安全与密码学2014isecpartners.github.io
CryptoCat iOS 应用渗透测试
CryptoCat iOS Application Penetration Test
进阶 · 约 45 分钟读完前置知识：移动应用安全、OTR 协议、渗透测试基础
导读
这是安全公司 iSEC Partners 受 Cryptocat 委托，为 iPhone 版 Cryptocat 做的一份渗透测试报告，指出了这款加密聊天应用的多处安全隐患。开发者澄清，测试对象是开启了 NSLog 等调试功能的预发布原型，报告中一些关键漏洞并未进入正式发布版本。
HN 关注点：加密聊天工具的安全审计结果，以及开发者与批评者之间围绕以下问题的争论：究竟是“预发布原型的调试残留”，还是真实存在的严重漏洞。
HN 评论精选
这几条评论里：支持 1 质疑 1 补充 1 亲历 1
亲历开发者回应：审计针对的是开启调试的预发布原型，关键漏洞未进入发布版，报告被断章取义。
我是 Cryptocat 的首席开发者。我强烈建议大家先读我们关于这次审计的博客文章，仅凭这份报告不足以了解全貌。这次审计是我们委托的，审查对象是 iPhone 版 Cryptocat 的一个预发布原型，许多问题源于原型开启了 NSLog 等调试功能。虽然审计确实发现了漏洞和改进空间，但其中的关键漏洞从未出现在正式发布版里，这份审计被断章取义地拿来攻击我们的工作，实在令人遗憾。我们的博客文章最后一节“论审计的意义”也解释了为什么 Cryptocat 被公开审计的次数多于其他加密项目，请大家自行明辨。
kaeporan查看英文原文
Hi, I'm the lead developer for Cryptocat. I strongly urge you all to please read our blog post regarding this audit: https://blog.crypto.cat/2014/04/recent-audits-and-coming-improvements/ This audit document alone does not give enough context. This audit was commissioned by us and concerns a pre-release version of Cryptocat for iPhone. Many of the bugs it found are due to the fact that it was reviewing a prototype with debugging features (such as NSLog) turned on. While this audit definitely does find some vulnerabilities and room for improvement, none of the critical bugs in this audit ever made it to Cryptocat for iPhone's release. It's very unfortunate that this audit is being taken out of context like this and used to attack our effort. I'd appreciate it if you could please upvote this comment and help me contextualize this audit. Again, please, read the blog post for context (and also for the results of another audit we comissioned in parallel.) We've done our best to address these issues and are working towards an open discussion on how to improve accessible encryption. https://blog.crypto.cat/2014/04/recent-audits-and-coming-improvements/ The blog post's last section ("On the Significance of Audits") discusses why it is that Cryptocat has seen more audits published about it than other encryption projects. Please, dare to discern. Read what we're doing to improve the security of accessible encryption and our reasoning for publishing these audits. I'll be grateful for you taking the time to read on what we're doing and I am more than happy to discuss with you and answer your questions.
补充评论者强调一个严重问题：OTR 密钥可在会话中静默更换，导致中间人攻击者能解密后续消息。
这非常令人担忧。Cryptocat 在所有平台上的 OTR 实现都允许聊天对端在会话期间更改 OTR 密钥而不通知用户。对客户端 XMPP 或 HTTPS 流发动中间人攻击的攻击者，可以在用户已经核验过对端 OTR 指纹之后，注入自己的 OTR 密钥。这样一来，攻击者就能解密之后的所有消息，而用户根本不会怀疑自己已被攻破。
primitivesuave查看英文原文
This is most alarming. CryptoCat's OTR implementation on all platforms allows a chat peer to change their OTR key during a chat session without user notification. An attacker performing a man-in-the-middle attack against the client's XMPP or HTTPS stream can inject their own OTR key in the discussion after a user has authenticated their peer's OTR fingerprint. This permits the attacker to decrypt all messages that follow, and no user would have reason to suspect the compromise.
支持对 Cryptocat 团队的技术能力持负面评价，同时肯定审计方 iSec 的工作质量。
2012 年我听了 Cryptocat 一位主要开发者的演讲，留下的印象是核心团队里没有人真正懂密码学、安全或软件工程。这次审计只是我多年来看到的、支持这一印象的又一块证据。不过 iSec 这份工作做得很好。
rancor查看英文原文
When I saw one of the main CryptoCat developers present in 2012, I came away with the impression that nobody on the core team understood crypto, security, or software engineering. This audit is another rock on the mountain of evidence I've seen supporting this impression in the following years. A really nice job by iSec, though.
质疑质疑 Cryptocat 的存在价值，认为 TextSecure 等竞品对待加密更认真，多平台支持不足以成为理由。
同样值得一读的是他们打算如何处理报告所述问题的博客文章。读完我仍不明白为什么还有人用 Cryptocat，市面上有 TextSecure 这类看起来认真对待加密得多的产品。我能想到的唯一理由是它的客户端覆盖平台更多，但如果所有平台都是这种状况，那又有什么意义？
natdempk查看英文原文
Also of interest is their blog post about how they plan to handle the issues described in this report: https://blog.crypto.cat/2014/04/recent-audits-and-coming-improvements/ Reading that, I still am not sure why anyone would use CryptoCat especially with things like TextSecure on the market that seem to take crypto far more seriously. The only reason I can see for that is that they have clients on more platforms, but if this is similar to the state of all of them, then what's the point?
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2014Hacker News 讨论帖168 分 · 131 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选