ntxissacsc4 - a brief history of cryptographic failures

@NTXISSA#NTXISSACSC4

ABriefHistoryofCryptographicFailures

BrianMorkCISO

Celanese2016-10-07


WhoAmI?

• CISOatS&P500/Fortune500company• Formerair-drophacker,securityengineer,penetrationtester,RFsimulationengineer,electronicsintelligenceexpert,optician’sassistant,newspaperdeliveryboy,softwarepirate,partyorganizer,andshortordercook.

• Alsoknownas“Hermit”withintheinformationsecurity/hackercommunity

NTXISSACyberSecurityConference– October2-3,2015 2


DISCLAIMERS

• I’mnotanexpertincryptography• WhileItakecryptographyseriously,Idon’ttakemyselfseriously

• IusedpicturesfromtheInternet.I’velistedthesourcesIknowonthesecondtolastslide.

• Ifwecan’thavefunwiththis…



Well,then…



Agenda

• WhatisCryptography?• WhyCryptography?• OurCast• TheFailures• HonorableMentions• Q&A



WhatIsCryptography?

“Theprocessofwritingorreadingsecretmessagesorcodes.”

- MiriamWebsterDictionary“Theartofwritingorsolvingcodes.”

- OxfordEnglishDictionary“Thescientificfieldofstudyrelatedtoprotectingorverifyinginformation.”

- BrianMork



WhyCryptography?

• Becauseyoulacktrustin… something…• Transmissionmediums• Integrityofcommunications• Otherpeople• Governments• Cigarettesmokingmen• Etc.



OurCast

Intraditionalcryptographicdiscussionswewouldconsiderthefollowingactors:• Alice– Someonesendinginformation• Bob– Someonereceivinginformation• Eve– Someoneeavesdropping

AllbecauseRonRivest (ofRSAfame)usedsuchtermsbackinthe1970s.



OurREALCast

Timeshavechanged,andweneedheroeswhoreflectthosetimes…


Alice,as… well… Alice

… Dilbert,asBob…

… andCatbert,asEve.Orevil.Eitherone/both.


Andnowhere’ssomethingwehopeyou’llreallylike!



FailureOne


REGULAR FAIL


TheScenario

AliceandDilbertsetupasecurewebsite.It’samazing.Itwashackerproof(justtrustmeonthisone),withanofficialcertificateandeverything.

Unfortunately,theiragentsusedbrowsersthatstilltrustedrootcertificateauthoritiesthatusedMD5forhashing.



Failure:MD5Certificate

SowhatisMD5?• Hashingalgorithm• Vulnerabletocollisions• Wasstillusedthrough2008bycertificateauthorities



Failure:MD5Collisions

Whatisacollision?

It’swhentwodifferentinputscreatethesameoutput.

Whyisthatbad?

Because… that’sexactlywhatit’snotsupposedtodo!




Howcanwemakethatworse?

Byhavingaconditionwheretwodifferentinputsshareafunctionorformat,suchasdocuments andexecutables

Or,Idon’tknow… cryptographicmaterial




ThefirstMD5collisionwasin2004.

By2007collidingexecutables,documents,andmorewerepossibleandhadbeendemonstrated,duetochosen-prefixcollisions.

Enterthefakecertificateauthority!




Step1:Generateapairofcertificateswiththesamehashbutdifferentcharacteristics(e.g.makeoneaCAthatcansignanything).

Step2:Getthebenigncertificatesignedbya”real”CAandcopythatsignaturetothemaliciousone.

Step3:ProfitNTXISSACyberSecurityConference– October2-3,2015 17


Failure:MD5CollisionsAndwhatdoesthatgiveyou?

Acertificatethatcansignliterallyanything,andwhichvalidatesbacktoatrustedrootcertificateauthority.

IamGoogle

MicrosoftMr.Robot

WhomeverIwanttobe!





I am Dilbert. You can trust this because Alice said I am. Now tell me

all your secrets. They’re safe with me.


FailureTwo



TheScenario

• Inanalternatedimension,AlicehasascendedtoleadamilitaryforceagainsttheevilfelinenationofCatbertia.

• Dilbert,herleadgeneral,needstocommunicatesecurelywithher.

• Theydecidetodeployoneofthemosteffectivephysicalcryptographicsystemsevermade… theenigmatic… er… Enigma.



FailureX:Enigma

ThisistheEngima.Itwasabeautyofengineering.Multiplerotors,eachinputchangedthenextencoding,easytooperateandfiendishlydifficulttobruteforce.



FailureX:Engima

Howcomplexwasit?• 3rotorwheelpositions,5wheelchoices(60startingcombinations)

• 26startingpositionsperwheel(17,576combinations)

• Wheelsrotateoneanother… wiringtocreatesubstitutions… egads!

