Category: Security

在圖片裡面放入圖片本身的 MD5 值

在 Hacker News Daily 上看到「The image in this post displays its own MD5 hash (retr0.id)」這篇，作者想要產生一張 PNG 圖，這張圖的 MD5 值就在圖片上呈現。然後作者本人有出現在 Hacker News 討論串上面，提到流量撐不住，所以丟到 Twitter 上面 (而很幸運的，Twitter 沒有壓這張圖，是保留原圖，所以可以驗證 MD5)：

另外一個有趣的主題是同時撞出一樣的 MD5 與 CRC32 的方式，其中 CRC32 的部份還可以直接指定值，在「MD5 Collision with CRC32 Preimage (gist.github.com)」這邊。

算是很趣味的玩法啦，畢竟 MD5 已經被大家知道是個 broken cryptographic hash function...

iOS 12.5.6

早上發現 iPhone 6 Plus 被自動更新到 iOS 12.5.6，查了一下發現是八月底的時候 Apple 推了一版 WebKit 的 ACE，CVE-2022-32893：「About the security content of iOS 12.5.6」。

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Description: An out-of-bounds write issue was addressed with improved bounds checking.

上個更新的版本 12.5.5 是 2021/09/23 出的，本來大家都以為已經沒有任何更新了，沒想到居然回過頭來發了一包，照蘋果的敘述看起來是因為這個洞被廣泛使用的關係？

iPhone 5S (目前 iOS 12 支援列表裡最早出的手機) 是 2013 下半年出的，到現在也九年了...

cURL 的 TLS fingerprint

看到「curl's TLS fingerprint」這篇，cURL 的作者 Daniel Stenberg 提到 TLS fingerprint。

先前在「修正 Curl 的 TLS handshake，避開 bot 偵測機制」與「curl 的 TLS fingerprint 偽裝專案 curl-impersonate 支援 Chrome 了」這邊有提到 curl-impersonate 這個專案，試著在 cURL 裡模擬市面上常見的瀏覽器的 TLS fingerprint。

在 Daniel Stenberg 的文章裡面也有提到這件事情，另外也提到了對 curl-impersonate 的態度：

I cannot say right now if any of the changes done for curl-impersonate will get merged into the upstream curl project, but it will also depend on what users want and how the use of TLS fingerprinting spread or changes going forward.

看起來短期內他是沒打算整，跟當初 curl-impersonate 的預期差不多...

Tor 的 Rust 計畫 Arti 推進到 1.0.0 版

在「Arti 1.0.0 is released: Our Rust Tor implementation is ready for production use.」這邊看到 Tor 的 Rust 計畫進入了 1.0.0 版。

不過每次編 Rust 的東西都會發現 Rust 版本不夠新，這次也不例外，就不知道是 Rust community 的特性還是真的太少用 Rust...

    Updating crates.io index
  Downloaded arti v1.0.0
error: failed to parse manifest at `/home/gslin/.cargo/registry/src/github.com-1ecc6299db9ec823/arti-1.0.0/Cargo.toml`

Caused by:
  feature `edition2021` is required

  this Cargo does not support nightly features, but if you
  switch to nightly channel you can add
  `cargo-features = ["edition2021"]` to enable this feature

