7 ms·

The Web Authentication Arms Race – A Tale of Two Security Experts

140 points by Permit 11y ago

zaroth 11y ago
Thought this was going to be about password cracking, but instead turned out to be an interesting take on MITM vectors which bypass the password and piggyback on an existing session. I would think that anyone with that level of access to compromise the channel would likely be able to just compromise the server itself?
- TeMPOraL 11y ago
  > I would think that anyone with that level of access to compromise the channel would likely be able to just compromise the server itself? That point is often brought up when discussing security, though personally I think non-maximally-effective attacks are also worth discussing - an attacker may have a reason to refrain from using full powers available for him. For instance, compromising the server immediately may lead to detection and subsequent mitigation of the attack, whereas just tapping a channel may remain undetected for long and let the attacker gather intelligence, select a particular target or perform some other, unexpected attack.
- dgoldstein 11y ago
  Mitm is often pretty easy, e.g. just arp spoof someone on the same network as you. Though if your target is on a different network, maybe not so simple. There's definitely a point where it probably makes more sense to try to attack the server than a well secured client; in general, hackers will aim for the weakest link (which I doubt will be your cookies not being channel bound)
- GauntletWizard 11y ago
  Not so. The NSA smiley [1] showed that the smartest of attackers (or maybe the chinese are, but that's besides the point) are still (or were still, as of ~5 years ago) relying on passive MITM. It's far easier to exploit a passive vulnerability for a long time - Active exploits leave traces, give clues as to who you are. Passive exploits often leave the user without any idea that they are being snooped. [1] https://www.google.com/search?q=nsa+smiley&es_sm=122&tbm=isch&imgil=VuJ8ZFTEmP3nvM%253A%253B4Fg1sd5R8Hj6wM%253Bhttp%25253A%25252F%25252Fwww.newyorker.com%25252Fnews%25252Famy-davidson%25252Ftech-companies-slap-back-at-the-n-s-a-s-smiley-face&source=iu&pf=m&fir=VuJ8ZFTEmP3nvM%253A%252C4Fg1sd5R8Hj6wM%252C_&biw=1920&bih=1115&usg=__QePJRyzqVcukmkqgDaKspXJPw_Q%3D&ved=0CCcQyjdqFQoTCL-x8oa5wcgCFYkqiAodX1QFjg&ei=EQUeVv_kN4nVoATfqJXwCA#imgrc=VuJ8ZFTEmP3nvM%3A&usg=__QePJRyzqVcukmkqgDaKspXJPw_Q%3D https://www.google.com/search?q=nsa+smiley&es_sm=122&tbm=isc...
  - dgoldstein0 11y ago
    ... because if a passive attack works and is easier to launch, why bother with an active attack?
deleted 11y ago
[deleted]
- sandworm101 11y ago
  Except that the phone itself is increasingly the target. A compromised phone renders such "second-factor" idents moot. I say "second-factor" in quotes because I don't really consider the code-to-the-phone a second factor. It's just another password. A proper second factor would be a token, a physical object or at least something that cannot be transmitted/intercepted. I'm running into this problem when doing PCI audits. PCI demands two-factor for some things (internal, non-customers) but specifies the 'something you know, something you have, and something you are' approach. Since biometrics are out in most situations, that leaves passwords+tokens as a practical mandate under PCI. Code-to-the-phone schemes don't qualify.
  - eeZi 11y ago
    I've seen PCI auditors accept code-to-the-phone as proper two-factor auth many times. Not that you aren't right...
  - pjc50 11y ago
    Does the "TrustZone" of iPhones count?
- eeZi 11y ago
  How does this example protect against phishing? Since the user believes that he's actually authenticating with WellsFargo.com, he would confirm. That's what U2F protects against.
  - downandout 11y ago
    It's also expensive...the vast majority of users aren't going to buy a U2F key and carry it around. They just won't. 2-way OOB authentication does protect against phishing when combined with other information, such as IP geolocation. For example, the message could say "if you are not in [city from which login is coming], do not reply to this message".
vortico 11y ago
> I will find or compromise a shady certificate authority and get my own certificate for your domain name Woah there, I don't think this is a realistic expectation of an attacker. However, the author is right in that it is much easier to attack the endpoints. Users install every piece of software on the planet, and the Firefox/Chrome user storage directory is in clear access for all programs. There are also many remote code execution vulnerabilities in the wild that could be used to query a database server or steal keys.
- dgoldstein0 11y ago
  I thought the same. I think at this point we've graduated from "there's already a metasploit / other open source code for it" to "it's probably possible, if you are fairly determined but not necessarily the NSA". There's probably a few CAs with lax security procedures, just given how many there are... but hacking one is a much bigger endeavor than SSL stripping.
jakeogh 11y ago
Attacker: I will buy the company that owns servers you are connecting to.
moreati 11y ago
I'm a fan of this dialogue style. Particularly for showing the history/motivations/context of a design or situation. Kerberos is what first introduced me to it http://web.mit.edu/kerberos/dialogue.html http://web.mit.edu/kerberos/dialogue.html
arikrak 11y ago
MITM attack = Man-in-the-middle attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack
balajics 11y ago
[offtopic] How many of you noticed that hovering on the left color band shows post list? clever UI/ bad design :/

140 points by Permit 11y ago

Thought this was going to be about password cracking, but instead turned out to be an interesting take on MITM vectors which bypass the password and piggyback on an existing session. I would think that anyone with that level of access to compromise the channel would likely be able to just compromise the server itself?

