1. © 2003 School of Computing, University of Leeds SY32 Secure Computing, Lecture 15 Implementation Flaws Part 3: Randomness and Timing Issues

2. 2 SY32 Secure Computing, Lecture 15 Outline Randomness Issues Randomness Issues Flaws of traditional PRNGs Flaws of traditional PRNGs Cryptographically-strong PRNGs Cryptographically-strong PRNGs Entropy collection Entropy collection Timing Issues Timing Issues Race conditions Race conditions Time of check, time of use (TOC-TOU) Time of check, time of use (TOC-TOU)

3. 3 SY32 Secure Computing, Lecture 15 Random Number Generation Computers, being deterministic, are not good at generating random numbers Computers, being deterministic, are not good at generating random numbers So-called ‘random number generators’ (RNGs) are, in fact, pseudo-random number generators (PRNGs) So-called ‘random number generators’ (RNGs) are, in fact, pseudo-random number generators (PRNGs) Common example: linear congruential algorithm Common example: linear congruential algorithm PRNGs are seeded with input data PRNGs are seeded with input data Allows for reproducibility where necessary; a given seed always produces same output sequence Allows for reproducibility where necessary; a given seed always produces same output sequence Seeds are typically 32-bit integers Seeds are typically 32-bit integers

4. 4 SY32 Secure Computing, Lecture 15 Attacks Against PRNGs Cryptanalytic attack Cryptanalytic attack Discovery of internal state Discovery of internal state Observe enough output values and we can figure out how generator was seeded Observe enough output values and we can figure out how generator was seeded Knowledge of seed allows us to predict output Knowledge of seed allows us to predict output Easier than you might think!... Easier than you might think!...

5. 5 SY32 Secure Computing, Lecture 15 Cigital’s Internet Poker Exploit Our cards We can’t see other players’ cards… …but we can compute what they will be!

6. 6 SY32 Secure Computing, Lecture 15 Cigital’s Internet Poker Exploit Flawed PRNG used for deck shuffling Flawed PRNG used for deck shuffling Non-cryptographic algorithm Non-cryptographic algorithm 32-bit seed, so 52! (about 2 226 ) possible shuffles reduces to around 4 billion 32-bit seed, so 52! (about 2 226 ) possible shuffles reduces to around 4 billion PRNG seed chosen poorly PRNG seed chosen poorly Milliseconds since midnight on system clock used, so 4 billion shuffles reduces to 86,400,000 Milliseconds since midnight on system clock used, so 4 billion shuffles reduces to 86,400,000 If we can sync closely to server’s clock, we can reduce this figure significantly… If we can sync closely to server’s clock, we can reduce this figure significantly…

7. 7 SY32 Secure Computing, Lecture 15 Synchronise clock & hit Shuffle button Program calculates shuffle, and predicts other players’ hands! Specify your 2 cards and first 3 from ‘flop’

8. 8 SY32 Secure Computing, Lecture 15 Success!

9. 9 A More Serious Scenario SSL uses randomly-generated session key to perform symmetric encryption of data SSL uses randomly-generated session key to perform symmetric encryption of data Public key cryptography is used to exchange session key securely Public key cryptography is used to exchange session key securely No need to break that encryption if we can predict what the session key should be! No need to break that encryption if we can predict what the session key should be! 1996: Netscape 1.1 1996: Netscape 1.1 PRNG seed could be determined from time of day and process IDs PRNG seed could be determined from time of day and process IDs

10. 10 SY32 Secure Computing, Lecture 15 Better PRNGs Cryptographic PRNGs produce numbers that are hard to predict, even when attacker has full knowledge of the algorithm Cryptographic PRNGs produce numbers that are hard to predict, even when attacker has full knowledge of the algorithm Typical techniques Typical techniques Encrypt a secret counter with a secret key Encrypt a secret counter with a secret key Compute MD5 or SHA-1 hash of secret counter Compute MD5 or SHA-1 hash of secret counter Critical dependence on seed quality Critical dependence on seed quality

11. 11 SY32 Secure Computing, Lecture 15 Entropy Collection Entropy of a seed measures its randomness; the more entropy we have, the better the seed Entropy of a seed measures its randomness; the more entropy we have, the better the seed Sources of entropy: Sources of entropy: Radioactive decay (needs special hardware) Radioactive decay (needs special hardware) Images of chaotic processes: http://www.lavarnd.org/ Images of chaotic processes: http://www.lavarnd.org/ http://www.lavarnd.org/ Keyboard and mouse events Keyboard and mouse events Events internal to OS (e.g., thread timing) Events internal to OS (e.g., thread timing)

