Matasano Chargen

~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~ MATASANO SECURITY - Chicago. New York City. Sunnyvale. Application Security Consultant Full-Time, work visa sponsorship available ~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~ The security of computer systems has increasingly become an everyday concern. The news all too often brings word of yet another compromise, exposing financial information, personal details, or simply salacious pictures. Whatever the impact, it's clear the technology industry has a problem, and there are few easy solutions. Some seek legislation to impose harsher penalties on the responsible parties. This ignores the fact that many of those responsible are outside the jurisdictions which seek to punish them. In some cases, they may have tacit approval of their own government, or even be operating on their government's behalf. Others turn to established security products looking for antivirus and network filtering technologies to add protection. This is an also an imperfect solution. It places the defender in a reactive posture, responding only to those threats which have been previously detected, and for which countermeasures have been developed. There's no perfect solutions. At Matasano, we believe the best way to combat security weaknesses is at their source; by discovering and remediating software vulnerabilities before others leverage them for ill effect. Our clients see the value in this approach. …

Not checking malloc's return value can easily lead to security vulnerabilities, particularly in bytecode interpreters and things like that. The basic plan is simple: Trick the target program into allocating an impossible huge block of memory (e.g. 3 gigabyte on a 32 bit system). Malloc will return NULL but the program blindly assumes the allocation has succeeded. Now use carefully chosen indices to read and write whatever memory you want. As an example, here's a classic Flash exploit that used this technique: http://chargen.matasano.com/chargen/2007/7/27/this-new-vulnerability-d… Really, xmalloc is five lines of code. Just use it. void *xmalloc(size_t size) { void *ptr = malloc(size); if (!ptr) abort(); return ptr; }

This isn't great, but it's not quite as terrible as its being made out to be for the official packages. The Mercurial bug is only relevant if you're using Mercurial with user supplied input on your production servers. Unlikely if you're not BitBucket. http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-m… Is a good read on the subject. The libtasn1 bug seems to be only relevant if you're using GnuTLS. Again, not great but not the most widely used library either. Cutting those two out cuts the number of vulnerable images in half and there's probably a few more rarely used programs with security issues further down the tail. Again, this isn't great, but it's not quite as terrible as the authors are making it to be. The user supplied packages on the other hand seems to be quite a bit worse.

There are some thoughts on the matter here: http://chargen.matasano.com/chargen/2015/3/26/enough-with-the-salts-up… But I would say yes, bcrypt is still best practice. Other commenters are right that bad passwords will still be recoverable, but using one of bcrypt/scrypt/PBKDF2 is due diligence. I would use whichever one is most easily available on your platform.

We wrote a quick blog post on this. The main meaningful feature is a table of distros, versions, and whether they're not vulnerable, vulnerable but with a patch, or vulnerable with no patch yet. I am accepting requests for other distros, and of course if you have any corrections I'd love to hear them! http://chargen.matasano.com/chargen/2015/1/27/vulnerability-overview-g…

Jeff Atwood has a great layman's introduction to rainbow tables and why this stuff deserves thought here: http://www.codinghorror.com/blog/2007/09/rainbow-hash-cracking.html The follow up by Thomas Ptacek, a security expert, goes into a lot more detail about what to use and how: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t… Both are very readable articles, which I find helps immensely.

http://chargen.matasano.com/chargen/2009/7/22/if-youre-typing-the-lett… is the best reference. (Don't do it!)

Yes. As a simple example, if you XORd your input text with a 1-byte key, the letter frequency of english text would be unchanged. So your most common byte in your output would be likely to be the encrypted char 'e'. You could then recover the key by XOR 'e' with that most common byte. More complex systems have more complex patterns, but that's what cryptopgraphers do - try and spot weaknesses in an algorithm. As always, this is a great read: http://chargen.matasano.com/chargen/2009/7/22/if-youre-typing-the-lett… Search for "Garbling a block to confuse an app" and read on from there for a real-world use of output patterns (used when you can partially control the input).

Author of the blog post here. I posted this mainly to get feedback on the different password hashing schemes for open source software/frameworks with the added benefit of some background as to why bcrypt matters. I defer to fellow HNer tptacek's article about secure password schemes for a complete explanation on why bcrypt is the best. It's linked in the post but here it is again for reference: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t…

TLS is not so easy to implement correctly. You still have to decide (a) which version of TLS to support, (b) which ciphersuites to support, (c) which signature algorithms to support, (d) which CA(s) to trust, and (e) which certificate revocation checking scheme(s) to use, at least. People tend to choose the defaults, which mostly works. But, Colin does make a valid point that the default list of CAs in particular is probably not the best choice considering the policies of the companies making these default lists. See http://chargen.matasano.com/chargen/2009/8/27/a-working-theory-about-r… for another example of a common misconfiguration of TLS implementations.

It's nice to see people still follow the old security PR playbook: http://chargen.matasano.com/chargen/2009/4/1/how-to-hidehhhandle-secur… The "modern" game Microsoft plays is boring. It acknowledges and thanks researchers, often accepts worst-case assessments of impact, and fast-tracks fixes. What they don't understand is that our stories need an antagonist, someone we can name and pillory. Thanks, Claire Cranton at GSM.com, for giving us one.

