Slashdot Mirror
Weak Apple PRNG Threatens iOS Exploit Mitigations
Trailrunner7 writes "A revamped early random number generator in iOS 7 is weaker than its vulnerable predecessor and generates predictable outcomes. A researcher today at CanSecWest said an attacker could brute force the Early Random PRNG used by Apple in its mobile operating system to bypass a number of kernel exploit mitigations native to iOS. 'The Early Random PRNG in iOS 7 is surprisingly weak,' said Tarjei Mandt senior security researcher at Azimuth Security. 'The one in iOS 6 is better because this one is deterministic and trivial to brute force.' The Early Random PRNG is important to securing the mitigations used by the iOS kernel. 'All the mitigations deployed by the iOS kernel essentially depend on the robustness of the Early Random PRNG,' Mandt said. 'It must provide sufficient entropy and non-predictable output.'"
The SSL "flaw" was too public, so they introduced a new flaw, and I am sure more than one.
"If any question why we died, Tell them because our fathers lied."
Why don't we decide on a handful of strong PRNGs, and make every major OS use them exclusively, and in the case you really need something fast/psuedo-random you have to use a source/API explicitly named "insecure_rng".
That's both Android and iOS fallen victim to poor PRNGs in the last year..
So "this one is deterministic" seems like a weak complaint.
This is essentially what makes them PRNGs instead of RNGs.
http://lkml.org/lkml/2005/8/20/95
..on a smart phone like the iPhone. Use the gyros/accelerometers, make the user draw randomly on the screen, maybe use random info like wifi network names currently available, generate random info based on images on the phone, etc. etc. Plenty of data/means available to create the entropy needed.
"Mandt said he did not disclose the issue to Apple"
We really need to stop paying people — directly or indirectly — for irresponsible disclosure.
Please could you repeat some of the statements a few more times in the writeup. Focus especially on "mitigations" - you can never write that word too many times.
Tarjei Mandt really hates Jonny Ives' new flat icons. Note that "iOS6 was teh better!" comment?
#DeleteChrome
Wow, that'll be a great session title for the next BlackHat conference.
The only thing surprising about this is that people are still surprised. Leak after leak has confirmed that encryption products from "all major vendors" have been deliberately compromised.
Now, was this a gift to the NSA, or to the Jailbreakers?
"Flyin' in just a sweet place,
Never been known to fail..."
Apple didn't want another security embarrassment so they asked the NSA to supply the most secure PRNG they had.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
So while the tin-foil-hatters were all pointing their fingers at Intel, who provide a full cascade RNG that isn't weak, doesn't have a back door and has stood up to scrutiny, they weren't paying attention to the OS vendors who were getting it wrong despite the hardware available to them.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
The article incoherently addresses entropy extraction, not matters of PRNGs but the author doesn't appear to understand the difference.
However the 'issue' is still an issue. Predictable output is bad in this context.
What amazes me is when designers flap around looking for 'random looking' things in memory and interrupts to munch together to get entropic numbers when it's in a phone with a radio next to it which as directly sampling noise and is entirely capable of making it available to the OS for used in seeding PRNGs.
It's not just Apple. They all do it.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
... yet fail to properly prime the PRNG? At some point you have to ask how it's even possible.
The A7 has a hardware random number generator in the Secure Enclave, This isn't used where available?
Why does the boot process require random numbers, anyway?
They mention this in the article - one way to make a kernel harder to write an exploit for is to randomize the layout of memory somewhat, so system libraries, kernel tables, and the like are located in different places. Obviously if the "random" numbers are predictable, this makes those mitigation techniques less-useful.
Obviously, this researcher is holding it wrong.
Also, as was noted before,
Hoodoos. Thought the matrix was full of mambos 'n' shit.
But, sadly, Occam's razor leads us to believe this is the NSA. Or Chinese. Or Israelis.
Or garden-variety laziness & incompetence.
I didn't see that in the article. Can you point it out? (Seriously if this is true, I really want to know.)
