PyConPL 2016 Keynote: Tales from Python Security

A history of Python security issues and security efforts, https://pl.pycon.org/2016/agenda.html

Resources:
Breaking RSA with a microphone https://www.tau.ac.il/~tromer/acoustic/
PKBDF2 performance https://jbp.io/2015/08/11/pbkdf2-performance-matters/

Transcript

1. Tales from Python Security PyConPl 2016 Keynote Christian Heimes christian@python.org / @ChristianHeimes Senior Software Engineer 2016-10-13
2. PyConPL 2016 2 Lots of first times!
3. PyConPL 2016 3 First time in Poland
4. PyConPL 2016 4 First keynote
5. PyConPL 2016 5 First year of talks in English
6. PyConPL 2016 6 Who am I • from Hamburg / Germany • Linux user since 1998 • Python developer since 2002 • Python core contributor since 2008
7. PyConPL 2016 7 Python • PEP 370: Per user site-packages directory • PEP 452: API for Cryptographic Hash Functions v2.0 • PEP 456: Secure and interchangeable hash algorithm • maintainer of ssl and hashlib modules • maintainer of Coverity Scan • Python Security Response Team (emeritus) • I put bytes and b'' into Python 2
8. PyConPL 2016 8 Professional Life • Senior Software Engineer with Red Hat • Security Engineering & Identity Management • FreeIPA IdM • Dogtag PKI • Custodia Secrets
9. PyConPL 2016 9 FreeIPA/IdM KDC LDAP PKI DNS CLI/UI
10. PyConPL 2016 10 Professionally paranoid Python programmer
11. Topics
12. PyConPL 2016 12 Topics • What does 'secure' mean? Why is it so hard? • Security efforts • Examples of CPython security issues • How to write secure software • from __future__ import ...
13. Hall Of Fame
14. PyConPL 2016 14 Python Security People • Alex Gaynor • Antoine Pitrou • Ashwini Oruganti • Benjamin Peterson • Cory Benfield • Gregory P. Smith • Hynek Schlawack • lvh • Paul Kehrer • Serhiy Storchaka • Victor Stinner
15. PyConPL 2016 15 Donald Stufft donate.pypi.io
16. Why is security relevant?
17. What can go wrong?
18. PyConPL 2016 18 Denial of Service (direct or indirect)
19. PyConPL 2016 19 bypass of authentication authorization access control
20. PyConPL 2016 20 data breach information disclosure
21. PyConPL 2016 21 code execution
22. PyConPL 2016 22 cryptography
23. Security is hard
24. PyConPL 2016 24 weakest link causes catastrophic failure
25. PyConPL 2016 25 untestable almost unprovable
26. PyConPL 2016 26 demo exploits are hard to write
27. PyConPL 2016 27 security fix = breaking backwards compatibility
28. PyConPL 2016 28 Different workflow for security fixes (issue tracker, reviews, testing, QA)
29. PyConPL 2016 29 crazy attack vectors side channel attacks
30. Python security efforts
31. PyConPL 2016 31 Motivation Culture Diversity
32. PyConPL 2016 32 Reviews • PEP process • design reviews • code reviews • commit reviews • Did I mention reviews?
33. PyConPL 2016 33 Collaboration • Upstream vendor security teams • Ruby and PHP security • Python Cryptography Authority (PyCA) • security people (Ryan Sleevi, DJB)
34. PyConPL 2016 34 Tools • multiple compilers and platforms • compiler warnings • clang code analysis • fuzzing • Coverity Scan
35. PyConPL 2016 35
36. PyConPL 2016 36
37. In the beginning...
38. PyConPL 2016 38
39. PyConPL 2016 39
40. PyConPL 2016 40
41. PyConPL 2016 41 XML <xml> <tag attribute=”value”>text</tag> </xml> <xml> <tag attribute=”value”>text</tag> </xml>
42. PyConPL 2016 42 XML entities <!DOCTYPE example [ <!ENTITY title "My title" > ]> <xml> <tag attribute=”value”>&title;</tag> </xml> <!DOCTYPE example [ <!ENTITY title "My title" > ]> <xml> <tag attribute=”value”>&title;</tag> </xml>
43. PyConPL 2016 43 XML entities expansion attack <!DOCTYPE xmlbomb [ <!ENTITY a "1234567890" > <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;"> <!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;"> <!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;"> ]> <bomb>&d;</bomb> <!DOCTYPE xmlbomb [ <!ENTITY a "1234567890" > <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;"> <!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;"> <!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;"> ]> <bomb>&d;</bomb>
44. PyConPL 2016 44 XML network / file access <!DOCTYPE external [ <!ENTITY remote SYSTEM "http://www.python.org/some.xml"> <!ENTITY local SYSTEM "file:///etc/passwd"> ]> <xml> <url>&remote;</file> <file>&local;</file> </xml> <!DOCTYPE external [ <!ENTITY remote SYSTEM "http://www.python.org/some.xml"> <!ENTITY local SYSTEM "file:///etc/passwd"> ]> <xml> <url>&remote;</file> <file>&local;</file> </xml>
45. PyConPL 2016 45 XML attacks • billion laughs / exponential entity expansion • quadratic blowup entity expansion • DTD & external entity expansion (remote and local) • attribute blowup / attribute hash collision attack • decompression bomb (gzip) • XPath injection attacks • XInclude <xi:include /> • XMLSchema-Import <xs:import /> • XSLT features wie xalan/redirect, xalan/java
