- Hello everyone. My name is Ionut Cernica,
and I am presenting:
Hack the hackers: Leaking data over SSL/TLS.
I will have a short introduction about the blind injections.
What is a blind injection?
Then, problems that may appear with blind injections.
Scenario and challenges, where you are exploiting
the blind injection.
Blind injection over SSL/TLS.
Then, the demo time with sqlmap,
the most used penetration testing tool,
for when it comes to SQL injections.
And, conclusion.
Who am I? I am a security researcher
for Future Networks 5G Lab.
I was a PhD student, at department,
Department of Computer Science, Politehnica, Bucharest.
CTF player, penetration tester, entrepreneur.
Actually, this research was done, at my PhD,
and I tried to innovate based on this research, I tried to,
to introduce a new layer of security for web applications.
And this was one of the component of that layer.
And, we run out of funds, (chuckles)
and, it is on, we take a break from the project.
And a former bug bounty hunter.
I used to, be involved in many, bug bounty programs,
Special thanks, for Pentest Tools.
They have the best online penetration testing platform,
you should try it, they give you a gift, two week trials,
you will have to visit their website.
I find them because, they are financially supporting me
for being in Vegas, and have this presentation there.
Blind injection.
It is about when you are trying to,
interrogate the server for true and falses in order to take,
one byte at a time, from the information you target.
This is done by Boolean base, this technique is done,
for Boolean, or time-based.
And the most cases where you all encounter this technique,
will be at the SQL injection vulnerabilities.
So you may heard about blind injection,
blind, blind SQL injection.
The problem.
We can distinguish the true and falses
from the encrypted traffic,
just looking on the length of the responses.
This is for the Boolean,
and, just looking at the delays between the packets,
between the responses.
And this is for time-based.
Maybe it is not the problem, maybe it is.
Let us see if this is the real problem.
No, the real problem is something else.
It is BILOST. BILOST, it is a new hacking technique,
a passive one.
It refers to blind injection leak over SSL/TLS.
It is a passive attack, as I already said,
no interaction with the victim, with the hacker,
which is, or penetration tester, which is, extracting,
extracting data from the server.
And, this is because, blind injection exploits are written
in a predictable way.
So.
How is that? We have the f, which is the method.
Charset, binary search, you will see in the next, slide.
Then, we have the two types of output, that we are taking,
taking from the encrypted traffic.
The two types of output, one is true,
and the other one should be false.
And the result, the n, which is the input to the method,
to the function, is the leak.
If you can, suppose the method, and the two types of output,
you can find, it is a feasible brute force.
Then you can find the leak by reversing the steps,
it is an easy, it is very easy to do that.
Known method, methods of exploiting with blind technique.
So these, these are the methods, which we are,
we should find, when we are looking for blind injection,
over SSL/TLS.
The charset method, which you have the letters
and the digits, and you are, starting to take
the first letter, A, in this case,
and interrogate the server, is the first letter
of the information A? And maybe he said false.
Then you go to B, you go to C.
Until you will have a true from the server.
And the server say, yes, this is the D letter from the,
from the information.
The first letter of the information is D, good job,
go to the second one, and so on.
So you can reverse if you suppose that,
the hacker, did this, the charset,
and used A, B, C, D,
0, 1,
2, 3, or 0, 1,
you do not have, this, this is challenging,
you will see, in the next slides.
But,
this is the way how this work,
because,
because, most of the hackers use this in their scripts.
The binary search,
we can use also as, exploiting the,
as a method for exploiting the blind technique.
The binary search, which, which is, an optimized way
to extract data from the servers, the sqlmap,
with, is doing this.
And, it is an improved way of the binary search,
because he is not on the whole axis, he is starting with,
with the, printable characters,
and is starting with the letters, then, it has some,
some changes on the binary, its binary search.
And, we will have a demo with the sqlmap, and you will,
you will see that, it is very easy to reverse the steps.
And, the bit shifting, again, it is not so common,
but it is a method, a known method.
And, I encounter it in that tool, which are,
it was doing the, it was doing the SQL injection.
Challenges with the extraction methods.
No challenges, when we are dealing
with optimization techniques,
like binary search or bit shifting,
because we already know the code, how, how they are doing,
and it is easy to reverse the steps,
but we are, we are having some challenges
when it came about, charset method,
because, here it was the biggest challenge.
