The Bitcoin Piñata
ownme.ipredator.se
ownme.ipredator.se
Is this exploitable in this bounty? No idea. At least, it's the right kind of vulnerability you need to forge a certificate.
CVE-2014-1568 was this problem in NSS.
[1]: https://github.com/mirleft/ocaml-nocrypto/blob/master/src/rs...
The unpad does RSA unpadding... or am I completely mistaken?
https://github.com/mirleft/ocaml-x509/blob/master/lib/certif...
PKCS1.5 stripping takes away the leading 0x00 0x01 0xff ... 0x00 -- if this prefix is not present, it fails.
The rest goes through the RSA tranform, and is parsed as PKCS1 DigestInfo, an ASN.1 structure. All ASN parsing checks for presence of trailing bytes, on top and in CONSTRUCTED nodes.
The presence of suffix-checking prevents malleability in my mind. Am I missing something?
In NSS, they did check for trailing bytes, but allowed one part of the ASN1 structure to have an arbitrary value (to work around flaws in other implementations).
To be abundantly clear: I am not saying that any of the presented code has an exploitable flaw. I am saying that the way the code is written has frequently been found to be faulty in the past.
We actually use combinators for doing that - this explains our ASN.1 library in more depth: http://openmirage.org/blog/introducing-asn1
Mirage, developed in OCaml for the cloud. The part that really interested me: "If a sudden spike in traffic occurs, the web-servers can be configured to create and deploy copies of themselves to service the demand. This auto-scaling happens so quickly that an incoming connection can trigger the creation of new server and the new server can then handle that request before it times out (which is on the order of milliseconds)."
I love this idea so much. There's also OSv which targets the JVM instead of OCamL. It's an open source commercial enterprise. https://github.com/cloudius-systems/osv
http://nymote.org/blog/2013/introducing-nymote/ and http://amirchaudhry.com/brewing-miso-to-serve-nymote/
Also how well does this work with persistent HTTP connections (and TLS handshakes)? i.e. will the browser keep a persistent connection to the jitsu proxy and the actual requests might be served by different VMs?
For the time-being, Jitsu [1] 'just' spawns a unikernel which serves requests, with no apparently latency for the requester. At some point, when the unikernel hasn't done anything for a while, it is culled (which is something of an implementation detail). In principle, we should be able to use this as part of a set of tools to create the hyper-elastic clouds mentioned upthread.
[1] Just in Time Summoning of Unikernels
Capacity demand is handled by resource concurrency thresholds so why would spinning up a new OS (no matter how lightweight) be better than having non-blocking IO threads on a single kernel?
Mirage's philosophy is mainly about reducing attack surface and unnecessary overhead. That it makes the OS so small that you can boot it up in milliseconds is just an added benefit.
I'm not saying MirageOS doesn't sound neat, I'm just not yet convinced it has a general purpose use case.
A WAF also still passes through HTTP requests which hit Apache/nginx which calls out into the OS and altogether that give a significant surface area for vulnerability (think e.g. shellshock and ENV variables.)
I also don't think anybody says that MirageOS is ready for the general purpose use case; it's very much specific experimental tooling for (currently) really niche cases.
Unikernels do have a ton of future potential though ....
However, I strongly advise you to read up on how production environments are done in security conscious enterprises (banks, payment providers, etc) as you seem to make some assumptions in your comment. To give you some idea of the environments I've designed in the past:
A WAF worth it's name won't pass any request back to a webserver if it matches a known signature, method, payload, etc. This is a functionality commonly called virtual patching. SSH is usually only allowed on internal vlans and often requires some sort of external authentication mechanism like a centralised jumpserver or ldap.
Also, if using Solaris with OVM for SPARC you wouldn't boot up a new server but a non-global zone (think Docker but 2 years from now) which can be started in ~1 second and offer full isolation from the host system. AIX also does something similar and I've seen several different approaches used on Linux from LXC to VMware + F5 irule based auto-scaling groups.
I guess this is defining things from a purely pragmative "more code means a bigger attack surface" perspective. I know that's an oversimplification but there's also some truth to it.
But indeed; the Solaris OVM / LXC stuff spawning minimal OS's without administrative access gets you quite close (and with a more vetted codebase,) so in that regards unikernels are indeed still mainly an academic exercise.
Did this clarify my point or in any other way contribute to your undestanding?
The overview page and the ASPLOS paper (linked upthread) and the ACM article [1] will help explain the benefits and trade-offs of the unikernel approach. Other people have also started using unikernels so you can read about their experiences too [2].
The current thrust of the effort in the TCP stack is to make sure that we cover all the corner cases, and build a functional testing framework to check regressions and protocol traces versus other implementations. It's also quite remarkable how thin on the ground test suites are for TCP...
Once all this is done, then I have an alpha-grade multipath TCP implementation to merge in, and defences like SYN cookies will be parameterised options that can be activated in a unikernel in response to traffic surges.
> Syncookies are discouraged these days. They disable too many valuable TCP features (window scaling, SACK) and even without them the kernel is usually strong enough to defend against syn floods and systems have much more memory than they used to be. So I don't think it makes much sense to add more code to it, sorry.
"I can trivially prevent any inbound client connections with 2 threads of syn flood. Enabling tcp_syncookies brings the connection handling back up to 725 fetches per second."
"This data compellingly supports the continued value of the syncookie and that position seems to have won the day."
Of course this refers to the Linux TCP/IP stack, the Mirage stack is completely different so it remains to be seen what measures will be effective against syn floods.
;_;
edit: now back
> "Before you ask: yes, Piñata will talk to itself and you can enjoy watching it do so."
