padding oracle attack

10,443 views
10,561 views

Published on

Published in: Education, Technology
2 Comments
1 Like
Statistics
Notes
No Downloads
Views
Total views
10,443
On SlideShare
0
From Embeds
0
Number of Embeds
5,424
Actions
Shares
0
Downloads
89
Comments
2
Likes
1
Embeds 0
No embeds

No notes for slide

padding oracle attack

  1. 1. Padding Oracle Attacks Satish B Satishb3@securitylearn.netOWASP20/08/2011 Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation http://www.owasp.org
  2. 2. Cryptography Attack OWASP 2
  3. 3. AgendaCryptography BasicsPadding oracle attackExploitationPadding oracle in .NETToolsRemedy OWASP 3
  4. 4. Cryptography BasicsStream Ciphers : Key supplied to encryption algorithm to get key stream Plain text is XOR with key stream to generate cipher text Ex: Rc4 1 0=1 P K=C 0 1=1 C P=KBlock Ciphers: Operates on fixed length group of bits or bytes (64 or 128 bit blocks) 128 bits of plain text is converted into 128 bits of cipher text Ex: AES 4 OWASP
  5. 5. Cryptography BasicsBlock Cipher : ModesECB mode – Electronic code book mode Encryption of the same plain text with the same key results in the same cipher text, which is a considerable threat to security. 5 OWASP
  6. 6. Cryptography BasicsCBC – cipher block chaining Ci = Ek (Pi xor Ci-1)Encryption of the same plain text with the same key results in different ciphertext because of IV.Each block of plaintext is XORed with the previous ciphertext block beforebeing encrypted. 6 OWASP
  7. 7. Cryptography Basics Each block of ciphertext is decrypted and XORed with the previous ciphertext block to obtain the plain text. First block of ciphertext is decrypted and XORed with IV to obtain the plain text. 7 OWASP
  8. 8. Cryptography BasicsBlock Ciphers – - Works on fixed size data - Messages are in variety of length - padding has introduced - Final block padded before encryptionPKCS#5 standard - final block of plaintext is padded with N bytes of value N. 8 OWASP
  9. 9. Padding oracle attackInitially discovered in 2002. Credits: http://netifera.com/research/Got famous in 2010.What is it ? Possible to decrypt and encrypt data without key in CBC mode.Typical Scenario:  Brian logged into myapp.com  Server created an encryption string specific to Brian and sent to him  Accessing any page in the application sends the encrypted value to server  Server decrypts and serves the content based on decrypted valueEx:http://myapp.com/home.jsp?UID=7B216A634951170FF851D6CC68FC9537858795A28ED4AAC6 9 OWASP
  10. 10. Padding oracle attack Client data value = BRIAN;12;1; IV=7B216A634951170F F851D6CC68FC9537 10 OWASP 858795A28ED4AAC6
  11. 11. Padding oracle attackClient datahttp://myapp.com/home.jsp?UID=7B216A634951170FF851D6CC68FC9537858795A28ED4AAC6 11 OWASP
  12. 12. Padding oracle attackhttp://myapp.com/home.jsp?UID=7B216A634951170FF851D6CC68FC9537858795A28ED4AAC6The application verifies whether the encrypted value is properly padded or not.When the application passed an encrypted value it responds with one of three ways: Valid ciphertext (with proper padding) – Normal response Invalid ciphertext (improper padding) – Exception Valid ciphertext and decrypts to an invalid value – Custom errorWrong padding can result in:  Error messages  Stack Traces  Time difference  Different responses 12 OWASP
  13. 13. Padding oracle attack oracle refers to a mechanism in cryptography that can be used to determine whether a test has passed or failed. Pass and Fail conditions can be used to decrypt without key.Decrypting without a keyValid cipherhttp://myapp/home.jsp?UID=7B216A634951170FF851D6CC68FC9537Invalid cipherhttp://myapp/home.jsp?UID=0000000000000000F851D6CC68FC9537 13 OWASP
  14. 14. Padding oracle attackInvalid cipherhttp://myapp/home.jsp?UID=0000000000000001F851D6CC68FC9537 14 OWASP
  15. 15. Padding oracle attackInvalid cipherhttp://myapp/home.jsp?UID=0000000000000003F851D6CC68FC9537 Intermediary Byte ^ 0×3C == 0×01, Intermediary Byte == 0×3C ^ 0×01, Intermediary Byte == 0×3D 15 OWASP
  16. 16. Padding oracle attackValid cipherhttp://myapp/home.jsp?UID=7B216A634951170FF851D6CC68FC9537 Plain text == Intermediary byte 0×3D ^ corresponding IV byte 0F = = 02Now crack the 7th byte and so on … In the end it gives Intermediate value 16 OWASP
  17. 17. Padding oracle attackEncrypting arbitrary values without key XOR the plaintext value with intermediary value to get IV Summary Padding oracle attack allows to encrypt and decrypt data without the key. 17 OWASP
  18. 18. Padding oracle attack in .NETWhere is it applicable ? View state Session cookies Any encrypted data in hidden parameters WebResource.axd - serves embedded resources ScriptResource.axd - serves embedded resources and files 18 OWASP
  19. 19. Padding oracle attack in .NEThttps://samplesite.com/WebResource.axd?d=llIAeUHrAWkUZEuvZB-98g2 valid cipher text decrypted to valid value - proper response (200 ok) valid cipher text decrypted to invalid value - page not found or similar response (404) Invalid cipher text - padding errorIf the application gives different errors in the above 3 cases, it is vulnerableand easy to exploit. 19 OWASP
  20. 20. Tools Padbusterhttps://www.gdssecurity.com/l/t/d.php?k=PadBuster Poethttp://netifera.com/research/ Padbusterdotnethttp://www.mindedsecurity.com/fileshare/padBusterdotnet.zip 20 OWASP
  21. 21. Padding oracle attackWhy Is this working?  CBC mode only provides confidentiality.  Confidentiality doe not ensure that the value is tampered or not.  Integrity check has to be performed. Solution  Implemented integrity check by adding hash to the encrypted value Before fix : http://website.com/application/WebResource.axd?d=jzjghMVYzFihd9Uhe_arpA2 After fix: http://website.com/application/WebResource.axd?d=jadfz0GadfahafMVYzFihd9Uh 21 adfadfdfdfe_aereradf349jkMjlrfgRr6moijfdn_Aretkjf093rpA2 OWASP
  22. 22. For more information on exploitation and usage of tools visit my sitehttp://www.securitylearn.netReferenceshttp://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.htmlhttp://weblogs.asp.net/scottgu/archive/2010/09/28/asp-net-security-update-now-available.aspxhttp://eglasius.blogspot.com/2010/09/aspnet-padding-oracle-how-it-relates-to.htmlhttp://www.gdssecurity.com/l/b/2010/09/14/automated-padding-oracle-attacks-with-padbuster/ 22 OWASP
  23. 23. Questions? 23 OWASP

×