Skip to content

Commit fe5bf47

Browse files
ic0nsic0ns
authored
Merge pull request #590 from RUB-NDS/bbfix
Fix for Bleichenbacher false positives on chaninging pulic key
2 parents 8dce522 + 54a2383 commit fe5bf47

File tree

4 files changed

+28
-17
lines changed

4 files changed

+28
-17
lines changed

Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/exception/PaddingOracleUnstableException.java renamed to Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/exception/OracleUnstableException.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,13 @@
1111
/**
1212
*
1313
*/
14-
public class PaddingOracleUnstableException extends RuntimeException {
14+
public class OracleUnstableException extends RuntimeException {
1515

1616
/**
1717
*
1818
* @param string
1919
*/
20-
public PaddingOracleUnstableException(String string) {
20+
public OracleUnstableException(String string) {
2121
super(string);
2222
}
2323

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/impl/BleichenbacherAttacker.java‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
import de.rub.nds.modifiablevariable.util.ArrayConverter;
1212
import de.rub.nds.tlsattacker.attacks.config.BleichenbacherCommandConfig;
13+
import de.rub.nds.tlsattacker.attacks.exception.OracleUnstableException;
1314
import de.rub.nds.tlsattacker.attacks.pkcs1.Bleichenbacher;
1415
import de.rub.nds.tlsattacker.attacks.pkcs1.BleichenbacherVulnerabilityMap;
1516
import de.rub.nds.tlsattacker.attacks.pkcs1.BleichenbacherWorkflowGenerator;
@@ -128,12 +129,12 @@ public EqualityError getEqualityError() {
128129
CONSOLE.info("A server is considered vulnerable to this attack if it responds differently to the test vectors.");
129130
CONSOLE.info("A server is considered secure if it always responds the same way.");
130131
LOGGER.debug("Testing: " + config.getWorkflowType());
131-
errorType = isVulnerable(pkcs1Vectors);
132+
errorType = isVulnerable(pkcs1Vectors, publicKey);
132133
return errorType;
133134
}
134135

135-
public EqualityError isVulnerable(List<Pkcs1Vector> pkcs1Vectors) {
136-
fingerprintPairList = getBleichenbacherMap(config.getWorkflowType(), pkcs1Vectors);
136+
public EqualityError isVulnerable(List<Pkcs1Vector> pkcs1Vectors, RSAPublicKey publicKey) {
137+
fingerprintPairList = getBleichenbacherMap(config.getWorkflowType(), pkcs1Vectors, publicKey);
137138
if (fingerprintPairList.isEmpty()) {
138139
LOGGER.warn("Could not extract Fingerprints");
139140
return null;
@@ -146,14 +147,14 @@ public EqualityError isVulnerable(List<Pkcs1Vector> pkcs1Vectors) {
146147
// network. In this case we do a rescan
147148
// and check if we find the exact same answer behaviour (twice)
148149
List<VectorFingerprintPair> secondBleichenbacherVectorMap = getBleichenbacherMap(config.getWorkflowType(),
149-
pkcs1Vectors);
150+
pkcs1Vectors, publicKey);
150151
EqualityError error2 = getEqualityError(secondBleichenbacherVectorMap);
151152
BleichenbacherVulnerabilityMap mapOne = new BleichenbacherVulnerabilityMap(fingerprintPairList, error);
152153
BleichenbacherVulnerabilityMap mapTwo = new BleichenbacherVulnerabilityMap(secondBleichenbacherVectorMap,
153154
error2);
154155
if (mapOne.looksIdentical(mapTwo)) {
155156
List<VectorFingerprintPair> thirdBleichenbacherVectorMap = getBleichenbacherMap(
156-
config.getWorkflowType(), pkcs1Vectors);
157+
config.getWorkflowType(), pkcs1Vectors, publicKey);
157158
EqualityError error3 = getEqualityError(secondBleichenbacherVectorMap);
158159
BleichenbacherVulnerabilityMap mapThree = new BleichenbacherVulnerabilityMap(
159160
thirdBleichenbacherVectorMap, error3);
@@ -202,7 +203,7 @@ private void printBleichenbacherVectormap(List<VectorFingerprintPair> bleichenba
202203
}
203204

204205
private List<VectorFingerprintPair> getBleichenbacherMap(BleichenbacherWorkflowType bbWorkflowType,
205-
List<Pkcs1Vector> pkcs1Vectors) {
206+
List<Pkcs1Vector> pkcs1Vectors, RSAPublicKey publicKey) {
206207
Config tlsConfig = getTlsConfig();
207208
tlsConfig.setWorkflowExecutorShouldClose(false);
208209
List<VectorFingerprintPair> bleichenbacherVectorMap = new LinkedList<>();
@@ -226,6 +227,17 @@ private List<VectorFingerprintPair> getBleichenbacherMap(BleichenbacherWorkflowT
226227
processFinishedStateVectorPair(stateVectorPair, bleichenbacherVectorMap);
227228
}
228229
}
230+
// Check that the public key send by the server is actually the public
231+
// key used to generate
232+
// the vectors. This is currently a limitation of our script as the
233+
// attack vectors are
234+
// generated statically and not dynamically. We will adjust this in
235+
// future versions.
236+
for (StateVectorPair pair : stateVectorPairList) {
237+
if (!pair.getState().getTlsContext().getServerRsaModulus().equals(publicKey.getModulus())) {
238+
throw new OracleUnstableException("Server sent us a different publickey during the scan. Aborting test");
239+
}
240+
}
229241

