry for omissions. ! Methodology • Unscientific survey of projects from Twitter and mailing lists ! • Excluded closed source projects & crypto currencies ! • Stats: • 1300 pageviews on submission form • 110 total nominations • 89 unique nominations • 32 mentioned today The People’s Choice • Open Whisper Systems: https://whispersystems.org/ • Moxie Marlinspike (@moxie) & open source community • Acquired by Twitter 2011 ! • TextSecure: Encrypt your texts and chat messages for Android • OTP-like forward security & Axolotl key racheting by @trevp__ • https://github.com/whispersystems/textsecure/ • RedPhone: Secure calling app for Android • ZRTP for key agreement, SRTP for call encryption • https://github.com/whispersystems/redphone/ Honorable Mention • ☢ Networking and Crypto Library (NaCl): http://nacl.cr.yp.to/ • Easy to use, high speed XSalsa20, Poly1305, Curve25519, etc • No dynamic memory allocation or data-dependent branches • DJ Bernstein (@hashbreaker), Tanja Lange (@hyperelliptic), Peter Schwabe (@cryptojedi) ! • ☢ libsodium: https://github.com/jedisct1/libsodium • Portable, cross-compatible NaCL • OpenDNS & Frank Denis (@jedisct1) The Old Standbys • Gnu Privacy Guard (GPG): https://www.gnupg.org/ • OpenSSH: http://www.openssh.com/ -
Post-Quantum Authentication in Openssl with Hash-Based Signatures
Recalling Hash-Based Signatures Motivations for Cryptographic Library Integration Cryptographic Libraries OpenSSL & open-quantum-safe XMSS Certificate Signing in OpenSSL / open-quantum-safe Conclusions Post-Quantum Authentication in OpenSSL with Hash-Based Signatures Denis Butin, Julian Wälde, and Johannes Buchmann TU Darmstadt, Germany 1 / 26 I Quantum computers are not available yet, but deployment of new crypto takes time, so transition must start now I Well established post-quantum signature schemes: hash-based cryptography (XMSS and variants) I Our goal: make post-quantum signatures available in a popular security software library: OpenSSL Recalling Hash-Based Signatures Motivations for Cryptographic Library Integration Cryptographic Libraries OpenSSL & open-quantum-safe XMSS Certificate Signing in OpenSSL / open-quantum-safe Conclusions Overall Motivation I Networking requires authentication; authentication is realized by cryptographic signature schemes I Shor’s algorithm (1994): most public-key cryptography (RSA, DSA, ECDSA) breaks once large quantum computers exist I Post-quantum cryptography: public-key algorithms thought to be secure against quantum computer attacks 2 / 26 Recalling Hash-Based Signatures Motivations for Cryptographic Library Integration Cryptographic Libraries OpenSSL & open-quantum-safe XMSS Certificate Signing in OpenSSL / open-quantum-safe Conclusions Overall Motivation I Networking requires authentication; authentication is realized by cryptographic signature schemes I Shor’s algorithm (1994): most public-key -
Black-Box Security Analysis of State Machine Implementations Joeri De Ruiter
Black-box security analysis of state machine implementations Joeri de Ruiter 18-03-2019 Agenda 1. Why are state machines interesting? 2. How do we know that the state machine is implemented correctly? 3. What can go wrong if the implementation is incorrect? What are state machines? • Almost every protocol includes some kind of state • State machine is a model of the different states and the transitions between them • When receiving a messages, given the current state: • Decide what action to perform • Which message to respond with • Which state to go the next Why are state machines interesting? • State machines play a very important role in security protocols • For example: • Is the user authenticated? • Did we agree on keys? And if so, which keys? • Are we encrypting our traffic? • Every implementation of a protocol has to include the corresponding state machine • Mistakes can lead to serious security issues! State machine example Confirm transaction Verify PIN 0000 Failed Init Failed Verify PIN 1234 OK Verified Confirm transaction OK State machines in specifications • Often specifications do not explicitly contain a state machine • Mainly explained in lots of prose • Focus usually on happy flow • What to do if protocol flow deviates from this? Client Server ClientHello --------> ServerHello Certificate* ServerKeyExchange* CertificateRequest* <-------- ServerHelloDone Certificate* ClientKeyExchange CertificateVerify* [ChangeCipherSpec] Finished --------> [ChangeCipherSpec] <-------- Finished Application Data <-------> Application Data -
