42 matches found
The Curious Case of WebCrypto Diffie-Hellman on Firefox - Small Subgroups Key Recovery Attack on DH
tl;dr Mozilla Firefox prior to version 72 suffers from Small Subgroups Key Recovery Attack on DH in the WebCrypto 's API. The Firefox's team fixed the issue removing completely support for DH over finite fields that is not in the WebCrypto standard. If you find this interesting read further below...
Side channel timing attacks against (EC)DSA in RSA BSAFE CVE-2019-3739/CVE-2019-3740 - Project Wycheproof is the AFL for Cryptography
About a year ago I wrote this tweet and now I can finally justify it Project Wycheproof https://t.co/wBz9P8atHs is the AFL https://t.co/JM2l557PZi of crypto. Thanks a lot @XorNinja and team notably including Bleichenbacher for providing such a powerful tool — Antonio Sanso @asanso April 9, 2018 i...
SIAM Conference on Applied Algebraic Geometry 2019 - Isogenies mini-symposium
So here we are in the nice city of Bern, in the Teutonic Switzerland, for SIAM Conference on Applied Algebraic Geometry 2019 that this year counts more than 750 attendees! The weather is warm enough but the isogenies topic has never been so hot! So for this occurrence of the conference Tanja Lang...
On Isogenies Verifiable Delay Functions (VDF)
This continues the post frompart 1. In the previous post we discussed about Verifiable Delay Functions. Here is a quick summary of what we discussed in the first part: We covered the definition of Verifiable Delay Functions VDF. We have seen a short history of how this idea slowly developed. We...
On Verifiable Delay Functions - How to Slow Burning the Planet Down (Verifiably)
Update: you can find the Part II of this series here In this blog post I am going to talk about some really cool cryptographic research done by Luca De Feo, Simon Masson, Christophe Petit and myself around a relatively new cryptographic construction called Verifiable Delay Functions VDF from now...
Persistent XSRF on Kubernetes Dashboard using Redhat Keycloak Gatekeeper on Microsof Azure
tl;dr I found an XSRF in the OAuth implementation of Redhat Keycloak Gatekeeper. This would be a bit worse for people using Gatekeeper to protect their Kubernetes Dashboard especially in Microsof Azure. The Issue in Keycloak Gatekeeper Keycloak Gatekeeper is an OpenID Proxy service for Keycloak, ...
Billion Laugh Attack in https://sites.google.com
tl;dr https://sites.google.com suffered from a Billion Laugh Attack vulnerability that made the containerized environment to crash with a single invocation. Introduction Few months ago I applied for a talk at a security conference titled So you wanna be a Bug Bounty Hunter but it was rejected :...
Micali-Schnorr Generator (MS-DRBG) Part III - Zero Knowledge Proof Wanted!!
See also Part I and Part II of this series This is going to be a short blog post about the infamous Micali-Schnorr Random Number Generator MS-DRBG. See Part I and Part II of this series for more information about this topic. WHO: NIST published the specification for Micali-Schnorr Random Number...
The Ugly Duckling in factoring aka the filtering steps part I
People that knows me well are well aware that prime numbers have been my obsession since my childhood and they are source of continue interest for me. Actually thanks to cryptography they are a relevant part of my everyday life. One of the most important problem in cryptography since the discover...
Bug bounty left over (and rant) Part III (Google and Twitter)
tl;dr in this blog post I am going to talk about some bug bounty left over with a little rant. Here you can find bug bounty left over part I and II Here you can find bug bounty rant part I and II Introduction In one of my previous post I was saying that: "The rule 1 of any bug hunter... is to hav...
Il (triste??) stato della crittografia (applicata) in Italia
Ho appena finito di scrivere a proposito dei miei 3 giorni trascorsi al Real World Crypto 2018 il blog post per chi legge inglese e' qui e mi sono accorto che non c'e' traccia di nessuna Universita' ma anche azienda italiana. Tutto cio' non puo' che rendermi un po' triste. L'Italia aveva una...
Real World Crypto 2018 (RWC 2018) brain dump
The 2018 edition of Real World Crypto RWC was in Zurich you can find the conference full program here.. I live in Switzerland so I was extremely happy about it. RWC is basically the best conference I ever attended and it will probably be so for a while. I almost risked to skip it due to flu but I...
How to try to predict the output of Micali-Schnorr Generator (MS-DRBG) knowing the factorization. Part II
See also Part I and Part III of this series tl;dr In the previous article of the same series we tried to predict the output of Micali-Schnorr Generator MS-DRBG knowing the factorization. In this blog post we continue the effort started in part I showing different strategies. If you want to skip a...