TeMPOraL 11y ago
> I would think that anyone with that level of access to compromise the channel would likely be able to just compromise the server itself? That point is often brought up when discussing security, though personally I think non-maximally-effective attacks are also worth discussing - an attacker may have a reason to refrain from using full powers available for him. For instance, compromising the server immediately may lead to detection and subsequent mitigation of the attack, whereas just tapping a channel may remain undetected for long and let the attacker gather intelligence, select a particular target or perform some other, unexpected attack.
dgoldstein 11y ago
Mitm is often pretty easy, e.g. just arp spoof someone on the same network as you. Though if your target is on a different network, maybe not so simple. There's definitely a point where it probably makes more sense to try to attack the server than a well secured client; in general, hackers will aim for the weakest link (which I doubt will be your cookies not being channel bound)
GauntletWizard 11y ago
Not so. The NSA smiley [1] showed that the smartest of attackers (or maybe the chinese are, but that's besides the point) are still (or were still, as of ~5 years ago) relying on passive MITM. It's far easier to exploit a passive vulnerability for a long time - Active exploits leave traces, give clues as to who you are. Passive exploits often leave the user without any idea that they are being snooped. [1] https://www.google.com/search?q=nsa+smiley&es_sm=122&tbm=isch&imgil=VuJ8ZFTEmP3nvM%253A%253B4Fg1sd5R8Hj6wM%253Bhttp%25253A%25252F%25252Fwww.newyorker.com%25252Fnews%25252Famy-davidson%25252Ftech-companies-slap-back-at-the-n-s-a-s-smiley-face&source=iu&pf=m&fir=VuJ8ZFTEmP3nvM%253A%252C4Fg1sd5R8Hj6wM%252C_&biw=1920&bih=1115&usg=__QePJRyzqVcukmkqgDaKspXJPw_Q%3D&ved=0CCcQyjdqFQoTCL-x8oa5wcgCFYkqiAodX1QFjg&ei=EQUeVv_kN4nVoATfqJXwCA#imgrc=VuJ8ZFTEmP3nvM%3A&usg=__QePJRyzqVcukmkqgDaKspXJPw_Q%3D https://www.google.com/search?q=nsa+smiley&es_sm=122&tbm=isc...
- dgoldstein0 11y ago
  ... because if a passive attack works and is easier to launch, why bother with an active attack?

deleted 11y ago

[deleted]

sandworm101 11y ago
Except that the phone itself is increasingly the target. A compromised phone renders such "second-factor" idents moot. I say "second-factor" in quotes because I don't really consider the code-to-the-phone a second factor. It's just another password. A proper second factor would be a token, a physical object or at least something that cannot be transmitted/intercepted. I'm running into this problem when doing PCI audits. PCI demands two-factor for some things (internal, non-customers) but specifies the 'something you know, something you have, and something you are' approach. Since biometrics are out in most situations, that leaves passwords+tokens as a practical mandate under PCI. Code-to-the-phone schemes don't qualify.
- eeZi 11y ago
  I've seen PCI auditors accept code-to-the-phone as proper two-factor auth many times. Not that you aren't right...
- pjc50 11y ago
  Does the "TrustZone" of iPhones count?
eeZi 11y ago
How does this example protect against phishing? Since the user believes that he's actually authenticating with WellsFargo.com, he would confirm. That's what U2F protects against.
- downandout 11y ago
  It's also expensive...the vast majority of users aren't going to buy a U2F key and carry it around. They just won't. 2-way OOB authentication does protect against phishing when combined with other information, such as IP geolocation. For example, the message could say "if you are not in [city from which login is coming], do not reply to this message".

vortico 11y ago

> I will find or compromise a shady certificate authority and get my own certificate for your domain name Woah there, I don't think this is a realistic expectation of an attacker. However, the author is right in that it is much easier to attack the endpoints. Users install every piece of software on the planet, and the Firefox/Chrome user storage directory is in clear access for all programs. There are also many remote code execution vulnerabilities in the wild that could be used to query a database server or steal keys.

dgoldstein0 11y ago
I thought the same. I think at this point we've graduated from "there's already a metasploit / other open source code for it" to "it's probably possible, if you are fairly determined but not necessarily the NSA". There's probably a few CAs with lax security procedures, just given how many there are... but hacking one is a much bigger endeavor than SSL stripping.

jakeogh 11y ago

Attacker: I will buy the company that owns servers you are connecting to.

moreati 11y ago

I'm a fan of this dialogue style. Particularly for showing the history/motivations/context of a design or situation. Kerberos is what first introduced me to it http://web.mit.edu/kerberos/dialogue.html http://web.mit.edu/kerberos/dialogue.html

arikrak 11y ago

MITM attack = Man-in-the-middle attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack

balajics 11y ago

[offtopic] How many of you noticed that hovering on the left color band shows post list? clever UI/ bad design :/