Predictable RNG
Luciano Bello and Maximiliano Bertacchini details dEF CON 16 - Luciano Bello & Maximiliano Bertacchini: Predictable RNG in the vulnerable Debian OpenSSL package, the What and the How.
Summary
Architecture and Background
DEF CON 16 - Luciano Bello & Maximiliano Bertacchini: Predictable RNG in the vulnerable Debian OpenSSL package, the What and the How. Recently, the Debian project announced an OpenSSL package vulnerability which they had been distributing for the last two years.
Vulnerability Analysis
This bug makes the PRNG predictable, affecting the keys generated by openssl and every other system that uses libssl (eg. openssh, openvpn).
Exploitation and Demonstrations
We will talk about this bug, its discovery and publication, its consequences, and exploitation. As well, we will demonstrate some exploitation tools.
Remediation and Defensive Strategies
Luciano Bello is an Engineer (Information Systems) and works as a researcher at CITEFA's Si6 Information Security Labs in Buenos Aires, Argentina. He has been a Debian Developer since 2007. Maximiliano Bertacchini is a PhD student in Computer Engineering at ITBA (Technological Institute of Buenos Aires). He is a researcher at CITEFA's Si6 Information Security Labs in Buenos Aires, Argentina. For copies of the slides and additional materials please see the DEF CON 16 Archive here:
Related talks
Main Stage·1 hr 54 min
Workshop
Workshop details workshop: Davix Workshop Need help understanding your gigabytes of application logs or network captures.
Main Stage·41 min
Weasel
Weasel details weasel: Compliance: The Enterprise Vulnerability Roadmap Compliance is no longer new.
Main Stage·48 min
Valsmith · Colin Ames
Valsmith and Colin Ames explores metapost-exploitation at DEF CON 16, examining emergency-systems and practical defenses.