6 ms·
OpenSSL Raccoon Attack (CVE-2020-1968)
- hannob 6y agoThe researcher's site is probably more informative: https://raccoon-attack.com/ https://raccoon-attack.com/ tl;dr cryptographically it's a neat attack, but practical risk is very small.
- comex 6y agoI like how this follows the trend of slick vulnerability websites with a name, logo, and layman’s explanation… but without the overhyped prose found in most of those websites. Instead it’s upfront about this being a low severity vulnerability.
- laksdjfkasljdf 6y ago> neat attack, but practical risk is very small that's what Intel said! sorry. i will see myself out...
- dependenttypes 6y agoYet another timing attack. I remember reading not too long ago that the OpenSSL developers will consider side channel attacks an issue only if someone provides a way of exploiting them rather than consider them as ticking time bombs. The easiest solution would be to only enable the X25519 and X448 key exchanges by default. (and in the future a post-quantum one)
- kryogen1c 6y agosecret reuse is not a timing attack. where do you see that?
- dependenttypes 6y agohttps://raccoon-attack.com/ https://raccoon-attack.com/ > Raccoon is a timing vulnerability ...
- kryogen1c 6y agointeresting. so the timing attack is just a method of key discovery, which only seems to matter if you are reusing your keys? which the paper claims up to 4.4% of major websites do. > So is this really only a timing vulnerability? > Sadly no. [...] You should probably check that you are not running a vulnerable configuration (see CVE-2020-5929) since this allows mounting a direct attack without complex timing measurements.
- tialaramex 6y agoNot key discovery per se. The attacker does not obtain a long term key. Running this attack gets them the premaster secret (now the main secret presumably in RFC8446bis?) for one particular TLS session they're attacking. Assuming that session has meanwhile concluded and the attacker has recorded the ciphertext, they can now decrypt and read it. I think in principle if it's still in progress when they complete the attack they could try to MITM the session from a suitable on-path position. This might also impact resumption. Because you (the server) use the same DH private key repeatedly the attacker gets to do a bunch of separate connections which fail, but they can measure the timing of those connections and use that to try to figure out the main secret for some particular TLS session they witnessed talking to the same server when it used the same DH private key. If clients never do an affected DH key agreement the attacker doesn't have anything to work with. If the server picks random ephemeral DH keys the attacker doesn't have anything to work with. If the server uses a better DH scheme which is less vulnerable to a timing attack (for example not stripping zeroes or ECDH instead of conventional DH) this attack gets much harder to do, maybe you need to be very much closer to your target, e.g. running on the same physical hardware to measure the time differences. But using ephemeral keys makes this whole concern moot, and was also necessary to Forward Secrecy, so everybody should already have been doing that.
- dan1234 6y agoFTA: Why is the attack called "Raccoon"? Raccoon is not an acronym. Raccoons are just cute animals, and it is well past time that an attack will be named after them :) Just in case anyone was trying to workout the meaning.
- mfer 6y agoI woke up one morning to find raccoons eating out of my dogs dish. They had broken in and trashed everything between that spot and the dogs food. The name seems fitting to me. They aren't just cute animals.
- freedomben 6y agoYep, raccoons can be mean. There was a raccoon in my neighborhood a few years back that was eating out of the cat dishes and killing the cat if it was anywhere near. They are smart and mean.
- Aaronstotle 6y agoA neighbor who was raising chickens told me her first flock was murdered by the the neighborhood raccoons. They can be cute, but they can also trash up a garden and kill all your chickens. Maybe the attack is called raccoon for the potential?
- edm0nd 6y agoThey are sneaky and crafty killers for sure. We used to have three pet turtles that we kept outside. They had a bunch of grass and dirt to roam around in and then at night we would put them in a plastic container. One day we woke up and only had two turtles. A thief has struck! I thought it might have been an raccoon so I added a window screen as a top and weighed it down with two large bricks to make sure it stayed on. The next morning I woke up to find the top knocked off and now we were down to zero turtles. The raccoon simply figured out how to knock the bricks off and get the two remaining turtle snacks inside. Very crafty indeed.
- 6y ago
- josephcsible 6y agoMy reading of this is that it only affects old, weak cipher suites that don't support forward secrecy, so only hosts that have an insecure configuration anyway are affected by this.
- ccktlmazeltov 6y agoNote that some implementations re-use ephemeral keys on DHE, this was one of the finding of LOGJAM, and I'm not sure if this has been fixed in every TLS libraries. https://raccoon-attack.com/ https://raccoon-attack.com/
- timeimp 6y agoTIL OpenSSL has premium customers!
- mlindner 6y agoOpenSSL is de-facto standard for most everything. (LibreSSL and others have had development stall on OpenSSL's old API and aren't getting the new upcoming APIs.)
- rblatz 6y agoDoes anyone know if LibreSSL is impacted by this?
- cordite 6y agoDon't some IoT devices use static parameters? Like while claiming an ephemeral ECDH key, it is actually only generated once when the device is provisioned? (Or worse, the same on every device of that series)
- edf13 6y agoAny reference info for this?
- cordite 6y agoCan't seem to find the original source I read that on. But here's something that mentions semi-static 0 round trip session setup https://www.cs.virginia.edu/dwu4/papers/PrivateIoT.pdf https://www.cs.virginia.edu/dwu4/papers/PrivateIoT.pdf as well as what goes wrong when you do reuse things https://www.math.uwaterloo.ca/~ajmeneze/publications/ephemeral.pdf https://www.math.uwaterloo.ca/~ajmeneze/publications/ephemer...
- deleted 6y ago[deleted]
- DINKDINK 6y agoThe CIA doesn't rely on TLS, do you? "Development Tradecraft DOs and DON'Ts [...] (U) Networking Directive Rationale [...] DO NOT solely rely on SSL/TLS to secure data in transit. Numerous man-in-middle attack vectors and publicly disclosed flaws in the protocol." https://wikileaks.org/ciav7p1/cms/page_14587109.html https://wikileaks.org/ciav7p1/cms/page_14587109.html
- 1vuio0pswjnm7 6y agoIn their civilian lives I would bet most if not all government employees, including CIA, do rely on all the same scatterbrained work foisted upon us by tech company "engineers". SSL/TLS, not to mention cookies, came from Netscape, a.k.a., Netscum.