Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2457 Thanks!
[Music]
um a lot of you probably use subbi keys
for the two Factor authentification
right uh well I have bad news for you
it's not as secure as you might
think what the [ __ ]
right um our next speaker
Serge will show how he could exploit the
system and cause a lot of headaches at
the Federal Agency for information
security in Germany please give a warm
welcome to
[Applause]
Z hello welcome everybody so nice to see
many people in this hit um
struggling um so uh the talk is going to
be about a solution uh it's called Uh
defa 2 for whatever reason um so the
outline of the talk is more or less uh
just a few words about Universal uh
second Factor how the solutions work and
what's the idea behind it uh then what
is um a the facto uh
solution just a few words about
certification I'm not an expert on it at
all but just to understand why uh this
attack is relevant we'll have to look at
it and uh talk about Java cards how they
work uh what kind of weird stuff uh can
happen there and finally about the
actual vulnerability uh which I found in
under 30 minutes looking at the source
code so this talk will take longer than
find an actual issue in the
code uh so uh Universal second Factor um
uh authenticator so the idea is to move
from passwords only and you have a
dedicated device just like UB key
there's many other Solutions as well UB
ke probably the most popular one um and
it protects you from fishing it protects
you from uh some uh uh types of malware
and the idea is you have a separate
device it has a key inside and
cryptographically signed challenges from
the remote server sent to the device and
back to the uh backand so they can
authenticate that not only your password
is correct but that also the device
signed this um action so there are bunch
of different solutions as I mentioned uh
you can see here um quite a few of them
uh they can look different but the idea
is very similar behind
them um so what is uh def facto uh one
day I was just um going through Twitter
uh stuff and I've seen a bunch of
popular uh Java card projects on GitHub
you see maybe not that popular 16 stars
but uh something and uh I've done quite
a bit of java card research I was kind
of interested to take a look at it just
for no reason it was my hobby uh project
um annulated to work but um when I
opened it it was uh kind of interesting
because I didn't first uh time paid
attention to who is the owner of this
rapper but I just looked at the code
start to scroll through I've seen there
is a cc folder which stands for common
criteria and uh turns out it is actual
official repository of um Bureau of
informatics of
Germany and uh I Googled a little bit
what this solution is is it like uh um
some test rep or something and turns out
they advertise it as one of the
solutions which can possibly help you to
protect your passwords so I thought uh
can be nice to take a look at it and uh
interestingly enough unlike many other
uh repositories on GitHub this one has
some um certificates next to it and not
often you see that um so this one is a
common criteria certificate for this
particular uh product they released it
all in GitHub some documentation and all
the code which is normally not the case
for any certified product and we'll see
why later just for from certification
points and they have this nice
certificat which says that uh BSI has
the uh certified uh Pho product so I
thought it's nice uh to take a look at
it I've read the readme it says uh that
this is not an actual product that want
to release not something they're going
to sell to anybody they're not in the
market of making tools but this is more
like a reference implement just for
other people to be inspired to show how
it can be done and also how the
certification of such a solution can be
done so what is CC certification common
criteria certification um and it's
especially fun to present it here at CCC
because um yeah it's very formal for
such an informal group of people but uh
it is um the idea is quite simple you
the vendor wants to certify it for
whatever reasons sometimes it's Market
requirements sometimes it just for
marketing purposes or any other reason
they have some kind of uh Target device
they design the way it should be use the
user guidance uh they Define the scope
and they say this sort of attacker want
to protect against and these are our
security features the
sfrs they go to independent lab and say
hey we have this product can you uh
verify that it works the way we are
State and it works and there's various
testing um not necessarily only
technical there's also of documentation
review and stuff and finally the lab
presents the results to certifier and
they say you get this certificate and U
the job is done there's also different
levels it's starting from uh 1 to 7 so
there's quite a bit of uh uh difference
there um most of um Solutions like your
payment cards they are level five and
that apparently enough to make sure that
your bank card is secure against um all
kind of attackers
so going back to the uh repository there
is a security Target document it has all
kind of uh the actual security features
which this product has and one of them
is user presence and this is also in the
standard for Pho user presence uh
ensures that the user of the fter token
actually physically approves a
transaction so it cannot be done by
software it has to be user just pushing
the
button or doing some action which
physically ensures that this is done and
if we go back to the picture if you
possibly can see it there's red circles
every single solution I found has a
button on it even this tiny one on the
right uh top it's a capacitive uh sensor
which just uh reads the user button
push if you've seen smart card before
usually smart cards don't have buttons
and that's a bit of a problem because
