- cypherpunks - lists.cpunks.org

Two possible vulnerabilities in OpenSSL?
by Peter Malone 11 Apr '14

11 Apr '14

Hey there, I was auditing OpenSSL last night. I looked at several files and found the following: https://github.com/openssl/openssl/blob/master/ssl/t1_lib.c#L2893 /* Determine if we need to see RI. Strictly speaking if we want to * avoid an attack we should *always* see RI even on initial server * hello because the client doesn't see any renegotiation during an * attack. However this would mean we could not connect to any server * which doesn't support RI so for the immediate future tolerate RI * absence on initial connect only. */ Well that's awful coding. Unless I'm mistaken, the following memcmp is vulnerable to a remote timing attack. https://github.com/openssl/openssl/blob/master/ssl/ssl_lib.c#L1974 static int ssl_session_cmp(const SSL_SESSION *a,const SSL_SESSION *b) { if (a->ssl_version != b->ssl_version) return(1); if (a->session_id_length != b->session_id_length) return(1); return(memcmp(a->session_id,b->session_id,a->session_id_length)); } I posted both of these findings to the full disclosure list last night. I figured someone on this list might find it interesting as well. Cheers, Peter.

3 3

Assange: Debian is Owned by the NSA
by rysiek 10 Apr '14

10 Apr '14

Hi there, so this has come to my attention. Whaddya guys and gals think? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://igurublog.wordpress.com/2014/04/08/julian-assange-debian-is-owned-by… In his Q&A to his keynote address at the World Hosting Days Global 2014 conference in April, the world’s largest hosting and cloud event, Julian Assange discussed encryption technology in the context of hosting systems. He discussed the cypherpunk credo of how encryption can level the playing field between powerful governments and people, and about 20 minutes into his address, he discussed how UNIX-like systems like Debian (which he mentioned by name) are engineered by nation-states with backdoors which are easily introduced as ‘bugs’, and how the Linux system depends on thousands of packages and libraries that may be compromised. I recommend watching his 36 minute Q&A in its entirety, keeping in mind my recent warnings about how GNU/Linux is almost entirely engineered by the government/military-affiliated Red Hat corporation. The Voice of Russia website has an article on Assange’s address with a few quotes: “To a degree this is a matter of national sovereignty. The news is all flush with talk about how Russia has annexed the Crimea, but the reality is, the Five Eyes intelligence alliance, principally the United States, have annexed the whole world as a result of annexing the computer systems and communications technology that is used to run the modern world,” stated Julian Assange in his keynote address… Don’t just read the short article, listen to the address yourself, because Assange goes into many areas, and the work being done in these fields. Assange mentions how Debian famously botched the SSL random number generator for years (which was clearly sabotaged – a known fact). Speaking of botched security affecting Red Hat, Debian, Ubuntu, Gentoo, SuSE, *BSD, and more, the nightmarish OpenSSL recently botched SSL again (very serious – updated comments on how a defense contractor in Finland outed the NSA here?) It’s very hard to believe this wasn’t deliberate, as botching the memory space of private keys is about as completely incompetent as you can get, as this area is ultra-critical to the whole system. As a result, many private keys, including of providers, were potentially compromised, and much private info of service users. Be sure to update your systems as this bug is now public knowledge. (For more on how OpenSSL is a nightmare, and why this bug is one among many that will never be found, listen to FreeBSD developer Poul-Heening Kamp’s excellent talk at the FOSDEM BSD conference.) From the start, my revelations on this blog about Red Hat’s deep control of Linux, along with their large corporate/government connections, hasn’t been just about spying, but about losing the distributed engineering quality of Linux, with Red Hat centralizing control. Yet as an ex-cypherpunk and crypto software developer, as soon as I started using Linux years ago, I noted that all the major distributions used watered-down encryption (to use stronger encryption in many areas, such as AES-loop, you needed to compile your own kernel and go to great lengths to manually bypass barriers they put in place to the use of genuinely strong encryption). This told me then that those who controlled distributions were deeply in the pockets of intelligence networks. So it comes as no surprise to me that they jumped on board systemd when told to, despite the mock choice publicized to users – there was never any option. A computer, and especially hosting services (which often run Linux), are powerful communication and broadcasting systems into today’s world. If you control and have unfettered access to such systems, you basically control the world. As Assange notes in the talk, encryption is only as strong as its endpoints. eg if you’re running a very secure protocol on a system with a compromised OS, you’re owned. As Assange observed: “The sharing of information, the communication of free peoples, across history and across geography, is something that creates, maintains, and disciplines laws [governments].” - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- Pozdr rysiek