You Really Shouldn't Roll Your Own Crypto: an Empirical Study of Vulnerabilities in Cryptographic Libraries
You Really Shouldn’t Roll Your Own Crypto: An Empirical Study of Vulnerabilities in Cryptographic Libraries Jenny Blessing Michael A. Specter Daniel J. Weitzner MIT MIT MIT Abstract A common aphorism in applied cryptography is that cryp- The security of the Internet rests on a small number of open- tographic code is inherently difficult to secure due to its com- source cryptographic libraries: a vulnerability in any one of plexity; that one should not “roll your own crypto.” In par- them threatens to compromise a significant percentage of web ticular, the maxim that complexity is the enemy of security traffic. Despite this potential for security impact, the character- is a common refrain within the security community. Since istics and causes of vulnerabilities in cryptographic software the phrase was first popularized in 1999 [52], it has been in- are not well understood. In this work, we conduct the first voked in general discussions about software security [32] and comprehensive analysis of cryptographic libraries and the vul- cited repeatedly as part of the encryption debate [26]. Conven- nerabilities affecting them. We collect data from the National tional wisdom holds that the greater the number of features Vulnerability Database, individual project repositories and in a system, the greater the risk that these features and their mailing lists, and other relevant sources for eight widely used interactions with other components contain vulnerabilities. cryptographic libraries. Unfortunately, the security community lacks empirical ev- Among our most interesting findings is that only 27.2% of idence supporting the “complexity is the enemy of security” vulnerabilities in cryptographic libraries are cryptographic argument with respect to cryptographic software. -
Analysis of Software Vulnerabilities Through Historical Data
Analysis of software vulnerabilities through historical data Magnus Törnquist [email protected] Department of Electrical and Information Technology Lund University Supervisor: Martin Hell Assistant Supervisor: Jonathan Sönnerup Examiner: Thomas Johansson June 29, 2017 c 2017 Printed in Sweden Tryckeriet i E-huset, Lund Popular science summary Lately there has been increasing media coverage of cyber crime, especially in re- lation to the elections in France and the United States. Every day information is being stolen from governments, businesses and private citizens. Information that can be sold, used for blackmail or for other nefarious purposes. Commonly this information is obtained through exploiting vulnerabilities in software. A vulnera- bility is essentially a bug in the code and they are very hard to avoid, especially in large complex programs. Having vulnerabilities in software is inevitable and software is everywhere: in every computer, router, webcam, mobile device and even in some coffeemakers. As long as these devices are connected an intruder has a wide variety of options on how to attack a network and the fast growth of Internet of Things (IoT) has lead to a huge amount of new devices on networks all over the world. This reality means that larger organizations have to spend a lot of time making sure all their software is updated and keeping track of potential breaches. This also means that it is very important for the software developer to maintain their code and patch any discovered vulnerabilities quickly. So how does an organization, the developer of an IoT product or a regular user choose which software to use if they are concerned about software security and is there a way to help them do it? That is what this thesis explores. -
Analyzing Semantic Correctness of Security-Critical Algorithm Implementations with Symbolic Execution
