5 ms·

This bug is so shockingly stupid you have to wonder if it's malice or staggering incompetence, so either we must admit that Kapersky has no business staying in

This bug is so shockingly stupid you have to wonder if it's malice or staggering incompetence, so either we must admit that Kapersky has no business staying in business, or they're willing to overlook little "mistakes" like this.

tptacek 10y ago
This is exactly what people said about the Apple "goto fail" bug. The conspiracy theories were silly then and they're silly now.
- Sir_Cmpwn 10y ago
  If you are knowledgable enough to MITM SSL then you should definitely be knowledgable enough to know how stupid this is, and - frankly - knowledgable enough not to fucking MITM SSL. I would attribute it to malice, assume it's malice, fire the developer, and contact the authorities. Of course, that's moot if the authorities are the ones who asked for the bug.
  - tptacek 10y ago
    Let's try a little exercise here. Stipulate that it's malice, and then generate the narrative in which malice makes sense. Specifically: You are whatever entity (I assume the FSB?) that can demand Kaspersky implant backdoors into its desktop antivirus software. You decide to target that backdoor at the component of Kaspersky's software that gets, by design, unrestricted access to the plaintext of all TLS sessions on the machine, in addition to practically unrestricted access to every file on machine itself, and to the machine's memory in cpl0 and cpl3. From that vantage point, you decide to... ... collide certificates? Remember, your evil backdoor only impacts machines running your software already. From this thread, I'm wondering if that's maybe unclear to people.
    - Sir_Cmpwn 10y ago
      Did you read the link? It describes an attack where you only need to have access to the same network as the target. Perhaps through that smart lightbulb they just installed?
      - tptacek 10y ago
        Yes, I did read the link. Do you understand the thread? The proposal is that this bug in Kaspersky's kernel code is a backdoor in Kaspersky's kernel code --- that is: an attacker that already owns your OS kernel is backdooring it to come up with an extremely convoluted and noisy way to get access to your TLS sessions --- by backdooring the part of their kernel code that already has access to every TLS session on the machine.
        Sir_Cmpwn 10y ago
        The described attack doesn't sound convoluted at all, it seems very practical.
        tptacek 10y ago
        Once again: the attacker here already controls TLS on the machines that are affected. They don't need to collide certificates. By design, they not only have the plaintext of every TLS session on the machine, but they are also the client side of every TLS session originating from the machine (they terminate TLS locally and proxy it over a new connection they control). I feel like the people claiming this is a smoking gun backdoor don't really understand what it means that Kaspersky's software is designed to proxy TLS. Yes: it is batshit that they proxy TLS. It's so batshit that this particular bug makes absolutely no sense as a backdoor. That idea is Xzibit-level crazy.
        Sir_Cmpwn 10y ago
        I see what you mean now. If you wanted to make a backdoor and have plausable deniability, you'd make it a bug.
    - jamesrom 10y ago
      Let's continue your exercise. Your backdoor gets detected by any security researcher. You're busted, your business is near destroyed, you cause diplomatic stress between nations and, you face criminal charges. The stakes are way too high. So instead you consider ways to introduce vulnerabilities that leave plausible deniability. Indeed, from that vantage point, you decide to... ... collide certificates.
      - tptacek 10y ago
        So you propose that they created a backdoor that regularly and sporadically breaks TLS for normal users because they are evil geniuses who needed a plausibly stupid backdoor in case they got caught. Not only are there better plausibly deniable backdoors they could use from this vantage point, but there are NOBUS backdoors they could use from this vantage point. You propose an attacker so clever that they've carefully calibrated the sophistication of their backdoors, but not clever enough to know how to backdoor a TLS MITM (a TLS MITM installed by design) without leaving the absurd tracks this one does. No. It's not a conspiracy. As usual: it's just a bug.
