February 09, 2007
More Nefarious Chip-And-Pin Attacks
Ziff-Davis has a story detailing some vulnerabilities in the use of smartcards that borders on lame. I love smartcards. They're amazing little things. But they're also prone to some Bad Things.
The reason I call the recent attack announce, "lame" is because it's a simple exploitation of the trust boundary of smartcards. The trust boundary of a smartcard is really the computer and the machine. In certain situations, the trust boundary is the computer, the machine, and the remote server, as I'll outline in the 'more interesting' attack below.
A little while ago I started working on a "PKCS#11 proxy service." The idea is that some older SSL apps don't support PKCS#11. If a server sends a client certficate request, the client doesn't know what to do...it will probably ask you for a file certificate at best, or just fail to negotiate at worst. If you use a HTTP CONNECT proxy service, the service could silently strip out the client certificate request from the SSL handshake and sign the data the server sent by talking to your smartcard itself. This doesn't break the SSL handshake, only the TCP stream, but the CONNECT proxy is the endpoint for the TCP stream so no worries.
"That's kinda neat," I started thinking to myself, "I wonder what else you could do with that." Looking at the way the handshake works, you can do a lot of bad things with SSL the way it's defined. The client cert request that an SSL server sends to the client is random data. It's in no way attributable to the site that requests the signature. "So what?" you ask. Here's what: I set up a web site with a URL, say https://www.foo.com and tell you to click the link. You do so, with your smartcard inserted. You connect to my server. My server then opens up a connection to your bank. The bank asks my server to authenticate itself, and sends the random data to my server asking my server to sign it. My server in turn sends an SSL client cert request to you, with the same data that your bank wanted signed, and you sign the request ("What could go wrong?" after all). Now my server is logged into your bank account, and is transferring your funds into my bank account. Neat, huh?
I feel like SSL should change, and should be required to send client cert requests in the format of domainname+date or something. Signing that would be safe(r), because your client could at least check that the certificate request is valid and that you're signing for the site that you think you're signing for. I guess if this idea/attack hasn't been published before, it might be new/novel...
Post a comment
Further back...
ArchivesFriends and Family
Search
Previous Trips...
-
Hiking Mount Whitney, 2007 
Spring Break in West Virginia, 2005
New Year's in Paris, 2003-2004
Coming to America, 2003
Protesting in Berlin, 2003
Prague Bier-Tour, 2002
Dresden, 2002
Recent Reading
![]()
The Curve of Binding Energy
John McPhee follows famous physicist Ted Taylor in this piece that was -- and probably still -- ahead of its time.
Originally published in 1973, McPhee outlined the coming security and environmental issues surrounding the plutonium enrichment processes. For the most part, though, McPhee invites the reader to draw his or her own conclusions, although he does point out the ease with which any number of people could obtain the material (though not necessarily the manufacturing prowess) to make an atomic weapon.
The question still sits in my mind after reading -- are we being too paranoid, or not paranoid enough?
Rated 
by reid
on October 01, 2007
by reid
on October 01, 2007
![]()
Zodiac
Zodiac touts itself as an 'eco-thriller,' and it is just that. Told from the first-person perspective of ST (or Sangamon Taylor), the book recounts a roughly six-month period of his life busting big corporations for violating environmental laws.
Not the tree-hugging political activist type, ST is equipped with chem labs, scuba divers, maps, and an organization (GEE International, the Group of Environmental Extremists) that masterfully brings the press into the fold to scare the public with the very real dangers posed by illegal dumping. It's sort of a Sierra Club member's wet dream -- a band of ecowarriors that actually get things done.
ST finds something odd happening in Boston Harbor during his tale: a new form of pollution that could poison everyone on the planet in a matter of weeks. His quest to uncover exactly who and what is causing the latest spike in toxins goes all the way up to the President of the United States, and could end up costing him his own life.
While a neat and fast-paced tale, the novel drags on a bit toward the end, begging disbelief from even the most forgiving sci-fi folk. While not as good as his latest offerings, it's still a great read for those that enjoy a good Stephenson novel (or even those who don't).
Rated 
by reid
on July 17, 2005
by reid
on July 17, 2005
![]()
Cat's Cradle
A few years ago, I attempted to woo an online datee, and she immediately criticized me for my politics. I protested the war on Iraq, which was "a shame." She defended her position of complete noninvolvement by standing behind Vonnegut.
It may seem odd to open a review that way. My assumption is now not that she was an idiot, but that she had only read Cat's Cradle, and only with a rather odd viewpoint.
Cat's Cradle looks at a cold-war world where the personifications of religious, political, and scientific single-mindedness collide to destroy the world.
Vonnegut tells a masterful tale, but it makes me wonder what one person's indifference would do to prevent us from all dying? So for now I will continue to unblindly stop unjust wars, even while I'm only reading.
Rated by reid
on July 17, 2005
by reid
on July 17, 2005