28c3: Effective Denial of Service attacks against web application platforms :: AWS round

Update:  as of 2011-01-19, AdaCore is aware of the situation and is already working on a fix to this problem.

Update 2:  as of 2011-01-19 (yes, the same day), the problem is fixed in the repository (revision 9f1405).

Update 3: AdaCore changed it's name from ACT several years ago. Changed all references to that name accordingly. Sorry about that. :)

Update 4: as Pascal Obry informed in his comment on this post, the updated version is available to all AdaCore customers and the GPL version has been updated at Open-DO forge.

A few weeks ago, the following video has been released:

Well, those guys did a great job not only studying this vulnerability but also spreading the news. Then the question arose: is Ada Web Server vulnerable to this sort of attack?

The short answer is: sadly yes. This post tries to explain how we have tested this issue.

Keep in mind that only if a few hours I managed to get this code working and managed to keep my server at 100% for over 3 minutes with only 46656 variables in my post request.

The compiler used was GNAT GPL 2011. The AWS version is 2.10.0. And the operating system is Sabayon Linux.

Introduction

It all started at the #ada IRC channel at freenode. As I am used to run AWS servers all around I was curious if my servers were vulnerable or not.

After some research on the web I realized there wasn't any official report on the issue and I couldn't find anything useful. So, I went to the chat room and started talking to jesselang.

He discovered the AWS uses the Ada.Strings.Hash function internally. As it isn't really complex I realized we where not safe.
This is the actual implementation of this function (which is actually inside the file s-strhas.adb in your GNAT distribution):

------------------------------------------------------------------------------
--                                                                          --
--                         GNAT COMPILER COMPONENTS                         --
--                                                                          --
--                    S Y S T E M . S T R I N G _ H A S H                   --
--                                                                          --
--                                 S p e c                                  --
--                                                                          --
--             Copyright (C) 2009, Free Software Foundation, Inc.           --
--                                                                          --
-- GNAT is free software;  you can  redistribute it  and/or modify it under --
-- terms of the  GNU General Public License as published  by the Free Soft- --
-- ware  Foundation;  either version 3,  or (at your option) any later ver- --
-- sion.  GNAT is distributed in the hope that it will be useful, but WITH- --
-- OUT ANY WARRANTY;  without even the  implied warranty of MERCHANTABILITY --
-- or FITNESS FOR A PARTICULAR PURPOSE.                                     --
--                                                                          --
--                                                                          --
--                                                                          --
--                                                                          --
--                                                                          --
-- You should have received a copy of the GNU General Public License and    --
-- a copy of the GCC Runtime Library Exception along with this program;     --
-- see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see    --
--                                                                          --
-- GNAT was originally developed  by the GNAT team at  New York University. --
-- Extensive contributions were provided by Ada Core Technologies Inc.      --
--                                                                          --
------------------------------------------------------------------------------

pragma Compiler_Unit;

package body System.String_Hash is

   --  Compute a hash value for a key. The approach here is follows the
   --  algorithm used in GNU Awk and the ndbm substitute SDBM by Ozan Yigit.

   ----------
   -- Hash --
   ----------

   function Hash (Key : Key_Type) return Hash_Type is

      pragma Compile_Time_Error
        (Hash_Type'Modulus /= 2 ** 32
          or else Hash_Type'First /= 0
          or else Hash_Type'Last /= 2 ** 32 - 1,
         "Hash_Type must be 32-bit modular with range 0 .. 2**32-1");

      function Shift_Left
        (Value  : Hash_Type;
         Amount : Natural) return Hash_Type;
      pragma Import (Intrinsic, Shift_Left);

      H : Hash_Type;

   begin
      H := 0;
      for J in Key'Range loop
         H := Char_Type'Pos (Key (J))
                + Shift_Left (H, 6) + Shift_Left (H, 16) - H;
      end loop;

      return H;
   end Hash;

end System.String_Hash;

Turns out this is a linear hash function. It should easy to come up with a reverse algorithm, but ...

Generating Strings with Colliding Hash

Generating a code for this should be hard. I haven't got lazy right from the start; I spent like 20 minutes trying to crack this up but as I have no previous experience in doing such thing and binary arithmetic isn't really my thing I decide to go for the brutal force approach. :)

So I generated a short string. Something arbitrary, such as "ccc" (that's actually what I used). And I implemented a dirty loop to generate substrings with 6 characters each with the same has. Bingo! I found out 12 strings but I decided to use only 8 of them for they only had alphanumeric characters.

And here is the pretty thing: as this hash function is linear all I had to do is to combine all those strings. I came up with 46656 combinations in total - only because I didn't want big variable names in my post requests.

Another thing I found out is that it seems to be quite more likely to have collisions in bigger strings. First I tested against "tt" I and came up with only 4 usable collisions. Adding another character gave me twice as much. I haven't really tested this though.

The attack

I decided to use AWS.Client to implement my attack on AWS.Server. Ironic, isn't it?

The code is really simple. Using unbounded string as a buffer I generated a string containing all the post data I needed. And then I invoked the AWS.Client.Post function. The client code is quite fast (really, less than 1 second).

