March 31, 2015

The OpenSSL project releases new versions of its software to squash 12 security vulnerabilities

openssl-logo(LiveHacking.Com) – The OpenSSL Project announced on March 16th that it would make a new release of its OpenSSL suite to fix a number security defects. As promised the project published three new versions today, OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf. The highest severity defect fixed by these releases is classified as High.

Before looking at the defects which have been fixed, it is worth noting that the project has reclassified its advisory about the FREAK vulnerability from Low to High. It was previously classified as Low severity because it was originally thought that server RSA export ciphersuite support was rare: a client was only vulnerable to a MITM attack against a server which supports an RSA export ciphersuite. Recent studies have shown that RSA export ciphersuites support is far more common.

The new security advisory lists only one High severity fix, for CVE-2015-0291 – ClientHello sigalgs DoS.  If a client connects to an OpenSSL 1.0.2 server and renegotiates with an invalid signature algorithms extension a NULL pointer dereference will occur. This can be exploited in a DoS attack against the server. This issue affects OpenSSL version 1.0.2.

The rest of the bug fixes are rated as Moderate or Low:

  • Multiblock corrupted pointer (CVE-2015-0290) – Severity: Moderate – OpenSSL 1.0.2 introduced the “multiblock” performance improvement. This feature only applies on 64 bit x86 architecture platforms that support AES NI instructions. A defect in the implementation of “multiblock” can cause OpenSSL’s internal write buffer to become incorrectly set to NULL when using non-blocking IO. Typically, when the user application is using a socket BIO for writing, this will only result in a failed connection. However if some other BIO is used then it is likely that a segmentation fault will be triggered, thus enabling a potential DoS attack.
  • Segmentation fault in DTLSv1_listen (CVE-2015-0207) – Severity: Moderate – The DTLSv1_listen function is intended to be stateless and processes the initial ClientHello from many peers. It is common for user code to loop over the call to DTLSv1_listen until a valid ClientHello is received with an associated cookie. A defect in the implementation of DTLSv1_listen means that state is preserved in the SSL object from one invocation to the next that can lead to a segmentation fault. Errors processing the initial ClientHello can trigger this scenario. An example of such an error could be that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only server.
  • Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286) – Severity: Moderate – The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check certificate signature algorithm consistency this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication.
  • Segmentation fault for invalid PSS parameters (CVE-2015-0208) – Severity: Moderate – The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and invalid parameters. Since these routines are used to verify certificate signature algorithms this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication.
  • ASN.1 structure reuse memory corruption (CVE-2015-0287) – Severity: Moderate – Reusing a structure in ASN.1 parsing may allow an attacker to cause memory corruption via an invalid write. Such reuse is and has been strongly discouraged and is believed to be rare.
  • PKCS7 NULL pointer dereferences (CVE-2015-0289) – Severity: Moderate – The PKCS#7 parsing code does not handle missing outer ContentInfo correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing.
  • Base64 decode (CVE-2015-0292) – Severity: Moderate – A vulnerability existed in previous versions of OpenSSL related to the processing of base64 encoded data. Any code path that reads base64 data from an untrusted source could be affected (such as the PEM processing routines). Maliciously crafted base 64 data could trigger a segmenation fault or memory corruption. This was addressed in previous versions of OpenSSL but has not been included in any security advisory until now.
  • DoS via reachable assert in SSLv2 servers (CVE-2015-0293) – Severity: Moderate – A malicious client can trigger an OPENSSL_assert (i.e., an abort) in servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message.
  • Empty CKE with client auth and DHE (CVE-2015-1787) – Severity: Moderate – If client auth is used then a server can seg fault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack.
  • Handshake with unseeded PRNG (CVE-2015-0285) – Severity: Low – Under certain conditions an OpenSSL 1.0.2 client can complete a handshake with an unseeded PRNG.
  • Use After Free following d2i_ECPrivatekey error (CVE-2015-0209) – Severity: Low – A malformed EC private key file consumed via the d2i_ECPrivateKey function could cause a use after free condition. This, in turn, could cause a double free in several private key parsing functions (such as d2i_PrivateKey or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption for applications that receive EC private keys from untrusted sources. This scenario is considered rare.
  • X509_to_X509_REQ NULL pointer deref (CVE-2015-0288) – Severity: Low – The function X509_to_X509_REQ will crash with a NULL pointer dereference if the certificate key is invalid. This function is rarely used in practice.

