Attacks against badly implemented cryptography that don't require in-depth knowledge of cryptography.

1. COPYRIGHT TRUSTWAVE 2011
Presented by:
No-Knowledge Crypto Attacks
Daniel Crowley

2. Structure
› Background
› Attack!
› Potential Win

3. IDENTIFYING CIPHERTEXT
“Yep, it‟s wood”

4. Properties of ciphertext
› Appears random
› Generally encoded
› Decoded length often multiple of 8/16/32
–Block ciphers

5. Example
› Base64 encoded
› Decodes to 80 bytes
› Ent shows strong signs of randomness
› Probably ciphertext (okay, it is, I generated it)

6. REPLAY ATTACK
Bait and switch

7. Background
› Reuse of cryptovariables
› Trust in decrypted data

8. Attack!
› Reuse ciphertext
OR
› Find two places where ciphertext is
being accepted
› Swap them around

9. Potential Win
› Ciphertext from “article.php?id=(ciphertext)”
› Placed in
“doPasswordReset.php?userid=(ciphertext)”
› Reset password for another user

10. DECRYPTION ORACLE
Decrypt ALL the things!

11. Background
› Application takes encrypted input
› Application decrypts input
› Application gives you decrypted output

12. Identifying Decryption Oracles
› Look for encrypted input
› Modify input and look for garbled response

13. Attack!
› Take ciphertext from another
location
› Plug into decryption oracle

14. Potential Win
› “Password” cookie with encrypted value
› Plug cookie into decryption oracle
› PASSWORDS!

15. ENCRYPTION ORACLE
Encrypt ALL the things!

16. Background
› Application takes plaintext input
› Application encrypts input
› Application gives you encrypted output

17. Identifying Encryption Oracles
› Look for ciphertext in responses
› Modify input and look for modified ciphertext
› Length is often the giveaway

18. Attack!
› Encrypt strings like ‘ or 1=1#
› Plug encrypted string into any encrypted
input
› Cross your fingers

19. Potential Win
› resetpass.php?id=(ciphertext)
› resetpass.php?id=( ENC(„ or 1=1
#) )
› SQLi!

20. STREAM CIPHER BIT
FLIPPING
Flipping easy

21. Background
› Construction is simple
› Same key & IV means same keystream
› Reusing cryptovariables means catastrophic
failure

22. 0 1 1 0 0 1 0 0
1 0 1 0 1 0 1 0
1 1 0 0 1 1 1 0

23. 0 1 1 0 0 1 0 1
1 0 1 0 1 0 1 0
1 1 0 0 1 1 1 1

24. Attack!
› Flip bits in ciphertext input
› Same bits in plaintext are flipped
› No modification to other parts of
message

25. Potential Win
› Plaintext
–username=fred&admin=0
› Flip lots of bits until…
–username=fred&admin=1

26. STREAM CIPHER KEYSTREAM
RECOVERY
I couldn‟t think of anything funny for this one

27. Attack!
› Guess plaintext of an encrypted
message
› XOR plaintext and ciphertext to get
suspected keystream
› XOR suspected keystream with
unknown ciphertext
–Attempt to read message

28. Definite Win
› Ability to encrypt and decrypt anything
– In byte positions where known plaintext resides

29. ECB BLOCK SHUFFLING
Every day I‟m shufflin‟

30. Background
› ECB is a block cipher mode
› Each block is encrypted independent of
others
› Blocks can be
reordered, removed, duplicated

31. BLOCK 1
CIPHER
BLOCK 1
BLOCK 2
CIPHER
BLOCK 2
BLOCK 3
CIPHER
BLOCK 3
PLAIN
TEXT
CIPHER
TEXT

32. Attack!
› Shuffle blocks around randomly in
encrypted messages
› Cross your fingers!

33. Plaintext before modification
0 1 2 3 4 5 6 7
L A S T V I S I
T E D = / E N /
H O M E . J S P
& U S E R I D =
1 2 3 4 x04 x04 x04 x04
lastVisited=/en/home.jsp&userId=1234

34. Plaintext after modification
0 1 2 3 4 5 6 7
L A S T V I S I
T E D = / E N /
H O M E . J S P
& U S E R I D =
1 & F O O = B A
1 2 3 4 x04 x04 x04 x04
lastVisited=/en/home.jsp&userId=1&foo=ba1234

35. CBC BIT FLIPPING
Flipping awesome

36. Background
› CBC is a block cipher mode
› When decrypting, each block affects next
block
› Flipping bits in ciphertext block n
– Garbles plaintext block n
– Flips same bits in plaintext block n+1

37. BLOCK A
IV
CIPHER
BLOCK A
BLOCK B
CIPHER
BLOCK B
BLOCK C
CIPHER
BLOCK C
PLAIN
TEXT
CIPHER
TEXT

38. BLOCK A
IV
CIPHER
BLOCK A
BLOCK B
CIPHER
BLOCK B
BLOCK C
CIPHER
BLOCK C
PLAIN
TEXT
CIPHER
TEXT

39. Attack!
› Submit ciphertext multiple times
› Flip a different bit each time
› Cross your fingers!

40. Potential Win
› Plaintext is:
–lastVisited=http://example.com/home.jsp&u
id=124%01
–(lastVisited=http)(://example.com/h)(ome.js
p&uid=124%01)
• Split into 16 byte blocks
› Flip bits in bytes 13-15 in block 2
–Block 2 becomes garbage
–“124” in block 3 has bits flipped in plaintext

41. MISCELLANEOUS
Bonus round!

42. Other Fun Attacks
› Padding Oracles
– padBuster.pl
› Hash length extension attacks
– Hash_extender