you have one user physically approve the
action but there is nothing to push on a
smart card there are some solutions
which have normally they don't have
buttons so how did they do it there is
some code which nobody will be able to
read so I'll try to uh tell you a little
bit um it is Java card code it is
similar to Java it's a subset not all of
the things are fully there but um there
is one interesting feature uh of java
card code so normally all your stuff all
your variables are in Flash they are
persistent and if you want to have u a
volatile uh memory use uh like variable
in Ram you make an array you call a API
to make Trent array that's the second
part in the code and this variable here
is called scratch persistent so what
they do is they have an array of one uh
BTE which initially when you boot up the
card the value is initial 8 to Z and
it's in Ram so when the card is powered
and uh it runs the value starts with
zero and when they execute any sensitive
transaction if you can possibly read in
the bottom one when it goes through the
sensitive uh path uh for example you
want to sign a transaction then or uh
enroll the new uh website then the value
is set to one and when they set the
value to one it never goes
programmatically to zero so you have to
power off the card and power it on again
so the idea is the user would have a
smart card reader they have a card uh
which has the solution on it you
physically every time have to plug in
the card in the reader when you sign and
if you want to sign again you pull it
out pull it back in in the reader and
that's how you physically show that it's
uh you're proving the transaction so
just to replace the button and this is
done with a bit of magic from java card
so so far so good the cycle how it
should work more or less like this so
you have you plug in the card you're in
this state when user presence is zero
that's the default value and then you
execute any sensitive operation the code
sets it to one you stay in one and you
have to pull the card out pull it back
in and then it goes back to zero because
the ram is reset because you power down
so all of this Mak sense um I guess if
you uh don't look too much into Java
card standard unfortunately I've made
too many wrong decisions to spend a lot
of days reading it so at that moment I
already thought something is wrong um so
I made a little
demo um let me see if it
works
so anything's
happening oh
no okay
now okay so this is a of application I
made a different script in initially
just for testing uh then I made a go
application for this time hoping that I
can show it on the screen so it's quite
simple it's like what kind of
application basically would do it so you
have a open uh smart card uh button just
to connect to the card in the uh back
you can see there's uh it sends data to
the card and it checks uh user presence
here and it just shows for us and we can
do sign and it signs the transaction the
value goes to one user presence is zero
Z now and uh when you pull out the card
now in a second uh oh no first I try to
sign again and it's denied because the
value is
zero and um when I will pull a card in a
second yeah there's an exception which I
didn't handle but then user presence
goes back to one and that's how it works
so I just tested it with my card I
didn't have the same one as BSI because
they certified through a specific
product but I didn't really care about
that because I wanted to take a look at
uh the standard and it is already quite
interesting so this is one of the field
which defines how
you uh create this trench and bite array
this variable in Ram and the flag you
give it to it is clear on reset and you
can see here at the end it says the
value uh is reset or the the value is
cleared on reset or power on so there's
already two possible States it's not
necessarily uh when you plug in the card
out or in but if we can somehow
programmatically reset the card we can
achieve the same behavior so that's what
I started to test uh right away and you
can see here it's already an interesting
behavior when I just opened the smart
card just connect to it over the driver
the LED on the bottom changes so when
it's open it is a solid green and uh
when it's closed it's
blinking so only programm ially just
opening the driver already has effects
on the reader so I was wondering uh what
about the card is the part card going to
be powered as well uh every time we open
and close driver or not and that is
quite simple so smart card has only
eight pads not even all of them I used
and what I care is a VCC I just need to
check uh the power on one of the lines
when I open the driver uh
programmatically and close and uh that
was my dam test doesn't matter
uh yeah and that's the line so you can
see here first I it's the VCC line the
power of the smart card uh first when I
open it uh it goes up then when I close
and open again it goes down again and up
and when I close the whole application
it goes fully down so the power is
controlled programmatically from our
it's my python script but can be
anything your browser eventually is
going to use the driver as well so every
time you connect to the driver it will
power the card and when you disconnect
it will power down and now the problem
is that the life cycle which they expect
it to be two simple circles is a bit
different so now we can as well just
plug in the card and improve transaction
by um removing and putting the card back
in or we can just programmatically open
and close device and it achieves exactly
the same uh result as you can see here
with the same application I uh sign I
close the device I open I don't even
touch the reader the present changes to
one and I sign again and I can
infinitely sign as many transactions as
I
want and as you remember it maybe not uh
doesn't look like a big deal but uh for
