Flame crypto attack was very hard to pull off, security researcher says

The MD5 collision attack carried out by Flame's authors took more attempts to pull off than the RapidSSL one in 2008

The MD5 collision attack used by the creators of the Flame malware was significantly more difficult to pull off than an earlier attack that resulted in the creation of a rogue CA certificate, according to security researcher Alexander Sotirov.

In December 2008, at the Chaos Communication Congress (CCC) in Berlin, an international team of security researchers that included Sotirov presented a practical MD5 collision attack that allowed them to obtain a rogue CA certificate signed by VeriSign-owned RapidSSL.

The attack was significant because it showed for the first time that at least one of the known theoretical MD5 collision techniques could be used in practice to defeat the security of the HTTPS (HTTP Secure) protocol. To pull off the attack, the researchers used computing power generated by a cluster of 200 PlayStation 3s.

The creators of the Flame cyber-espionage malware used a similar attack to obtain a rogue digital certificate that allowed them to sign code as Microsoft. The certificate was used to distribute Flame to targeted computers as an official Windows update.

Last week, cryptanalysts announced that the MD5 collision attack used by Flame's creators was not identical to the RapidSSL one, which has been fully documented since 2009. Rather, the Flame attack uses a different method that might have been developed in parallel.

While this is an impressive achievement in itself, it turns out that the Flame attack was also significantly more difficult to pull off than the RapidSSL one.

The RapidSSL attackers had a one-second window to obtain a legitimate certificate with a serial number they predicted in advance and whose signature could be copied over to their rogue certificate. It took several attempts to time this right, and after each failed attempt they had to generate a new rogue certificate, which took several hours.

The Flame attackers had only a one-millisecond window to obtain the right certificate signed by Microsoft, said Sotirov, co-founder and chief scientist at security firm Trail of Bits, in a presentation at the SummerCon conference on Saturday. That means they probably needed a far greater number of attempts to succeed.

The RapidSSL attack would have cost around US$20,000 if it had been performed on Amazon's EC2 cloud. The Flame attack would have cost between 10 and 100 times more, Sotirov said.

"[Sotirov's] analysis on the time window seems to be correct and is excellent research," said Marc Stevens, a scientific staff member in the cryptology group at the Dutch national research center for mathematics and computer science (CWI), via email.

"This would significantly increase the overall cost and I agree with that assessment," said Stevens, another member of the team that performed the RapidSSL attack in 2008.

However, Stevens didn't agree with Sotirov's estimate for the theoretical cost of using Amazon's cloud for the attack. That's because there's currently not enough information about the MD5 collision method used in the Flame attack.

Sotirov assumes the attack had a similar cost-per-attempt as the RapidSSL one, Stevens said. However, the Flame attackers might have used a method that was faster, or one that was slower.

He expects they used a slower method, but that's still being researched and the findings won't be released until later.

The Flame attackers might also have had free access to powerful computer hardware, which would have significantly reduced the time required to perform the attack.

"More powerful hardware reduces the wall clock time," Stevens said. "The collision attack is highly parallelizable and a big cluster can be used very efficiently."

Comments

Comments are now closed

 
Computerworld
CIO
Techworld
CMO

Latest News

03:09PM
CoinJar’s bitcoin EFTPOS card to hit the market next week
02:52PM
Queensland Government appoints Interactive Intelligence to ICT Service Panel
02:19PM
More than 200 Aussie Apple fanatics hire minions to stand in line for iPhone 6
12:59PM
Former Microsoft exec named CEO of Australian bar tab start-up
More News
18 Sep
National Data Centre Roadshow - Canberra
18 Sep
How the shift to subscription-based licensing is introducing new risks that ever...
29 Sep
Vendor and Supplier Management Workshop
30 Oct
Ovum 2020 Telecoms Summit
View all events