« first day (1398 days earlier)      last day (3704 days later) » 
00:00 - 15:0015:00 - 00:00

15:00
Swearing MUST offend someone or something, otherwise it is not swearing.
@AJHenderson i sometimes do randomly fall in with random questions about random things, so i'll do dat
@ThomasPornin then it's... cursing?
cursing at your PC for not functioning?
@AJHenderson yeah it is in there, right at the end of the topic list...
which reminds me
hey
room topic changed to The DMZ: The first breach costs you an arm.... [double-entendre] [doughnuts] [food] [libations] [nono-php] [no-singing] [rory] [security]
@ThomasPornin I knew people who use it as punctuation
15:01
why isnt beer or alcoholic-beverages in the topics?
@RоryMcCune Good on you for spelling it right.
da hell man D:
@Lighty perhaps there is beer in the donunts
@TerryChia had to be done ... cough cough @Simon cough
interesting...
raz
raz
15:01
I never understood cursing, and why people get offended by the main 7 words.
@raz butt?
@raz It is not people, it is Americans.
2
@ThomasPornin so you are saying American's aren't people ;)
@AJHenderson Yeah, I can perfectly offend people (or Americans) without swearing.
raz
raz
@AJHenderson I see what you did there, and I'm offended
15:03
@AJHenderson Top Gear UK states that perfectly
raz
raz
Please remove that comment
This is sarcasm
@RоryMcCune I had a thought about your package managers talk. How does maven fair?
indeed
remove that comment, its 'muricans, not americans
racist doughnut
raz
raz
@TerryChia terrible
@TerryChia not looked at that one yet, but I'll add it to my list :) Hoping to get some research time in a couple of weeks to start looking at stuff properly...
15:05
@RоryMcCune Aye, thinking about the Java model I don't think there's any code execution during install? I may be wrong though.
@Lighty sweet, I didn't realize I could be racist against myself
@TerryChia interesting thought, that will be one of the key bits. Though to an extent if you an install a library, you'll probably use it at least once, so code execution on instantiation would work too...
@RоryMcCune Very true.
But at least that model doesn't encourage installing packages as root.
@TerryChia but I still think code execution on install is a more fun vector as it's less expected.
@RоryMcCune Definitely. :)
One large issue with that is that if there's code execution during runtime it's usually in the context of a normal user. By default Python's package manager requires root to install so code execution during install directly leads to root.
15:08
@TerryChia ooh good point
My girfreind was throwing crackers and buiscuits at me
can anyone here translate that?
raz
raz
@Lighty You messed up
she was also saying i should buy cheese
raz
raz
You didn't correctly edit her, and now she's pissed.
any additions?
@raz i see wut u did dere m8
i wouldn't even DARE to edit her
she'll cut off my...
err
you know
15:18
@Lighty nah, she'd just edit it
with a truncation
thats some dark nerdy humour
i like it
15:46
@ManishEarth ah, so it still works for everything except password fields?
16:05
@deed02392 yep
16:15
oh hey, just noticed that the CTF room accidentally got left in closed mode
and apparently write access in a private room doesn't give the ability to unfreeze if you aren't a mod on that network
16:47
@AJHenderson fixed
(I have owner access to the room)
raz
raz
So you know how you debug a program, and put a bunch of print statements in. And when you run the program you're like, "Damn it I forgot the \n's!!"? Now imagine you put debug statements into a kernel, built it, packed it and flashed a device and then checked for the print statements only to realize you didn't put \n's in.... >.<
@raz I'm just imagining having to use print statements to debug
raz
raz
haha
atleast you don't need gotos
@raz That's why I use gdb
uh, oh
hm
kernel
raz
raz
16:55
@ManishEarth Yeah, android device. I enabled kdb in the same build, so we'll see what happens.
 
1 hour later…
17:55
SSLv3: ask here http://security.stackexchange.com/ and wait for his answer http://security.stackexchange.com/users/655/thomas-pornin Thomas Pornin
raz
raz
@RоryMcCune We should make a "How does SSL3 work?" question.
