Re: Randomness Attacks Against PHP Applications

[Solar Designer <solar () openwall com>]

Hi,

On Thu, Aug 09, 2012 at 11:19:14AM -0700, Yves-Alexis Perez wrote:
> I'm currently at the Usenix Security 2012 conference, where there was a
> nice paper about randomness vulnerabilities in PHP applications. I
> invite you to read the paper[1] but in summary, a lot of PHP
> applications make false assumption about the true randomness of the core
> PHP random functions and it might lead to attacks, for example using the
> ???password reset??? features.
>
> Paper authors tried to port this to PHP security team, but it seems the
> answer was that it was an application problem.

Here's a vulnerability in and attack on session IDs of PHP proper:

http://blog.ptsecurity.com/2012/08/not-so-random-numbers-take-two.html

This is not exactly the same topic (PHP apps vs. PHP itself), yet it's
closely related and the timing of it was provoked by the same research.

Alexander