2 1

OpenWTF
by rysiek 10 Apr '14

10 Apr '14

OHAI, So I suppose many of you have already seen this. Nonetheless... W: http://article.gmane.org/gmane.os.openbsd.misc/211963 T: http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf F: http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse To get you interested: > No. OpenSSL has exploit mitigation countermeasures to make sure it's > exploitable. -- Pozdr rysiek

1 0

Passwords problem
by jim bell 09 Apr '14

09 Apr '14

http://news.yahoo.com/passwords-vulnerable-security-flaw-found-222708914.ht… Passwords vulnerable after security flaw found By ANICK JESDANUN 6 hours ago * * * * * * * NEW YORK (AP) — Passwords, credit cards and other sensitive data are at risk after security researchers discovered a problem with an encryption technology used to securely transmit email, e-commerce transactions, social networking posts and other Web traffic. Related Stories * 'Heartbleed' bug in web technology seen as major threat to user data Reuters * Internet “Heartbleed” Bug Exposing Passwords To Hackers CBS Dallas Fort Worth (RSS) * What You Need to Know About Heartbleed, the New Security Bug Scaring the Internet The Atlantic Wire * 'Heartbleed' bug puts encrypted data in dangerAFP * Google, Microsoft Race to Assess Heartbleed Vulnerability The Wall Street Journal Security researchers say the threat, known as Heartbleed, is serious, partly because it remained undiscovered for more two years. Attackers can exploit the vulnerability without leaving any trace, so anything sent during that time has potentially been compromised. It's not known, though, whether anyone has actually used it to conduct an attack. Researchers are advising people to change all of their passwords. The flaw was discovered independently in recent days by researchers at Google Inc. and the Finnish security firm Codenomicon. The breach involves SSL/TLS, an encryption technology marked by the small, closed padlock and "https:" on Web browsers to signify that traffic is secure. With the Heartbleed flaw, traffic was subject to snooping even if the padlock had been closed. The problem affects only the variant of SSL/TLS known as OpenSSL, but that happens to be one of the most common on the Internet. Researchers at Codenomicon say that OpenSSL is used by two of the most widely used Web server software, Apache and nginx. That means many websites potentially have this security flaw. OpenSSL is also used to secure email, chats and virtual private networks, which are used by employees to connect securely with corporate networks. Despite the worries, Codenomicon said many large consumer sites don't have the problem because of their "conservative choice" of equipment and software. "Ironically smaller and more progressive services or those who have upgraded to (the) latest and best encryption will be affected most," the security firm added. A fix came out Monday, but affected websites and service providers must install the update. Yahoo's Tumblr blogging service uses OpenSSL. In a blog post Tuesday, officials at the service said they had no evidence of any breach and had immediately implemented the fix. "But this still means that the little lock icon (HTTPS) we all trusted to keep our passwords, personal emails, and credit cards safe, was actually making all that private information accessible to anyone who knew about the exploit," Tumblr's blog post read. "This might be a good day to call in sick and take some time to change your passwords everywhere — especially your high-security services like email, file storage, and banking, which may have been compromised by this bug." Yahoo Inc. said its other services, including email, Flickr and search, also have the vulnerability. The company said some of the systems have already been fixed, while work is being done on the rest of Yahoo's websites. The company reiterated its standard recommendation for people to change passwords regularly and to add a backup mobile number to the account. That number can be used to verify a user's identity if there are problems accessing the account because of hacking. ___ AP Technology Writer Michael Liedtke in San Francisco contributed to this report.