New versions of OpenSSL are available as listed below:

  • OpenSSL 1.0.2a is now available, including bug and security fixes.
  • OpenSSL 1.0.1m is now available, including bug and security fixes.
  • OpenSSL 1.0.0r is now available, including bug and security fixes.
  • OpenSSL 0.9.8zf is now available, including bug and security fixes.

FREAK vulnerability weakens secure Web sites

padlock-icon-on-computer-monitor-showing-safety-security-and-protected_300x225(LiveHacking.Com) – FREAK (or ‘Factoring attack on RSA-EXPORT Keys’) is a newly disclosed vulnerability that can force browsers into using weaker encryption keys. Once the connection is using weaker keys then the traffic can be cracked relatively quickly. This then exposes all the information that was being sent over the secure connection.

The vulnerability stems directly from an old U.S. government policy that made it illegal to export strong encryption and required that weaker “export-grade” products be shipped to customers in other countries. These export restrictions were lifted in the late 1990s, but the weaker encryption got built-in into widely used software, some of which made its way back into USA.

In the 1990s the USA only allowed companies to create technology with 512-bit encryption for use overseas. The law was designed to limit the trade in military technology. But 512-bit encryption has long been seen as “unacceptably weak” and most security experts thought that its use had ceased completely.

According to the Washington Post, it is possible to crack the export-grade encryption key in about seven hours, using computers on Amazon Web services. The site freakattack.com has a list of sites that are vulnerable to FREAK. The list “includes news organizations, retailers and financial services sites such as americanexpress.com.” According to Nadia Heninger, a University of Pennsylvania cryptographer, over 5 million sites are vulnerable to this attack vector.

FREAK has been assigned the Common Vulnerabilities and Exposures identifier CVE-2015-0204. According to the description, “The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role.”

According to a security advisory from OpenSSL, “an OpenSSL client will accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. A server could present a weak temporary key and downgrade the security of the session.”

This issue affects all current OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.1 users should upgrade to 1.0.1k, OpenSSL 1.0.0 users should upgrade to 1.0.0p, and OpenSSL 0.9.8 users should upgrade to 0.9.8zd.

This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen Henson of the OpenSSL core team the following day.

It also looks like Android’s web browser and Apple’s Safari browser are vulnerable. According to Matt Green, “A group of cryptographers at INRIA, Microsoft Research and IMDEA have discovered some serious vulnerabilities in OpenSSL clients (e.g., Android) and Apple TLS/SSL clients (e.g., Safari) that allow a ‘man in the middle attacker’ to downgrade connections from ‘strong’ RSA to ‘export-grade’ RSA.”

Another NSA backdoor found in RSA’s products

rsa-squareAccording to research performed by a group of professors from Johns Hopkins, the University of Wisconsin and the University of Illinois, the security company RSA used a second security tool developed by the NSA which reduced the time needed to crack secure Internet communications.

At the end of last year is was revealed that the NSA paid RSA $10 million to use the Dual Elliptic Curve random number generator in its products. It has since come to light that the Dual Elliptic Curve algorithm had a built-in flaw which made it easier for the NSA to decrypt data that was encrypted with a random number generated by the Dual Elliptic Curve generator.

According to research seen by Reuters, the team of academic researchers have discovered that a second NSA tool, known as the “Extended Random” extension for secure websites, could reduce the time needed to crack a version of RSA’s Dual Elliptic Curve software by tens of thousands of times.

