26
Return Of Bleichenbacher’s Oracle Threat (ROBOT) Hanno Böck Juraj Somorovsky (Ruhr University Bochum / Hackmanit) Craig Young (Tripwire VERT)
Return Of Bleichenbacher’s Oracle Threat (ROBOT)
Hanno Böck
Juraj Somorovsky (Ruhr University Bochum / Hackmanit)
Craig Young (Tripwire VERT)
Recent Attacks on TLS
• CRIME, BEAST, Lucky 13, Heartbleed, Early CCS
• 20 years ago: Bleichenbacher’s attack• Applied to RSA PKCS#1 v1.5 in SSL/TLS• Decrypt SSL/TLS traffic• Implementations applied ad-hoc fixes• Everything is secure, right?
• Return of Bleichenbacher’s Oracle Threat – ROBOT*
* Name idea shamelessly stolen from ROCA
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 2
1. Bleichenbacher’s attack
2. How we started – Attack on Facebook
3. Performing the scans
4. Responsible disclosure
5. Conclusions
Overview
Designed by Ange Albertini
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 3
TLS Protocol (High Level Overview)
1. TLS Handshake• Selection of algorithm, version, extensions
• Key exchange: RSA, (EC)DH, (EC)DHE
2. Encrypted and authenticated data transport
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 4
TLS RSA Handshake
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 5
ClientHello
ServerHello
Certificate
ServerHelloDone
ChangeCipherSpec
(Client-) Finished
ChangeCipherSpec
(Server-) Finished
ClientKeyExchange
RSA encrypted premaster secret
ClientKeyExchange
RSA PKCS#1 v1.5
• Used to pad and encrypt the premaster secret:• To pad it to the RSA key length
• To add randomization
• Example for TLS 1.2:
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 6
00 02 [non-zero padding] 00 03 03 [secret]
Encryption block type
0x00 Delimiter
TLS 1.2 version(Don’t ask why, a different story)
[non-zero padding] [secret]
Bleichenbacher’s Attack
• 1998: Adaptive chosen-ciphertext attack
• Exploits strict RSA PKCS#1 v1.5 padding validation
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 7
C1
valid/invalid
M = Dec(C)
C2
valid/invalid
Ciphertext C
…
Starts with 00 02 ?
Bleichenbacher’s Attack
• The attack needs some math (Not going into details here)
• “Million message attack”
(In general performance depends on the oracle properties)
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 8
Creating Bleichenbacher’s Oracle
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 9
ClientHello
ServerHello
Certificate
ServerHelloDone
ClientKeyExchange’
Server
Decrypt
Error
ChangeCipherSpec
(Client-) Finished:
Bad Record
MAC Alert/
Modified ciphertext
TLS Countermeasure
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 10
ClientHello
ServerHello
Certificate
ServerHelloDone
Alert
ChangeCipherSpec
(Client-) Finished:
If the attacker can distinguish valid /invalid PKCS#1 messages, he wins
ClientKeyExchange’
1. Bleichenbacher’s attack
2. How we started – Attack on Facebook
3. Performing the scans
4. Responsible disclosure
5. Conclusions
Overview
Designed by Ange Albertini
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 11
Hanno Found a Weird Behavior of Facebook
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 12
ClientHello
ServerHello
Certificate
ServerHelloDone
Server
Illegal
Parameter
ChangeCipherSpec
(Client-) Finished:
Bad Record
MAC Alert/
ClientKeyExchange’
Can We Exploit It?
• Idea: It would be funny to sign a message with Facebook’s private key• Yes, signing is possible as well
• Millions of queries needed…would Facebook block us?
• Successful after several tries:
“We hacked Facebook with a
Bleichenbacher Oracle (JS/HB).”
• Facebook fixed
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 13
Facebook: New Attempt
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 14
ClientHello
ServerHello
Certificate
ServerHelloDone
Server
ChangeCipherSpec
(Client-) Finished:
/
ClientKeyExchange’
Facebook Fixed Again
• This is interesting. So how about other servers?
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 15
1. Bleichenbacher’s attack
2. How we started – Attack on Facebook
3. Performing the scans
4. Responsible disclosure
5. Conclusions
Overview
Designed by Ange Albertini
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 16
Let’s Start Scanning
• Careful selection of ClientKeyExchange messages:• Wrong TLS version
• Wrong padding length
• Not starting with 0x00 02
• Full / Shortened TLS handshakes:
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 17
00 02 [non-zero padding] 00 03 03 [secret]
ClientHello
ServerHello
Certificate
ServerHelloDone
ChangeCipherSpec
(Client-) Finished:
ClientKeyExchange’
ClientHello
ServerHello
Certificate
ServerHelloDone
ChangeCipherSpec
(Client-) Finished:
ClientKeyExchange’
Alexa Top 1 Million Scan
• 2,8 % vulnerable
• PayPal, Apple, ebay, Cisco, …
• Different behaviors…different combinations:
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 18
Illegal
Parameter
Bad Record
MAC Alert/
TCP connection resets Timeouts
Different alerts
Duplicate alerts Alert/Alert Alert
Handshake
Failure/ Internal
Error/ /..
1. Bleichenbacher’s attack
2. How we started – Attack on Facebook
3. Performing the scans
4. Responsible disclosure
5. Conclusions
Overview
Designed by Ange Albertini
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 19
Who Is Responsible for These Mistakes?
• Reporting is not always that easy …
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 20
Your server is vulnerable to Bleichenbacher‘s attack.
No worries, we usemillitary grade encryption.
Don’t Fix for Some Vendors … Cisco ACE
• Supports only TLS RSA
• Cisco: We won't fix it, it's out of support for several years
• But there were plenty of webpages still running with these devices
Like cisco.com
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 21
Identified (Most of) Them
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 22
Test Tools
• No easily usable test tool for Bleichenbacher attacks available
• Currently implemented in SSL Labs, testssl.sh, TLS-Attacker, tlsfuzzer
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 23
1. Bleichenbacher’s attack
2. How we started – Attack on Facebook
3. Performing the scans
4. Responsible disclosure
5. Conclusions
Overview
Designed by Ange Albertini
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 24
Future Work
• Timing attacks
• Fingerprinting
• Some servers send certificates or "garbage bytes"• Bleedinbacher? There could be a Heartbleed-style memory disclosure waiting
to be found
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 25
Illegal
Parameter
Bad Record
MAC Alert/ /..
Conclusions
• Old 20 year attacks still work
• New side-channels (timeouts, TCP resets, …)
• Crypto attack countermeasures are hard to apply
• Disable TLS_RSA cipher suites (not used in TLS 1.3)
• Stop using RSA PKCS#1 v1.5, use elliptic curves
(or RSA-OAEP if RSA needed)
https://robotattack.org/
Return Of Bleichenbacher’s Oracle Threat (ROBOT). USENIX Security 2018 26
