Topic: Cryptographic "Timing" attack can affects Twitter & Digg (OAuth, OpenID...)

[Samker]

A well-known cryptographic attack could be used by hackers to log into Web applications used by millions of users, according to two security experts who plan to discuss the issue at an upcoming security conference.

Researchers Nate Lawson and Taylor Nelson say they've discovered a basic security flaw that affects dozens of open-source software libraries -- including those used by software that implements the OAuth: http://groups.google.com/group/oauth/browse_thread/thread/f3e9ec6c3aa0fe1a and OpenID: http://lists.openid.net/pipermail/openid-security/2010-July/thread.html standards -- that are used to check passwords and user names when people log into websites. OAuth and OpenID authentication are accepted by popular Web sites such as Twitter and Digg.

They found that some versions of these login systems are vulnerable to what's known as a timing attack. Cryptographers have known about timing attacks for 25 years, but they are generally thought to be very hard to pull off over a network. The researchers aim to show that's not the case.

The attacks are thought to be so difficult because they require very precise measurements. They crack passwords by measuring the time it takes for a computer to respond to a login request. On some login systems, the computer will check password characters one at a time, and kick back a "login failed" message as soon as it spots a bad character in the password. This means a computer returns a completely bad login attempt a tiny bit faster than a login where the first character in the password is correct.

By trying to log in again and again, cycling through characters and measuring the time it takes for the computer to respond, hackers can ultimately figure out the correct passwords.

This all sounds very theoretical, but timing attacks can actually succeed in the real world. Three years ago, one was used to hack Microsoft's Xbox 360 gaming system, and people who build smart cards have added timing attack protection for years: http://beta.ivancover.com/wiki/index.php/Xbox_360_Timing_Attack

But Internet developers have long assumed that there are too many other factors -- called network jitter -- that slow down or speed up response times and make it almost impossible to get the kind of precise results, where nanoseconds make a difference, required for a successful timing attack.

Those assumptions are wrong, according to Lawson, founder of the security consultancy Root Labs. He and Nelson tested attacks over the Internet, local-area networks and in cloud computing environments and found they were able to crack passwords in all the environments by using algorithms to weed out the network jitter.

They plan to discuss their attacks at the Black Hat conference later this month in Las Vegas: https://www.blackhat.com/html/bh-us-10/bh-us-10-briefings.html#Lawson

"I really think people need to see exploits of it to see that this is a problem they need to fix," Lawson said. He says he focused on these types of Web applications precisely because they are so often thought to be invulnerable to timing attacks. "I wanted to reach the people who were least aware of it," he said.

The researchers also found that queries made to programs written in interpreted languages such as Python or Ruby -- both very popular on the Web -- generated responses much more slowly than other types of languages such as C or assembly language, making timing attacks more feasible. "For languages that are interpreted, you end up with a much greater timing difference than people thought," Lawson said.

Still, these attacks are nothing that most people should worry about, according to Yahoo Director of Standards Eran Hammer-Lahav, a contributor to both the OAuth and OpenID projects. "I am not concerned by it," he wrote in an e-mail message. "I do not think any large provider is using any of the open source libraries for their server-side implementation, and even if they did, this is not a trivial attack to execute."

Lawson and Nelson have notified the software developers affected by the problem, but will not release the names of vulnerable products until they are fixed. For most of the libraries affected, the fix is simple: Program the system to take the same amount of time to return both correct and incorrect passwords. This can be done in about six lines of code, Lawson said.

Interestingly, the researchers found that cloud-based applications could be more vulnerable to these type of attacks because services like Amazon EC2 and Slicehost give the attackers a way to get close to their targets, thus reducing network jitter.

Lawson and Nelson aren't saying before their talk at Black Hat how precise their timing measurements were, but there are actually reasons it might be harder to pull off this type of attack in the cloud, according to Scott Morrison, CTO with Layer 7 Technologies, a cloud-computing security provider.

Because many different virtual systems and applications are competing for computing resources in the cloud, it can be hard to get reliable results, he said. "All of those things work to help mitigate this particular ... attack because it just adds unpredictability to the whole system."

Still, he said this type of research is important because it shows how an attack, that seems almost impossible to some, really can work.

(PCW)