用 rustup update 更新後就能編了，然後跑起來看起來沒什麼問題：

$ arti proxy -p 9150
2022-09-03T17:13:30.234032Z  INFO arti: Starting Arti 1.0.0 in SOCKS proxy mode on port 9150...
2022-09-03T17:13:30.238606Z  INFO tor_circmgr: We now own the lock on our state files.
2022-09-03T17:13:30.238652Z  INFO tor_dirmgr: Didn't get usable directory from cache.
2022-09-03T17:13:30.238674Z  INFO arti::socks: Listening on 127.0.0.1:9150.
2022-09-03T17:13:30.238686Z  INFO arti::socks: Listening on [::1]:9150.
2022-09-03T17:13:30.238713Z  INFO tor_dirmgr::bootstrap: 1: Looking for a consensus.
2022-09-03T17:13:33.833304Z  INFO tor_dirmgr::bootstrap: 1: Downloading certificates for consensus (we are missing 9/9).
2022-09-03T17:13:34.335754Z  INFO tor_dirmgr::bootstrap: 1: Downloading microdescriptors (we are missing 6629).
2022-09-03T17:13:41.041683Z  INFO tor_dirmgr::state: The current consensus is fresh until 2022-09-03 17:00:00.0 +00:00:00, and valid until 2022-09-03 19:00:00.0 +00:00:00. I've picked 2022-09-03 18:35:38.290798754 +00:00:00 as the earliest time to replace it.
2022-09-03T17:13:41.061978Z  INFO tor_dirmgr: Marked consensus usable.
2022-09-03T17:13:41.065536Z  INFO tor_dirmgr: Directory is complete.
2022-09-03T17:13:41.065557Z  INFO tor_dirmgr: We have enough information to build circuits.
2022-09-03T17:13:41.065564Z  INFO arti: Sufficiently bootstrapped; system SOCKS now functional.

用 curl 測試也的確是 Tor 的 exit node 了：

$ curl -i --socks5 127.0.0.1:9150 https://httpbin.org/ip
HTTP/2 200 
date: Sat, 03 Sep 2022 17:21:20 GMT
content-type: application/json
content-length: 32
server: gunicorn/19.9.0
access-control-allow-origin: *
access-control-allow-credentials: true

{
  "origin": "85.93.218.204"
}

$ host 85.93.218.204
204.218.93.85.in-addr.arpa domain name pointer tor.localhost.lu.

看起來 client 的功能能用了...

滲透測試的工具，各種搜尋引擎

在 Twitter 上看到的東西：

裡面是一張圖，整理一下這 24 個站台：

一堆 .io 網域...

裡面有蠻多服務是偶而會用到的，改拿來當作 pen test 的基礎工作也是蠻好用的，各種預先掃好的結果拿來搜...

確認 Deepfake Video Call 的方式

在 Hacker News 首頁上看到「To uncover a deepfake video call, ask the caller to turn sideways (metaphysic.ai)」這篇，講怎麼在 video call 的時候辨認是不是 deepfake 的人。原文在「To Uncover a Deepfake Video Call, Ask the Caller to Turn Sideways」這邊可以讀到。

文章裡面介紹一個很簡單的方式，就是轉頭拍側面，會看到明顯的缺陷：

這張 GIF 會更明顯：

Hacker News 上的討論也有人提到這是目前的技術限制，所以這個方法算是有效的。但以現在各類 machine learning 成長的速度來看，可能沒多久後就會有新技術突破這個方法了。

Post-Quantum 的 KEM，SIDH/SIKE 確認死亡

似乎是這幾天 cryptography 領域裡面頗熱鬧的消息，SIDH 以及 SIKE 確認有嚴重的問題：「SIKE Broken」，論文在「An efficient key recovery attack on SIDH (preliminary version)」這邊可以取得。

這次的成果是 Key recovery attack，算是最暴力的幹法，直接把 key 解出來。

另外 SIKE 剛好也是先前 Cloudflare 在解釋 Hertzbleed 時被拿來打的目標：「Cloudflare 上的 Hertzbleed 解釋」，這樣看起來連 patch 也都不用繼續研究了...

論文裡面的攻擊對象中，第一個是 Microsoft 在 $IKE challenges 內所定義的 $IKEp182 與 $IKEp217，在只用 single core 的情況下，分別在四分鐘與六分鐘就解出來：

Ran on a single core, the appended Magma code breaks the Microsoft SIKE challenges $IKEp182 and $IKEp217 in about 4 minutes and 6 minutes, respectively.

接著是四個參與 NIST 標準選拔的參數，分別是 SIKEp434、SIKEp503、SIKEp610 以及 SIKEp751，也都被極短的時間解出來：

A run on the SIKEp434 parameters, previously believed to meet NIST’s quantum security level 1, took about 62 minutes, again on a single core.

We also ran the code on random instances of SIKEp503 (level 2), SIKEp610 (level 3) and SIKEp751 (level 5), which took about 2h19m, 8h15m and 20h37m, respectively.

