Ivan Novikov - Filesystem timing attacks practice
1 like1,116 views
This document discusses timing attacks against filesystem operations. It begins by explaining timing attack basics, where the time it takes a function to execute can depend on private data, allowing an attacker to determine the private data. It then discusses how filesystem operations like searching a directory have execution times that depend on the search string and file contents, allowing timing attacks. It covers the algorithms and hashes used for directories in common filesystems like ext2-4, FAT, NTFS, and UFS, and how their properties impact susceptibility to timing attacks. Code snippets are provided. Lastly, it discusses optimizing classic directory bruteforcing using timing attacks and provides examples of real attacks.
![ext3/4 MD4 hash tricks
mkfs.ext3/4
seed from
/dev/urandom
p = name;
while (len > 0) {
(*str2hashbuf)(p, len, in, 8);
half_md4_transform(buf, in);
len -= 32;
seed, 16 bytes
(4x32 bits long)
“secret”
p += 32;
}
minor_hash = buf[2];
hash = buf[1];
break;
128 bit of state
require to calculate
next hashes](https://image.slidesharecdn.com/ivannovikov-filesystemtimingattackspractice-131119063547-phpapp02/85/Ivan-Novikov-Filesystem-timing-attacks-practice-17-320.jpg)
Ivan Novikov - Filesystem timing attacks practice
- 1. Filesystems timing attacks ZeroNights, Moscow, 08/11/13 research
- 2. Timing attacks basics time to execution of Function(UserData,PrivateData) depends from UserData and PrivateData this time can be use to determine PrivateData by UserData
- 3. Filesystems timing attacks What is Function(UserData,PrivateData) ? Basically - STAT, but not only
- 4. FS timing attacks intro execution time of search operation depends on: ● search string ● data on which searches for attack concept is determine data by timings on different search strings
- 5. FS timing attacks intro execution time of search operation depends on: ● search string ● data on which searches for attack concept is determine data by timings on different search strings
- 6. Filesystems search basics Directory indexing mechanism ● list ● BTree (not binary tree) ● HTree + cache mechanism
- 7. Filesystem Directory indexing algo Hash type Cache ext2 list - + ext3/4 htree half_md4 + seed (earlier Legacy, TEA) + ufs2/NFS dirhash FNV (FreeBSD) DJB (OpenBSD) + FAT list (btree) - + NTFS btree - +
- 8. To cache or not to cache ● Cache does not prevent timing attacks ● Cache remove disk operations noises
- 9. ext2 lists To find a file, the directory is searched front-to-back for the associated filename HTree indexes were originally developed for ext2 but the patch never made it to the official branch. The dir_index feature can be enabled when creating an ext2 filesystem, but the ext2 code won't act on it.
- 10. ext2 lists ./fs/ext2/dir.c: static inline int ext2_match (int len, const char * const name, struct ext2_dir_entry_2 * de) { if (len != de->name_len) return 0; if (!de->inode) return 0; return !memcmp(name, de->name, len); } Timing anomaly for files with unexisting length
- 11. ext2 results 10 loops 100k STATS/loop Time(compared bytes)
- 12. OPTIMIZATION
- 13. ext3/4 HTree ./fs/ext3/hash.c: ext3fs_dirhash * Returns the hash of a filename. If len is 0 and name is NULL, then * this function can be used to test whether or not a hash version is * supported. * * The seed is an 4 longword (32 bits) "secret" which can be used to * uniquify a hash. If the seed is all zero's, then some default seed * may be used.
- 14. ext3/4 HTree 4x32 bites = 16 bytes - impossible to brute force ;( ./fs/ext3/hash.c: ext3fs_dirhash * Returns the hash of a filename. If len is 0 and name is NULL, then * this function can be used to test whether or not a hash version is * supported. * * The seed is an 4 longword (32 bits) "secret" which can be used to * uniquify a hash. If the seed is all zero's, then some default seed * may be used.