12. 12 SY32 Secure Computing, Lecture 15 Practical Sources of Randomness Windows Windows CryptGenRandom call from Win32 API CryptGenRandom call from Win32 API Entropy gathered from huge range of sources, including time, CPU counters, interrupt info, PID, paging info… Entropy gathered from huge range of sources, including time, CPU counters, interrupt info, PID, paging info… RNGCryptoServiceProvider class in.NET RNGCryptoServiceProvider class in.NET Linux Linux Standard devices, which we open & read like files Standard devices, which we open & read like files /dev/random (processed entropy) /dev/random (processed entropy) /dev/urandom (pseudo-random numbers) /dev/urandom (pseudo-random numbers)

13. 13 SY32 Secure Computing, Lecture 15 Race Conditions Common problem in multithreaded apps, or apps where multiple processes share resources Common problem in multithreaded apps, or apps where multiple processes share resources Very difficult to detect and fix Very difficult to detect and fix Application will not be robust… Application will not be robust… …and there could be security problems …and there could be security problems

14. 14 SY32 Secure Computing, Lecture 15 Exploiting a Race Condition Attacker ‘races’ to invalidate an assumption made by programmer in the interval between operations Attacker ‘races’ to invalidate an assumption made by programmer in the interval between operations If attacker wins, program will behave incorrectly If attacker wins, program will behave incorrectly Period during which violating the assumption leads to incorrect behaviour is window of vulnerability Period during which violating the assumption leads to incorrect behaviour is window of vulnerability

15. 15 SY32 Secure Computing, Lecture 15 Time Of Check, Time Of Use Special class of RC involving file access—often abbreviated to TOC-TOU Special class of RC involving file access—often abbreviated to TOC-TOU Window of vulnerability occurs between check on some file property and use of the file Window of vulnerability occurs between check on some file property and use of the file More of a problem for UNIX than for Windows More of a problem for UNIX than for Windows System calls such as access use pathnames rather than a filehandle… System calls such as access use pathnames rather than a filehandle… …and a pathname can be made to reference a different file within window of vulnerability! …and a pathname can be made to reference a different file within window of vulnerability!

16. 16 SY32 Secure Computing, Lecture 15 Canonical TOC-TOU Example A program is running ‘setuid root’ A program is running ‘setuid root’ Grants program the privileges of root, regardless of the user executing it Grants program the privileges of root, regardless of the user executing it Program must write to a file owned by user running the program… Program must write to a file owned by user running the program… …so program must take care not to write to that file unless actual user is permitted to do so …so program must take care not to write to that file unless actual user is permitted to do so

17. 17 SY32 Secure Computing, Lecture 15 Canonical TOC-TOU Attack FILE* outfile;... if (access(filename, W_OK) == 0) { outfile = fopen(filename, "wb+"); writeDataTo(outfile); } else { fprintf(stderr, "Not permitted to open %s\n", filename); exit(1); } Check whether real UID has write permission Open file for writing Window of vulnerability

18. 18 SY32 Secure Computing, Lecture 15 How The Attack Works $ touch dummy $ ln –s dummy symlink $ rm symlink; ln –s /etc/passwd symlink Creates a zero-length, dummy file with attacker’s permissions Creates a symbolic link pointing to the dummy file Within window of vulnerability: Link now points to /etc/passwd, but program thinks it is attacker’s file; password file is overwritten! Preparation:

19. 19 SY32 Secure Computing, Lecture 15 Summary When generating pseudo-random numbers: When generating pseudo-random numbers: Use a cryptographically-strong PRNG Use a cryptographically-strong PRNG Collect enough entropy to provide a good seed Collect enough entropy to provide a good seed Watch out for race conditions in multithreaded or multi-process applications Watch out for race conditions in multithreaded or multi-process applications Beware of TOC-TOU problems with file access Beware of TOC-TOU problems with file access Avoid system calls that use filenames, if possible; file could change after you start dealing with it! Avoid system calls that use filenames, if possible; file could change after you start dealing with it!