Slack SAML authentication bypass
tl;dr I found a severe issue in the Slack's SAML implementation that allowed me to bypass the authentication. This has now been solved by Slack. Introduction IMHO the rule 1 of any bug hunter note I do not consider myself one of them since I do this really sporadically is to have a good RSS feed...
How to try to predict the output of Micali-Schnorr Generator (MS-DRBG) knowing the factorization
The article was modified since its publication. Last update was 09/10/2017 See also Part II and Part III of this series tl;dr in this post we are going to describe how to try predict the output of Micali-Schnorr Generator MS-DRBG knowing the factorization of the n value. If this sounds like, "why...
CVE-2017-7781/CVE-2017-10176: Issue with elliptic curve addition in mixed Jacobian-affine coordinates in Firefox/Java
tl;dr Firefox and Java suffered from a moderate vulnerability affecting the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result POINTATINFINITY when it should not. Introduction Few months ago I was working on a vulnerability affecting th...
Analisi dei dump di Rousseau (Movimento Cinque Stelle) - Parte I: password
Disclaimer Questo blog post e' scritto da evariste.gal0is ed Antonio Sanso. Entrambi gli autori non hanno nessuna affiliazione politica ed il post ha l'unico scopo di fornire un'analisi tecnica di parte dei dump relativa alle password. Riassunto delle puntate precedenti In data 2 agosto 2017 uno...
Historical courses and resorts in Elliptic Curves Cryptography - Is Curve25519 dead?
tl;dr This short blog post serves to me to recollect some of the thing I have been learning climbing about Elliptic Curves Cryptography ECC from now on during the last months/years, so please take it with a grain of salt since it might contains some erroneous beliefs. '80 - Introduction...
Cross-origin brute-forcing of Github SAML and 2FA recovery codes
Yesterday while reading my Twitter stream I found this interesting article about downloading GitHub SSO bypass codes. Same as Yasin Soliman I was invited to a Github pre-release of the organisation SAML single sign-on SSO private program. And same as him I found an issue in the same endpoint. So ...
OAuth Worm II - The revenge
We all know about this massive Google Doc Phishing Attack that hit about 1 million accounts right? --- Image from https://arstechnica.com/security/2017/05/dont-trust-oauth-why-the-google-docs-worm-was-so-convincing/ Well this really "sophisticated attack" really?? was based on a really spread...
Meh : CSRF in Facebook Delegated Account Recovery
Note this is going to be a quick post. This year, at Enigma 2017 Conference, Facebook introduced a way to move Account Recovery beyond Email and the "Secret" Question. After the presentation the moved operationally and presented the first integration partner : Github. These days I have seen a lot...
CSRF in Facebook/Dropbox - "Mallory added a file using Dropbox"
tl;dr Facebook Groups offers the option to upload files directly from the Dropbox account. This integration is done using the OAuth 2.0 protocol and suffered from a variant of the classic OAuth CSRF defined by Egor Homakov as the the Most Common OAuth2 Vulnerability, see video below: Introduction...
Critical vulnerability in JSON Web Encryption (JWE) - RFC 7516
tl;dr if you are using go-jose, node-jose, jose2go, Nimbus JOSE+JWT or jose4j with ECDH-ES please update to the latest version. RFC 7516 aka JSON Web Encryption JWE hence many software libraries implementing this specification used to suffer from a classic Invalid Curve Attack. This would allow a...
All your Paypal OAuth tokens belong to me - localhost for the win
tl;dr I was able to hijack the OAuth tokens of EVERY Paypal OAuth application with a really simple trick. Introduction If you have been following this blog you might have got tired of how many times I have stressed out the importance of the redirecturi parameter in the OAuth flow. This simple...
The RFC 5114 saga
Back in January I posed a question "to the Internet": What the heck is RFC 5114? It looks like a lot happened since then around it. I would like to use this post to recollect some of the stuff around RFC5114 . Chapter 0: October 2007 RFC5114 draft was submitted to the IETF . Chapter I: January 20...
Native applications with OAuth 2
By Justin Richer and Antonio Sanso This article was excerpted from the book OAuth 2 in Action. The OAuth core specification specifies four different grant types: Authorization Code, Implicit, Resource Owner Password Credentials and Client Credentials. Each grant type is designed with different...
Holy redirect_uri Batman!
If you bought the book I have been writing with Justin Richer namely OAuth 2 in Action you might have noticed that we will never got tired to stress out how much important the redirecturi is in the OAuth 2 universe. Failing to understand this rather simple concept might lead to disasters. The...