The company is reported to have told Reuters that it had not intentionally weakened security on any product and noted that Extended Random was not widely adopted. RSA also said that the Extended Random functionality has been removed from its software.

“We could have been more skeptical of NSA’s intentions,” said RSA Chief Technologist Sam Curry. “We trusted them because they are charged with security for the U.S. government and U.S. critical infrastructure.”

The researchers were able to demonstrate the weakness of the Dual Elliptic Curve random number generator by decrypting TLS connections made using the RSA Share library in several seconds.

Following the release of documents by former NSA contractor Edward Snowden, a presidential advisory group reported that the NSA’s practice of subverting cryptography standards should stop.

The possibility of a back door in the Dual Elliptic Curve random number generator was first mooted back in 2007. Recent research shows that when the NSA’s default parameters are replaced with new values, the current popular cryptography libraries are still vulnerable. According to the report’s authors, “The RSA BSAFE implementations of TLS make the Dual EC back door particularly easy to exploit compared to the other libraries we analyzed. ”

The research concludes that the Extended Random extension allows a client to request longer TLS random numbers from the server, a feature that, if it enabled, would speed up the Dual EC attack by a factor of up to 65,000.

In brief: RSA launches new system which splits credentials over two servers

(LiveHacking.Com) – RSA has launched a new distribution system which splits credentials over two servers. The idea being that if one server is hacked the attackers only gains access to half of the stored information (password etc). The system called “RSA Distributed Credential Protection” scrambles, randomizes and splits passwords into multiple locations.

As part of the system, administrators can re-randomize and re-split log-in data if a breach is suspected. This means that unless the hackers manage to break into both servers before the re-hashing, the stolen data would be useless.

“DCP scrambles, randomizes and splits sensitive credentials, passwords and Pins and the answers to life or challenge questions into two locations,” said the RSA’s mananger Liz Robinson.

The product however isn’t open source but is rather a commercial offering. RSA expect that DCP will be ready before the end of the year. It will cost about $150,000 per licence which RSA says is less than the cost of “an expensive lawsuit.”

Worldwide losses from phishing attacks increases to over US$687 million

(LiveHacking.Com) – RSA has released some new figures about phishing attacks during the first half of 2012 and the news isn’t good. The number of phishing attacks rose again (for the fourth time), this time by 19% compared to the second half of 2011. In real terms this means that the estimated worldwide financial losses from these attacks alone amounted to over US$687 million.

The countries targeted by the attacks has remained unchanged with the top five being the UK, U.S., Canada, Brazil and South Africa. Although Canada occupies a spot in the top three, it has also seen some significant increases with phishing attacks increasing by nearly 400% in the first half of 2012. This is likely due to the economic health of the North American country, to put it simply fraudsters follow the money.

“The interesting part this time was the fact that the industry’s attack duration median (uptime), according to the Anti-Phishing Working Group, went down from 15.3 hours per attack to 11.72 hours per attack, thus somewhat curbing the monetary impact of each attack, even though attack numbers keep climbing,” wrote Limor Kessem. “Had attack medians remained the same, the monetary losses to phishing in 1H2012 would have exceeded US$897 million. Statistically speaking, this saved the world close to an additional 31% in money that could have been lost to phishing attackers.”

Phishing is, of course a crime, and it is perpetrated by fraudsters who can persuade victims to respond to a legitimate-looking email or click on a seemingly safe link. To do that, the attackers create emails to play on human emotions, it is a con. Although phishing is a modern crime for the Internet age, the forces behind it – manipulation, deceit and persuasion – are not.

With Internet users increasingly relying on webmail and social networking sites, successful phishing attacks to obtain access to Facebook or Gmail open the doors to many other avenues. If an email account is hacked by information used during a phishing attack then the attacker can reset passwords for other important accounts (PayPal, Amazon, Apple/iCloud etc). This is what happened to Mat Honan. The hackers managed to breached Mat’s iCloud account and then proceeded to reset all of Mat’s accounts and devices, they even sent remote wipe commands to Mat’s iPhone, iPad and MacBook.