The basis of Mandt's argument is that Apple used a Linear Congruent Generator to eliminate the time-based correlation issues from iOS6's use of the Mach's absolute time values. The LCG is based on information from four sources with 13 bits of output (the 3 LSB dropped). Because the outputs are subject to having repeated outputs over a period of time there is a chance that brute force method could be used to determine the PRNG output.
He didn't demonstrate that having four sources for the values were insufficient to mitigate the sequential correlation of each individual source.
Whats this "early" mean?
Some drink at the fountain of knowledge. Others just gargle.
"Yes, our PRNG is weak. The next one we replace it with will also be weak. We can not talk about why. Draw your own conclusions."
Why don't these security researchers ever actually demonstrate the exploit they're talking about?
....but we never see that. We just hear about these hypothetical scenarios that create a lot of FUD and noise and a lot of scrambling from vendors and customers over nothing.
Seems to me that there are all these stories of late about how 'flaw X' *could* be used to do 'bad thing y."
Why don't these clever researchers rarely if ever demonstrate the flaw in use, in a reproducible way?
"I will now demonstrate using the faulty random number generator to attack the kernel and I will do this Really Bad Thing."
Not sure if the troll mod comes from my blind trust in Apple written in the form of a joke, or from my own oversized Android display size and stupid model number signature troll.
Get free satoshi (Bitcoin) and Dogecoins
Take a shot from each camera, sample each microphone for a few milliseconds, Sample the gyros and accelerometers for a few milliseconds. Sample the current battery voltage/charge state, Salt in the current time/date and last known location, along with the various readable serial numbers, SHA each of these sources and fold them into each other and SHA the result, and you should be good to go.
Once the device is booted, it can do a lengthy and more sophisticated RNG to make a seed that will be folded into the above entropy sources on the next boot.
But it does sound like apple should put in a good hardware entropy source on their A8 (and future) chips. (One with no NSA/CSEC/GCHQ/KGB/FSB backdoors please!)
That can also be folded into the above sources (I think you would never want to rely on only one source of entropy, no matter how good or trusted.)
Ian Ameline
That was for fast secure hashes, and not for psuedorandom numbers. They aren't really the exact same thing, are they?
Take off every 'sig' !!
Let's say its the combination of the two.
I don't know what is more surprising, that people think computer are capable of generating numbers "randomly". Or "more entropy" (aka disorder) is something people actually wish upon their system.
When cryptographers say that a PRNG is deterministic (in a bad sense), they usually mean it violates one of the following rules (or similar):
1) It should be realistically impossible for an outsider to determine or guess all the values that constitute a seed.
2) No matter how much of the "random stream" an attacker has seen, they should not be able to realistically determine the next value in the stream (without all the sources of entropy throughout the process).
3) Given the initial seed, an attacker should not be able to determine the random value at a point in the future because that value should constantly be affected by both new "entropy" inputs including the number of times, size, and amount of random data previously requested.
The problem with the English is that they feel the need to tell you the whole history of the East India company just to get a nice hot cup of not-entirely-quite-unlike tea.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Why don't we decide on a handful of strong PRNGs, and make every major OS use them exclusively,
Maybe because if somebody then breaks one or more of THOSE they have a zero-day exploit for EVERYTHING.
While we're at it. why don't we standardize on an operating system, and version, and stop all this diversity? After all, if a committee comes up with a pick how can any individual or team invent anything better?
Genetic engineering is getting to the point that we can soon modify our children so they all have the same immune system - the best one we can find in the wild or tweak up. Why don't we do that too? After all, you'd NEVER see a disease mutate so it's fatal to everyone with that flavor of immune system, would you? B-/ (You know, like the corn blight that was fatal to the cytoplasmic male-sterile corn that was virtually all that was grown in the US in the early '70s, and nearly wiped out the crop for a year or two?)
Of course the REAL reason is because it's a FREE MARKET. Companies who's management thinks they have a better design for a random number generator get to deploy their own choice, and the customers get to decide whether they want to trust their data and critical processes to that OS or switch to some alternative (either immediately or after they pick up the pieces from the LAST set of exploits...)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
You have no idea what you're talking about.
http://dilbert.com/strips/comic/2001-10-25/