1 0

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL
by grarpamp 08 Apr '14

08 Apr '14

On Tue, Apr 8, 2014 at 2:02 PM, Joe Btfsplk <joebtfsplk(a)gmx.com> wrote: >> On 4/7/2014 6:14 PM, grarpamp wrote: >> http://heartbleed.com/ >> Patch your stuff. > Comments / suggestions from those w/ in depth knowledge in this area? How > users should proceed; how to check if sites used (banks, email, retail > sites, etc.) were / still are affected, so one knows if & when to change > passwords or other data? > > If the number of sites potentially affected is as large as indicated on > heartbleed.com, changing PW on even 60% of sites I use could take a long > time - even to do it once. > > It would do little good to change a password on a site that hasn't patched > this. > Or perhaps it would do some good, to change the password before logging out > of a site? Then when a site must be accessed again, change the password > again. > > Either way, this might not provide perfect safety, but might ? be better > than nothing. https://blog.torproject.org/ covers what to do for Tor things. For everything else on the net, fix the clients and servers you're responsible for. Then... You're right, there's a big gotcha in all this, users won't really know if the services they interact with have been fixed [1] because huge swaths of services simply don't publish what they do on their pages, they bury it to keep quiet and shiny happy sites. Only some banks, insurers, utilities, schools, etc will post "we're fixed" anywhere remotely prominent. So you have to trust they did [2], which is a reasonable assumption given regulation and liability of big institutional services. You should already have a regular password changing/logout/session management regimen, so inserting some extra instances of that along guesstimates of [2] should suffice with these classes of service. [2] Sometime during the falloff curve starting yesterday afternoon. The real user risk is likely on mid to small services, embedded things, shared platforms, legacy systems, services that didn't get the news, don't have the resources or knowledge to fix, etc. Again, consider some form of reasonable regimen. And there are all sorts of tools and site testing services coming out now for which a brave user might be completely warranted in using to determine [1 above] so they know when to utilize [regimen 2]. (Far better to use a testing service or email their help desks seeking a positive statement than risk being potentially considered an exploiter of things you don't own.) Partial list... http://s3.jspenguin.org/ssltest.py https://gist.github.com/takeshixx/10107280 https://github.com/FiloSottile/Heartbleed https://www.ssllabs.com/ssltest/index.html (Note, this is a TLS in process bug, so more than HTTP/S services are affected...) This bug will no doubt trigger some thinking, analysis and change in the services, security, infrastructure and user communites... that's a good thing.

1 0

Re: [Cryptography] [cryptography] Github Pages now supports SSL
by Eric Mill 08 Apr '14

08 Apr '14

Yeah, it's real terrific. -_____- @ITechGeek, my understanding was that SNI was handled at an OS level by WinXP, and no browser would work on it. I could be wrong, I haven't researched it myself. On Mon, Apr 7, 2014 at 10:31 PM, Bill Stewart <billstewart(a)pobox.com> wrote: > At 11:08 AM 4/4/2014, Eric Mill wrote: > >> I know most of the people on here have transcended the earthbound, >> maudlin Certificate Authority system, but as services-adopting-SSL-news >> goes, I'm particular excited about <https://twitter.com/benbalter/status/ >> 444555263195217920>Github Pages, which started quietly supporting SSL >> for *.<http://github.io>github.io domains a few weeks back. >> > > Well that was convenient timing, considering the OpenSSL "Change All Your > Certs and Keys Now" bug announcement that just hit the wires :-) > > _______________________________________________ > The cryptography mailing list > cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography > -- konklone.com | @konklone <https://twitter.com/konklone>

1 0

Should openssl accept weak DSA/DH keys with g = +/- 1 ?
by Georgi Guninski 08 Apr '14

08 Apr '14

I am a noob at crypto. IIRC similar attack was used against Tor several years ago. In DSA it is possible to force g=1 or g \equiv -1 \mod p. The first is unit and the second is of multiplicative order 2. This are clearly weak and insane choices, but this might have implications to MITM (might be wrong on this). For DH could generate key with g=1, though couldn't test it. Tested both 1 and -1 cases in DSA, the probability of successful connection was about 1/4 (or maybe 1/2), errors in the other cases. (for $1$ I would expect probability $1$). Attached are cacert.pem and cacert2.pem, the magic word is 1234. To test: $ openssl s_server -accept 8888 -www -cert cacert.pem $ openssl s_client -connect localhost:8888 -showcerts To examine $openssl x509 -text -in cacert2.pem $openssl dhparam -text -in dHParam.pem (not sure if dHParam.pem this is usable, forged generation). Firefox refuses connections, Konqueror works with same probability. Suspect this might be related to EC refusing the point at infinity. Might have MITM implications, don't have working exploit (If a MITM can forge $g=1$ in DH, the private keys are useless).