Poster: Analyzing Semantic Correctness of Security-critical Algorithm Implementations with Symbolic Execution Author: Sze Yiu Chau ([email protected]) Affiliation: Purdue University Poster Abstract: In order to achieve security, protocol implementations not only need to avoid low-level memory access errors, but also faithfully follow and fulfill the requirements prescribed by the protocol specifications at the semantic level. Failure to do so could lead to compatibility issues and damage the security guarantees intended by the original design. In this poster, I will discuss how to use symbolic execution to analyze semantic correctness of implementations of security-critical algorithms. The main intuition is that, while symbolic execution faces scalability challenges, it provides a systematic means of exploring possible execution paths and a formula-based abstraction, both of which are useful in finding semantic level implementation flaws. In many cases, scalability challenges can be avoided with concolic inputs carefully crafted by exploiting features of the input formats used by target protocols, along with optimizations based on domain knowledge that can help prune the search space. As examples, the poster will first present our previous work on analyzing implementations of X.509 certificate validation. Our analysis of 9 small footprint TLS libraries has uncovered 48 instances of noncompliance, as well as some inaccurate claims in a previous work based on blackbox fuzzing. It will then discuss our most recent work on analyzing implementations of PKCS#1 v1.5 RSA signature verification, and explain how some of the implementation flaws we found in crypto libraries and IPSec software suites can lead to authentication bypass and denial-of-service attacks due to new variants of the Bleichenbacher-style low-exponent RSA signature forgery. -
IETF Hackathon
IETF 106 TEEP Hackathon Report Akira Tsukamoto, Nov. 19, 2019 IETF 106 Hackathon - TEEP 1 What we planned • Open Trust Protocol: • Evaluate OTrPv1 vs TEEP (aka OTrPv2) proposal • Test implementations of OTrP-over-HTTP • draft-ietf-teep-otrp-over-http-02 • Brought prototypes of TAM and TEEP device • TAM with node-js by Isobe-san • TAM with SGX by Dave Thaler • TEEP device on OP-TEE by Akira Tsukamoto • TEEP device on SGX by Dave Thaler IETF 106 Hackathon - TEEP 2 Great TEEm IETF 106 Hackathon - TEEP 3 What got done • First time to interop OTrP/TEEP protocol implementations built from specs. • See pictures on following pages. IETF 106 Hackathon - TEEP 4 On the Table IETF 106 Hackathon - TEEP 5 TAM`s UI for uploading TA IETF 106 Hackathon - TEEP 6 TEEP device IETF 106 Hackathon - TEEP 7 Hacking, Debugging! IETF 106 Hackathon - TEEP 8 TEEP Device installing TA IETF 106 Hackathon - TEEP 9 What we learned • Filed issues • draft-ietf-teep-otrp-over-http-03 • #5: demuxing TEEP vs OTrP • draft-tschofenig-teep-protocol-00.txt • Would like to have JSON example • A lot of implementation action items • Prerequisite required for OTrP/TEEP • HTTP, JSON, CBOR stack must be completely working • Understand TEE concepts, such as SGX, Arm TrustZone, knowledge of implementation details (e.g. OP-TEE) IETF 106 Hackathon - TEEP 10 What went well • Constructing stand alone wired network on Hackathon table for TAMs and TEEP devices but having uplink • This will prevent harming IETF network when sending broken packets. • My TEEP device needs to talk to ntp, since does not have RTC. -
Kryptering, Teknikker Og Pro- Tokollerne Der Bruges Pa˚ Internet Idag, Herunder: Ipsec, SSL/TLS, PGP, PKI, AES M.fl
Welcome to Penetration testing IV cryptography og cracking Henrik Lund Kramshøj, internet samurai [email protected] http://www.solidonetworks.com c license CC BY 3.0. 2014 Solido Networks, Henrik Lund Kramshøj 1 Formalet˚ idag Introducere nogle almindelige protokoller og deres krav Introducere basale penetrationstest værktøjer indenfor kryptografi Skabe en grundig forstaelse˚ for praktisk anvendelig kryptografi c license CC BY 3.0. 2014 Solido Networks, Henrik Lund Kramshøj 2 Generic advice Recommendations • Lock your devices, phones, tables and computers • Update software and apps • Do NOT use the same password everywhere • Watch out when using open wifi-networks • Multiple browsers: one for Facebook, and separate for home banking apps? • Multiple laptops? One for private data, one for work? • Think of the data you produce, why do people take naked pictures and SnapChat them? • Use pseudonyms and aliases, do not use your real name everywhere • Enable encryption: IMAPS POP3S HTTPS TOR OpenPGP VPN SS- L/TLS c license CC BY 3.0. 2014 Solido Networks, Henrik Lund Kramshøj 3 Stop watching us! c license CC BY 3.0. 2014 Solido Networks, Henrik Lund Kramshøj 4 Appropriate paranoia Source: google paranoia definition c license CC BY 3.0. 2014 Solido Networks, Henrik Lund Kramshøj 5 Face reality From the definition: suspicion and mistrust of people or their actions without evidence or justifica- tion. ”the global paranoia about hackers and viruses” It is not paranoia when: • Criminals sell your credit card information and identity theft • Trade infected computers like a commodity • Governments write laws that allows them to introduce back-doors - and use these • Governments do blanket surveillance of their population • Governments implement censorship, threaten citizens and journalist You are not paranoid when there are people actively attacking you! c license CC BY 3.0. -
