Your SlideShare is downloading. ×
OWASP Much ado about randomness
Upcoming SlideShare
Loading in...5

Thanks for flagging this SlideShare!

Oops! An error has occurred.

Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

OWASP Much ado about randomness


Published on

1 Like
  • Be the first to comment

No Downloads
Total Views
On Slideshare
From Embeds
Number of Embeds
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

No notes for slide
  • Transcript

    • 1. 1 Much Ado About Randomness. What Is a Random Number? Aleksandr Yampolskiy, Ph.D. Gilt Groupe
    • 2. Randomness Random number generation is easy to get wrong.
    • 3. 3 In Theory • Cryptography is based on random numbers: – Secret keys must be random – Random bits are needed for public-key encryption, signatures, SSL, etc. • A common assumption in theory is a random oracle model, where all parties have access to a perfect random source [BR92]. • Under this assumption, many crypto tools can be proven formally secure.
    • 4. In Practice • Kaminsky bug used to poison DNS caches. • Debian OpenSSL versions <0.9.8g-9 generated weak SSL keys. • Some Majordomo versions were susceptible to subscribing victim to thousands of mailing lists. • Kerberos 4 secret keys could be guessed in a few seconds. • Netscape 1.1 generated SSL keys using time and process ID as seed; easily guessable and breakable.
    • 5. Example #1 - unsigned char magic_cookie[LEN]; - srand(time(NULL)); - for (int i=0; i<LEN; i++) magic_cookie[i] = rand() & 0xFF; X Windows “magic cookie” used a weak LCG generator and was guessable in X11R6.
    • 6. Example #2 protected void doStart() { //… _random=new java.util.Random(); _random.setSeed(_random.nextLong()^System.currentTimeMillis() ^hashCode()^Runtime.getRuntime().freeMemory()); _sessions = new MultiMap(); //... } Jetty 4.2.26 used java.util.Random to generate predictable session ID which could be brute-forced.
    • 7. 7 Example #3 • global variable seed; • function RNG_CreateContext() – (seconds, microseconds) = time of day; – pid = process ID; ppid = parent process ID; – a = mklcpr(microseconds); – b = mklcpr(pid + seconds + (ppid << 12)); – seed = MD5(a, b); • function mklcpr(x) // simple scrambler – return ((0xDEECE66D * x + 0x2BBB62DC) >> 1); • function MD5(x) // secure hash function In 1996, two UC Berkeley students reverse exploit Netscape 1.1
    • 8. Lessons Learnt • Numbers, used to derive session IDs and keys, weren’t truly random! • Seeds must be unpredictable – 128 bit sequences are sufficient – All possibilities equally likely – Best seeds are truly random • PRG (pseudorandom number generator) must be secure – No detectable pattern – Even if attacker guesses some pseudorandom bits, no correlation to other bits.
    • 9. 9 Two Types of Randomness • Truly random number generator – Radioactive decay. – Disk timing. – Fair coin flip. – Randomness inherent in PC disk IO, thread scheduling, etc.. • Pseudo-random number generator (aka computational) – Generate a small “truly random” seed. – Stretch into a larger pseudo-random sequence. • Fact: In practice, we use pseudo-random number generators.
    • 10. 11 What is (Pseudo)-Random? (cont.) PRG random seed pseudorandom string random string look indistinguishable to any efficient observer Definition [Blum-Micali-Yao]: PRG is a polytime function whose output is indistinguishable from random by any efficient observer 01010111001… 11010011010… 1001
    • 11. 12 Find programs with weak PRGFind programs with weak PRG Break-inBreak-in Attacking Weak PRGs Guess the initial seed of a PRG Guess the initial seed of a PRG Guess the state of a PRG Guess the state of a PRG
    • 12. Finding programs with weak PRG • If source code is available, grep for weak API calls. • If only a binary is available, reverse engineer the program or grep for weak system calls. • For client programs, use Stompy or Ent to analyze output’s randomness quality. • For web-based programs, use BurpSuite or WebScarab proxy to analyze session ID randomness. • Google Hacking for weak session IDs.
    • 13. Finding programs with weak PRG (cont.) • High-entropy session ID generators use things like: • (Java) • System.Security.Cryptography.RNGCryptoServiceProvider (.NET) • /dev/urandom, /dev/(s)random (if the latter, look for exhaustion attacks!) • OpenSSL’s RAND bytes • hardware security module. • It’s pretty easy to quickly identify weak, low-entropy session ID generation in the code. They use • the time and date • a random static string in the source code • the output of C library rand, the output of java.util.Random • small (32 bits or less) numbers • a cryptographic hash (like MD5) of anything low in entropy to generate their session IDs.
    • 14. Know Weak API •The weak API generally use insecure constructions such as LCG, LSFR, Mersenne twister, etc. •The strong API may use DES, SHA-1 based PRNG, Blum-Blum- Shub, etc.
