Personal weblog and homepage of Tom Ritter. A smash and grab approach to technology.
WebGL exposes the details of your graphics hardware (specifically, the string that describes the rendering engine) in 2 ways. There are three levels of protection that browsers have taken to protect this data. gl.getParameter(gl.VENDOR) and gl.getParameter(gl.RENDERER) - these are the 'simple' names. At some point in the past, someone argued that it wasn't enough information, and therefore we have…
Phew, it's been a minute since I last wrote anything, hasn't it. And this blog design is pretty dated... Let me start with this: it is your right to disable telemetry. I fully support that right, and in many cases I disable telemetry myself. If your threat model says "nope", or you simply don't like it, flip the switch. Your relationship with the software and the author of it is a great guide for…
This article originally appeared on the Mozilla Hacks blog. That shopping rabbit hole you started on your laptop this morning? Pick up where you left off on your phone tonight. That dinner recipe you discovered at lunchtime? Open it on your kitchen tablet, instantly. Connect your personal devices, securely. – Firefox Sync Firefox Sync lets you share your bookmarks, browsing history, passwords and…
Over time, I've accumulated a lot of ideas that I would love to work on myself, but have to admit I pretty much never will (there's only so many hours in the day.) At the same time, I regularly see project proposals (as part of the Advisory Councils for OTF and CII ) that... while not bad, often don't inspire excitement in me. So I thought I'd write down some of my ideas in the hope that they…
For the past year and change I've been working with dkg and Linus Nordberg on Certificate Transparency Gossip . I'll assume you're familiar with Certificate Transparency (you can read more about it here .) The point of CT Gossip is to detect Certificate Transparency logs that have misbehaved (either accidentally, maliciously, or by having been compromised.) The CT Gossip spec is large, and…
Recently I wanted to run a complex query across every certificate in the CT logs. That would obviously take some time to process - but I was more interested in ease-of-execution than I was in making things as fast as possible. I ended up using a few tools, and writing a few tools, to make this happen. catlfish Catlfish is a CT Log server that's written by a friend (and CT Gossip coauther ). I'm…
A little bit ago NCC Group North America had an all-hands retreat, and solicited technical talks. I fired off a one-line e-mail: "All About Tor - Everything from the Directory Authorities to the Link Protocol to Pluggable Transports to everything in between." And promptly forgot about it for... a couple months. I ended up building the deck, with a level of detail I thought was about 80% of what I…
A little bit ago, while in London at Real World Crypto and hanging out with some browser and SSL folks, I mentioned the thought "Why isn't there a directive in HSTS to require OCSP Stapling?" (Or really just hard fail on revocation, but pragmatically they're the same thing. ) They responded, "I don't know, I don't think anyone's proposed it." I had batted the idea around a little bit, and ended up…
Disk Encryption is “a litany of difficult tradeoffs and messy compromises” as our good friend and mentor Tom Ptacek put it in his blog post . That sounds depressing, but it’s pretty accurate - trying to encrypt an entire hard drive is riddled with constraints. For example: Disk Encryption must be really, really fast. Essentially, if the crypto happens slower than the disk read speed (said another…
Tor is interesting for a lot of reasons. One of the reasons it's interesting is that the network itself operates, at its core, by mutually distrusting Directory Authorities. These Directory Authorities are run by members of the Tor Project and by trusted outside individuals/groups, such as RiseUp.net and CCC.de . A Directory Authory votes on its view of the network, and collects the votes of the…
Many moons ago, before Grub2 came about, I looked into booting from a RAID partition. It was possible, but quite difficult. Today it's possible, but only slightly difficult. I can't claim this blog post is 100% accurate, but these are my experiences, and if you got here via a search engine for a particular error, hopefully it will help guide you. I started from a complete, working Gentoo…
Last May, I was in Hong Kong for OpenITP's Circumvention Tech Summit - and I ended up taking an afternoon walk with none other than Daniel Kahn Gillmor . Over a 7 hour and I-have-no-idea-how-many-kilometer walk, we talked about a ton of things, until I eventually asked him "Why don't you think we have email encryption?" We talked about a lot of the hard problems of email encryption - problems that…