在 Ars Technica 的採訪「Post-quantum encryption contender is taken out by single-core PC and 1 hour」裡面，有問到 SIKE 的共同發明人 David Jao 的看法，他主要是認為密碼學界的人對於數學界的「武器」了解程度不夠而導致這次的情況：

It's true that the attack uses mathematics which was published in the 1990s and 2000s. In a sense, the attack doesn't require new mathematics; it could have been noticed at any time. One unexpected facet of the attack is that it uses genus 2 curves to attack elliptic curves (which are genus 1 curves). A connection between the two types of curves is quite unexpected. To give an example illustrating what I mean, for decades people have been trying to attack regular elliptic curve cryptography, including some who have tried using approaches based on genus 2 curves. None of these attempts has succeeded. So for this attempt to succeed in the realm of isogenies is an unexpected development.

In general there is a lot of deep mathematics which has been published in the mathematical literature but which is not well understood by cryptographers. I lump myself into the category of those many researchers who work in cryptography but do not understand as much mathematics as we really should. So sometimes all it takes is someone who recognizes the applicability of existing theoretical math to these new cryptosystems. That is what happened here.

這樣第四輪的選拔只剩下三個了...

Let's Encrypt 更新了 ToS

在「Let's Encrypt’s subscriber agreement changes on Sept 21 (letsencrypt.org)」這邊看到的，Let's Encrypt 有提供 diff 的內容，在「LE-SA-v1.2-v1.3-diff.docx」這邊，你也可以用 Google Docs Viewer 看：「LE-SA-v1.2-v1.3-diff.docx」。

看起來主要是用語上的改變 (可能是律師的建議？)，除了 revoke 的章節外看起來沒什麼大變化。而 revoke 的章節部份增加了這兩段文字：

You warrant to ISRG and the public-at-large, and You agree, that before providing a reason for revoking Your Certificate, you will have reviewed the revocation guidelines found in the “Revoking Certificates” section of the Let’s Encrypt documentation available at https://letsencrypt.org/docs/ , and that you will provide Your corresponding revocation reason code with awareness of such guidelines.

You acknowledge and accept that ISRG may modify any revocation reason code provided by You if ISRG determines, in its sole discretion, that a different reason code for revocation is more appropriate or is required by industry standards.

不確定自動化的 client 需不需要重新再 accept 一次？

原來有專有名詞：TOCTOU (Time-of-check to time-of-use)

看「The trouble with symbolic links」這篇的時候看到的專有名詞：「TOCTOU (Time-of-check to time-of-use)」，直翻是「先檢查再使用」，算是一個常見的 security (hole) pattern，因為檢查完後有可能被其他人改變，接著使用的時候就有可能產生安全漏洞。

在資料庫這類環境下，有 isolation (ACID 裡的 I) 可以確保不會發生這類問題 (需要 REPEATABLE-READ 或是更高的 isolation level)。

但在檔案系統裡面看起來不太順利，2004 年的時候研究出來沒有 portable 的方式可以確保避免 TOCTOU 的問題發生：

In the context of file system TOCTOU race conditions, the fundamental challenge is ensuring that the file system cannot be changed between two system calls. In 2004, an impossibility result was published, showing that there was no portable, deterministic technique for avoiding TOCTOU race conditions.

其中一種 mitigation 是針對 fd 監控：

Since this impossibility result, libraries for tracking file descriptors and ensuring correctness have been proposed by researchers.

然後另外一種方式 (比較治本) 是檔案系統的 API 支援 transaction，但看起來不被主流接受？

An alternative solution proposed in the research community is for UNIX systems to adopt transactions in the file system or the OS kernel. Transactions provide a concurrency control abstraction for the OS, and can be used to prevent TOCTOU races. While no production UNIX kernel has yet adopted transactions, proof-of-concept research prototypes have been developed for Linux, including the Valor file system and the TxOS kernel. Microsoft Windows has added transactions to its NTFS file system, but Microsoft discourages their use, and has indicated that they may be removed in a future version of Windows.

目前看起來的問題是沒有一個讓 Linux community 能接受的 API 設計？