Date: Fri, 10 Aug 2012 10:56:24 -0700 From: Yves-Alexis Perez <corsac@...ian.org> To: oss-security@...ts.openwall.com Cc: argyros.george@...il.com, Aggelos Kiayias <aggelos@...yias.com> Subject: Re: Randomness Attacks Against PHP Applications On jeu., 2012-08-09 at 11:19 -0700, Yves-Alexis Perez wrote: > Hi list, > > I'm currently at the Usenix Security 2012 conference, where there was a > nice paper about randomness vulnerabilities in PHP applications. I > invite you to read the paper but in summary, a lot of PHP > applications make false assumption about the true randomness of the core > PHP random functions and it might lead to attacks, for example using the > “password reset” features. > > Paper authors tried to port this to PHP security team, but it seems the > answer was that it was an application problem. Some examples are given > in the paper, but I have no idea where exactly the vulnerabilities > really lie. The various rand() functions used by application developers > might just not hold up to the expectations, or the developers might just > don't know that they should use a cryptographically secure random > function. > > In any case, I guess some discussion might be needed on how to really > fix those vulnerabilities, and here seems like a good place. I've just > added the two papers authors to CC:, but it might be interesting to > bring PHP security team and applications developers in the loop. > ven., 2012-08-10 at 09:57 -0700, Aggelos Kiayias wrote: Hi Yves-Alexis - > > my student George Argyros brought the below to my attention - (but I > have not received any e-mail myself - ) Sorry, I tried to add you to CC: of the initial mail but it seems I failed > thanks for taking this initiative - I think it is important to find > the optimal way to resolve these problems and > relying on web application developers to have the expertise to resolve > these problems on their side is totally unrealistic. To be honest, I don't have any position on this. I was merely forwarding your work to raise awareness on this list, but I have no idea what's the correct way to move forward. Regards, -- Yves-Alexis Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.