I'd like to take a moment to talk about privacy preserving by default. I don't intend for this to be a rant about current commercial decisions - instead I'd like it to be praise of what I think (and hope) is great design, and use it to try and set an example that other people can follow. I was talking with a friend recently, and he talked about how, ultimately, most people want personalization,…
Background: there's this huge problem where TLS ClientHellos that exceed 255 bytes result in hangs for certain hardware (like some F5 hardware). Hangs are horrible because the only thing you can do is have a timeout and reconnect – super slow. So we're trying to add extensions (like ALPN for SPDY) and new ciphersuites, all while keeping the size under 255 bytes. Someone asks "Hey how come this…
Over the past year, iSEC Partners has worked with the Open Technology Fund on several of their supported projects, and I've been extremely fortunate to have a finger, arm, or whole body in each of the audits. Most of them were as an Account Manager (just helping arrange the audit between the project and some of our extremely talented consultants) but I also got to roll up my sleeves and pick on a…
Unless you've been living under a rock for the past weekend, you heard about several documents publish by The Guardian and The Washington Post that are (likely) from the NSA explaining how they deal with Tor. I wanted to take a look and analyze them from a technical standpoint. The good news from these documents is that Tor is doing pretty good. There's a host of quotes that confirm what we hoped:…
Randomness, and DSA Last weekend, Bitcoin reported that several Android-based wallets were insecure and that bitcoin were stolen from them - all because the individual transactions (authenticated by a ECDSA signature) used a poor source of randomness. When you use a poor source of randomness in a DSA (or ECDSA) signature, you may reuse one of the values in the signature, the k value. Reusing k can…
I've been overwhelmed by the positive response to De-Anonymizing Alt.Anonymous.Messages on twitter, mailing lists, reddit, and all around. I recognize it's pretty niche (in comparison to the Femtocell talk, the room in AAM slowly dwindled, as opposed to slowly filling up over time) - but I'm glad people enjoyed it, and I'm extremely happy that publishing the transcript/speaker notes has let so…
For the past four years I've been working on a project to analyze Alt.Anonymous.Messages , and it was finally getting to a point where I thought I should show my work. I just finished presenting it at Defcon , and because a lot of the people I know are interested in this were not able to make it, I'm making the slides, and more importantly the speaker notes, available for download . This kind of…
Hi all. If you wound up here as a result of the many news articles about the Verizon femtocell - thanks. This is my personal site, and while I try to keep it pretty tech relevant, it goes into more cryptography and anonymity theory than my company's website . Obviously, the opinions I express here and on twitter are not my employer's. If you'd like to learn more about how we broke into Verizon's…
This week is the 19th Annual International C. Elegans Meeting, where the poster Dendritic arborization in dauer IL2 neurons: Genetic and bioinformatic analyses is being presented, which I am a contributing author on. This work shows the changes that IL2 neurons undergo as a result of the stress-induced dauer lifecycle stage. For more information, you can attend the meeting and register on-site…
This blog post originally appeared on crypto.is. We've since shut down that website, so I have copied the blog post back to my own for archival purposes. As was pointed out in a recent comment on the first blog post , I had used the terms "mix network" and "onion routing" almost interchangeably. In actuality I had fallen into a trap that a fair number of people familiar with the space have fallen…
If you spin up a Windows Instance on Amazon EC2, the only way to get your password to it is using an Amazon-provided command-line tool to decrypt the password (supplying your private SSH Key) or pasting your private SSH key into the Web Interface. That didn't sit too well with me. I'd prefer Amazon not have my private SSH key. I dug into the web interface, and their 3MB of obfuscated javascript,…
Liberation Technology is kind of a catch-all bucket I borrowed from Stanford's Program & Listserv that I use to describe technology that's designed to be used by activisits, journalists, folks with increased privacy needs (survey participants, whistleblowers, law enforcement), and the like. (I'm probably offending or upsetting someone by using this term willy nilly but I don't have a better one.)…