this sort of products when you certify
and you say this is your security
feature and if say user presence has to
be physically uh protected uh with the
implementation it is um not exactly the
way it's supposed to be so how these
attacks are so normally for your uh web
vulnerabilities or anything else you
have CVS score so here you have Gill
rating it's kind of the same idea but a
bit different so you just count what
kind of equipment the attacker needs to
identify the uh vulnerability and what
they need to exploit it how much time
they need what kind of expertise uh and
so on and eventually you want to reach
some nice number which is uh secure
enough and if it's lower than that it is
uh fail in the test pretty
much so uh it took me less than an hour
to find the issue so you can see here um
identification uh uh time is less than
one day so it's zero points and
altogether all of them end up to be nine
and this is very low for an attack like
uh there should be no such an attack
which is possible to execute on one of
the features in this time so I reported
all this uh to BS
through their disclosure program um they
facilitate disclosure to third parties
and they also handle this case uh very
nicely or quick to respond and um they
issu the fix and uh this is the best
part of Open Source which I like a lot
when I report vulnerabilities to vendors
when it's open source it's nice to see
also the effects of uh what you've done
what uh how they uh fix the
vulnerability um so you can see here uh
that's the as far as I remember remember
the security Target it was talking about
user presence this is one of the changes
in the document it was saying that uh
before proof of presence means that u a
button of physically placing the token
to the NFC Reader U enables user
presence with a fix it says um that the
card cannot really detect that and um so
the user must keep his system secure
that the host PC or the smartphone is
free of malware and Under full control
of that
user um and they issue this
[Music]
document the title is Assurance
continuity maintenance
report and um in there there is um
pretty much also part of the process
that what happens to every vendor if
somebody found an issue in their
certified product and they want to keep
their certification they have to assess
the risk figure out what they do with it
uh address it and it says here the
vendor of uh the def facto uh
authentication appli BSI submitted
impact analysis report to BSI for
approval and um so on and finally the
certified product did not change the
security T Target was editorially
updated so um that was the fix um maybe
not what I expect to be honest but
um this is part of the deal I guess um
the conclusions my talk was very fast
surprisingly um the conclusions are
simple there are still no buttons on the
smart card so unless you have a special
dedicated Hardware there is no easy
trick you can use to implement a button
as far as I know in the initial note uh
BSI had um in the readmy of the whole
project at the end they were saying that
they want to inspire other people to do
certification projects but it might uh
prove the process to be a tough
Challenge and I think it was proven to
be exactly that it's not easy to make
something secure and especially when it
has to be to the very high level and uh
the last one um I really enjoyed that
they released it because there is so
little projects you can see certified
and uh public and so many of them
probably still also have issues but just
never known to public and it is nice
that they released it and then we can
take a look at it and see what kind of
issues they also have and how they can
be uh possibly handled so it's really
nice to have it open source and to find
issues in open source and I enjoyed it
myself a lot and hope you enjoyed this
talk and if you have questions we have a
lot of
[Applause]
[Music]
time thank you very much Sergey um yes
indeed we have a lot of time for
questions
um I see one over there
here one with the white shirt number
one thank you thank you for the talk in
the previous slide did I read it correct
that the fender asked the BSI for
approval who is the fender again uh from
what I read vendor uh and from the
certificate itself it says vendor is BSI
that day they developed it and uh okay
so the BSI submitted to the BSI for
approval it seems to be the case
glorious thank
you another question to people over
yes you need to press okay do you think
uh since you're an expert on Java card
is there a technical solution to this uh
problem that they found that you found
uh um for example store the user
presence in Flash instead of in Trans in
memory no uh well that's why when I
started to look at it initially I
thought it's in Flash but then I just
misunderstood how it works the thing is
if you keep an in Flash then you still
need to somehow detect the act of the
card being disconnected and there is no
way for the card to distinguish it and
this is the only possible source of
physical action for the card like there
is nothing else you can physically do to
a card which it can detect so whatever
you do you cannot really indicate to the
card you are uh pulling it out of the
reader without just checking if it's
powered or not so I don't think there is
any other way there are some solutions
with buttons they maybe have multip not
just a secure element but external MCU
in one package and everything but uh for
normal smart cards like this it just the
reader and uh plastic maybe also NFC uh
antenna but that's it like so there's no
actual way I can see myself okay thank
you any more
questions yes
Spector you hi thank you for the talk um
so it seems like the solution they
propose is that the user system has to
be free of malware which means that the
vendor must make sure that the user
system is free of malware which sounds
like they need to rely on some form of