@raz or we could have a "why is SSLv3 broken" Q and just update each time there's a new bug..
raz
raz
@RоryMcCune That'd be a lot of updates
18:35
I give it until noon tomorrow before this bug has a name, and we have a new tag and ten questions that are variations on "how to exploit [x]" and "is [y] vulnerable to [x]"
@Xander ooh well as these things tend to have names that sound like metal bands "heartbleed", "shellshock", "sandworm", we should agitate for the new one to be called "metaltech" :op
are there actually any details about the issue yet
@RоryMcCune Brilliant! :-D
@AJHenderson No. Not until tomorrow.
@AJHenderson All we know is a commit in OpenSSL source code that deactivates support for the encrypt-then-MAC extension (RFC 7366) for SSL 3.0 (all algorithms) and for RC4 specifically (in TLS 1.0+).
It is not confirmed that this commit is actually related to the vulnerability.
hey @AviD as you're right into getting low-level understanding of hipster languages, here's some schtick on how ruby is implemented in C for you. omniref.com/ruby/2.2.0.preview1/symbols/…
18:48
@ThomasPornin well, I'd be happy if it is just another Open-SSL issue, that's relatively easy for me to fix, though if it is generically related to RC4, even in TLS, then I might be a bit worried
raz
raz
@AJHenderson Yeah if it's a protocol vulnerability then people are gonna go APE-POO
And then @ThomasPornin is gonna have to update his How SSL/TLS works post, it'll be terrible.
@AJHenderson I am beginning to think that the commit to OpenSSL is unrelated.
@ThomasPornin it does seem like it would be odd
And the vulnerability may be something else, at the protocol level (not merely an implementation).
@ThomasPornin So, given how close SSLv3 and TLSv1.0 are, what could break SSLv3.0, but not TLSv1.0?
raz
raz
18:54
@AJHenderson It seems like a big bandaid is what it seems.
The commit is in fact justified: RFC 7366 explicitly denies applicability of encrypt-then-MAC to SSL 3.0; and also to stream ciphers. The commit merely aligns with the RFC.
@Xander As a shot in the dark, I'll say it is in the CBC padding.
2
With SSL 3.0, the padding consists in n+1 bytes, the last of which having value n.
raz
raz
@ThomasPornin Wait really?
With TLS 1.0+, a further restriction is that the n first padding bytes must also have value n.
I suppose it isn't the end of the world if I simply have to turn off SSL3.0 support tomorrow. I already have a pretty limited set of use cases for it on my server
Thus, with SSL 3.0, there is some room for modifications that will not impact the decrypted data (since they fall in the padding bytes whose value is ignored), but that will impact the decryption of the next record, since the encryption of the last padding block serves as IV for the next record.
raz
raz
18:57
@ThomasPornin How does that weaken the protocol though? The padding is encrypted, and there's no knowledge of how long the encrypted data is.
ah you're ahead of me
@raz Such knowledge usually exists through guesswork, or in chosen-plaintext attacks (the BEAST/CRIME setup).
raz
raz
@ThomasPornin Right
Still not sure I see the benefit. If you're modifying data just for the next record to be decrypted wrong, and the end-point severs the connection.
@RoryAlsop So. You going to compose a theme song for Wolfie?
@raz Mmh, I think one can resurrect the BEAST attack that way.
Suppose that you have 3DES encryption, with blocks of 8 bytes.
Suppose that you have a record whose length (after appending the MAC) has length multiple of 8.
Then there will be a full extra block of padding, whose last byte will have value 7.
raz
raz
@ThomasPornin Following so far
19:05
Now if I alter the first byte of that block, then I have 1/256 probability that the record will still be valid.
I will know that my modification passed, since at that point the server won't complain.
(Prob 1/256 is the probability that decryption of the block still ends with a 7)
However my modification of that first byte is propagated as is to the first byte of the contents of the next record.
Since that's a XOR.
raz
raz
@ThomasPornin Right
So at that point I'll try to substitute the first block of the next record with the encryption of a block that has identical contents except for the first byte, that is unknown and that I want to guess.
(one minute)
raz
raz
@ThomasPornin I'm having trouble seeing what the end goal really is. If your end goal is to derive the key, or predict plaintext values wouldn't you need a fairly high number of records within the same session?
5 minutes, I have work to do
raz
raz
haha
19:14
@RоryMcCune heh, thanks, that looks like some light reading for the flight...