Okay, biggest challenge.
Yes, it was the biggest challenge, it was, because,
we do not know where, are the letters, if they,
the hacker, started with the letters, then the digits,
or his charset is,
his charset starts with digits,
then the letters.
And, you should brute force this, their position,
by rotating the output, and looking on the output,
make a text recognition, or something like this, to see the,
to extract the data base.
Exploit, how will you exploit these over SSL/TLS,
over this protocol, it is an important one.
We have the length of the packets,
we are using the length of the packets for Boolean based.
And we are, we are using the time,
the delays between the packets, to find the trues,
true, from the server, when its,
when it comes the time based.
In some cipher, there is a padding involved.
So, we still exploit this problem because,
that would work if the block, if the block size, it is,
is smaller than the difference between true and falses.
So, true and falses will be differentiated by a huge,
length.
And, as a disclaimer,
it is not a problem with SSL/TLS protocol.
The problem is in the way we are written,
the exploits, to exploit this type of attack.
Scenarios of exploiting,
we have the penetration testing company,
which is doing a penetration, test.
And,
our pen tester is extracting with sqlmap,
the database from, a vulnerable web application.
And,
can be a huge problem,
because someone with the encrypted traffic,
from his company or, some, or the internet service provider,
because this is the second scenario,
can look at his traffic, and take, reverse the steps,
and take the same database as the penetration tester did.
This will be included, this scenario will be in our demo.
You will see later.
Our internet service provider, which has all the traffic,
and, he can start digging for information,
start digging for database where, our script kiddies,
or, even professional hackers, or,
penetration testers,
are trying to, exploit to databases,
and our internet service provider,
can take the same database.
And, the third one, maybe one more reason
why large countries have a strategic interest
to pass the traffic of another country
to their infrastructure.
Maybe, could be a reason, I do not know. (chuckles)
Over Tor. Future work.
I was thinking of Tor, but I do not have exit nodes,
but, if you have exit nodes, maybe,
be a challenging,
it is challenging to, to see what happened there, and,
if a script kiddie, or a penetration, or a hacker,
a professional one, will, dump some database in the wild,
and, you should be aware of the cell padding.
And if you are lucky enough, that your true and falses are,
bigger than the,
cell size of the padding, in Tor,
then the block size, needs to, it is more of than that,
difference between true and falses, then,
you are lucky, and it can recuperate the information,
exactly like the hacker did.
Tools and exploits, database.
We,
try to analyze some tools. We, we analyze some tools.
We analyze some exploits from an exploited database,
databases.
And with no exception, we find that,
all those tools, and all those, scripts,
that, we are supposed to exploit blind injections,
were written in a predict, in an unsafe way.
And, there is a big impact on the,
when they are trying to exploit.
When they are trying to exploit, there is a big problem,
because, someone can reverse the steps,
much more if they know, with what tool was made,
that the extraction.
And,
now for the demo, we are, we are using the SQL map.
We try to, to contact the two main contributors
from, SQL map.
We do not have a reply for, two months ago.
And,
we are doing this demo because,
even I would hide from you that sqlmap,
and I would not say a word about sqlmap,
most of you guys already think about sqlmap, that it,
may have the same problem, this problem, and,
you can check it very, very easy.
So,
let us start the demo.
We have a penetration tester, which already started
his sqlmap against the vulnerable web application.
The sqlmap will find the, the exploit, the vulnerability,
and will confirm it.
In the meantime, then we have three parties.
The man in the middle starts, a TCP dump.
And he will get the encrypted traffic.
That sqlmap, as you can see, already find the vulnerability,
confirm it, and exploiting it.
So, he is dumping data from the vulnerable web app.
Man in the middle, he is, he is sending on the,
on the, on the traffic, he is taking the traffic.
He is dumping all the traffic, even if it is encrypted,
we will see,
in seconds that, that traffic, it is all about,
server hello, and then the encrypted packets.
And from those encrypted traffic, will dump some data,
like packet lengths.
Now, when I am doing this,
so, I will open with Wireshark, you will see that,
there is an encrypted traffic.
Okay?
So, here it is.
Look, entry the traffic server client exchange,
hello, and so on.
