3 ms·

Someone needs to show these guys Stripe CTF 2.0 Level 8. https://github.com/stripe-ctf/stripe-ctf-2.0/tree/master/levels/8 https://github.com/stripe-ctf/stripe

• trebor 14y ago
  What was the weakness of chunked storage of passwords? I thought that an adaptation of something like Shamir's Secret Share could work.
  • ontoillogical 14y ago
    In the CTF's implementation, the 2nd piece of the password would only be checked if the first one was correct. You could figure out how many different requests were made by correlating TCP sequence numbers. If only 1 request was made, the first piece was incorrect. If 2 requests were made, the 1st piece was correct, but not the second, etc... The attack was akin to a timing attack (but definitely not a timing attack).
• jarin 14y ago
  Haha, this is the first thing I thought of when reading this article. In reality, it would probably be difficult to execute on a live production server via the TCP port method. The artificial delay they added in to prevent timing attacks might cause a heavy load on the server, so if they leave that out that would be another possible attack vector.
  • webreac 14y ago
    I enjoyed a lot stripe 2.0 and I have watched Dan Bone on coursera. In the article, they just split the password in two. 128bit/2 -> 64bits. This remains two much for brute force like TCP port method or timing attack.