[PPT] - SSL, GONE IN 30 SECONDS b r e a c h A BREACH beyond CRIME SSL, PowerPoint Presentation

SLIDE 1

SSL, GONE IN 30 SECONDS

b r e a c h

SSL, GONE IN 30 SECONDS

A BREACH beyond CRIME

Angelo Prado Neal Harris Yoel Gluck

SLIDE 2

SSL, GONE IN 30 SECONDS

b r e a c h

AGENDA

Review of CRIME Introducing BREACH In the weeds Demo time! Mitigations

Proceed with caution:

SLIDE 3

SSL, GONE IN 30 SECONDS

b r e a c h

PREVIOUSLY...

CRIME

Presented at ekoparty 2012

Target

Secrets in HTTP headers

Requirements

TLS compression MITM A browser

Juliano Rizzo Thai Duong

SLIDE 4

SSL, GONE IN 30 SECONDS

b r e a c h

SO ABOUT CRIME...

SSL doesn’t hide length SSL/SPDY compress headers CRIME issues requests with every possible character, and measures the ciphertext length Looks for the plaintext which compresses the most – guesses the secret byte by byte Requires small bootstrapping sequence knownKeyPrefix=secretCookieValue

The Compression Oracle:

SLIDE 5

SSL, GONE IN 30 SECONDS

b r e a c h

COMPRESSION OVERVIEW

DEFLATE / GZIP

LZ77: reducing redundancy

Googling the googles -> Googling the g(-13,4)s

Huffman coding: replace common

bytes with shorter codes

SLIDE 6

SSL, GONE IN 30 SECONDS

b r e a c h

IT’S FIXED!

TLS Compression Disabled

SLIDE 7

SSL, GONE IN 30 SECONDS

b r e a c h

DO NOT PANIC: TUBES SECURE

SLIDE 8

SSL, GONE IN 30 SECONDS

b r e a c h

Or are they?

SLIDE 9

SSL, GONE IN 30 SECONDS

b r e a c h

[let’s bring it back to life]

SLIDE 10

SSL, GONE IN 30 SECONDS

b r e a c h

FIRST THINGS FIRST: FIX WIKIPEDIA

SLIDE 11

SSL, GONE IN 30 SECONDS

b r e a c h

BREACH

Browser Reconnaissance & Exfiltration via Adaptive Compression of Hypertext

INTRODUCING

SLIDE 12

SSL, GONE IN 30 SECONDS

b r e a c h

A CRIME AGAINST THE RESPONSE BODY

SLIDE 13

SSL, GONE IN 30 SECONDS

b r e a c h

(sample traffic)

SLIDE 14

SSL, GONE IN 30 SECONDS

b r e a c h

BREACH / the ingredients

· Very prevalent, any browser Any version of SSL / TLS GZIP A secret in the response body · CSRF, PII, ViewState… anything! Attacker-supplied guess · In response body Three-character prefix · To bootstrap compression · Less than 30 seconds for simple pages Fairly stable pages · No SSL tampering / downgrade MITM / traffic visibility

SLIDE 15

SSL, GONE IN 30 SECONDS

b r e a c h

[PREFIX / sample bootstrap]

secret (CSRF token) guess

SLIDE 16

SSL, GONE IN 30 SECONDS

b r e a c h

BREACH / architecture

SLIDE 17

SSL, GONE IN 30 SECONDS

b r e a c h

BREACH / command & control

SLIDE 18

SSL, GONE IN 30 SECONDS

b r e a c h

C&C/ logic

Traffic Monitor

Transparent relay SSL proxy

HTML/JS Controller

I. Dynamically generated for specific target server

II. Injects & listens to iframe streamer from c&c:81 that

dictates the new HTTP requests to be performed

(img.src=...)

III. Issues the outbound HTTP requests to the target site via

the victim's browser, session-riding a valid SSL channel

IV. Upon synchronous completion of every request (onerror),

performs a unique callback to c&c:82 for the Traffic Monitor to measure encrypted response size

MITM: ARP spoofing, DNS, DHCP, WPAD…

SLIDE 19

SSL, GONE IN 30 SECONDS

b r e a c h

C&C/ logic

Main C&C Driver

Coordinates character guessing
Adaptively issues requests to target site
Listens to JS callbacks upon request completion
Measures -inbound- packets length
Has built-in intelligence for compression oracle

runtime recovery

SLIDE 20

SSL, GONE IN 30 SECONDS

b r e a c h

THE ORACLE

MEASURE SIZE DELTA GUESSING BYTE-BY-BYTE ERROR RECOVERY

SLIDE 21

SSL, GONE IN 30 SECONDS

b r e a c h

SSL cipher text HTTP clear text

10 bytes TCP connection SSL records

SSL REVEALS LENGTH

SLIDE 22

SSL, GONE IN 30 SECONDS

b r e a c h

COMPRESSION ORACLE (I)

<html> … tkn= … guess=

supersecret

48 bytes

supersecreX

after gzip

<html> … tkn= … guess=

supersecret

38 bytes

(-22, 10)X

SLIDE 23

SSL, GONE IN 30 SECONDS

b r e a c h

COMPRESSION ORACLE (II)