@AviD you off to the states again?
raz
raz
Didn't we just have a question like this one recently
2
Q: What are the odds of an RSA private key collision?

Naftuli Tzvi KayGiven the various lengths of RSA key pairs (1024, 2048, 4096) what are the odds of two users having generated the exact same private key?

I'm back.
@RоryMcCune yeah.... :-(
but donuts!
raz
raz
@AviD Work complete?
gah, wrong reply
19:17
@AviD be careful not to have a cold or anything vaguely resembling one!
Yeah, one problem solved, waiting for the next.
raz
raz
@ThomasPornin Aren't we all
@RоryMcCune oy, umm.... why?
ah the ebola scare?
oh damn, I'm actually in the midst of an allergy attack.
I might get quarantined.
@AviD yeah they held up a flight in glasgow of all places 'cause some guy didn't feel well on the flight..
oh lordy. this is baaaad timing.
19:18
and of course there was the guy in texas who got the whole hazmat treatment for saying he had ebola...
so I'm betting that @ThomasPornin wild guess about SSL3 is spot on. Any takers?
2
raz
raz
I'm in
@AviD quite probably
@raz wait, you're actually betting against @ThomasPornin??
so we need to go on twitter and talk about the "new metaltech padding bug in OpenSSL"
19:20
@RоryMcCune ha! luvvit!
raz
raz
@AviD I know it's a bold move, but I'm a bold guy.
Is bold the right word?
@raz okay, but before you do so, check out his track record. Look up CRIME.
one of his previous wild ass guesses.
@raz or foolish. Time usually provides the distinction.
@RоryMcCune I'm in - but I may seem biased on Twitter
I'll happily retweet though :-)
raz
raz
@AviD I live in Washington D.C. I don't need to look up CRIME, I just look out the window.
@raz oh noes @raz is a fed!
:op
raz
raz
haha
A fed who's car window was broken last week to steal my gym bag.
@raz even worse, an undercover fed!
@raz WHAT DID YOU HAVE IN YOUR GYM BAG??
WAS IT SNAKES? I bet it was snakes.
Or a dead body.
Damn feds.
raz
raz
@AviD Why's it always have to be snakes?
19:29
@AviD My fovourite Ingress portal in Edinburgh is titled Snakes on a Flame. It's the large cadauceus out the front of the Blood Donor Centre :-)
Ok, I think I have the whole thing.
raz
raz
@ThomasPornin orly?
@ThomasPornin That took ages... ;-P
19:33
@RoryAlsop Yeah, I had a meeting, and then people kept on coming to ask me to do some miracles.
raz
raz
@ThomasPornin Bet you can't get me out of this cave.
@raz Damn feds....!
raz
raz
Well my work day is over, catch you on the flip side.
Attacker is both inside (hostile Javascript) and outside (has control of the WiFi hotspot). Attacker wants to get the victim's cookie on some other site.
2
Hostile Javascript issues a GET HTTPS request to the bank site; the request contains the cookie. Encryption is CBC, let's say with 3DES. In the stream, attacker arranges for the last byte of the cookie to be the first of an 8-byte block.
The attacker knows the bytes immediately after the cookie (start of the next HTTP header).
So attacker sees y = E((X || c) xor d) where X is the last byte of the cookie, c is the next (known) 7 bytes, and d is the previous encrypted block (also known).
Attacker then instructs his Javascript to issue a request including the bytes A || c such that A is his guess of the unknown byte, and that sequence happens as first block of a record.
Attacker also arranges for the previous record to have length such that the padding for the previous record has length 8 bytes.
The attacker intercepts and alters the two records (the one that contains 'A || c' and the previous one).
He replaces the last block of the first record with d, and the first block of the second record with y.
Replacement in the first record has probability 1/256 of being accepted by the server, because of the SSL 3.0 padding (it depends on whether decryption yields a final byte of value 7, the other bytes being ignored).
The attacker can see that by just setting a small delay between sending of the two records, just to see if the server complains or not.
If the server does not complain, then it will accept the subsequent record, or not, depending on whether A = X or not.
Thus, with an average of 128*256 calls, the attacker guesses the last byte of the cookie.
He then iterates with the previous one, and so on.
There are details to adjust in the description above (data after A || c must match the modification of the first encrypted block of the second record) but it seems that it works on the paper.
