oss-sec mailing list archives
Randomness Attacks Against PHP Applications
From: Yves-Alexis Perez <corsac () debian org>
Date: Thu, 09 Aug 2012 11:19:14 -0700
Hi list, I'm currently at the Usenix Security 2012 conference, where there was a nice paper about randomness vulnerabilities in PHP applications. I invite you to read the paper[1] but in summary, a lot of PHP applications make false assumption about the true randomness of the core PHP random functions and it might lead to attacks, for example using the “password reset” features. Paper authors tried to port this to PHP security team, but it seems the answer was that it was an application problem. Some examples are given in the paper, but I have no idea where exactly the vulnerabilities really lie. The various rand() functions used by application developers might just not hold up to the expectations, or the developers might just don't know that they should use a cryptographically secure random function. In any case, I guess some discussion might be needed on how to really fix those vulnerabilities, and here seems like a good place. I've just added the two papers authors to CC:, but it might be interesting to bring PHP security team and applications developers in the loop. Regards, -- Yves-Alexis [1]: https://www.usenix.org/conference/usenixsecurity12/i-forgot-your-password-randomness-attacks-against-php-applications
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Randomness Attacks Against PHP Applications Yves-Alexis Perez (Aug 09)
- Re: Randomness Attacks Against PHP Applications Yves-Alexis Perez (Aug 10)
- Re: Randomness Attacks Against PHP Applications Solar Designer (Aug 22)
- Re: Randomness Attacks Against PHP Applications Solar Designer (Sep 14)
- Re: Randomness Attacks Against PHP Applications Josh Bressers (Sep 17)
- Re: Randomness Attacks Against PHP Applications Raphael Geissert (Sep 17)
- Re: Randomness Attacks Against PHP Applications Daniel Kahn Gillmor (Sep 17)
- Re: Randomness Attacks Against PHP Applications Kurt Seifried (Sep 17)
- Re: Randomness Attacks Against PHP Applications George Argyros (Sep 20)
- Re: Randomness Attacks Against PHP Applications Solar Designer (Sep 22)
- Re: Randomness Attacks Against PHP Applications Vladimir Vorontsov (Sep 23)
- Re: Randomness Attacks Against PHP Applications Solar Designer (Sep 14)