[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1344536350.13241.51.camel@scapa>
Date: Thu, 09 Aug 2012 11:19:14 -0700
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Cc: argyros.george@...il.com
Subject: Randomness Attacks Against PHP Applications
Hi list,
I'm currently at the Usenix Security 2012 conference, where there was a
nice paper about randomness vulnerabilities in PHP applications. I
invite you to read the paper[1] but in summary, a lot of PHP
applications make false assumption about the true randomness of the core
PHP random functions and it might lead to attacks, for example using the
“password reset” features.
Paper authors tried to port this to PHP security team, but it seems the
answer was that it was an application problem. Some examples are given
in the paper, but I have no idea where exactly the vulnerabilities
really lie. The various rand() functions used by application developers
might just not hold up to the expectations, or the developers might just
don't know that they should use a cryptographically secure random
function.
In any case, I guess some discussion might be needed on how to really
fix those vulnerabilities, and here seems like a good place. I've just
added the two papers authors to CC:, but it might be interesting to
bring PHP security team and applications developers in the loop.
Regards,
--
Yves-Alexis
[1]:
https://www.usenix.org/conference/usenixsecurity12/i-forgot-your-password-randomness-attacks-against-php-applications
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
