WhiteHat Security Blog

Backstory:

You probably don't care about this much if you don't pay attention the market for security services.

WhiteHat is a well-known VC-funded enterprise appsec company. They sell a SAAS web security scanner. Their founder and now CEO is Jeremiah Grossman, a pretty well-known web security guy.

A year or so ago? WhiteHat released "Aviator", a "secure browser". Aviator, as it turns out, is rebranded Chromium. Chromium is an open-source project, of course. Aviator is (at the time) not.

Fast forward a year. The Aviator browser product has fizzled, like most new products do. WhiteHat executes the "open source the project and make like that's an outcome we are happy about" play, using language which --- corroborated a bit by this post --- signals that the project has been abandoned.

Several hours later, Google star vulnerability researcher Tavis Ormandy tweets(!) an embarrassing drive-by RCE in Aviator.

Hours after that, Justin Schuh from the Chromium security team posts what can best be described as thermonuclear schadenfreude† to his Google+ feed (if you're not a vulnerability researcher, you should know that there are major points for style awarded to a meaningful critique of the branding code in a target).

In response to all this, Robert Hanson (a very well-known web security guy employed by WhiteHat) writes what I would call an ill-advised and transparently prickly response on WhiteHat's blog††, suggesting that WhiteHat has been victimized by their underdog…

Tor hidden services are not bulletproof. Just as a really simple example, you can do network traffic analysis to find network nodes with one-way traffic to hosts without a correlated public service and deduce if a hidden service is nearby.

There are several exploits which have been used in the past to expose Tor hidden services, and several papers on theoretical ways to expose them. Many of these attacks can be used in reverse to expose the origin of a connection to a hidden service.

In the [not so] extreme case, the govt can always issue a National Security Letter to WaPo and scoop up any data it wants directly from the hidden service servers, similar to its Silk Road and Freedom Hosting takedowns.

The FBI TOR Exploit [ http://resources.infosecinstitute.com/fbi-tor-exploit/ ]

Heartbleed used to reveal Tor hidden services [ https://blog.torproject.org/blog/openssl-bug-cve-2014-0160/ ]

Hot or Not: Revealing hidden services by their clock skew [ http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf ]

Tor Hidden Service Passive De-Cloaking [ http://blog.whitehatsec.com/tor-hidden-service-passive-de-cloaking/ ]

Here's another post that discusses the same technique - extension attacks on SHA-1-signed messages. https://blog.whitehatsec.com/hash-length-extension-attacks/

The idea is that if a message is being signed using SHA-1 to prevent tampering from the user side, given an existing message/SHA-1 hash combo and the length of the secret key (which you can guess after a few trials), its possible to craft arbitrary messages and sign them without obtaining the secret key.

This came up while I was doing the Stripe CTF 2.0, and I thought it was an interesting read.

I haven't had time to explore this, yet, but I suspect this change has broken my use of a Firefox extension.

In turn, I've wondered whether it would be acceptable to change the value to "SAMEORIGIN", which I believe would fix my use case.

https://developer.mozilla.org/en-US/docs/The_X-FRAME-OPTIONS_response_header

https://blog.whitehatsec.com/x-frame-options/

Here are links to part 1 and 2 for anyone unable to "hack" the URL scheme. ;)

http://blog.whitehatsec.com/interview-with-a-blackhat-part-1/

(pastebin if it goes down: http://pastebin.com/jiUM0AFr)

http://blog.whitehatsec.com/interview-with-a-blackhat-part-2/

(pastebin if it goes down: http://pastebin.com/SAKS2CTW)