trusted Computing so everyone who's
running a free operating Sy will be
out um yeah so one of the things for the
products is that there is the product
itself and all the rest so of course
when certified product cannot uh expect
to you know for the system to be uh
anything in particular but
um yeah it's uh hard to say how it can
be enforced technically but it's also
certification to be big part of it is
somewhat like insurance so it's not
necessarily always solve the issue but
it just somehow puts the boundaries on
things so they don't necessarily always
make technical sense fully but it just
the way it plays out for if it's a good
thing or not I'm not I don't know but uh
that's the way it
works all right next question yes hello
um what would be the typical attack so
someone leaves a card on the reader and
then you have some malware which just
glitches the driver and then you can
sign anything without that the user
presented it
or yeah yeah so it would look something
like this uh the idea is it should not
be possible remotely for any software or
uh even Hardware given this rating for
the uh certification level like a lot of
things can be scoped like even your
reader cannot be fully trusted because
you just bought something from eBay uh
from China and then you can you really
trust the trader of course it's
difficult to imagine the attack for that
case but uh even those things cannot
always be uh considered um benevolent
but um yes so it would be something like
this you have your card plugged in you
just didn't remove it right away even if
you do like it's going to be microsc for
to do execute multiple uh transactions
so for user there is no physical way to
just really put the card in sign your
transaction pull it out very quickly so
no other malware can sign another uh
action so uh it's indeed something like
that um I've uh read something about
smart cards with a fingerprint reader on
it uh have you experience with that yeah
they also exist um and it would be uh
possibly uh one of the ways so the thing
is when the product is certified here
somewhere in the slide if we go all the
way
back yeah you cannot possibly see that
but uh I can tell you there is um in the
certificate it Al also States the
operating system on which this applet
runs so the applet is just the software
and they got another certified smart
card platform like the actual physical
hardware and for this particular
platform it only works so it cannot work
on any random piece of Hardware like
technically this is of course not
certified because I run my applet on it
because this is a different platform but
um uh the point is uh they could use
some other solution but maybe for the
reason of price or just complexity of
the solution it becomes uh more
difficult that's why they didn't use
it all right one more question there in
the
back is it on is it too far
away no it's
not
Okay this may be slightly off topic but
how did you dump the Java software from
the card to reverse it uh I did not uh
it is all open source in the repository
you can still see this they put the
whole applet they put all the documents
uh and stuff so all of it was open
source as they wanted to make it
reference implementation it makes sense
to release it of
course yeah if you would have to dump it
it's a non tral task at all and they
never released it as a solution so it
was just a reference
implementation all right any more
questions yes here uh right in the
middle with a light blue
shirt
[Music]
so I am
not I am no expert in Smart Cuts but
wouldn't you typically also need some
kind of pin to use the material on the
card with u Keys which also act like
smart cards you need a
PIN uh this solution does not have the p
as far as I remember uh I would need to
check the code as well but uh as far as
I remember not it's not needed
thank all right there's one in front
here in the black
shirt hi do you know of any actual
wender who has used some something
similar to this technique uh to uh
actually build and and sell uh
Universal two Factor U two Factor uh
smart cards is there anything on the
market or is it just just this reference
implementation yeah I I see one fork I
wonder if it's from UB uh no uh I don't
know to be honest I doubt somebody used
it uh it was released three years ago I
think um but uh I don't think it was
used in production similar idea was some
companies tried to use
for uh blockchain wet so they thought
about using smart cards but there's
similar problem you don't have a button
you don't have a screen you don't really
want to use it as a trusted device fully
because you want to really see what
you're
signing all right um yeah I'll take it
as a last question now that one the
white shirt black mask in the
back so is this
on appication uh of the
doesn't Force the vendor to at all
adhere to the original thing that was
certified so basically
they the LD is
on okay um they basically changed the
original product by specifying that you
can't rely on it for the security
anymore and uh just like that they keep
the certification
don't they have to like notify their
customers or
anything yeah well for this one is
particularly difficult because it's not
like they have any customers from uh
what I can imagine but uh you can see
there is uh an official document for
that reason so it's not just changing
the product you cannot just update your
uh software like fixing bugs becomes a
problem when your product is certified
because you know it's an issue but the
moment you change the code it's not the
same solution so it's not necessarily
certified but uh this is an official
document the Assurance continuity
maintenance report which addresses the
issue um yeah but how IT addresses is a
different
question all right thank you very much
everyone let's give it up for SE
again thank you for being here stay
hydrated and have a nice
camp
[Music]