The Case of Openssl
The Impact of a Major Security Event on an Open Source Project: The Case of OpenSSL James Walden [email protected] Northern Kentucky University Highland Heights, KY ABSTRACT larger, as OpenSSL was the default cryptographic library for An- Context: The Heartbleed vulnerability brought OpenSSL to interna- droid devices, and more than one billion Android devices shipped tional attention in 2014. The almost moribund project was a key in 2014 [34]. security component in public web servers and over a billion mobile At the time of Heartbleed, the OpenSSL project was largely devices. This vulnerability led to new investments in OpenSSL. inactive, except for an ever-growing number of unaddressed issues. Objective: The goal of this study is to determine how the Heart- The project had no full time developers, and the OpenSSL Software bleed vulnerability changed the software evolution of OpenSSL. We Foundation received about $2,000 per year in donations [21]. There study changes in vulnerabilities, code quality, project activity, and were no policies for handling issues or vulnerabilities. OpenSSL software engineering practices. had no release plan, and the project was still supporting version Method: We use a mixed methods approach, collecting multiple 0.9.8, which had been released in 2005. Project source code was types of quantitative data and qualitative data from web sites and complex and difficult to understand and maintain, while the project an interview with a developer who worked on post-Heartbleed team was small with static membership [13]. changes. We use regression discontinuity analysis to determine The goal of this case study is to understand how the OpenSSL changes in levels and slopes of code and project activity metrics project responded to the Heartbleed vulnerability. -
Solution Brief
THE TRUE COST OF OPEN SOURCE SECURITY SOFTWARE FOR THE INTERNET OF THINGS THE RISKS AND HIDDEN COSTS OF “FREE” OPEN SOURCE SECURITY Mocana Corporation Copyright 2017 www.mocana.com IS OPEN SOURCE SECURITY vulnerabilities, provide a patch and update the affected systems. SUITABLE FOR MISSION-CRITICAL IOT? Vulnerabilities According to analysts, there will be more Open source cybersecurity software than 20 billion connected devices by such as OpenSSL, WolfSSL, MbedTLS 2020. Already, there are more than eight and LibreSSL have had more than 200 billion Internet of Things (IoT) devices, published vulnerabilities. Of those including connected vehicles, industrial vulnerabilities, OpenSSL is responsible manufacturing and agricultural devices, for 184, most of which still have not been medical and fitness devices, electricity patched. In 2016 alone, OpenSSL and gas smart meters, and home and experienced 34 vulnerabilities, at a rate building automation systems. of nearly three vulnerabilities per month. Each of these vulnerabilities How do we ensure that these connected require attention and represent systems are safe and reliable? With significant risk and drain on resources to safety, reliability and lives at stake, we the companies that use open source must make sure these systems are i software for security across their protected. According to a recent study product lines. by Black Duck, more than 55% of companies leverage open source software (OSS) for production Slow RemediAtion infrastructure, an increase of 65% from According to a security reportiii, most the prior year. companies take an average of 100-120 days to patch vulnerabilities. According to OpenSSL Foundation, it takes on WHY OPEN SOURCE SECURITY? average 40 days to release a security Why are companies selecting OSS for patch from the day they find out about production applications? According to the vulnerability.