Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities Robert Merget and Juraj Somorovsky, Ruhr University Bochum; Nimrod Aviram, Tel Aviv University; Craig Young, Tripwire VERT; Janis Fliegenschmidt and Jörg Schwenk, Ruhr University Bochum; Yuval Shavitt, Tel Aviv University https://www.usenix.org/conference/usenixsecurity19/presentation/merget This paper is included in the Proceedings of the 28th USENIX Security Symposium. August 14–16, 2019 • Santa Clara, CA, USA 978-1-939133-06-9 Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX. Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities Robert Merget1, Juraj Somorovsky1, Nimrod Aviram2, Craig Young3, Janis Fliegenschmidt1, Jörg Schwenk1, and Yuval Shavitt2 1Ruhr University Bochum 2Department of Electrical Engineering, Tel Aviv University 3Tripwire VERT Abstract the encryption key. The attack requires a server that decrypts a message and responds with 1 or 0 based on the message va- The TLS protocol provides encryption, data integrity, and lidity. This behavior essentially provides the attacker with a authentication on the modern Internet. Despite the protocol’s cryptographic oracle which can be used to mount an adaptive importance, currently-deployed TLS versions use obsolete chosen-ciphertext attack. The attacker exploits this behavior cryptographic algorithms which have been broken using var- to decrypt messages by executing adaptive queries.Vaudenay ious attacks. One prominent class of such attacks is CBC exploited a specific form of vulnerable behavior, where im- padding oracle attacks. These attacks allow an adversary to plementations validate the CBC padding structure and re- decrypt TLS traffic by observing different server behaviors spond with 1 or 0 accordingly. which depend on the validity of CBC padding. This class of attacks has been termed padding oracle We present the first large-scale scan for CBC padding attacks. Different forms of padding oracle attacks were oracle vulnerabilities in TLS implementations on the mod- demonstrated to break cryptographic hardware [6], XML ern Internet. Our scan revealed vulnerabilities in 1.83% of Encryption [23], or web technologies like Java Server the Alexa Top Million websites, detecting nearly 100 differ- Faces [33] and ASP.NET web applications [15]. Rizzo and ent vulnerabilities. Our scanner observes subtle differences Duong used a padding oracle attack to steal secrets and forge in server behavior, such as responding with different TLS authentication tokens, gaining access to sensitive data [15]. alerts, or with different TCP header flags. In all of these works, the attacker was able to use a direct side We used a novel scanning methodology consisting of three channel – different error messages – to instantiate a padding steps. First, we created a large set of probes that detect vul- oracle and decrypt confidential data. nerabilities at a considerable scanning cost. We then reduced Transport Layer Security (TLS) employs CBC mode in a the number of probes using a preliminary scan, such that a MAC-then-Pad-then-Encrypt scheme which makes it poten- smaller set of probes has the same detection rate but is small tially vulnerable to these attacks. Indeed, different types of enough to be used in large-scale scans. Finally, we used the CBC padding oracles have been used to break confidential- reduced set to scan at scale, and clustered our findings with ity TLS connections [39, 4, 3, 20]. All these attacks require a novel approach using graph drawing algorithms. the attacker to perform precise timing measurements. This Contrary to common wisdom, exploiting CBC padding or- requirement stems from the properties of the TLS protocol; acles does not necessarily require performing precise timing after establishing a TLS connection, all TLS error messages measurements. We detected vulnerabilities that can be ex- are sent encrypted and are of the same length. Therefore, ploited simply by observing the content of different server even if an attacker is able to cause the server to send differ- responses. These vulnerabilities pose a significantly larger ent error messages, the attacker is generally unable to distin- threat in practice than previously assumed. guish between the different encrypted responses. Since most previous analyses have only analyzed padding 1 Introduction oracle attacks based on timing side channels, they required testing an implementation in a local environment. These In 2002, Vaudenay presented an attack which targets mes- evaluations uncovered many new vulnerabilities [4, 3, 20]. sages encrypted with the Cipher Block Chaining (CBC) However, implementing a proper countermeasure to these mode of operation [39]. The attack exploits the malleability