I don't write a lot, so when I do write for another blog (usualy an employer's) I tend to go to pains to copy the blog post here (with a credit). Today I've published five technical blog posts for another blog, but I'm not reposting them - I'm just pointing at them. They're hosted on the same machine as this one, just on a seperate domain, so I'm not worried about losing them. Crypto.is kicks off…
SSL is designed to provide Authenticity, Confidentiality, and Integrity. If an attacker is performing a Man in the Middle attack, they can slow down or close a SSL connection - but they cannot modify or learn the contents. The attacker should also not be able to impersonate the server - that's the Authenticity part. But Authenticity relies on Certificate Authorities - the attacker cannot…
This is a tad dated, but I need to catch this blog up to the blog posts I've authored for my employer's blog. Here's the blurb for a whitepaper I authored on revocation in web browsers. The past couple years have had a number of Certificate Authority compromises that have resulted in high-profile sites having fraudulent certificates issued for them. It has shown a spotlight on Certificate…
This blog post originally appeared on crypto.is. We've since shut down that website, so I have copied the blog post back to my own for archival purposes. We've laid the groundwork in the past two blog posts to explain a tagging attack on the Mixmaster remailer system. In our scenario, an attacker runs several remailer nodes in a system. An attacker may get lucky and control the first and last…
This blog post originally appeared on crypto.is. We've since shut down that website, so I have copied the blog post back to my own for archival purposes. While most of ritter.vg will function without javascript, this blog post is an exception. A remailer's packet format is the format of the data it passes to the next remailer. The packet format is somewhat independent of the remailer transport…
This blog post originally appeared on crypto.is. We've since shut down that website, so I have copied the blog post back to my own for archival purposes. A Tagging Attack is a class of attack that allows an adversary to recognize traffic at a later date by modifying it. It may be best illustrated by an example. Consider a simple example, where clients communicate with a server using AES in CTR…
This blog post originally appeared on crypto.is. We've since shut down that website, so I have copied the blog post back to my own for archival purposes. There are two main implemented remailer networks in operation: Mixmaster and Mixminion. Mixmaster was written in the early 90s by Lance Cottrell, and was maintained for a number of years by Len Sassaman. Mixminion was written in the early 2000s…
This blog post originally appeared on crypto.is. We've since shut down that website, so I have copied the blog post back to my own for archival purposes. A remailer is slang for a system that allows you to send anonymous email to a recipient. It re-mails messages for you. There are a lot of reasons why people would want to send anonymous emails. Researchers and Survey Participants, who don't want…
Pond is a personal project published this weekend by Adam Langley . Adam is wicked smart and manages both Google's SSL infrastructure and Chrome's SSL implementation (and all the nifty SSL features Chrome throws in, like NPN and DNSSEC Stapled Certs). So when he tweeted about Pond, I knew it was worth a very close look. Pond is a new encrypted messaging protocol and implementation, akin to…
So Google Chrome has a preloaded list of sites they can force SSL on (Strict Transport Security) and certificates they can pin up to (Public Key Pinning). You can request yourself be added to this list over here . But Chrome is open source, so you can look at the code behind this. The relevant file is in transport_security_state.cc and the actual list of directives is in…
Background Juliano Rizzo and Thai Duong, the authors of the BEAST attack on SSL (or TLS - used interchangeably here), have released a new attack dubbed CRIME, or Compression Ratio Info-leak Made Easy. The attack allows an attacker to reveal sensitive information that is being passed inside an encrypted SSL tunnel. The most straightforward way to leverage this vulnerability is to use it to retrieve…
Scroll Down for an Update Recently Couchsurfing sent out an email about their new terms of service . I took a look, and was pretty surprised - even in the world of ridiculous Terms of Services, this one seemed over the top. I fired off a quick rantly message through the only feedback system I could find, tweeted about it, and planned on deleting myself a short while later. However, they replied…
Jon Passki came to me a couple months ago with an idea for a new adaptive ciphertext attack on block cipher modes - similar to the Padding Oracle or Manger's Oracle attacks. I found some ways to extend it, and we wound up collaborating on it - and we're finally able to publish it today. Certain block cipher confidentiality modes, including CBC, CTR, CFB, and OFB, perform decryption with a final…
