Skip to content

Commit 7a635b8

Browse files
author
Robert Quander
committed
Finished up Docu for Facepalm, will read over it again later.
1 parent 2b1a457 commit 7a635b8

File tree

1 file changed

+105
-1
lines changed

1 file changed

+105
-1
lines changed

‎documentation/README.md‎

Lines changed: 105 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,16 @@ Facepalm Documentation
1919
- [Creating, viewing and joining Events](#creating-viewing-and-joining-events)
2020
- [5. The Exploits and their fixes](#5-the-exploits-and-their-fixes)
2121
- [5.1 Insecure UUID Generation](#51-insecure-uuid-generation)
22+
- [Vulnerability](#vulnerability)
2223
- [Exploit](#exploit)
2324
- [The Fix](#the-fix)
25+
- [5.2 Cropped Keys](#52-cropped-keys)
26+
- [Vulnerability](#vulnerability-1)
27+
- [Exploit](#exploit-1)
28+
- [The Fix](#the-fix-1)
29+
- [6. File Structure](#6-file-structure)
30+
- [6.1 Checker](#61-checker)
31+
- [6.2 Service](#62-service)
2432

2533

2634
## 1. Introduction
@@ -134,6 +142,8 @@ Then all events can be viewed, and, if not already in it, access can be requeste
134142

135143
### 5.1 Insecure UUID Generation
136144

145+
#### Vulnerability
146+
137147
The User IDs and the Post IDs are both derived deterministically (in the classes `IdentifierGenerator.swift` and `PostIDGenerator.swift`, respectively).
138148

139149
The User ID is directly derived from a (padded or cut) username, while the PostID is derived from the User ID, a counter (initialized to 0) and a timestamp (with `minute` precision). These values are `XOR`ed together, and then form the (derivable) PostID.
@@ -157,4 +167,98 @@ return uuid()
157167

158168
This returns a secure uuid, from which the postID is then derived. For additional security, this could also be replaced by the same logic.
159169

160-
Alternatively, only the PostID generation could be made secure. In the current state of development for facepalm, the deterministic User ID does not have implications (that have been found).
170+
Alternatively, only the PostID generation could be made secure. In the current state of development for facepalm, the deterministic User ID does not have implications (that have been found).
171+
172+
### 5.2 Cropped Keys
173+
174+
#### Vulnerability
175+
176+
When generating the key used to enter an event, a 32 char long random hex numbers is generated and used as the key. When storing this numbers in the DB, though, only the first byte of the key is stored - thus making the search space $2^{8}$ instead of $2^{32}$. Since multiple keys at once can be uploaded, a huge keyfile containing all keys that hash to the complete set of keys can be uploaded in one go, allowing access to all events.
177+
178+
#### Exploit
179+
180+
To exploit the vulnerability, the own keystore (which is in the DB for the user) needs to be filled with 32 char long strings that hash to `00` to `ff`. A brute force approach can be used, since the search room is relatively small. A file containing a variety of keys to get the flags is also stored in `checker/src`. These are used by the checker to automatically exploit the vulnerability if needed.
181+
182+
#### The Fix
183+
184+
The fix here is to simple store the entire key in the DB. This requires the removal of `prefix(1)` from every interaction with the keys. E.g. when storing the key in the DB, this is called, and needs to be changed as follows:
185+
186+
```Swift
187+
--- self.eventKey = hash.prefix(1).map { String(format: "%02x", $0) }.joined() // removed
188+
189+
+++ self.eventKey = hash.map { String(format: "%02x", $0) }.joined() // added
190+
```
191+
192+
Then, the entire key is stored, and the search room is now $2^{32}$, making the key a secure method.
193+
194+
## 6. File Structure
195+
196+
### 6.1 Checker
197+
```bash
198+
checker
199+
├── docker-compose.yaml
200+
├── Dockerfile
201+
├── requirements.txt
202+
└── src
203+
├── automatedExploit.py
204+
├── checkerArchived.py
205+
├── checker.py
206+
├── event_templates.txt
207+
├── FinalFinalTry.py
208+
├── gunicorn.conf.py
209+
├── keysGenerator.py
210+
├── key.txt
211+
├── logs.txt
212+
├── noise-posts.txt
213+
└── uuidTest.py
214+
```
215+
216+
### 6.2 Service
217+
```bash
218+
service
219+
├── data
220+
│ └── uploads
221+
├── docker-compose.yml
222+
├── Dockerfile
223+
├── Package.swift
224+
├── Public
225+
│ └── facepalm_logo.png
226+
├── README_Before_playing.md
227+
├── Sources
228+
│ ├── App
229+
│ │ ├── configure.swift
230+
│ │ ├── Globals.swift
231+
│ │ ├── Middleware
232+
│ │ │ └── NotFoundMiddleware.swift
233+
│ │ ├── Migrations
234+
│ │ │ ├── AddCreatedAtToProfile.swift
235+
│ │ │ ├── AddCreatedAtToUser.swift
236+
│ │ │ └── AddPostCounterToUser.swift
237+
│ │ ├── Models
238+
│ │ │ ├── CreateEventInvite.swift
239+
│ │ │ ├── CreateEventRequest.swift
240+
│ │ │ ├── CreateEvent.swift
241+
│ │ │ ├── CreatePost.swift
242+
│ │ │ ├── CreateProfileFollow.swift
243+
│ │ │ ├── CreateProfile.swift
244+
│ │ │ ├── CreateToken.swift
245+
│ │ │ ├── CreateUser.swift
246+
│ │ │ ├── EventInvite.swift
247+
│ │ │ ├── EventRequest.swift
248+
│ │ │ ├── Event.swift
249+
│ │ │ ├── IdentifierGenerator.swift
250+
│ │ │ ├── PostForm.swift
251+
│ │ │ ├── PostIDGenerator.swift
252+
│ │ │ ├── Post.swift
253+
│ │ │ ├── ProfileFollow.swift
254+
│ │ │ ├── Profile.swift
255+
│ │ │ ├── Token.swift
256+
│ │ │ └── User.swift
257+
│ │ ├── routes.swift
258+
│ │ └── Utils
259+
│ │ ├── ErrorPages.swift
260+
│ │ └── StringAppend.swift
261+
│ └── Run
262+
│ └── main.swift
263+
└── uploads
264+
```

0 commit comments

Comments
 (0)