The root cause: SSL 3.0 CBC padding allows for a lot of modifications that will be ignored upon decryption, which gives leverage to play IV-based games.
In TLS 1.0 all the padding bytes are fixed and the implementations must check them, so this attack does not work.
RFC 7366 (encrypt-then-MAC) would actually help a lot against these attacks. But it is not defined for SSL 3.0.
That's it. We'll see tomorrow how things turn out.
19:50
@ThomasPornin if not, then it sounds like you have the start towards another announcement
@AJHenderson Publish or perish.
This chat room transcript may serve as proof of anteriority.
We should just start feeding @ThomasPornin random code conspiracy theories and watch him generate real announcements from them.
9
@RоryMcCune I don't have a twitter account. If you want, you may answer in my name: "my guess is a BEAST-like attack that abuses the ignored bytes in SSL 3.0 padding (1/256 chance of unnoticed alteration, modifies IV for next record)".
Workaround: deactivate SSL 3.0 support (in browsers or servers or both).
@ThomasPornin done, though I had to tweet the link to Chat.SE rather than the text (crypto vuln descriptions aren't generally 140-char friendly :) )
@RоryMcCune Now you know why I don't have a twitter account.
19:58
@ThomasPornin yeah i could see lots of tweets that go 1/x , 2/x , 3/x etc
It's them words. I like them. I don't want to see them tortured and crushed into an arbitrary size limitation designed to fit the average attention span of Internet users.
@ScottPack Math and Computer Science
@ThomasPornin Twitter is a linguistic art all to itself. It's sort of like haiku, only harder.
@Xander @ThomasPornin well there are times when you just get torn between "what linguistic crime am I going to commit here to get my point over in <140 chars"
@Xander Give laptops and Internet access to enough chimpanzees, and one of them will end up twitting a correctly formed haiku.
20:07
SSLv3 - Smashed into tiny pieces - Finally broken.
SSLv3 - Padding the final downfall - Completely broken.
3
@julianor I <3 him so much
And no, tqbf wasn't talking about me, he was talking about @ThomasPornin
Research is not like homework: you don't know if there is a solution.
This SSLv3 attack again demonstrates it: when you know that something works, it becomes easy.
@ThomasPornin yeah, the hard part is always figuring out which of the thousands of possible vectors actually produces something
@ThomasPornin yeah I often compare pen testing to CTFs in the same way. With a CTF you know there's a problem there, with a pen test you could be banging your head up against a brick wall
completely changes the mindset (well does for me anyway)
@RоryMcCune Yes, CTF are very artificial.
@ThomasPornin they're useful for practicing techniques, so that when you find them in the live you know what to do, but can give an artificial expectation if that's all you've done..
20:23
Thomas Pornin’s theory of what the problem with SSL 3 might be http://chat.stackexchange.com/transcript/151?m=18151930#18151930
By the way, thanks for propagating my wisdom to the twittospace. I thus get the fame without having to bother with an actual account.
8
@ThomasPornin no worries, I'm indelibly stained with social media stuff by now :op
on the SSLv3 thing interesting note from MS technet.microsoft.com/en-us/library/security/2977292.aspx
20:39
@ThomasPornin This is the 3rd time I've seen you mentioned on Twitter recently :P
@Polynomial Third time ? What were the other two ?
@ThomasPornin One was a link to your answer to a question about PKCS7 padding
the other one was something on crypto.se I think... something about probability maths... I can't remember
This is very cool, and also quite cheap. kickstarter.com/projects/1146711895/…
@ThomasPornin although there's some odd randomness in there twitter.com/search?q=pornin&src=sprv actually shows quite a few tweets... you'll get social media stain if you're not careful :op
@DavidFreitag nice :)
20:44
@Polynomial I thought so, I ordered two of them
Normally those GSM modules are $50+ alone
@ThomasPornin You're Twitter-famous! I particularly like this one.
@Polynomial Yea, that one is nice.
and twitter would muchly like you to join:
BTW does anyone know if Thomas Pornin has a twitter? I would like to subscribe to his newsletter
I think it is time for @ThomasPornin to start monetizing the twitters.
20:50
@Gilles cool feature, I did not know about that..
Ok, time for me to retreat to my cave and slumber for a while. See ya later.