- 15. ext3/4 predicted seed ● Usefull while filesystem comes from firmware image ● All devices with same firmwares has the same seeds
- 16. What hash type used ext3/4 ? man tune2fs hash_alg=hash-alg Set the default hash algorithm used for filesystems with hashed b-tree directories. Valid algorithms accepted are: legacy, half_md4, and tea. half_md4 by default
- 17. ext3/4 MD4 hash tricks mkfs.ext3/4 seed from /dev/urandom p = name; while (len > 0) { (*str2hashbuf)(p, len, in, 8); half_md4_transform(buf, in); len -= 32; seed, 16 bytes (4x32 bits long) “secret” p += 32; } minor_hash = buf[2]; hash = buf[1]; break; 128 bit of state require to calculate next hashes
- 18. ext3/4 MD4 hash tricks MD4($salt.$filename) - really? If you know MD4($salt.”a”) You know MD4($salt.”a”.$postfix) W/o knowledge about $salt value ! What is $salt? Seed which unique for whole current filesystem (all folders)
- 19. ext3/4 legacy hash static __u32 dx_hack_hash_signed(const char *name, int len) { __u32 hash, hash0 = 0x12a3fe2d, hash1 = 0x37abe8f9; const signed char *scp = (const signed char *) name; while (len--) { hash = hash1 + (hash0 ^ (((int) *scp++) * 7152373)); if (hash & 0x80000000) hash -= 0x7fffffff; hash1 = hash0; hash0 = hash; } return hash0 << 1; }
- 20. Binary search for timing attack ext3_find_entry -> ext3_dx_find_entry -> dx_probe: p = entries + 1; q = entries + count - 1; while (p <= q) { m = p + (q - p)/2; dxtrace(printk(".")); if (dx_get_hash(m) > hash) q = m - 1; else p = m + 1; } 1. min_hash <= hash <= max_hash 2. (max-min)/2 <= hash 3. ... T=T1+T2+T3+T4 T1 T2 T3 T4
- 21. ufs2/NFS FNV hash - no seed/salt! static __inline Fnv32_t fnv_32_buf(const void *buf, size_t len, Fnv32_t hval) { const u_int8_t *s = (const u_int8_t *)buf; while (len-- != 0) { hval *= FNV_32_PRIME; hval ^= *s++; } return hval; }
- 22. ufs2/NFS DJB hash - no seed/salt! #define HASHINIT 5381 #define HASHSTEP(x,c) (((x << 5) + x) + (c)) hash32_buf(const void *buf, size_t len, uint32_t hash) { const unsigned char *p = buf; while (len--) hash = HASHSTEP(hash, *p++); return hash; }
- 23. UFS search by filename ufs_lookup -> ufs_lookup_ino: switch (ufsdirhash_lookup(dp, cnp>cn_nameptr, cnp->cn_namelen, &i_offset, &bp, nameiop == DELETE ? &prevoff : NULL)) { case 0: ep = (struct direct *)((char *)bp->b_data + (i_offset & bmask)); goto foundentry; case ENOENT: i_offset = roundup2(dp->i_size, DIRBLKSIZ); goto notfound; default: break; ufsdirhash_lookup: ... for (; (offset = DH_ENTRY(dh, slot)) != DIRHASH_EMPTY; slot = WRAPINCR(slot, dh->dh_hlen)) { ... if (dp->d_namlen == namelen && bcmp(dp->d_name, name, namelen) == 0) { /* Found. Get the prev offset if needed. */ if (prevoffp != NULL) { if (offset & (DIRBLKSIZ - 1)) { prevoff = ufsdirhash_getprev(dp, offset); if (prevoff == -1) { error = EJUSTRETURN; goto fail; } } else ...
- 24. FAT/NTFS results ● BTree + binary search - no hashes, no problems ;) ● Just test using PoC from github
- 25. PoC ● Simple tool that can demonstrate timing anomaly ● Just PoC, not a framework ● Framework soon ;) https://github. com/wallarm/researches/blob/master/fstiming/fs-timing.c
- 26. Remote attacks ● Network noises ● Lack of opportunity to request multiple files in same loop ● But you can use additional features: ○ CPU overload ○ inodes count I think you know ○ memory usage how to do it remotely ;)
- 27. Real case from a wild ● ● ● ● ● TFTP service Classic bruteforce w/o results Times to retrieve files are different Sort it! Find prefixes with anomaly timings: ○ rom○ firmware. ○ … ● Brute filename after prefixes
- 28. Next steps ● And... YES! ● We want to optimize classic DirBusting technology ● For bruteforce to search through timing-attacks!
- 29. The end Contacts: @wallarm, @d0znpp http://github.com/wallarm no+SQL timing attacks at: research