    • 15. Reverse Engineering The Binaries • Many Java programs mistakenly use java.util.Random to generate session IDs instead of root# javap -c BadRandom | grep Random Compiled from "" public class BadRandom extends java.lang.Object{ public BadRandom(); 0: new #2; //class java/util/Random 4: invokespecial #3; //Method java/util/Random."<init>":()V 24:invokevirtual #9; //Method java/util/Random.nextInt:()I
    • 16. Reverse Engineering the Binaries • Similarly, C/C++ programs use rand() or random() instead of reading from /dev/random. • Note /dev/random blocks and /dev/urandom doesn’t but may produce randomness of worse quality. root# strings bad_random __gmon_start _IO_stdin_used srand time printf … root# nm bad_random | grep rand U rand@@GLIBC_2.0 U srand@@GLIBC_2.0
    • 17. 18 Analyzing the Output Without Binaries • Compute entropy of the stream • Count number of characters in each position • FIPS 140-2 statistical PRNG tests – Monobit test: Are there as many 1’s as 0’s? – Runs test: Are the number of runs (sequences of only 0’s or 1’s) as expected for random numbers? – Maurer’s test: Can the sequence be compressed? – Next-bit test: given m bits of the sequence, predict (m+1)st bit • Just compress the data using WinRAR
    • 18. java.util.Random •The java.util.Random PRG is really a linear congruential generator (LCG) where x(n+1) = axn + b (mod m) for large constants a, b and moduli n,m • synchronized protected int next(int bits) { seed = (seed * 0x5DEECE66DL + 0xBL) & ((1L << 48) - 1); return (int) (seed >>> (48 - bits)); }
    • 19. Entropy of java.util.Random • In practice things aren’t that bad. • For 20,000 samples, the entropy of java.util.Random and streams is almost identical. • For both, 14.2877123795 bits of entropy. • They also pass all FIPS 140-2 tests. • For 200,000 samples, has slightly more entropy than java.util.Random, but is it significant? • For java.util.Random, we get 17.6095804744 bits of entropy • For, we get 17.6096204744 bits of entropy
    • 20. Is that much worse than java.util.Random? • Folklore says that it is. But it really depends on OS: • OpenSolaris (SunOS 5.11) : 67.9 slower  • Windows XP, 64.5 times slower  • Windows 7, 24.5 times slower  • MAC OS X, Leopard: 25.1 times slower 
    • 21. Hacking Java bytecode to use SecureRandom • inherits from java.util.Random and has all its methods • ASM bytecode manipulation framework: • Replace Random with SecureRandom in the bytecode public class ChangeMethodCallAdapter extends MethodAdapter { @Override public void visitMethodInsn(int opcode, String owner, String name, String desc) { System.out.println("ChangeMethodCallAdapter(): opcode=" + opcode + ",owner=" + owner + ",name=" + name + ",desc=" + desc); if ("java/util/Random".equals(owner)) { mv.visitMethodInsn(opcode, "java/security/SecureRandom", name, desc); } else { mv.visitMethodInsn(opcode, owner, name, desc); } } gilt-ml-ayampolskiy:ClassTransformer ayampolskiy$ javap -c API | grep Random 8: new #5; //class java/util/Random 12: invokespecial #6; //Method java/util/Random."<init>":()V 27: invokevirtual #7; //Method java/util/Random.nextInt:(I)I gilt-ml-ayampolskiy:new ayampolskiy$ javap -c API | grep Random 8: new #28; //class java/util/Random 12: invokespecial #31; //Method java/security/SecureRandom."<init>":()V 27: invokevirtual #35; //Method java/security/SecureRandom.nextInt:(I)I
    • 22. Google Hacking • Know the common session cookie names (SESSIONID,JSESSIONID,PHPSESSID,PHPSESSIO NID, etc.) • Google for the cookie names: inurl:"? sessionid=” • Even better, try googling session IDs with non- random sequences “66”, “128”: inurl:”? sessionid=128” • How about “lang:java java.util.Random session”
    • 23. Testing Randomness of Client Programs • Fourmilab’s entropy tests: http://www.fourmilab.c • Stompy (session stomper): http://lcamtuf.coredum
    • 24. “We could not arrest or charge this suspect because technically, no offence was being committed as there was no legislation in place to say that the act being committed was criminal. So, we had to let him go,” said Sergeant Jemesa Lave of the Fiji Police Cyber Crime Unit.
    • 25. experiment • uses a session-id, a 17-digit random number- is a persistent cookie that expires after 7 days. It is set the first time you reach Amazon. Its value does not change after you log in, nor when you switch users.
    • 26. Testing Randomness of Web-Based Programs • Several nice GUI tools to analyze session IDs for common problems ( WebScarab, BurpSuite, SPI Cookie Cruncher,Foundstone CookieDigger, etc) • Test alphabet distribution, average bits changed, FIPS tests, etc.
    • 27. WebScarab – Predictable Cookies Entropy is a measure of uncertainty regarding a discrete random variable. For many purposes, the Shannon entropy is the only measure needed. Shannon entropy is defined byShannon (4.1) has the unit bits. Not
    • 28. WebScarab –
    • 29. Burpsuite -
    • 30. BurpSuite – Typical session-id 180-3029497- 6907862
    • 31. BurpSuite –
    • 32. Conclusion • Use good seeds and strong PRNGs. • Know what the strong API for generating secure random numbers are (SecureRandom, /dev/random) • Try out Stompy, Ent, WebScarab, BurpSuite. • Happy hacking!
    • 33. 35 Questions, Comments?