230242
return bleichenbacherVectorMap;
231243
}
@@ -236,7 +248,7 @@ private void processFinishedStateVectorPair(StateVectorPair stateVectorPair,
236248
ResponseFingerprint fingerprint = ResponseExtractor.getFingerprint(stateVectorPair.getState());
237249
bleichenbacherVectorMap.add(new VectorFingerprintPair(fingerprint, stateVectorPair.getVector()));
238250
} else {
239-
LOGGER.error("Could not execute Workflow. Something went wrong... Check the debug output for more information");
251+
LOGGER.warn("Could not execute Workflow. Something went wrong... Check the debug output for more information");
240252
}
241253
clearConnections(stateVectorPair.getState());
242254

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/impl/PaddingOracleAttacker.java‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
import de.rub.nds.tlsattacker.attacks.config.PaddingOracleCommandConfig;
1212
import de.rub.nds.tlsattacker.attacks.exception.AttackFailedException;
13-
import de.rub.nds.tlsattacker.attacks.exception.PaddingOracleUnstableException;
13+
import de.rub.nds.tlsattacker.attacks.exception.OracleUnstableException;
1414
import de.rub.nds.tlsattacker.attacks.padding.PaddingTraceGenerator;
1515
import de.rub.nds.tlsattacker.attacks.padding.PaddingTraceGeneratorFactory;
1616
import de.rub.nds.tlsattacker.attacks.padding.PaddingVectorGenerator;
@@ -165,7 +165,7 @@ public Boolean isVulnerable() {
165165
public boolean lookEqual(List<VectorResponse> responseVectorListOne, List<VectorResponse> responseVectorListTwo) {
166166
boolean result = true;
167167
if (responseVectorListOne.size() != responseVectorListTwo.size()) {
168-
throw new PaddingOracleUnstableException(
168+
throw new OracleUnstableException(
169169
"The padding Oracle seems to be unstable - there is something going terrible wrong. We recommend manual analysis");
170170
}
171171

@@ -191,7 +191,7 @@ public boolean lookEqual(List<VectorResponse> responseVectorListOne, List<Vector
191191
continue;
192192
}
193193
if (equivalentVector.getFingerprint() == null) {
194-
LOGGER.error("Equivalent vector has no fingerprint:" + testedSuite + " - " + testedVersion);
194+
LOGGER.warn("Equivalent vector has no fingerprint:" + testedSuite + " - " + testedVersion);
195195
equivalentVector.setErrorDuringHandshake(true);
196196
result = false;
197197
continue;
@@ -200,7 +200,7 @@ public boolean lookEqual(List<VectorResponse> responseVectorListOne, List<Vector
200200
EqualityError error = FingerPrintChecker.checkEquality(vectorResponseOne.getFingerprint(),
201201
equivalentVector.getFingerprint(), true);
202202
if (error != EqualityError.NONE) {
203-
LOGGER.error("There is an error beween rescan:" + error + " - " + testedSuite + " - " + testedVersion);
203+
LOGGER.warn("There is an error beween rescan:" + error + " - " + testedSuite + " - " + testedVersion);
204204
result = false;
205205
vectorResponseOne.setShaky(true);
206206
}
@@ -231,19 +231,17 @@ public List<VectorResponse> createVectorResponseList() {
231231
ResponseFingerprint fingerprint = null;
232232
if (pair.getFingerPrintTask().isHasError()) {
233233
errornousScans = true;
234-
LOGGER.error("Could not extract fingerprint for " + pair.toString());
234+
LOGGER.warn("Could not extract fingerprint for " + pair.toString());
235235
VectorResponse vectorResponse = new VectorResponse(pair.getVector(), null, testedVersion, testedSuite,
236236
tlsConfig.getDefaultApplicationMessageData().getBytes().length);
237237
vectorResponse.setErrorDuringHandshake(true);
238238
tempResponseVectorList.add(vectorResponse);
239-
LOGGER.error("Could not execute whole workflow: " + testedSuite + " - " + testedVersion);
240-
241239
} else {
242240
testedSuite = pair.getFingerPrintTask().getState().getTlsContext().getSelectedCipherSuite();
243241
testedVersion = pair.getFingerPrintTask().getState().getTlsContext().getSelectedProtocolVersion();
244242
if (testedSuite == null || testedVersion == null) {
245243
LOGGER.fatal("Could not find ServerHello after successful extraction");
246-
throw new PaddingOracleUnstableException("Fatal Extraction error");
244+
throw new OracleUnstableException("Fatal Extraction error");
247245
}
248246
fingerprint = pair.getFingerPrintTask().getFingerprint();
249247
tempResponseVectorList.add(new VectorResponse(pair.getVector(), fingerprint, testedVersion,

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/task/FingerPrintTask.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ public void execute() {
4343
try {
4444
WorkflowExecutor executor = new DefaultWorkflowExecutor(state);
4545
executor.executeWorkflow();
46+
4647
if (!state.getWorkflowTrace().executedAsPlanned()) {
4748
throw new FingerprintExtractionException(
4849
"Could not extract fingerprint. Not all actions executed as planned");

0 commit comments

Comments
 (0)