    - sigmar 10y ago
      >Let's try a little exercise here. Stipulate that it's malice, and then generate the narrative in which malice makes sense. Sure. Kaspersky creates security software. The FSB benefits from vulnerabilities in antivirus software. Kaspersky knows this and puts company resources into particular areas. ie how to spot the next stuxnet, rather than fix bugs like this. The FSB does not need to write the source code (for Kaspersky Anti-virus) to benefit from vulnerabilities. In fact NSA, GCHQ, and FSB all benefit from subversion of https.
      - tptacek 10y ago
        You can't stop at that point in my comment. You have to read the whole thing first. I'm not asking "does it ever make sense to backdoor Kaspersky AV". Clearly it does.
        sigmar 10y ago
        I did. You created a ridiculous narrative, that seems to amount to a strawman. No one ever said that FSB wrote the antivirus program.
        tptacek 10y ago
        My narrative has in fact nothing whatsoever to do with the FSB. That's why I said "whatever entity".
        sigmar 10y ago
        "your evil backdoor only impacts machines running your software already. " seems to assume that "whatever entity" can freely put in whatever code they want. I agree that cert collisions is a strange way to backdoor, but to dismiss any questions as to possible malice as "conspiracy theories" seems to ignore many recent events (such as Juniper Networks)
        tptacek 10y ago
        Once again, you're responding to an argument I did not make. I'm not saying this bug doesn't make sense because nobody would want to backdoor Kaspersky AV. Clearly they would. I'm saying it doesn't make sense because it doesn't make sense as a backdoor. It provides the attacker with far less access than they already have, and does so in a way that leaves tracks all over the Internet even when the "backdoor" isn't "in use".
- astrodust 10y ago
  It used to be a "conspiracy theory" that the government was reading all your email, but it's turned out to be a fact. It's worth noting the "goto fail" bug was likely exploited, so it had value to someone. As has been shown through various leaks, the NSA and other entities like it have a war-chest of these toys. Things that used to be "you're just being paranoid" type concerns are now "we may never know" ones. Regardless of the origin or intent, it still paints Kapersky in a very, very bad light. There's no escaping that.
  - tptacek 10y ago
    It's still a conspiracy theory that the government is reading all your email!
    - throwaway91111 10y ago
      I'm not sure you can call government itself a conspiracy.
      - tptacek 10y ago
        There is in fact no evidence that the government (any government) is "reading all our emails", or has had the access to do that. There is, on the other hand, a virulent conspiracy theory that the PRISM disclosures from Snowden revealed NSA's ability to do that; that claim was so false that Greenwald now (somewhat deceptively) denies he even acknowledged it.
        throwaway91111 10y ago
        Unless I'm missing something, the national security letters allow just that. My point stands.
        madgar 10y ago
        National security letters target individuals and aren't sent in enough volume to cover more than 0.01% of "everyone's emails".
- jamesrom 10y ago
  Apple's "goto fail" bug is completely different: it was not a design flaw, but a merge error. Hanlon's razor applies sufficiently. But anyone with a basic understanding of information security would know that keying by truncated MD5 is certainly a bad idea. This is not just stupidity. This is not accidental. This design not only flies in the face of everything you want from a cert store, but is so blatantly bad that surely more than one person at Kaspersky was in on it.
  - tptacek 10y ago
    I don't know why you're operating from the presumption that most security people know anything at all about basic cryptography, because practically none of them do. Cryptography seems like it should be a general topic in information security, but it isn't; it's very much a specialist topic. This is far, far from the dumbest crypto bug I've seen in a security product. You're simply wrong about this. If you'll take a second to look at the "goto fail" threads on HN, by the way, you'll see people every bit as committed to the idea that "goto fail was an inside job" as you are to this bug being enemy action. Have you taken a second to even think about how this precise bug even makes sense as an implant? Hint: it does not make sense as an implant.
