Recommended
More Related Content
What's hot
What's hot (15)
Similar to No-Knowledge Crypto Attacks
Similar to No-Knowledge Crypto Attacks (20)
More from BaronZor
Recently uploaded
Recently uploaded (20)
No-Knowledge Crypto Attacks
- 1. COPYRIGHT TRUSTWAVE 2011 Presented by: No-Knowledge Crypto Attacks Daniel Crowley
- 2. Structure › Background › Attack! › Potential Win
- 3. IDENTIFYING CIPHERTEXT “Yep, it‟s wood”
- 4. Properties of ciphertext › Appears random › Generally encoded › Decoded length often multiple of 8/16/32 –Block ciphers
- 5. Example › Base64 encoded › Decodes to 80 bytes › Ent shows strong signs of randomness › Probably ciphertext (okay, it is, I generated it)
- 6. REPLAY ATTACK Bait and switch
- 7. Background › Reuse of cryptovariables › Trust in decrypted data
- 8. Attack! › Reuse ciphertext OR › Find two places where ciphertext is being accepted › Swap them around
- 9. Potential Win › Ciphertext from “article.php?id=(ciphertext)” › Placed in “doPasswordReset.php?userid=(ciphertext)” › Reset password for another user
- 10. DECRYPTION ORACLE Decrypt ALL the things!
- 11. Background › Application takes encrypted input › Application decrypts input › Application gives you decrypted output
- 12. Identifying Decryption Oracles › Look for encrypted input › Modify input and look for garbled response
- 13. Attack! › Take ciphertext from another location › Plug into decryption oracle
- 14. Potential Win › “Password” cookie with encrypted value › Plug cookie into decryption oracle › PASSWORDS!
- 15. ENCRYPTION ORACLE Encrypt ALL the things!
- 16. Background › Application takes plaintext input › Application encrypts input › Application gives you encrypted output
- 17. Identifying Encryption Oracles › Look for ciphertext in responses › Modify input and look for modified ciphertext › Length is often the giveaway
- 18. Attack! › Encrypt strings like ‘ or 1=1# › Plug encrypted string into any encrypted input › Cross your fingers
- 19. Potential Win › resetpass.php?id=(ciphertext) › resetpass.php?id=( ENC(„ or 1=1 #) ) › SQLi!
- 20. STREAM CIPHER BIT FLIPPING Flipping easy
- 21. Background › Construction is simple › Same key & IV means same keystream › Reusing cryptovariables means catastrophic failure
- 22. 0 1 1 0 0 1 0 0 1 0 1 0 1 0 1 0 1 1 0 0 1 1 1 0
- 23. 0 1 1 0 0 1 0 1 1 0 1 0 1 0 1 0 1 1 0 0 1 1 1 1
- 24. Attack! › Flip bits in ciphertext input › Same bits in plaintext are flipped › No modification to other parts of message
- 25. Potential Win › Plaintext –username=fred&admin=0 › Flip lots of bits until… –username=fred&admin=1
- 26. STREAM CIPHER KEYSTREAM RECOVERY I couldn‟t think of anything funny for this one
- 27. Attack! › Guess plaintext of an encrypted message › XOR plaintext and ciphertext to get suspected keystream › XOR suspected keystream with unknown ciphertext –Attempt to read message
- 28. Definite Win › Ability to encrypt and decrypt anything – In byte positions where known plaintext resides
- 29. ECB BLOCK SHUFFLING Every day I‟m shufflin‟
- 30. Background › ECB is a block cipher mode › Each block is encrypted independent of others › Blocks can be reordered, removed, duplicated
- 31. BLOCK 1 CIPHER BLOCK 1 BLOCK 2 CIPHER BLOCK 2 BLOCK 3 CIPHER BLOCK 3 PLAIN TEXT CIPHER TEXT
- 32. Attack! › Shuffle blocks around randomly in encrypted messages › Cross your fingers!
- 33. Plaintext before modification 0 1 2 3 4 5 6 7 L A S T V I S I T E D = / E N / H O M E . J S P & U S E R I D = 1 2 3 4 x04 x04 x04 x04 lastVisited=/en/home.jsp&userId=1234
- 34. Plaintext after modification 0 1 2 3 4 5 6 7 L A S T V I S I T E D = / E N / H O M E . J S P & U S E R I D = 1 & F O O = B A 1 2 3 4 x04 x04 x04 x04 lastVisited=/en/home.jsp&userId=1&foo=ba1234
- 35. CBC BIT FLIPPING Flipping awesome
- 36. Background › CBC is a block cipher mode › When decrypting, each block affects next block › Flipping bits in ciphertext block n – Garbles plaintext block n – Flips same bits in plaintext block n+1
- 37. BLOCK A IV CIPHER BLOCK A BLOCK B CIPHER BLOCK B BLOCK C CIPHER BLOCK C PLAIN TEXT CIPHER TEXT
- 38. BLOCK A IV CIPHER BLOCK A BLOCK B CIPHER BLOCK B BLOCK C CIPHER BLOCK C PLAIN TEXT CIPHER TEXT
- 39. Attack! › Submit ciphertext multiple times › Flip a different bit each time › Cross your fingers!
- 40. Potential Win › Plaintext is: –lastVisited=http://example.com/home.jsp&u id=124%01 –(lastVisited=http)(://example.com/h)(ome.js p&uid=124%01) • Split into 16 byte blocks › Flip bits in bytes 13-15 in block 2 –Block 2 becomes garbage –“124” in block 3 has bits flipped in plaintext
- 42. Other Fun Attacks › Padding Oracles – padBuster.pl › Hash length extension attacks – Hash_extender
Editor's Notes
- If you care how it works, pay attention to the Background slidesBuy me a beer and ask for more detailsMore understanding makes these attacks more effective
- Ciphertext generated using a sound algorithm shows signs of randomnessEnt is a nice tool for testing randomness of datahttp://fourmilab.ch/randomRandom bytes play hell with lots of protocolsUsual suspects:Base64URL-safe Base64ASCII hexURL encodingDecoded length is often a multiple of 8/16/32 bytesAuthenticated crypto generally adds another 4 bytes
- Developers reuse cryptovariablesKeyIVCipherDevelopers usually reuse cryptovariables and trust that the data they have decrypted using their application is sane, due to the poor assumption that no one can generate or alter the encrypted data without the key.No input validationNo error handling
- Similar to fuzzing for XSSBit flipping should produce garbled dataWith authenticated crypto, swapping ciphertext might work
- Similar to fuzzing for XSS
- Stream ciphersProduce pseudo-random bytes (keystream) using key & IVEncryption/Decryption: XOR with keystreamIV reuse was the downfall of WEP
- Here is a multi-byte XOR operation. We assume this to be a part of a stream cipher. The middle row is the keystream, which is XORed with the ciphertext to decrypt the message.
- We do not know the keystream, but we know that flipping the bits of the ciphertext results in corresponding bits of the plaintext being flipped.
- Other messages’ blocks can be used tooRequires key reuse