46. PyConPL 2016 46 Defusing XML • defusedxml • defusedexpat YAML has some fancy features, too.
47. Reading and parsing data
48. PyConPL 2016 48 HTTP RFC822 header content-type: text/html; charset=utf-8 content-length: 47446 x-clacks-overhead: GNU Terry Pratchett <html> <head> ... content-type: text/html; charset=utf-8 content-length: 47446 x-clacks-overhead: GNU Terry Pratchett <html> <head> ...
49. PyConPL 2016 49 HTTP header parsing sock = create_connection(('host', 80)) f = sock.makefile() for line in f: name, value = line.split(':', 1) ... sock = create_connection(('host', 80)) f = sock.makefile() for line in f: name, value = line.split(':', 1) ...
50. PyConPL 2016 50 HTTP parsing (fixed) MAX_LENGTH = 1024 sock = create_connection((host, port)) f = sock.makefile() while True: line = f.readline(MAX_LENGTH + 1) if len(line) > MAX_LENGTH: raise ValueError ... MAX_LENGTH = 1024 sock = create_connection((host, port)) f = sock.makefile() while True: line = f.readline(MAX_LENGTH + 1) if len(line) > MAX_LENGTH: raise ValueError ...
51. PyConPL 2016 51 CVE-2013-1752 • Issue #16037 httplib (Adrien Kunysz) • Issue #16038 ftplib • Issue #16039 imaplib • Issue #16040 nntplib • Issue #16041 poplib • Issue #16042 smtplib
52. PyConPL 2016 52 Header injection http://127.0.0.1%0d%0aX-injected:%20header %0d%0ax-leftover:%20:12345/foo GET /foo HTTP/1.1 Host: 127.0.0.1 X-injected: header x-leftover: :12345 >>> socket.getaddrinfo( '127.0.0.1\r\n', 12345)[0][4] ('127.0.0.1', 12345) http://127.0.0.1%0d%0aX-injected:%20header %0d%0ax-leftover:%20:12345/foo GET /foo HTTP/1.1 Host: 127.0.0.1 X-injected: header x-leftover: :12345 >>> socket.getaddrinfo( '127.0.0.1\r\n', 12345)[0][4] ('127.0.0.1', 12345)
53. Hash collision attacks PEP 456
54. PyConPL 2016 54 Python's dict type • dicts are implemented as hash maps • average search and insert: O(1) • worst case: O(n)
55. PyConPL 2016 55 Hash map primer >>> hash('de') 12800076900115529 >>> hash('de') & (8 - 1) 1 >>> hash('de') 12800076900115529 >>> hash('de') & (8 - 1) 1 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 de
56. PyConPL 2016 56 Hash map primer (2) >>> hash('df') 6672104196504639850 >>> hash('df') & (8 - 1) 2 >>> hash('df') 6672104196504639850 >>> hash('df') & (8 - 1) 2 0 1 2 3 4 5 6 7 de df
57. PyConPL 2016 57 Hash collision >>> hash('cf') & (8 - 1) 1 >>> hash('bg') & (8 - 1) 1 >>> hash('cf') & (8 - 1) 1 >>> hash('bg') & (8 - 1) 1 0 1 2 3 4 5 6 7 de cf bg df
58. PyConPL 2016 58 PEP 456 SipHash24 • First attempt by Victor Stinner failed • Alternatives were slow and/or insecure • SipHash24 by Jean-Philippe Aumasson and Daniel J. Bernstein
59. ssl.match_hostname()
60. PyConPL 2016 60 TLS / SSL • encrypts communication • protects data integrity • prevents reply attacks • authenticate server with X.509 certificate
61. PyConPL 2016 61 TLS handshake 1) Client and server negotiate connection parameters. • protocol version • SSL 3, TLS 1.0, TLS 1.1, TLS 1.2 • cipher suit • TLS_RSA_WITH_AES_128_CBC_SHA • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 2) Client verifies server cert. 3) Client and server agree on a master secret.
