SSL/TLS Suffers 'bar Mitzvah attack' Vulnerability Detection Method and repair suggestions

SSL/TLS Suffers 'bar Mitzvah attack' Vulnerability Detection Method and repair suggestions

0x01 Preface

Once again, SSL is difficult for everyone due to the Bar Mitzvah Attack Vulnerability.

At the Black Hat Asia security conference held in Singapore, Imperva's Security Director Itsik Mantin detailed how to use this attack principle, this vulnerability is caused by a 13-Year-Old RC4 encryption algorithm with weak functionality. with the immutable weak key of RC4, attackers can restore plain text in encrypted information under special circumstances, which may expose account passwords, credit card data, or other sensitive information. Unlike the previous SSL attack methods, only passive sniffing and listening for SSL/TLS connections can be used for attacks. Itsik Mantin said that man-in-the-middle attacks may be used to hijack sessions.

This vulnerability is caused by immutability. It is an L-type key image in the RC4 encryption algorithm. Once it exists in an RC4 key, the saved status is complete until the entire initialization process ends. this complete section includes at least significant bits arranged when processed by the PRGA algorithm, identifying a long prefix that is said to be the minimum valid bits of the pseudo-random output stream along the data stream. The exclusive or operation of the plaintext bytes of these bitstream will cause major leakage of the plaintext bytes.


In the handshake protocol, the RC4 encryption key is generated for upstream and downstream communication. In the record protocol, the upstream key is used to encrypt the communication between the client and the server, while the downstream key is used to encrypt the communication between the server and the client. It should be noted that encryption is important. The first encrypted stream is used to encrypt the messages of the first byte, And the next message is encrypted by the next encrypted byte. Given that immutability only indicates the first 100-byte dense stream, it can only be used for the first 100-byte protected upstream traffic and the first 100-byte protected downstream traffic. Because the SSL handshake is the first encrypted message in each direction to complete the message (SSL typically uses 36 bytes), about 64 bytes of plaintext data is left to attackers.

For more information about the flow description, see.


At present, although mainstream Release versions such as Debian, Ubuntu, and RedHat have not released official repair patches, we are lucky that the attack POC has not been officially released, so you can refer to the temporary repair solution for repair first.

0x02 affected version range

The Web Container enables SSL/TLS access and does not block the RC4 encryption algorithm.

0x03 check whether the vulnerability exists locally

Https remote check method (to see if a website is vulnerable to RC4 weak key attacks, you can use the OpenSSL command ):

Openssl s_client-connect adobe.com: 443-cipher RC4
 


If the connection handshake is successful and the certificate information is displayed, this risk vulnerability exists.

If you see "alert handshake failure", the website is safe.



0x04 Online Monitoring

You can also use the SSL Server Test-security testing tool to Test whether your HTTPS has any risks.



0x05 temporary repair solution

1. Disable the apache server from using the RC4 encryption algorithm.

Vi/etc/httpd/conf. d/ssl. conf

Modify to the following Configuration:

SSLCipherSuite HIGH: MEDIUM :! ANULL :! MD5 :! RC4

Restart the apache service

/Etc/init. d/httpd restart
 
Access to view results:



2. About the nginx Encryption Algorithm

1.0.5 and later versions, the default SSL password algorithm is HIGH :! ANULL :! MD5

For versions 0.7.65, 0.8.20, and later, the default SSL password algorithm is HIGH :! ADH :! MD5

In version 0.8.19, the default SSL password algorithm is ALL :! ADH: RC4 + RSA: + HIGH: + MEDIUM

0.7.64, 0.8.18, and earlier versions. The default SSL password algorithm is ALL :! ADH: RC4 + RSA: + HIGH: + MEDIUM: + LOW: + SSLv2: + EXP

You can directly modify the ssl-related configuration under the domain name for a lower version of nginx or without annotations

Ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384: ECDHE-RSA-AES128-GCM-SHA256: DHE-RSA-AES256-GCM-SHA384: DHE-RSA-AES128-GCM-SHA256: ECDHE-RSA-AES256-SHA384: ECDHE-RSA-AES128-SHA256: ECDHE-RSA-AES
256-SHA: ECDHE-RSA-AES128-SHA: DHE-RSA-AES256-SHA256: DHE-RSA-AES128-SHA256: DHE-RSA-AES256-SHA: DHE-RSA-AES128-SHA: ECDHE-RSA-DES-CBC3-SHA: EDH-RSA-DES-CBC3-SHA: AES256-GCM-SHA384: AES128-GC
M-SHA256: AES256-SHA256: AES128-SHA256: AES256-SHA: AES128-SHA: DES-CBC3-SHA: HIGH :! ANULL :! ENULL :! EXPORT :! DES :! MD5 :! PSK :! RC4 ";
Ssl_prefer_server_ciphers on;

Nginx is required to reload the service

/Etc/init. d/nginx reload
 
Access to view results:

Or whether the repair is completed online:

0x06 manual shielding solution for browsers

By default, when the RC4 priority encryption algorithm is enabled in apache, the Chrome browser accesses the result as follows:

Windows users:

1) completely disable Chrome and Mozilla Firefox

2) copy a shortcut that usually opens Chrome (Mozilla Firefox)

3) Right-click the new shortcut to go to the properties page.

4) enter the following command-cipher-suite-blacklist = 0x0004,0x0005, 0xc011, 0xc007 at the end of the space field after the target



0x0004 corresponds to the RSA-RC4128-MD5,

0x0005 corresponds to the RSA-RC4128-SHA,

0xc011 ECDHE-RSA-RC4128-SHA,

And the last 0xc007 corresponds to the ECDHE-ECDSA-RC4128-SHA.

In this way, RC4 can be disabled.



Mac OS X users:

1) Close Chrome completely

2) Find the Terminal that comes with the Local Machine (Terminal)

3) enter the following command:/Applications/Google \ Chrome. app/Contents/MacOS/Google \ Chrome-cipher-suite-blacklist = 0x0004,0x0005, 0xc011, 0xc007

Linux users:

1) Close Chrome completely

2) enter the following command in the terminal: google-chrome-cipher-suite-blacklist = 0x0004,0x0005, 0xc011, 0xc007