1 1

Meanwhile as the internet reboots...
by grarpamp 08 Apr '14

08 Apr '14

Depending on your looking glass, at around 20:30UTC one particular system (the Tor network, ~5300 nodes) had a cumulative uptime of about 14.05Gsec. It's dropped by about 6.5% so far. This bug should make for some interesting infrastructure analysis across a variety of systems. http://heartbleed.com/

1 0

Re: [cryptography] Github Pages now supports SSL
by Eric Mill 08 Apr '14

08 Apr '14

For what it's worth, I think CloudFlare dropping the price of SSL is going to force other companies to follow suit, so hopefully their move creates competition that both reduces CloudFlare dependency and increases the amount of encrypted traffic on the web. For example, today I learned that Amazon CloudFront finally dropped the price of SSL in front of S3 for custom domains from $600/month(!!) to $0/month: http://aws.amazon.com/cloudfront/custom-ssl-domains (As long as you're comfortable using SNI, which excludes users on Windows XP.) CloudFlare is hopefully just one part of the tip of the spear. On Mon, Apr 7, 2014 at 4:05 AM, ITechGeek <itg(a)itechgeek.com> wrote: > For the 3 co-founders, they appear to provide the exact same info as when > the Wayback Machine first captured the people page in 2010. > > > http://web.archive.org/web/20101015060142/http://www.cloudflare.com/people.… > > http://www.linkedin.com/in/mprince > http://www.linkedin.com/pub/michelle-zatlyn/9/b19/17b?trk=pub-pbmap > http://www.linkedin.com/pub/lee-holloway/0/152/159 > > I don't see any indication of connections to the US Intel Community based > on looking them up online. I see connections to Law Enforcement for > Matthew Prince, but connections to law enforcement != connections to Intel > community. > > I'm not debating the idea Cloudflare could receive an NSL which is true > for any US company (although I think most countries have some equiv). > > You are telling us to do our homework. Since we don't seem to be seeing > the same information that you are, can you point us at some sites? Maybe > the search engine you are using is pointing you in a different direction > than Google is pointing me or maybe you know better search terms. > > > > ----------------------------------------------------------------------------------------------- > -ITG (ITechGeek) > ITG(a)ITechGeek.Com > https://itg.nu/ > GPG Keys: https://itg.nu/contact/gpg-key > Preferred GPG Key: Fingerprint: AB46B7E363DA7E04ABFA57852AA9910A DCB1191A > Google Voice: +1-703-493-0128 / Twitter: ITechGeek / Facebook: > http://fb.me/Jbwa.Net > > > On Sun, Apr 6, 2014 at 5:28 PM, Ryan Carboni <ryacko(a)gmail.com> wrote: > >> oh dear. >> He helped the government combat crime and nuisance style offenses. >> Clearly in collusion. >> >> >> On Sun, Apr 6, 2014 at 12:20 PM, <tpb-crypto(a)laposte.net> wrote: >> >>> > Message du 06/04/14 17:41 >>> > De : "staticsafe" >>> > On 4/6/2014 10:40, tpb-crypto(a)laposte.net wrote: >>> > >> Message du 04/04/14 20:09 >>> > >> De : "Eric Mill" >>> > >> Along with Cloudflare's 2014 plan to offer SSL termination for >>> free, and >>> > >> their stated plan to double SSL on the Internet by end of year, the >>> barrier >>> > >> to HTTPS everywhere is dropping rapidly. >>> > >> >>> > > >>> > > I agree that putting https everywhere is great, but Cloudflare's >>> founders are tightly linked with the US-intelligence community. That fact >>> alone kind of kills any claims they make about data security within their >>> service. >>> > >>> > Source for this please? >>> > >>> >>> Is it so painful to do your own homework? >>> >>> "Matthew Prince, Lee Holloway, and Michelle Zatlyn created CloudFlare in >>> 2009.[1][2] They previously worked on Project Honey Pot." - >>> http://en.wikipedia.org/wiki/CloudFlare >>> >>> "[...] the project organizers also help various law enforcement agencies >>> combat private and commercial unsolicited bulk mailing offenses and overall >>> work to help reduce the amount of spam being sent [...]" - >>> http://en.wikipedia.org/wiki/Project_Honey_Pot >>> >>> That's just for starters, you can dig more and find more. It is >>> interesting that the history of the founders themselves is no longer >>> exhibited in cloudflare.com website as it was years ago. >>> >>> >>> As an American company, there is nothing preventing Cloudflare from >>> receiving NSLs and having to shut up about them. What use is a system that >>> you can't trust like this? >>> >>> You can say "oh, but they go after the bad guys, spammers". But that >>> doesn't limit it to spammers neither do we know who are the so called bad >>> guys, since that is decided by American secret laws, made by secret courts, >>> that issue secret orders. >>> >>> No trust to American companies, less even trust to American companies >>> that promise any kind of data security. Better no security than a false >>> sense of it. >>> >>> Sorry. >>> _______________________________________________ >>> cryptography mailing list >>> cryptography(a)randombit.net >>> http://lists.randombit.net/mailman/listinfo/cryptography >>> >> >> >> _______________________________________________ >> cryptography mailing list >> cryptography(a)randombit.net >> http://lists.randombit.net/mailman/listinfo/cryptography >> >> > > _______________________________________________ > cryptography mailing list > cryptography(a)randombit.net > http://lists.randombit.net/mailman/listinfo/cryptography > > -- konklone.com | @konklone <https://twitter.com/konklone>

