Checksums are not secure

One day I stumbled upon a web app testing environment that used client side Javascript to perform authentication.

It was very simple to break into because it hashed the password using a very simple checksum algorithm.

I created this presentation to share my thoughts on what I found.

Transcript

1. Checksum != Security An example hacking into bad Javascript authentication
2. What’s so Bad? The Enemy Breaking Bad Closing Found in the wild: a web app testing environment
3. function  promptUserForPassword(pass)  {      if  (jesChecksum(pass)  !=  9887)  {          pass  =  prompt("Please  enter  the  passkey","");          if  (pass  ==  null)  {              document.location.href  =  defaultHref;          }  else  {              verifyPassword(pass);          }      }  else  {          successfulLogin(pass);      }   }   What’s so Bad? The Enemy Breaking Bad Closing
4. function  jesChecksum(str)  {      var  primes  =  [  2,  3,  5,  7,11,                                  13,17,19,23,29,                                  31,37,41,43,47,                                  53,59,61,67,71,                                  73,79,83,89,97];      var  rtn  =  0;      for  (i  =  0;  i  <  (str.length);  i++)  {          tmp  =  str.charCodeAt(i)  *  primes[i];          rtn  =  rtn  +  tmp;      }      return  rtn;   } What’s so Bad? The Enemy Breaking Bad Closing
5. What’s so Bad? The Enemy Breaking Bad Closing A hash function is any function that can be used to map digital data of any size to digital data of a fixed size.
6. “checksums are often used to verify data integrity, but should not be relied upon to also verify data authenticity" What’s so Bad? The Enemy Breaking Bad Closing
7. “It is infeasible to find two different messages with the same [cryptographic] hash” What’s so Bad? The Enemy Breaking Bad Closing
8. It should be feasible to find two different messages with the same checksum. What’s so Bad? The Enemy Breaking Bad Closing
9. What’s so Bad? The Enemy Breaking Bad Closing jesChecksum(pass)  ==  9887 Find “pass” such that
10. function  jesChecksum(str)  {      …      for  (i  =  0;  i  <  (str.length);  i++)  {          tmp  =  str.charCodeAt(i)  *  primes[i];          rtn  =  rtn  +  tmp;      }      …   } The simplicity of this algorithm makes it very easy to solve. What’s so Bad? The Enemy Breaking Bad Closing
11. Thanks to Unicode: Solve 2x + 3y = 9887 over integers One such solution is “Ŏఁ” Ŏఁ = String.fromCharCode(334, 3073); What’s so Bad? The Enemy Breaking Bad Closing
12. Using the right tool for the job requires you to understand the tools available What’s so Bad? The Enemy Breaking Bad Closing
13. Don’t roll your own security either What’s so Bad? The Enemy Breaking Bad Closing
14. And definitely don’t do security client side in Javascript What’s so Bad? The Enemy Breaking Bad Closing
15. Thanks Justin Mancinelli @piannaf http://piannaf.github.io https://www.linkedin.com/in/justinmancinelli
16. Slide 5: http://en.wikipedia.org/wiki/Hash_function Slide 6: http://en.wikipedia.org/wiki/Checksum Slide 7: http://en.wikipedia.org/wiki/Cryptographic_hash_function Slide 8: http://blog.codinghorror.com/checksums-and-hashes/ Slide 13: http://xkcd.com/1286/ http://www.explainxkcd.com/wiki/index.php/Encryptic