RSA SecurID Software Token Cloned and Rendered Useless

(LiveHacking.Com) – The use of two-factor authentication has grown as the simple username & password method has proved to be insufficient for more sensitive systems. From online banking to employee access to business networks two-factor authentication is become more the norm, even Google optionally offers two step authentication to its service like Gmail. In two-factor authentication a token is needed which can only be generated by something in possession of the user. In the past this has been a special hardware device which churns out the right numbers during login. However the widespread use of smart phones allows these devices to be used as an authentication token generator. For example, RSA SecureID software token programs are available for iPhone, Nokia and the Windows platforms.

Security researcher Behrang Fouladi has posted details of how he has been able to clone the software token from RSA’s SecurID two-factor authentication system on the Windows platform. On the Windows platform the SecurID software token program uses a hard drive plug-in with unique device serial number. If the same user tries to install the software on a different computer, the user cannot import software tokens into the application because the hard drive plug-in on the second computer has a different serial number. This means that only one user on one computer can be authorized to generate the tokens.

Fouladi has managed to reverse engineer the hard disk plugin and discover that the serial number is formed from the system’s host name and current user’s windows security identifier (SID). An attacker, with access to these values, can easily calculate the target token’s device serial number and bypass the plug-in which ties the software to just one machine.  The SecureID device serial number calculation can be represented with the following formula: device_serial_number=Left(SHA1(host_name+user_SID+“RSA Copyright 2008”),10)

Fouladi’s how-to goes on to explain how the token information, including the secret seed value, is stored in a SQLite database and the steps needed to decrypt the information in that database. “When the above has been performed, you should have successfully cloned the victim’s software token and if they run the SecurID software token program on your computer, it will generate the exact same random numbers that are displayed on the victim’s token,” he wrote.

Behrang has proved his technique by installing two instances of the software  (A and B) on two separate Windows XP virtual machines and attempted to clone token B on the virtual machine that was running token A. Using his method, token B was successfully cloned on the machine running token A.

Is SSL Falling Apart? New Research Papers Find More Holes

(LiveHacking.Com) – Two new research papers (here and here) have been published which examine the low level details of SSL, specifically randomness aspects, and the results are surprising. According to the “Ron was wrong, Whit is right” paper,  two out of every one thousand RSA moduli that on the Internet today offer no security. While the Princeton’s Center for Information Technology Policy blog shows that 0.4% of all the public keys used for SSL web site security can be remotely compromised.

Two in one thousand is  0.2%, Princeton is talking 0.4%. These aren’t huge numbers… but a search on Google for how many sites have “https://” in the URL shows 19,640,000,000 sites. Some of these are sites about HTTPS and aren’t secure sites. If just one quarter of those are really using https, that is 4,910,000,000 sites. 0.4% of 1,964,000,000. That is a lot of SSL certificates. And a huge potential number of sites which can be hacked.

“Our conclusion is that the validity of the assumption is questionable and that generating keys in the real world for “multiple-secrets” cryptosystems such as RSA is signi cantly riskier than for “single-secret” ones such as ElGamal or (EC)DSA which are based on Die-Hellman,” wrote Arjen K. Lenstra et al.

SSL has been having a hard time recently and it is starting to look as if this system isn’t as robust as previously thought. Recent SSL stories include the BEAST, Diginotar and Verisign.

“Unfortunately, we’ve found vulnerable devices from nearly every major manufacturer and we suspect that more than 200,000 devices, representing 4.1% of the SSL keys in our dataset, were generated with poor entropy. Any weak keys found to be generated by a device suggests that the entire class of devices may be vulnerable upon further analysis,” wrote Nadia Heninger.

20 Percent of Fortune 100 Companies Were Hit by the RSA Attackers

(LiveHacking.Com) – Brian Krebs, who was until just a couple of years ago a reported for The Washington Post, has revealed that over 760 other companies have been hit by the same attackers which targeted RSA earlier this year.