Now the server code. I just implemented a hello world. Simply as that. It's actually a slightly changed version of the code listed in Gem #29 AdaCore have published. The changes where just to check if I was calling AWS.Client right, before I did the not-so-tricky part of generating the post data. Of course.

The results

I ran both client and server in a computer with AMD Athlon(tm) II X4 640 Processor and 4gB ram. The client being small I see no problem. :)

As expected, the client kept my server using 100% of one core. It stayed that way until the process completion, which took well over 3 minutes.

Firing up 5 client instances managed to get a DoS.

Both brutal force, client and server codes have been forwarded to jesselang's email address who kindly will report back to Ada Core Technologies. With any luck we will be seeing a patch for this in the near future.

Conclusion

It was a really bad surprise finding any information about this issue online. I don't know if Ada Core has been working on it already of they have ignored it completely. Until there is a fix for this available, let's hope no one uses this to damage running systems.
 
Even more astonishing is that the development community (with the exception of perl community) assumed plain Hash tables are great for everything. I've avoided it in the past for security reasons myself. After seeing anyone using hash table I decided to use it a lot.... and now I've been using Hash table myself to represent json data and key/value pairs from configuration files. Time to review all my code. :)

KOW Framework still on the works...

I have been working on the KOW framework for a couple of years now. So much we have accomplished, and then rewritten and finally we are really close of a public release with some tutorials and stuff like that.

So, in order to celebrate that I decided to write a simple overview on the framework and what it is all about. So, here it is.

The framework was designed with simplicity and modularity in mind. Once you have your application up and running it should be straightforward to extend and maintain it. You shouldn't have to worry about versioning much (well, you need some sort of versioning but not as grained as "take the revision #1012023".... a simple "use the release 2.0" should be enough).

Also, memory management is a big concern (after all it is a server based framework.. all users will be using the same memory space on the server).

We did our best to make it robust, fast and small. Yes, being small is actually a good thing. The framework has no tool for handling complex scripts. Neither for processing images or any of the sorts. If you need something that does that you should by all means use GNAT.Expect package for calling other process (which can be considered an ugly workaround but works like magic) or implement your own (or even find a 3rd party) package. You can put this package inside your app folder and you will be just fine.

A more detailed post about the framework and how to use it is yet to be written. Actually, our biggest issue right now is not having a decent set of introduction documentation. It's quite easy to use the framework after you got yourself used to the main libraries (only tree are quite important here: kowconfig, kowview and kowent) but there is no "make a blog in 2 minutes" kind of documentation (which I think is quite possible and easy to do... but I tend to get busy with other things easily).

KOW Framework :: ERP in the works

Howdy all.


I'm the developer for the not-so-known KOW Framework. I'm also the current maintainer for the APQ database bindings for Ada (which is now part of the framework).

I started up codding this framework for developing business applications (both web and desktop) easily. As things have evolved, our focus has changed several times and now we are back to the original idea. :)

Right now we are working with complex Web Applications. KOW Framework has a powerful and high scalable modular architecture. One module can depend on other directly (ie, including the module specification), but you can develop using IoC (Inversion of Control). It allows you to use some MVC principles even though we haven't built it thinking about any of those concepts.

The idea is to make a framework that easy our work for some tedious tasks (such as database interaction, configuration files and page construction). Even though I think we have achieved some of these goals there is a long way to go before we can say it's ready for the general public.

Well, I started using the framework in heavy duty tasks a couple of weeks ago. I'm listing some of it's problems and I intend to fix them ASAP (and then write some decent documentation about it and make a decent public release). But the thing is I'm quite happy with the current status. Even though I've been working all alone and thing has progressed pretty fast. Hopefully we'll have a decent set of Ada libraries for building complex business applications in a short period of time.

For the ones who might ask: I call "business applications" those applications someone who isn't a coder would "implement" using Microsoft Access, or some initial (or lazy) programmers would do in PHP.

The vast majority of programmers would usually go to Java or .NET, which I believe not to be fit to any real life application at all (but that's a totally different topic and I'm not messing with it right now).

ERP and CMS are excellent examples of what I call business applications.

Trac vs Redmine

Tenho usado o trac por um baita tempo... muito contente com ele até que eu decidi mudar meus repositórios de svn para git.


Vi que não fazia sentido manter os módulos do KOW Framework (antigo AdaWorks) em um mesmo repositório git. O subversion é muito legal no lance de ser orientado a pastas, mas o git não segue essa idéia.

Além de me oferecer opção de um download muito menor por repositório, sem incluir módulos legados nem código não suportado, essa abordagem do git também me oferece maior segurança. Posso escolher quem faz o que e aonde; sendo assim, posso misturar repositórios públicos e privados em um mesmo servidor, sem muito trabalho.


Migrei e amei o git; rápido, super fácil de entender, completinho.. só que... bom... agora meu trac não consegue mais listar meus repositórios... . Nunca pensei que isso me faria TANTA falta!


Googlei, googlei e o que eu acho? Redmine! Já tinha esbarrado nele antes, mas ele tem 2 coisas que me deixaram bem contentes: suporte a git e multiplos projetos! Tudo o que eu precisava!

Vou instalar o redmine correndo no meu servidor e ver se me dou bem com ele... sendo o caso migro tudo para ele e, finalmente, concluo a mudança do AdaWorks para KOW Framework! :)