Also, what should I be using to connect using TLS/TCP?
So to get them to talk to each other you could either write a server that listens on 40001 then proxies any incoming connections back to 10000 (that's what nothrabannosir's named pipes + nc example does), or just connect to 10000 and 10002 and pipe the two connections to each other.
e.x. in Node.js:
var net = require("net");
var server = net.connect({ host: 'ownme.ipredator.se', port: 10002 });
var client = net.connect({ host: 'ownme.ipredator.se', port: 10000 });
server.on('data', console.log.bind(console, 'server'));
client.on('data', console.log.bind(console, 'client'));
client.pipe(server).pipe(client);Try this:
$ mkfifo /tmp/tlspipe
$ nc -l -p 40001 </tmp/tlspipe | tee /tmp/tlsconvo | nc ownme.ipredator.se 10000 > /tmp/tlspipe
Disclaimer: I'm completely unfamiliar with named pipes or tls, but I think this is what they mean.
EDIT: This should also work:
$ mkfifo /tmp/tlspipe
$ nc ownme.ipredator.se 10002 </tmp/tlspipe | tee /tmp/tlsconvo2 | nc ownme.ipredator.se 10000 >/tmp/tlspipe
$ nc ownme.ipredator.se 10002 </tmp/tlspipe | tee /tmp/client-to-server | nc ownme.ipredator.se 10000 | tee /tmp/server-to-client >/tmp/tlspipe
$ strings /tmp/server-to-client
sYcdI*
Cambridge1
BTC Pinata Team1 0
ocaml-tls@h3q.com0
150207183718Z
150329183718Z0$1
tls services0
...http://www.felipemartins.info/2013/03/netcat-the-it-swiss-kn...
FWIW you can also do it with a single socat invocation, but I'll leave the exact command as an exercise for the reader.
$ cat /tmp/tlsconvo2|xxd|less
But I'm not into crypto, even that I don't know what it means or if it's the way to go. I liked the initiative though :-)
Edit: But I do get 404s when I click the "language-links" on the challenge pages, like http://cryptopals.com/sets/1/challenges/1/ruby. What are those anyways?
http://www.amazon.com/Cryptography-Engineering-Principles-Pr...
Very bad idea to sign everything that comes your way, kind of like `eval` on text input.
Edit: here's a JavaScript implementation I wrote that does that, if anyone is interested in details: https://github.com/cryptocoinjs/coinmsg/blob/d2cb985dd9994f1...
Nowhere did he suggest this.
for online signing we'd first need to implement the bitcoin protocol...
or am I getting something wrong?
[1] https://www.schneier.com/crypto-gram/archives/1998/1215.html...
I do hope you're logging all incoming data to a backup server somewhere, so you can analyze it afterwards if this were to happen.
But please tell us if you do. We'd like to learn from this exercise and improve the stack.
You can try to confuse the ASN.1 parser, or even the protocol level parser.
You can try to defeat certificate validation logic.
You can try to get handshake state-machine do an illegal transition.
You can try to smash its memory and either read it or get your code into it.
You can try to defeat its RNG.
It doesn't let you do adaptive-plaintext attacks, but everything else is up for grabs. And you don't necessarily have to wait for it to politely send you the bitcoin key - it's somewhere in there, in memory!
You are probably thinking of these guys: http://www.mitls.org.
They have a killer TLS, but it drags the entire CLR in.
We are these guys: http://openmirage.org/blog/introducing-ocaml-tls.
A bunch of people write crypto software, and want to find out/demonstrate how secure it is. They do so by setting up a system that will transfer ~$2k worth of bitcoins to the first guy who breaks it.
As the page (and my post) emphatically state, this contest cannot prove anything about how secure it is. That distinction is really important.
You could measure the amount of time it takes for someone to break this security and grab the cash, but that only provides you with one datum. To really show how secure it is, you would also need to provide a $1000 prize, a $500 prize, a $250 prize, a $125 prize, and so on, all with equally strong security.
Then you start the clock. After the first prize is won, you put out the second prize and start the clock again.
Even if the winners don't share their methods, you can determine how long it took to claim the biggest prize, and compare with the length of time it takes for subsequent lesser prizes. A reduction in the interval spells trouble for your security method, because the attackers found an easier way to get in.
You can then determine the general level of effort required, when people finally stop taking the otherwise free money. If the $125 prize is claimed, and the $62.50 prize is not, you can assume that it costs between $62.50 and $125, plus a certain amount of time, to break your security.
As long as whatever you put behind that security is worth less than that amount of time and money, it will probably be safe from random attackers. Unlike an in-home safe or a bank vault, you can't take calipers and measure the thickness of the walls, to calculate how long it would take to cut through.
This contest doesn't prove anything, but it does suggest a guideline. If no one takes the $2000, then as long as the expected value of a random attack on you is not higher than that, you can feel safe using it. The problem is that it doesn't take much to rise above that amount. Late model car? Nice house? Taking an actual vacation? You're worth at least a spear-phishing attempt.
It's really worth reading Schneier's comments on security contests. https://www.schneier.com/crypto-gram/archives/1998/1215.html...
But it doesn't tell you anything about dedicated attackers, and those are the guys you really need to worry about. Anyone who really wants in can climb over the fence, or cut through it, or drive a tank over it.
I'm not a fan of this type of bounty myself, but it might seem like a good idea if you have enough money for a contest prize but not anywhere near what would be needed for a professional audit. Even so, if your bounty is claimed, you still might want to know how much of the work for that first attack is reusable for all subsequent attacks, and that requires a second prize.