21:09
Thomas Pornin not having a twitter account invalidates everything we do on here
3
22:06
@ThomasPornin What would be grand is a blog post on it - just expanding your brief chatroom summary. I'm definitely not qualified, but if you (or one of our other crypto folks) wanted to draft up a blog post for publication tomorrow as a place to go for all (insert name of new SSL3 vuln here) questions we could ping that around the intarwebsphere
22:33
Poodle
Really?
Poodle
P double Oh - Dull
So, no logo yet?
I have suggested making it a Great Bear
I was talking about the Sandworm thing
@Adnan Isn't that one ... a Sandworm :-)
@tylerl Looks like you're fifteen minutes late
becuase t.co links are inscrutible
What exactly is the vulnerability?
Yeah I'm still not sure why @Rory did that. Must've been twittering too.
3 hours ago, by Thomas Pornin
@RоryMcCune I don't have a twitter account. If you want, you may answer in my name: "my guess is a BEAST-like attack that abuses the ignored bytes in SSL 3.0 padding (1/256 chance of unnoticed alteration, modifies IV for next record)".
@DavidFreitag Been busy reading the docs. They went aout about a half hour ago.
22:57
hm
@tylerl I figured it was something like that
@tylerl As @gsuberland pointed out - nice and easy to read...even for me
It's more involved than what Thomas posted.
@tylerl he has the core though
22:59
@RoryAlsop He has CBC padding oracle pretty much nailed.
@tylerl yarr - I got that much. Some of the extra notation was a bit above my head (as ever)
but they're using the announcement to also say "rc4 is not a reasonable alternative" and draw attention to the downgrade attack
basically the solution they propose is kill ssl3 altogether.
Maan.. I can't believe that there's still no PoC for the CVE-2014-4114 anywhere on the underwebs
Usually, by the time the vuln. goes public, any circulating exploit code becomes easier to find.
@tylerl I think it's a useful opportunity
Not sure whether it's significant, but I posted Thomas's summary to the security mailing list, and the official announcement went live 15 minutes later. Pornin might have moved the timetable by guessing it early, or perhaps it was just a coincidence.
23:14
@tylerl A few other folks have suggested he 'accelerated' timelines for the announcement :-)
(How does that go down in the community?)
Can imagine various google bods scurrying about going "damnit, the Bear has awoken! Get this published NOW!"
2
Need to check and see what was in the latest Cyanogen that got pushed to my One+one a couple of hours ago
For reference, here are 3 original announcements:
http://www.openssl.org/~bodo/ssl-poodle.pdf
http://googleonlinesecurity.blogspot.ie/2014/10/this-poodle-bites-exploiting-ssl-30.html
https://blog.cloudflare.com/sslv3-support-disabled-by-default-due-to-vulnerability/
damn you markdown
Also, I like how cloudflare says they're "continuing to track this announcement as it breaks, even though they had their blog post up BEFORE the announcement.
Of course, it's not Poodle, it's Becky:
When someone says the SSL vulnerability is named "poodle," you say, "no its becky." http://t.co/w6haONCp1w
:-)
@RoryAlsop Isn't that some reddit thing?
23:29
@DavidFreitag I think so, yes
(I don't keep down wid the kids all the time)
@RoryAlsop Yeah I don't reddit either
23:47
@RoryAlsop Well, it has lost a bit of its relevance since the details have been published.
@ThomasPornin That was a quick nap.
The attack indeed uses the SSL 3.0 CBC padding. It turns out to be a bit simpler than what I was explaining (though my technique would have worked, too).
0
Q: SSL3 "Poodle" Vulnerability

tylerl Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the Poodle vulnerability? I use [product]. Am I affected? Is [product] vulnerable to the Poodl...

@ThomasPornin ^^
Figure we ought to just get out ahead of the questions.
@tylerl Just to close all others as dupes ? That may work.
I'll write an answer, then.
A few other sites (SF comes to mind) typically maintain "canonical" entries for popular questions. This way you don't end up with a bunch of incomplete answers scattered across dozens of questions.
We do it too, sometimes, but usually we just link to the first person to ask, and often their question is too specific.
00:00 - 15:0015:00 - 00:00

« first day (1398 days earlier)      last day (3704 days later) »