vulnerabilities is very challenging and requires complex of the CBC mode, which allows altering the ciphertext such constant-time implementations. It is not surprising that the that specific cleartext bits are flipped, without knowledge of implementation of such countermeasures could introduce USENIX Association 28th USENIX Security Symposium 1029 new attacks. For example, in an attempt to fix the Lucky websites with this reduced test vector set within three days. 13 padding oracle, the OpenSSL cryptographic library intro- Our scanner observes different server responses, not only in duced a different vulnerability where OpenSSL responded the TLS layer, but also in the TCP layer, similar to [9]. Our with different TLS alert messages [37]. Analysis of imple- results indicate that about 1.83% of TLS servers are vulner- mentations in lab settings therefore requires laborious test- able to CBC padding oracle attacks. ing for each new version of different implementations. This is obviously unrealistic, and therefore this type of analysis is Minimizing false positives. When a host first displays vul- performed sporadically. nerable behavior, we rescan it to make sure the behavior is Given the complexity of constant-time TLS padding veri- not a scanning artifact. We only consider a host to be vulner- fication, we expect that vulnerabilities similar to the one in- able if it responds identically in three separate scans to each troduced by OpenSSL [37] could have been introduced in of our test vectors. It is unlikely that hosts will be mislabeled other implementations as well. Therefore, this work moves as vulnerable under this criterion. We therefore believe our away from the above method of lab analyses and evaluates statistics for vulnerability are a conservative lower estimate. CBC padding oracles using large-scale Internet scans. We attempt to answer the two following questions: How preva- lent are padding oracle vulnerabilities? Are these attacks Nearly 100 different padding oracle vulnerabilities. The only exploitable by using timing side-channels? detected vulnerabilities have to be clustered in order to notify different vendors. Until now, this was done manually [9]. Contributions. In our work, we employ a novel scan- To achieve this automatically, we re-scan vulnerable hosts ning methodology that is capable of scanning for TLS CBC against a larger set of test vectors. We refer to the set of the padding oracles at scale. We use this methodology to find host responses to all test vectors as the host’s response map. new padding oracle vulnerabilities and perform responsi- This response map is essentially a fingerprint of the host’s ble disclosures. We identify nearly 100 different padding vulnerability. We then cluster the scanned hosts according oracles. We show that some of them can be exploitable to their response maps. This process identified 93 different without subtle timing side channels and thus pose a signif- response maps, i.e., 93 different vulnerabilities. These vul- icantly larger threat in practice compared to most recently- nerabilities include different behaviors, ranging from typical discovered padding oracles. padding oracles with different TLS alert messages [39], to TCP connection timeouts triggered by specific invalid MAC New large-scale scanning methodology. Scanning at bytes, or closed connections observed when using invalid scale for padding oracles is challenging. Such scans detect padding values. vulnerabilities by sending different malformed inputs and We treat distinct response maps as distinct vulnerabilities. observing server behavior. As shown by Böck et al. [9], in We argue that this is the natural way to count vulnerabilities some cases these inputs only trigger vulnerabilities when us- since it captures the case of the same vulnerability occurring ing specific TLS versions or cipher suites. Scanning with in similar, yet different implementations. Consider two hosts all possible combinations of protocol versions, cipher suites that respond identically to all test vectors. These hosts likely and malformed inputs is not feasible since it would require share an identical or very similar part of the implementation an enormous number of connections to each scanned host. that causes the vulnerability to manifest with identical re- We overcome this limitation by carefully selecting a set sponse maps. However, they do not necessarily share the ex- of probes, which allows for effective scans at scale. We sys- act same code. They may use different versions of the same tematically analyzed padding oracles previously described in TLS library, or two different libraries with a shared compo- the literature [39, 4, 3, 20, 37, 27, 25, 10, 29, 28]. We then nent. carefully