Re: Randomness Attacks Against PHP Applications

[Yves-Alexis Perez <corsac () debian org>]

On jeu., 2012-08-09 at 11:19 -0700, Yves-Alexis Perez wrote:
> Hi list,
>
> I'm currently at the Usenix Security 2012 conference, where there was a
> nice paper about randomness vulnerabilities in PHP applications. I
> invite you to read the paper[1] but in summary, a lot of PHP
> applications make false assumption about the true randomness of the core
> PHP random functions and it might lead to attacks, for example using the
> “password reset” features.
>
> Paper authors tried to port this to PHP security team, but it seems the
> answer was that it was an application problem. Some examples are given
> in the paper, but I have no idea where exactly the vulnerabilities
> really lie. The various rand() functions used by application developers
> might just not hold up to the expectations, or the developers might just
> don't know that they should use a cryptographically secure random
> function.
>
> In any case, I guess some discussion might be needed on how to really
> fix those vulnerabilities, and here seems like a good place. I've just
> added the two papers authors to CC:, but it might be interesting to
> bring PHP security team and applications developers in the loop.
 ven., 2012-08-10 at 09:57 -0700, Aggelos Kiayias wrote:
Hi Yves-Alexis -
> my student George Argyros brought the below to my attention - (but I  
> have not received any e-mail myself - )

Sorry, I tried to add you to CC: of the initial mail but it seems I
failed

> thanks for taking this initiative - I think it is important to find  
> the optimal way to resolve these problems and
> relying on web application developers to have the expertise to
resolve  
> these problems on their side is totally unrealistic. 

To be honest, I don't have any position on this. I was merely forwarding
your work to raise awareness on this list, but I have no idea what's the
correct way to move forward.

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part