Date: Thu, 09 Aug 2012 11:19:14 -0700 From: Yves-Alexis Perez <corsac@...ian.org> To: oss-security@...ts.openwall.com Cc: argyros.george@...il.com Subject: Randomness Attacks Against PHP Applications Hi list, I'm currently at the Usenix Security 2012 conference, where there was a nice paper about randomness vulnerabilities in PHP applications. I invite you to read the paper but in summary, a lot of PHP applications make false assumption about the true randomness of the core PHP random functions and it might lead to attacks, for example using the “password reset” features. Paper authors tried to port this to PHP security team, but it seems the answer was that it was an application problem. Some examples are given in the paper, but I have no idea where exactly the vulnerabilities really lie. The various rand() functions used by application developers might just not hold up to the expectations, or the developers might just don't know that they should use a cryptographically secure random function. In any case, I guess some discussion might be needed on how to really fix those vulnerabilities, and here seems like a good place. I've just added the two papers authors to CC:, but it might be interesting to bring PHP security team and applications developers in the loop. Regards, -- Yves-Alexis : https://www.usenix.org/conference/usenixsecurity12/i-forgot-your-password-randomness-attacks-against-php-applications Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