In his blog post, Brian says that “more than 760 other organizations had networks that were compromised with some of the same resources used to hit RSA. Almost 20 percent of the current Fortune 100 companies are on this list.”

Brian does, however, give some caveats:

  1. Many of the network owners listed are Internet service providers, and are likely included because some of their subscribers were hit.
  2. It is not clear how many systems in each of these companies or networks were compromised.
  3. Some of these organizations (there are several antivirus firms mentioned  below) may be represented because they  intentionally compromised internal systems in an effort to reverse engineer malware used in these attacks.
The most interesting name on the list include:
  • The Alabama Supercomputer Network
  • Cisco Systems
  • eBay
  • The European Space Agency
  • Facebook,
  • Google
  • IBM
  • Intel Corp
  • the Internal Revenue Service (IRS)
  • MIT
  • Motorola Inc.
  • Northrop Grumman
  • Novell
  • PriceWaterhouseCoopers
  • Research in Motion (RIM) Ltd.
  • Seagate Technology
  • VMWare

RSA to Replace SecurID Tokens – But Not For Everyone

Back in March, RSA revealed that its systems had come under a “very sophisticated cyber attack” and that as a results “certain information” related to its SecurID product was taken. Then last week Lockheed Martin, the US defense contractor and manufacturer of a variety of military products including the Trident missile and F-16, disclosed that its IT systems had come under “a significant and tenacious attack.” What connects these two events? Lockheed Martin uses SecurID.

In the post about the Lockheed Martin attack I wrote that “RSA need to be more public about how they are dealing with the theft of the information relating to SecurID. If this attack is a direct result of that theft, then no user of SecurID is safe. Have RSA been replacing the SecurID tokens and changing the keys and seeds?”

RSA have finally spoken up and have confirmed that the information taken from RSA in March was used during the attack on Lockheed Martin. As a result RSA will expand its “security remediation program to reinforce customers’ trust in SecurID tokens” and it will offer to replace SecurID tokens.

But - and the fact that there is a but is a very bad  for of RSA - only for “customers with concentrated user bases typically focused on protecting intellectual property and corporate networks.”

I have read that phrase “customers with concentrated user bases typically focused on protecting intellectual property and corporate networks” a dozen times and to be honest I have no idea what it means practically. It is probably a polite way of saying, “if you are a big customer we will give you new SecurID tokens, if you aren’t, forget it.”

The result is that Lockheed Martin will get new SecurID tokens as will any other defense contractor or big corporate. The rest of its customers get nothing, but then RSA don’t think you have anything worth stealing.

Lockheed Martin Thwarts IT Breach

Lockheed Martin, the US defense contractor and manufacturer of a variety of military products including the Trident missile and F-16, has acknowledged that its IT systems came under “a significant and tenacious attack” last week, but that due to the fast work of its security team it was able to protect all systems and data.

According to the press release, “as a result of the swift and deliberate actions taken to protect the network and increase IT security, our systems remain secure; no customer, program or employee personal data has been compromised.”

However what the Lockheed Martin press release fails to mention is that the company uses SecureID tokens from RSA to provide two-factor authentication for remote VPN access to their corporate networks.

Two months ago RSA revealed in an open letter to its customers that its servers where compromised by an extremely sophisticated cyber attack and as a result “certain” information was extracted from RSA’s systems.

That “certain” information turns out to be information about RSA’s SecurID two-factor authentication products, which has now been used to reduce the effectiveness of a SecurID.

Analysis
Lockheed Martin are to be congratulated on their speed and efficiency in dealing with this attack. However this attack marks a significant turning point in the nature and makeup of cyber attacks. First, RSA need to be more public about how they are dealing with the theft of the information relating to SecureID. If this attack is a direct result of that theft, then no user of SecurID is safe. Have RSA been replacing the SecurID tokens and changing the keys and seeds? Second, the nature of this attack, in that is was planned and premeditated, starting with an attack on RSA and then an attack on Lockheed Martin is a significant and disturbing event.