Then, we are trying to dump some data packet lengths,
to a CVS,
file. With that, with that file,
we are running the Python scripts to,
take the packet lengths from the vulnerable web app,
to the penetration tester, those packet lengths,
we are interesting in.
And, from those packet lengths,
we will see what packet lengths are for true,
and, what are for falses.
And we will, we will have a file, with false and trues,
and we will feed our local sqlmap with the same,
with the same false and trues.
Right now, I am creating, on the man in the middle,
a database on, is not, does not have any connection
to the database that was,
exploited before,
in the vulnerable web app.
You can create any database, it is a dummy one,
like the other one, but let us suppose that is a real one.
And now,
we are trying to,
start a sqlmap,
man in the middle will start a sqlmap on his local machine,
against his database, which is already vulnerable to,
SQL injection, with a web app, through a web application,
on the local machine.
And right away, before sqlmap starts to,
exploit that database, the man in the middle will start,
feeding the sqlmap with the same responses
as the vulnerable web app, feeds the pen tester.
And you will see that the, the sqlmap will have the same,
the same, results as the pen tester.
The sqlmap from the man in the middle,
we have the same results as the sqlmap from the pen tester.
So right now we are, we are,
we are having the, the application,
which responds with the same, true and false from,
as the vulnerable web, responded to the penetration tester.
And,
now we saved the file.
We have the responses, false and trues, and as you can see,
the sqlmap, is extracting the same data,
as the sqlmap from the penetration tester. (chuckles)
Let us see, until the end.
So, the message from the, database was extracted too.
So,
what happened?
So, what we did in the demo?
The pen tester from a company, company A,
exploit a vulnerable web application, with sqlmap.
The man in the middle, took the encrypted traffic
through a TCP dump, and he did a passive attack.
How he did this passive attack?
So, it was no interaction between the man in the middle,
and the other two parties, web application,
and the penetration tester, no interaction.
So, this is, this can have a big impact,
this problem I found.
So, he extracted the true and falses from packet lengths,
from the encrypted traffic.
So, it does not matter if it is encrypted,
or it is not encrypted, does not matter.
He just took the, packet lengths,
And feed his local sqlmap with the same true and falses
to leak the data.
Or, you can reverse the steps, and create, a tool that,
do the same, but much faster.
I did this to be, to see the impact,
to understand, the impact much,
easy, in an easy way.
So, the, the result, it was that, the man in the middle,
as you can see in this, picture, took the same information
as the pentester did, with the vulnerable web app.
So, this can be very tricky because,
when you are using sqlmap, you should consider this,
your data, you are, you are extracting data from,
vulnerable web applications, and those extracted data,
those,
dump databases, can be extracted by anyone,
or within your encrypted traffic.
And,
is not,
there are many cases, where you can, have problems,
like this charset method.
So, how, how can we fix this problem?
For the charset method, it is an easy way to,
to shuffle the order of the characters in the charset,
and on your, exploit most,
the position of each character,
and, that the, someone like the man in the middle,
will not know ever.
And for the binary search, you should add some extra steps.
Of course you will, it will have an,
impact on the optimization because,
binary search, tries to optimize the process.
You will have extra steps, but,
it is safer for you to, to add those extra steps.
Conclusion.
So, the way we are writing blind injection,
exploits, should be,
should be, written in a way, in such a way that, no one can,
reverse the steps of the, of the,
communication between the exploit,
and vulnerable application.
When we want to optimize the blind injection attacks,
we must consider inserting random steps for,
for the, optimization algorithms, like binary search,
or bit shifting, or any other type of optimization.
And,
as a defensive tech, you can consider these.
I tried to,
so, as I said to my PhD,
I tried to introduce a new layer of security
for web applications.
Okay, so threat hunting, is not, it is a layer because,
it is post exploitation, it is a threat hunting,
like a threat hunting.
And, what I was trying to do was to,
find ways to confirm attacks,
without looking at the payload, so it will,
so the payload complexity does not matter.
We are looking for other, other things in the, in the data,
like in this case, the packet lengths,
and confirm an SQL injection, and so on.
Maybe some attackers want to take this in consideration.
They will need full optimization.
They want to take the data as fast as possible.
So, maybe,
can be feasible as a defensive technique,
even,
those problems with blind injection
will be known from today.
Thank you. If you have questions, please ask me.