    - jamesrom 10y ago
      > I don't know why you're operating from the presumption that most security people know anything at all about basic cryptography I don't know why you're operating from the presumption I'm talking about security people in general. I'm talking about the people at Kaspersky who were tasked with writing a SSL certificate store. I will also quote the bug report: "You don't have to be a cryptographer to understand a 32bit key is not enough to prevent brute-forcing a collision in seconds. In fact, producing a collision with any other certificate is trivial." > Have you taken a second to even think about how this precise bug even makes sense as an implant? Hint: it does not make sense as an implant. Hint: Pair this with a DNS spoof and you can pretend to be whatever website you want.
      - tptacek 10y ago
- sigmar 10y ago
  Concocting theories as to intended malice based on this bug alone would be ridiculous. But it isn't dificult to imagine malice if you frame this with the history Kaspersky has Particularly when they have a history of remote access "bugs"[1], insecure broadcasting of user-agent info[2], and a cozy relationship with the Kremlin[3]. [1] http://www.zdnet.com/article/flaw-found-in-kaspersky-antivirus/ http://www.zdnet.com/article/flaw-found-in-kaspersky-antivir... [2] https://theintercept.com/2015/06/22/nsa-gchq-targeted-kaspersky/ https://theintercept.com/2015/06/22/nsa-gchq-targeted-kasper... [3]https://www.wired.com/2012/07/ff_kaspersky/ https://www.wired.com/2012/07/ff_kaspersky/
  - tptacek 10y ago
    https://news.ycombinator.com/item?id=13313794 https://news.ycombinator.com/item?id=13313794
- b2600 10y ago
  I don't know if comparing "bugs" from AV software and OSs is apples to apples. Also, goto followed by erroneous goto looks like an error (I know) but "keys are generated, they're inserted using the first 32 bits of MD5(serialNumber||issuer) as the key. If a match is found for a key, they just pull the previously generated certificate and key out of the binary tree" doesn't
  - tptacek 10y ago
    Why not? Caching certificate chains makes sense. Bad hash functions are the norm in systems code, not the exception.
    - b2600 10y ago
      I guess I'm reading these two examples as: 1. an extra goto and 2. a strategy dealing with creating an ssl store that uses a 32(!) bit key. I'm not implying malice but they seem fundamentally different type of errors.

tptacek 10y ago

This is exactly what people said about the Apple "goto fail" bug. The conspiracy theories were silly then and they're silly now.

Sir_Cmpwn 10y ago
If you are knowledgable enough to MITM SSL then you should definitely be knowledgable enough to know how stupid this is, and - frankly - knowledgable enough not to fucking MITM SSL. I would attribute it to malice, assume it's malice, fire the developer, and contact the authorities. Of course, that's moot if the authorities are the ones who asked for the bug.
- tptacek 10y ago
  Let's try a little exercise here. Stipulate that it's malice, and then generate the narrative in which malice makes sense. Specifically: You are whatever entity (I assume the FSB?) that can demand Kaspersky implant backdoors into its desktop antivirus software. You decide to target that backdoor at the component of Kaspersky's software that gets, by design, unrestricted access to the plaintext of all TLS sessions on the machine, in addition to practically unrestricted access to every file on machine itself, and to the machine's memory in cpl0 and cpl3. From that vantage point, you decide to... ... collide certificates? Remember, your evil backdoor only impacts machines running your software already. From this thread, I'm wondering if that's maybe unclear to people.
  - Sir_Cmpwn 10y ago
    Did you read the link? It describes an attack where you only need to have access to the same network as the target. Perhaps through that smart lightbulb they just installed?
    - tptacek 10y ago
      Yes, I did read the link. Do you understand the thread? The proposal is that this bug in Kaspersky's kernel code is a backdoor in Kaspersky's kernel code --- that is: an attacker that already owns your OS kernel is backdooring it to come up with an extremely convoluted and noisy way to get access to your TLS sessions --- by backdooring the part of their kernel code that already has access to every TLS session on the machine.