<html> … tkn= … guess=

supersecret

48 bytes

supersecret

after gzip

<html> … tkn= … guess=

supersecret

37 bytes

(-22, 11)

SLIDE 24

SSL, GONE IN 30 SECONDS

b r e a c h

SLIDE 25

SSL, GONE IN 30 SECONDS

b r e a c h

THE ORACLE

Huffman Coding Nightmares

Incorrect Guess

https://target-server.com/page.php?blah=blah2... &secret=4bf (response: 1358 bytes) a

Correct Guess

https://target-server.com/page.php?blah=blah2... &secret=4bf (response: 1358 bytes) b

SLIDE 26

SSL, GONE IN 30 SECONDS

b r e a c h

THE ORACLE

Fighting Huffman Coding

Two Tries + random [dynamic] padding

7 8 https://target-server.com/page.php?blah=blah2... &secret=4bf {}{}(...){}{}{}{}{} &secret=4bf{}{}(...){}{}{}{}{} 7 7 https://target-server.com/page.php?blah=blah2... &secret=4bf {}{}(...){}{}{}{}{}---a-b-c-d-…-5-6-8-9-… &secret=4bf {}{}(...){}{}{}{}{}---a-b-c-d-…-5-6-7-9-…

Character set pool + random padding

SLIDE 27

SSL, GONE IN 30 SECONDS

b r e a c h

THE ORACLE

Two Tries Reality

Less than ideal conditions:

In theory, two-tries allows for short-circuiting once winner

is found

In practice, still need to evaluate all candidates
Huffman encoding causes collisions

SLIDE 28

SSL, GONE IN 30 SECONDS

b r e a c h

ROADBLOCKS

Conflict & Recovery mechanisms

(no winners / too many winners)

Look-ahead (2+ characters) – reliable, but expensive
Best value / averages
Rollback (last-known conflict)
Check compression ratio of guess string

Page URL / HTML entity encoding

Can interfere with bootstrapping

SLIDE 29

SSL, GONE IN 30 SECONDS

b r e a c h

MORE ROADBLOCKS

Stream cipher vs. block cipher

10 bytes

SSL cipher text Compressed HTTP response

Stream cipher reveals exact plain text length

SLIDE 30

SSL, GONE IN 30 SECONDS

b r e a c h

MORE ROADBLOCKS

Stream cipher vs. block cipher

Compressed HTTP response

Block cipher hides exact plain text length

16 bytes

SSL cipher text Compressed HTTP response

Align response to a tipping point
Guess Window (keeping response aligned)

SLIDE 31

SSL, GONE IN 30 SECONDS

b r e a c h

EVEN MORE ROADBLOCKS

Keep-Alive (a premature death)

Image requests vs. scripts vs. CORS requests

Browser synchronicity limits (1x)

Hard to correlate HTTP requests to TCP segments

Filtering out noise

Active application?
Background polling?

SLIDE 32

SSL, GONE IN 30 SECONDS

b r e a c h

YET MORE ROADBLOCKS

‘Unstable’ pages (w/ random DOM blocks)

Averaging & outlier removal

The war against Huffman coding

Weight (symbol) normalization

Circumventing cache

Random timestamp

Other Oracles

Patent-pending!

SLIDE 33

SSL, GONE IN 30 SECONDS

b r e a c h

OVERWHELMED?

SLIDE 34

SSL, GONE IN 30 SECONDS

b r e a c h

DEMO TIME

(let us pray)

SLIDE 35

SSL, GONE IN 30 SECONDS

b r e a c h

THE TOOL

SLIDE 36

SSL, GONE IN 30 SECONDS

b r e a c h

MITIGATIONS

RANDOMIZING THE LENGTH · variable padding · fighting against math · /FAIL DYNAMIC SECRETS · dynamic CSRF tokens per request MASKING THE SECRET · random XOR – easy, dirty, practical path · downstream enough THROTTLING & MONITORING CSRF-PROTECT EVERYTHING · unrealistic SEPARATING SECRETS · deliver secrets in input-less servlets · chunked secret separation (lib patch) DISABLING GZIP FOR DYNAMIC PAGES

SLIDE 37

SSL, GONE IN 30 SECONDS

b r e a c h

FUTUREWORK

Better understanding of DEFLATE / GZIP Beyond HTTPS

Very generic side-channel
Other protocols, contexts?

Stay tuned for the next BREACH

SLIDE 38

SSL, GONE IN 30 SECONDS

b r e a c h

WANT MORE?

AGENTS STANDING BY

PAPER PRESENTATION POC TOOL

BreachAttack.com

SLIDE 39

SSL, GONE IN 30 SECONDS

b r e a c h

THANK YOU EVERYBODY !

SLIDE 40

SSL, GONE IN 30 SECONDS

b r e a c h

If you liked the talk*, don’t forget to scan your badge for the evaluation survey

* ignore otherwise

BREACHATTACK.COM

angelpm@gmail.com @PradoAngelo Angelo Prado neal.harris@gmail.com @IAmTheNeal Neal Harris yoel.gluck2@gmail.com Yoel Gluck