1 0

fuck ALL obscene systems of covert compromise and corruption [was: Geoff Stone, Obama's Review Group]
by coderman 07 Apr '14

07 Apr '14

the entire "Legislative Laundry of FBI+CIA+NSA+DIA Collusion" and their enablers need to die in a fire. sole focus on NSA a smoke screen... On Wed, Apr 2, 2014 at 7:56 PM, <dan(a)geer.org> wrote: >... > From the outset, I approached my responsibilities as a member > of the Review Group with great skepticism about the NSA. I am > a long-time civil libertarian, a member of the National Advisory > Council of the ACLU, and a former Chair of the Board of the > American Constitution Society. To say I was skeptical about > the NSA is, in truth, an understatement. > > I came away from my work on the Review Group with a view of > the NSA that I found quite surprising. Not only did I find > that the NSA had helped to thwart numerous terrorist plots > against the United States and its allies in the years since > 9/11, but I also found that it is an organization that operates > with a high degree of integrity and a deep commitment to the > rule of law. my greatest fears are not about what the NSA has intended, but what the NSA has built with the best intentions, which in turn will fall into malicious hands. history tells us this is but a matter of time. as an attacker, i see the capabilities so developed as nothing short of abhorrent. they should not exist, they should not be pursued. they are means that are unethical no matter the end. > ... The Review Group found that many of > the programs undertaken by the NSA were highly problematic and > much in need of reform. But the responsibility for directing > the NSA to carry out those programs rests not with the NSA, > but with the Executive Branch, the Congress, and the Foreign > Intelligence Surveillance Court, which authorized those programs see also, the "Legislative Laundry of FBI+CIA+NSA+DIA Collusion" to focus on NSA is to miss the underlying patterns of control at work... > It gradually became apparent to me that in the months after > Edward Snowden began releasing information about the government's > foreign intelligence surveillance activities, the NSA was being > severely -- and unfairly -- demonized by its critics. conflating NSA as an institutional entity, NSA tasking, and NSA staff. NSA tasking is bad and should feel bad. NSA institutional culture is less bad, yet needs correction. NSA employees individually? they have been deceived and demoralized themselves! this group is the least culpable, in my eyes. i have friends in IC and i can tell you they feel no less sucker punched by these revelations. make no mistake, they've been similarly mislead by "legal weasel words" and "exceptionally compartmentalized deceptions", etc. there are heads at the top that need severing from bodies. [wait, they've admitted that is too kind. life support in keep-away for centuries!!!!] > Of course, "I was only following orders" is not always an > excuse. But in no instance was the NSA implementing a program > that was so clearly illegal or unconstitutional that it would > have been justified in refusing to perform the functions > assigned to it by Congress, the President, and the Judiciary. see also "compartmentalization". i have a story to tell here about physical encryption systems in surveillance satellites. you think NSA staff even knew what they were working on? that's the exception, rather than the rule. your "big data science to optimize in memory representation of sparse lattices" is just an innocuous cog in a machine cracking weak crypto to target drones to metadata targets that resulted in the loss of innocent life in some third world backwater you've never given thought to. [and tomorrow's domestic oppression of opportunity unleashed through the best intentions. if only we knew back then... if only...] > Although the Review Group found that many of those programs > need serious re-examination and reform, none of them was so > clearly unlawful that it would have been appropriate for the > NSA to refuse to fulfill its responsibilities. you think that's an accident? this is precision engineering! see also, the "Legislative Laundry of FBI+CIA+NSA+DIA Collusion" > Moreover, to the NSA's credit, it was always willing to engage > the Review Group in serious and candid discussions about the > merits of its programs, their deficiencies, and the ways in > which those programs could be improved. Unlike some other > entities in the intelligence community and in Congress, the > leaders of the NSA were not reflexively defensive, but were > forthright, engaged, and open to often sharp questions about > the nature and implementation of its programs. this means they're the least useful to question. when does CIA/DIA scrutiny begin? > In short, I found, to my surprise, that the NSA deserves the > respect and appreciation of the American people. But it should > never, ever, be trusted. NSA used like a tool, just like the sysadmin and cryptographer "tools" they exploited and used so effectively...

6 7