      - Sir_Cmpwn 10y ago
        The described attack doesn't sound convoluted at all, it seems very practical.
        tptacek 10y ago
        Once again: the attacker here already controls TLS on the machines that are affected. They don't need to collide certificates. By design, they not only have the plaintext of every TLS session on the machine, but they are also the client side of every TLS session originating from the machine (they terminate TLS locally and proxy it over a new connection they control). I feel like the people claiming this is a smoking gun backdoor don't really understand what it means that Kaspersky's software is designed to proxy TLS. Yes: it is batshit that they proxy TLS. It's so batshit that this particular bug makes absolutely no sense as a backdoor. That idea is Xzibit-level crazy.
        Sir_Cmpwn 10y ago
        I see what you mean now. If you wanted to make a backdoor and have plausable deniability, you'd make it a bug.
  - jamesrom 10y ago
    Let's continue your exercise. Your backdoor gets detected by any security researcher. You're busted, your business is near destroyed, you cause diplomatic stress between nations and, you face criminal charges. The stakes are way too high. So instead you consider ways to introduce vulnerabilities that leave plausible deniability. Indeed, from that vantage point, you decide to... ... collide certificates.
    - tptacek 10y ago
      So you propose that they created a backdoor that regularly and sporadically breaks TLS for normal users because they are evil geniuses who needed a plausibly stupid backdoor in case they got caught. Not only are there better plausibly deniable backdoors they could use from this vantage point, but there are NOBUS backdoors they could use from this vantage point. You propose an attacker so clever that they've carefully calibrated the sophistication of their backdoors, but not clever enough to know how to backdoor a TLS MITM (a TLS MITM installed by design) without leaving the absurd tracks this one does. No. It's not a conspiracy. As usual: it's just a bug.
  - sigmar 10y ago
    >Let's try a little exercise here. Stipulate that it's malice, and then generate the narrative in which malice makes sense. Sure. Kaspersky creates security software. The FSB benefits from vulnerabilities in antivirus software. Kaspersky knows this and puts company resources into particular areas. ie how to spot the next stuxnet, rather than fix bugs like this. The FSB does not need to write the source code (for Kaspersky Anti-virus) to benefit from vulnerabilities. In fact NSA, GCHQ, and FSB all benefit from subversion of https.
    - tptacek 10y ago
      You can't stop at that point in my comment. You have to read the whole thing first. I'm not asking "does it ever make sense to backdoor Kaspersky AV". Clearly it does.
      - sigmar 10y ago
        I did. You created a ridiculous narrative, that seems to amount to a strawman. No one ever said that FSB wrote the antivirus program.
        tptacek 10y ago
        My narrative has in fact nothing whatsoever to do with the FSB. That's why I said "whatever entity".
        sigmar 10y ago
        "your evil backdoor only impacts machines running your software already. " seems to assume that "whatever entity" can freely put in whatever code they want. I agree that cert collisions is a strange way to backdoor, but to dismiss any questions as to possible malice as "conspiracy theories" seems to ignore many recent events (such as Juniper Networks)
        tptacek 10y ago
        Once again, you're responding to an argument I did not make. I'm not saying this bug doesn't make sense because nobody would want to backdoor Kaspersky AV. Clearly they would. I'm saying it doesn't make sense because it doesn't make sense as a backdoor. It provides the attacker with far less access than they already have, and does so in a way that leaves tracks all over the Internet even when the "backdoor" isn't "in use".
astrodust 10y ago
It used to be a "conspiracy theory" that the government was reading all your email, but it's turned out to be a fact. It's worth noting the "goto fail" bug was likely exploited, so it had value to someone. As has been shown through various leaks, the NSA and other entities like it have a war-chest of these toys. Things that used to be "you're just being paranoid" type concerns are now "we may never know" ones. Regardless of the origin or intent, it still paints Kapersky in a very, very bad light. There's no escaping that.
- tptacek 10y ago
  It's still a conspiracy theory that the government is reading all your email!