• 107,458,687,327,250,619,360,000keysNTXISSACyberSecurityConference– October2-3,2015 24


FailureX:Engima

Oh,andthentherewasthefactthatEngimaoperationsusedkeyencryptingkeys… really!

Thedaykeywasapre-sharedsecretusedtoencryptone-timekeyscalledmessagekeys.Messagekeyswerethenusedtoencryptactualmessages.

Prettynifty!NTXISSACyberSecurityConference– October2-3,2015 25


Catbert HasNoChance!

• It’strue!Withthatmanycombinationsandfrequencyofchangethere’snohopefortheempireofevil.

• Thenagain,peoplehavebeenknowntomakemistakes.

• ButI’msureAliceandDilbertwouldn’tmakethesameonesthattheirhistoricalpredecessorsdid.Whatwerethoseagain?



FailureX:Engima

HowwasEnigmapreviouslydefeated?• Reuseofrotorsettings• Transmissionwithmultipleciphers• Operatorsoftenreusedthesamemessagekeymultipletimes(e.g.“cillies”)

• Commonmessageformats



FailureX:Enigma

• What’sthat?Dilberthastakentousingthedayoftheweekasthemessagekey?



Failure2



TheScenario

AliceandDilbertarejoiningthemodernage.Theyvisiteachother’shousesfrequently,anduseeachother’swirelessnetworks.

Tobeextrasafe,they’veselectedWiredEquivalentPrivacy(WEP)tosecuretheirnetwork.Whatcouldpossiblygowrong?Well,sinceWEPusesasinglekeythatneedstobeprotected!



Failure:WEP


TheyknowthatCatbert istryingtointercepttheircommunications,sotheypaidadrivertotaketheoutinthemiddleofamudfieldinElbonia.

Onceoutthere,theychoseasupersecretpasswordjustbetweenthetwoofthem.Thisisnowtheirwirelessnetworkpassword.

Whew!Thatwasclose.Goodthingthatsharingthekeyisthebiggestconcern.Right?


Failure:WEP

Well,maybenotJUSTthat… there’salso:• Poorinitializationvectors(IV)size• WeakIVs• Weakkeyspace• Poorkeyentry(ASCIIreduceskeyspace)• Replay/packetstimulation(whenyouneedmoreIVs)

• Chop-ChopAttack!



Failure:WEP


TheonlythingIlikemorethanweakcryptoismy

enemiesusingit.

@NTXISSA#NTXISSACSC4NTXISSACyberSecurityConference– October2-3,2015 34

Will this guy ever shut up?


HonorableMention

• AdvancedEncryptionStandard(AES)–ElectronicCodebook(ECB)• Samekeyusedoverandover• Block-basedencryption• Knownplaintextlookup!• SmashECB,forexample(writtenbyyourstruly)



HonorableMention

• ClipperChip– LawEnforcementAccessField• Includeddatanecessarytorecoverkey• Only16-bithashprotectingit• Bypassandreusewerepossibleanddemonstrated

• UseofthirdpartyLEAFdatawaspossibletoo!



HonorableMention

• Microsoft’s”GoldenKey”• BootingRT/ARMdeviceschecktwothings:apolicy(mustbesignedbyMicrosoft)andtheoperatingsystem(alsomustbesignedbyMicrosoft)

• The“GoldenKey”isadebugmodepolicythatwasaccidentallyshipped,andthatpolicyallowsskippingthecheckfortheoperatingsystem

• Presto!AnyOSonaSurface/WinPhone/etc.NTXISSACyberSecurityConference– October2-3,2015 37


HonorableMentions

Andsomany,manymore…• WPA- Design• DualECDRBG- Design• MD4– Time,mostly• NISTP- curves(ECC)– Design• DigitalEncryptionStandard(DES)– Design• 3DES– Design



Questions

Ifyou’vegot’em,throw‘em.

IfIknowtheanswer,I’llgiveit.

IfIdon’t,I’llansweranywaysbeforeIdisclosethatIhavenocluewhatI’mtalkingabout.



Miscellaneous

• PictureCredits• MulderImage:PascalWagler• DilbertCharacters:ScottAdams• Engima Machine:TheHistoryBlog.com• FailurePictures:TheInternetTubes

• FindMe• Twitter:@hermit_hacker• LinkedIn:/in/bcmork


@NTXISSA#NTXISSACSC4@NTXISSA#NTXISSACSC4

The Collin College Engineering DepartmentCollin College StudentChapteroftheNorthTexasISSA

NorthTexasISSA(InformationSystemsSecurityAssociation)


Thankyou