Google Chrome Potential leak of sensitive information to malicious extensions (CVE-2016-1658)
Last Google Chrome release for Chrome 50.0.2661.75 contains the fix for a security low bug I found CVE-2016-1658. When first I found this bug I was under the impression it could be an UXSS. Quickly after I reported I started to realize that this wasn't as exploitable though. The issue per se was...
OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
Usual Mandatory Disclaimer: IANAC I am not a cryptographer so I might likely end up writing a bunch of mistakes in this blog post... tl;dr The OpenSSL 1.0.2 releases suffer from a Key Recovery Attack on DH small subgroups. This issue got assigned CVE-2016-0701 with a severity of High and OpenSSL...
What the heck is RFC 5114?
Mandatory Disclaimer: IANAC I am not a cryptographer so I might likely end up writing a bunch of mistakes in this blog post... I already talked about Diffie–Hellman DH from now on in TLS in my previous post: Small subgroup attack in Mozilla NSS. As mentioned FWIW I strongly agree with Google Chro...
Small subgroup attack in Mozilla NSS
tl;dr While the TLS servers attacks has been pretty much studied and fixed see e.g. https://www.secure-resumption.com/ and https://weakdh.org/ the situation with the TLS clients is was not ideal and can be improved. Here I report a Small subgroup attack for TLS clients that I performed against...
Top 10 OAuth 2 Implementation Vulnerabilities
Some time ago I posted a blogpost abut Top 5 OAuth 2 Implementation Vulnerabilities. This week I have extended the list while presenting Top X OAuth 2 Hacks at OWASP Switzerland. This blog post like the presentation is just a collection of interesting attack OAuth related. 10 The Postman Always...
A Quick Glance at Modern Browsers's Protection Part #1
tl;dr in this blog post we are going to give a look at modern browsers's protection with some hands on example available at and deployed in Heroku. This blog post is NOT about Same-origin policy Introduction In this blog post we are going to give a look at modern browsers's protection. More...
On (OAuth) token hijacks for fun and profit part #2 (Microsoft/xxx integration)
In a previous blogpost we have already analyzed a token hijack on one OAuth integration between some Microsoft and Google service and seen what went wrong. Now it is time to see yet another integration between Microsoft and xxxx unluckily I can't disclose the name of the other company due the fac...
Apple Safari URI spoofing (CVE-2015-5764)
tl;dr Apple Safari for OS X was prone to URI spoofing vulnerability and more general a user interface spoofing. Apple released security updates for Safari 9 on OS X and assigned CVE-2015-5764. Accidentally this vulnerability was also present in iOS. Instant demo In Safari up to 8.0.8 : go to clic...
New OAuth book: OAuth 2 in Action
Justin Richer and myself have been writing a book about OAuth. It gives a deep look at the OAuth 2.0 protocol including hands on examples and practical implementation vulnerabilities to avoid. You can preorder the book today or you can download the first chapter for free on the publisher’s websit...
Apple Safari SOP bypass (CVE-2015-3753)
Damien Antipa and me love browser security. Hence we always keep up to date on what is going on this field. Few months ago Christian Schneider blogged about Chrome SOP Bypass with SVG. We decided to poke some other browser using the same technique and the outcome was CVE-2015-3753. The SOP-bypass...
On (OAuth) token hijacks for fun and profit part #1 (Google/Microsoft integration)
Here we go again.... I have already blogged about OAuth token hijacks 1 2 , but hey, things happens and re-happens : In the past I had mainly focused my attention on Authorization Servers weakness. As the cited Facebook's vulnerable regex pattern matching for redirecturi. It turns out that also...
So, you wanna crypto (in AEM)
So another year passed by and I will talk again , ... at the Connect WE conference. This year with Damien Antipa we will have a speech entitled So, you wanna crypto in AEM . Now, is true that even symmetric encryption isn't a “solved problem” but hey we still need to protect information et al : N...
Open redirect in rfc6749 aka 'The OAuth 2.0 Authorization Framework'
!Image result for meme all the...
OAuth Hacks A gentle introduction to OAuth 2 and Apache Oltu
Here I posted the slides of the JUG event in Basel. I have been kind of quiet lately in this space. I have a couple on vulnerabilities outstanding one OAuth related and one browser related. Waiting for the green light... stay tuned...
Top 5 OAuth 2 Implementation Vulnerabilities
Heya, back to my favourite topics namely OAuth . I have previously discussed about common OAuth 2 Implementation Vulnerabilities but now it is time maybe to list those and order them based on their criticality. 5 The Postman Always Rings Twice I have introduced this 'attack' in last year post...