+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: DUHK Attack (Don't Use Hardcoded Keys) (/Thread-DUHK-Attack-Don-t-Use-Hardcoded-Keys)
DUHK Attack (Don't Use Hardcoded Keys) - S3xySmurf - 10-25-2017
DUHK (Don't Use Hard-coded Keys) is a vulnerability that affects devices using the ANSI X9.31 Random Number Generator (RNG) in conjunction with a hard-coded seed key. The ANSI X9.31 RNG is an algorithm that until recently was commonly used to generate cryptographic keys that secure VPN connections and web browsing sessions, preventing third parties from reading intercepted communications.
DUHK allows attackers to recover secret encryption keys from vulnerable implementations and decrypt and read communications passing over VPN connections or encrypted web sessions. The encrypted data could include sensitive business data, login credentials, credit card data and other confidential content.
The affected implementations were all historically compliant with FIPS, the Federal Information Processing Standards.
A device is vulnerable to DUHK if:
- It uses the X9.31 random number generator
- The seed key used by the generator is hard-coded into the implementation
- The output from the random number generator is directly used to generate cryptographic keys
- At least some of the random numbers before or after those used to make the keys are transmitted unencrypted. This is typically the case for SSL/TLS and IPsec.
News Source
Website
Technical Paper
CVE-2016-8492
RE: DUHK Attack (Don't Use Hardcoded Keys) - mothered - 10-25-2017
I'd assume that fully-encrypted communications (no leaks) are not susceptible to this vulnerability.
Really appreciate this. I've already hit Google and have10+ tabs open to perform an In depth research.
RE: DUHK Attack (Don't Use Hardcoded Keys) - S3xySmurf - 10-25-2017
(10-25-2017, 05:34 AM)mothered Wrote: I'd assume that fully-encrypted communications (no leaks) are not susceptible to this vulnerability.
Really appreciate this. I've already hit Google and have10+ tabs open to perform an In depth research.
By the looks of it yes, it's only this implementation which is vulnerable, this vulnerability is in regard to legacy software and the US NIST deprecated the algorithm in 2011, and scientists warned that the algorithm could be broken if the seed key ever leaked way back in 1998.
But as I'm sure most of you know sometimes leaving that old implementation of something on the network is still a common practice.
RE: DUHK Attack (Don't Use Hardcoded Keys) - mothered - 10-25-2017
(10-25-2017, 02:18 PM)S3xySmurf Wrote: But as I'm sure most of you know sometimes leaving that old implementation of something on the network is still a common practice.
I certainly agree.
I'm surprised at the number of corporations (even Fortune 500 companies), that do not update with the latest security measures.
RE: DUHK Attack (Don't Use Hardcoded Keys) - S3xySmurf - 10-25-2017
(10-25-2017, 08:38 PM)mothered Wrote:(10-25-2017, 02:18 PM)S3xySmurf Wrote: But as I'm sure most of you know sometimes leaving that old implementation of something on the network is still a common practice.
I certainly agree.
I'm surprised at the number of corporations (even Fortune 500 companies), that do not update with the latest security measures.
I think it's primarily cost as to why most companies don't do security upgrades either that or just laziness