Something I've been interested in for the past few months is SSL/TLS, and in particular looking at undetectable attacks. Censorship is detectable. You know you're being censored. Censorship always implies passive network tapping - the entity has to perform the tap to do the censorship. And censorship itself is an active attack - the entity blocks you from visiting the website. But passive attacks…
Just two weeks (to the day) after presenting Cloud & Control at RSA in San Francisco, I was in Amsterdam presenting at Black Hat EU. I've been getting more involved with the tremendous number of standards bodies and keeping track in my own head on what improvements are coming down the pipe - I decided it'd be worthwhile to quantify that in a talk (and whitepaper). The talk actually only brushes…
Calyx Institute , Nick, et al I can't express how impressed and inspired I was by Nick's prolonged legal battle. His willingness to stay the course, challenge the system meaningfully, and effect change is an inspiration to anyone who considers themselves a free speech advocate. I want to make The Calyx Institute aware of a severe deficiency online, and hope to inspire you to do what you can about…
I gave my first presentation at a security conference on Friday, presenting at ekoparty on some work I did at the beginning of the year on distributing complex tasks to hundreds or thousands of computers. SETI@Home was the project that pioneered the idea of distributed volunteer computing, and their command & control software evolved into a generic project called BOINC . You can run just about any…
I just got out of Dan Kaminsky's talk at Black Hat where he talked about a myriad of topics, but the one I want to focus on was his tool Phidelius. It's a library you reference with LD_PRELOAD that hooks /dev/random, /dev/urandom and some other functions that un-randomizes the random data that key generators like gnupg, openssl, or ssh-keygen uses. Why would you want to do that? Well, instead of…
I am not a lawyer, and this blog does not constitute legal analysis. It should be taken merely as speculation and pointers to topics for you to do your own research on. Throughout this blog post I'm going to use this notation to indicate a word has a specific legal definition, and I'm not using the word colloquially. One of the biggest targets of armchair lawyers on blogs, twitter, and reddit…
Several months ago I was looking at the proceedings from #days 2010 and read Pascal Junod 's slides Open-Source Cryptographic Libraries and Embedded Platforms . In them, he mentioned James Manger's attack on RSA OAEP, a padding scheme first defined in PKCS #1 v2.0. I hadn't heard of it before, and it interested me enough to investigate. (The paper is available via Google or ACM if you're a…
I've heard it from three different sources: Certificate Authorities will make verification more painful, more costly, and more difficult - but only if they're mandated industry-wide. They can't add overhead their competitors can skip on. The CAs and Browsers have been working together in the CA/Browser Forum to come up with new requirements for Certificate Authorities. The Public Comment period on…
I've been working on a document for a while, and I'm happy to announce it's made it's way through the committees and has been accepted by the IETF . It's the result of about 2 years of (non-contiguous) idle thought, bouncing ideas off people, and editing. But what is it about?! Well, as the internet has grown the concept of a LAN changed from the original concept of a Local Area Network where…
I got some bleed-through badges at a client the other month. I was curious to see if I could somehow prevent the bleed-through , and you absolutely can.
A few weeks ago NYU Polytechnic held the final round of their Capture the Flag . Marcin previously wrote about his challenge for the qualification round . We both wrote challenges for the final round, and my challenge was primarily based around steganographic tricks with file formats, surrounded by some simple cryptography. Introduction The first things you received were a bat script and a…
There's a million and one explanations of how RSA Encryption works, but significantly fewer on ElGamal - which is used more often these days (at least, based on the default key selection in gnupg). I tried my hand at explaining it from near-first principles. I don't expect you to know any group theory, so I cover that, but you should know what modulo and asymmetric cryptography are. Here's my…
I wrote a bugtraq post about the Microsoft ClickOnce Installer/Updater system, and how it's relatively easy to strip away code signing and man-in-the-middle an update and inject your malicious code. Here's the writeup.