62. PyConPL 2016 62 Hostnames in X.509 certificates Certificate: Data: Issuer: C=IL, O=StartCom Ltd., ... Validity Not Before: Feb 2 08:35:11 2015 GMT Not After : Feb 1 21:03:59 2017 GMT Subject: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, CN=*.python.org X509v3 extensions: X509v3 Subject Alternative Name: DNS:*.python.org, DNS:python.org Certificate: Data: Issuer: C=IL, O=StartCom Ltd., ... Validity Not Before: Feb 2 08:35:11 2015 GMT Not After : Feb 1 21:03:59 2017 GMT Subject: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, CN=*.python.org X509v3 extensions: X509v3 Subject Alternative Name: DNS:*.python.org, DNS:python.org
63. PyConPL 2016 63 Bug #0 No function to verify a hostname • ssl.match_hostname() added in Python 3.2 • backported to 2.7.9
64. PyConPL 2016 64 Bug #1 (Issue #12000) Use CN when subject alternative name field has no dNSName entries. • fixed in 3.3
65. PyConPL 2016 65 Bug #2 (CVE-2013-2099) Multiple wildcards cause Denial-of-Service • *.*.*.*.*.example.org • caused by regular expression engine • fixed in 3.3.3
66. PyConPL 2016 66 Bug #3 (Issue #17997) Use RFC 6125 instead of outdated RFC 2818 • only one left-most wildcard is allowed • *.*.python.org or www.*.python.org are forbidden • fixed in 3.3.3
67. PyConPL 2016 67 Bug #4 (Issue #17997) Fix wildcard matching for internationalized domain names (IDN) • über.python.org → xn--ber-goa.python.org • fixed in 3.3.3 • Mozilla NSS / Firefox and OpenSSL 1.0.2dev were affected, too.
68. PyConPL 2016 68 Bug #5 (Issue #18709) NULL bytes inside subjectAltNames general names, e.g. www.python.org\x00evil.com • fixed in 3.4 • Ruby and PHP were also affected
69. PyConPL 2016 69 Bug #6 (too many CVEs) Python does not check hostname by default • PEP 476 (Alex Gaynor) • fixed for httplib/urllib in 3.4 and 2.7.9 • still not fixed for imap, pop, smtp etc.
70. PyConPL 2016 70 Bug #7 (issue #17305) Python does not support IDNA 2008 • critical for German domains like straße.de • IDNA 2003: strasse.de • Chrome, Edge, Konqueror • IDNA 2008: xn--strae-oqa.de • Firefox • still not fixed
71. PyConPL 2016 71 'Руthοn' != 'Python'
72. PyConPL 2016 72 homoglyphic confusion attack >>> import unicodedata >>> for c in 'Руthοn': ... print(unicodedata.name(c)) ... CYRILLIC CAPITAL LETTER ER CYRILLIC SMALL LETTER U LATIN SMALL LETTER T LATIN SMALL LETTER H GREEK SMALL LETTER OMICRON LATIN SMALL LETTER N >>> import unicodedata >>> for c in 'Руthοn': ... print(unicodedata.name(c)) ... CYRILLIC CAPITAL LETTER ER CYRILLIC SMALL LETTER U LATIN SMALL LETTER T LATIN SMALL LETTER H GREEK SMALL LETTER OMICRON LATIN SMALL LETTER N
73. How to write secure software
74. PyConPL 2016 74 Think first! • Read and use open standards • Learn from mistakes • Document security claims and trade-offs • Design software for human • Default to secure and easy to use • Defense in depths
75. PyConPL 2016 75 Does • Use frameworks • Django, Flask, Plone, Pyramid… • sqlalchemy • PyCA cryptography • passlib • Use TLS/SSL (Let's Encrypt, FreeIPA)
76. PyConPL 2016 76 Here be dragons • Beware of dangerous Python features • exec(), eval(), import • pickle, marshal • random module • Don't roll your own crypto!
77. PBKDF2 Password based key derivation function
78. PyConPL 2016 78
79. Sane and secure defaults settings
80. PyConPL 2016 80 2 PEPs for ssl work-in-progress Supported OpenSSL version Secure default settings
81. PyConPL 2016 81 PEP 446 by Victor Stinner Make newly created file descriptors non-inheritable
82. PyConPL 2016 82 PEP 524 by Victor Stinner Make os.urandom() blocking on Linux
83. PyConPL 2016 83 Random Number Generator • random.random() • /dev/random • /dev/urandom • getrandom() Linux syscall • getentropy() BSD syscall • CryptGenRandom()
84. PyConPL 2016 84 Python 3.6 • PEP 524 os.urandom() • hashlib • blake2, sha3, scrypt • ssl • OpenSSL 1.1.0 • sessions • get cipher suite • AF_ALG Linux Kernel Crypto
85. Future
86. PyConPL 2016 86 Future • TLS 1.3 • Hardware security (Intel MPX, HSM, TPM 2.0) • 2FA • containers • IoT (internet of things) • Quantum Computers
87. Questions? christian@python.org @ChristianHeimes
88. THANK YOU plus.google.com/+RedHat linkedin.com/company/red-hat youtube.com/user/RedHatVideos facebook.com/redhatinc twitter.com/RedHatNews