  - throwaway91111 10y ago
    I'm not sure you can call government itself a conspiracy.
    - tptacek 10y ago
      There is in fact no evidence that the government (any government) is "reading all our emails", or has had the access to do that. There is, on the other hand, a virulent conspiracy theory that the PRISM disclosures from Snowden revealed NSA's ability to do that; that claim was so false that Greenwald now (somewhat deceptively) denies he even acknowledged it.
      - throwaway91111 10y ago
        Unless I'm missing something, the national security letters allow just that. My point stands.
        madgar 10y ago
        National security letters target individuals and aren't sent in enough volume to cover more than 0.01% of "everyone's emails".
jamesrom 10y ago
Apple's "goto fail" bug is completely different: it was not a design flaw, but a merge error. Hanlon's razor applies sufficiently. But anyone with a basic understanding of information security would know that keying by truncated MD5 is certainly a bad idea. This is not just stupidity. This is not accidental. This design not only flies in the face of everything you want from a cert store, but is so blatantly bad that surely more than one person at Kaspersky was in on it.
- tptacek 10y ago
  I don't know why you're operating from the presumption that most security people know anything at all about basic cryptography, because practically none of them do. Cryptography seems like it should be a general topic in information security, but it isn't; it's very much a specialist topic. This is far, far from the dumbest crypto bug I've seen in a security product. You're simply wrong about this. If you'll take a second to look at the "goto fail" threads on HN, by the way, you'll see people every bit as committed to the idea that "goto fail was an inside job" as you are to this bug being enemy action. Have you taken a second to even think about how this precise bug even makes sense as an implant? Hint: it does not make sense as an implant.
  - jamesrom 10y ago
    > I don't know why you're operating from the presumption that most security people know anything at all about basic cryptography I don't know why you're operating from the presumption I'm talking about security people in general. I'm talking about the people at Kaspersky who were tasked with writing a SSL certificate store. I will also quote the bug report: "You don't have to be a cryptographer to understand a 32bit key is not enough to prevent brute-forcing a collision in seconds. In fact, producing a collision with any other certificate is trivial." > Have you taken a second to even think about how this precise bug even makes sense as an implant? Hint: it does not make sense as an implant. Hint: Pair this with a DNS spoof and you can pretend to be whatever website you want.
    - tptacek 10y ago
sigmar 10y ago
Concocting theories as to intended malice based on this bug alone would be ridiculous. But it isn't dificult to imagine malice if you frame this with the history Kaspersky has Particularly when they have a history of remote access "bugs"[1], insecure broadcasting of user-agent info[2], and a cozy relationship with the Kremlin[3]. [1] http://www.zdnet.com/article/flaw-found-in-kaspersky-antivirus/ http://www.zdnet.com/article/flaw-found-in-kaspersky-antivir... [2] https://theintercept.com/2015/06/22/nsa-gchq-targeted-kaspersky/ https://theintercept.com/2015/06/22/nsa-gchq-targeted-kasper... [3]https://www.wired.com/2012/07/ff_kaspersky/ https://www.wired.com/2012/07/ff_kaspersky/
- tptacek 10y ago
  https://news.ycombinator.com/item?id=13313794 https://news.ycombinator.com/item?id=13313794
b2600 10y ago
I don't know if comparing "bugs" from AV software and OSs is apples to apples. Also, goto followed by erroneous goto looks like an error (I know) but "keys are generated, they're inserted using the first 32 bits of MD5(serialNumber||issuer) as the key. If a match is found for a key, they just pull the previously generated certificate and key out of the binary tree" doesn't
- tptacek 10y ago
  Why not? Caching certificate chains makes sense. Bad hash functions are the norm in systems code, not the exception.
  - b2600 10y ago
    I guess I'm reading these two examples as: 1. an extra goto and 2. a strategy dealing with creating an ssl store that uses a 32(!) bit key. I'm not implying malice but they seem fundamentally different type of errors.