What you are referring to is called "stretching". It's a lot better than a simple salted hash, but bcrypt would still be better. I'm no crypto expert, but I think this is due to the way bcrypt was designed, and their use of a pessimized Blowfish cypher. SHA512 was designed for speed, which is the opposite of what you want with a password hashing scheme. tptacek talks a little about this in this blog post: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t… "Bcrypt uses Blowfish instead of MD5. Blowfish is a block cipher with a notoriously expensive setup time. To optimize Blowfish to run much faster, you’d have to contribute a major advance to cryptography. We security practioners are all “betting people”, and we usually like to place our bets on the side that “demands major advances in cryptography”." Other interesting links: http://stackoverflow.com/questions/3722780/do-any-security-experts-rec… http://en.wikipedia.org/wiki/Bcrypt

Security has been a focus of NaCl from the outset. It uses a sandbox security model built around a restricted set of "native code". The aim was to make NaCl apps verifiable from a security stand point. Chris Rohlf from Matasano did a great blog post, The Security Implications Of Google Native Client, that compares the NaCl approach to ActiveX and Java -- and included beautiful diagrams to boot! Unfortunately the images appear to be broken on the Matasano blog [1] but I've found a PDF'd version [2] that contains them in all their glory. The post came out of the Matasano team's entry in the Native Client Security Contest [3] that Google held early last year. The Matasano team ended up taking second place behind Mark Dowd / Ben Hawkes [4]. All those guys are 'rockstars' in the security industry. So, Google has thought deeply and tried hard when designing NaCl's security. They a care enough and are switched on enough to run a security contest that was well received by the industry (rare). A number of mega-brains-on-sticks found issues back in May '09 -- hopefully they have all been addressed. It looks to me that Google has done a good job at learning from past mistakes when implementing NaCl and it should be different. No doubt there will be further security issues found but then again, name a framework that is free from flaws? [1] http://chargen.matasano.com/chargen/2009/8/27/the-security-implication… [2]…

Maybe sed -i 's/old certificate/new certificate/g' /usr/bin/dropbox Used to work in some software. EDIT: Matasano has a nice guide for bypassing OpenSSL cert pinning (for iOS apps, but the techniques should be more broadly applicable): http://chargen.matasano.com/chargen/2015/1/6/bypassing-openssl-certifi…

Two discussions: http://news.ycombinator.com/item?id=639647 http://news.ycombinator.com/item?id=1030560 The original post: http://chargen.matasano.com/chargen/2009/7/22/if-youre-typing-the-lett…

There was a nice 5-part series you and I wrote on this topic back in 2006. However, parts of it are no longer available. Could you rescue it from your archives, with diagrams? Thanks. http://chargen.matasano.com/chargen/2006/9/18/rsa-signature-forgery-ex…

They are talking bullshit. Here's an interesting article about password security: http://www.codinghorror.com/blog/2007/09/youre-probably-storing-passwo… Even better is the linked article from matasano.com, but the link at codinghorror.com is broken. This should work: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t… To quote from that article: "We learned that the correct choice [to store passwords] is Bcrypt." (which is definitely one way)

The first rule of crypto is: never implement your own crypto. And tptacek's corollary: "If You're Typing The Letters A-E-S Into Your Code, You're Doing It Wrong" http://chargen.matasano.com/chargen/2009/7/22/if-youre-typing-the-lett…

Why reinvent the wheel using engineering techniques you only have cursory knowledge of from reading an encyclopedia? There is a standard method of securing online accounts, using known methods that are currently known to be perfectly safe in every application from financial institutions to the latest social networking site. Triple-salting passwords is not that method. http://codahale.com/how-to-safely-store-a-password/ http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t…

Previous post: http://news.ycombinator.com/item?id=1998819 Similar discussion: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t…

Just as a curiosity: yesterday I watched a talk by Thomas Ptacek at some indie Mac dev conference where he showed, en passant, how some kludges used by Apple produced vulnerabilities in Mac OS X. It’s old, fixed stuff by now, but I was like “WTF?” all the same. Because it’s very stupid stuff from Apple. Here’s the talk, slides (check slide 11), and related blog post: http://www.viddler.com/explore/rentzsch/videos/31/ http://www.slideshare.net/tqbf/c42-software-security-presentation http://chargen.matasano.com/chargen/2009/9/24/indie-software-security-…

Guy doesn't know what he is talking about. See http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t… and http://codahale.com/how-to-safely-store-a-password/

The werkzeug implementation uses sha1 or md5 (which is bad, see http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t… for a good explanation). Stick to bcrypt.

Yes, this is consensus. "Salting" isn't actually a real security practice. See: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t…

http://chargen.matasano.com/chargen/2009/1/10/applicable-lessons-from-… Some crazy stuff that you could do with Forth. The author shows how you can inject a forth VM in shellcode and build exploits on top of that.

If you read the post he links to by Tom Ptacek [1] (one of the go-to guys for security around here) you will see the reason this is considered a bad "alternative". He has also discussed this in depth here in the past if you search back over his comments (tptacek) 1. http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t…

You are incorrect, and it's why you are being downvoted. Please read this article to learn why: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-t… Essentially, MD5 and SHA were designed to be fast hashing algorithms. This is NOT what you want with password hashing, as you need to be able to tune the complexity of your algorithm to scale with Moore's Law and other factors.

I am typically one of the opinion that if you are doing crypto in javascript you are doing it wrong. Talks like http://rdist.root.org/2009/08/06/google-tech-talk-on-common-crypto-fla… provide insight and let us not forget http://chargen.matasano.com/chargen/2006/4/28/oh-meebo.html Besides it is very difficult to have javascript return sutiably random numbers cross platform. If you need to encrypt browser traffic use ssl instead of some half-assed pseudo-secure javascript mess. Sorry JSCrypto team, while your implementation is awesome and all, you are doing it wrong.