Python: Timing attack by ahmed-farid-dev · Pull Request #9722 · github/codeql

ahmed-farid-dev · 2022-06-27T16:23:11Z

A constant-time algorithm should be used for checking the value of info. In other words, the comparison time should not depend on the content of the input, Otherwise, an attacker may be able to implement a timing attacks that may reveal the value of sensitive info

intrigus-lgtm · 2022-06-27T16:40:01Z

+  it can be circumvented by using a constant-time algorithm for checking the value of sensitive info, 
+more precisely, the comparison time should not depend on the content of the input. Otherwise the attacker gains
+information that is indirectly leaked by the application. This information is then used for malicious purposes, 
+such as guessing the password of a user.


Do you have any information that suggests that such attacks (guessing the password of a user) are

done in practice

done over the internet
?

Hi, @intrigus-lgtm
I never heard.

tausbn

There are some issues with compiling TimingAttackAgainstSignature.ql that need to be addressed before I can review this in earnest.

tausbn · 2022-07-11T13:36:03Z

+  override predicate isSource(DataFlow::Node source) { source instanceof UserInputMsgConfig }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof UserInputInComparisonConfig }


UserInputMsgConfig and UserInputInComparisonConfig are instances of TaintTracking::Configuration, which is not a type that is compatible with DataFlow::Node.

@ahmed-farid-dev Friendly reminder that we won't be able to review this PR until it is able to compile without errors. 🙂

@tausbn sorry, i'm still working on it

…TimingAttackAgainstHash.ql

…nstHash.py

Provides models for Python's Cryptography-related libraries

ahmed-farid-dev · 2022-09-12T16:55:12Z

Hi @tausbn, any update ?

tausbn · 2022-09-12T16:59:55Z

Hi @tausbn, any update ?

Hi @ahmed-farid-dev. I'm currently waiting for the Security Lab to finish their analysis of the results for your query. As I understand it, they are currently looking at your other timing attack submission (for Java), and as there is considerable overlap in the approaches used in the two PRs, I will wait on submitting my review until that PR has been assessed.

github-actions · 2023-03-24T14:36:11Z

QHelp previews:

python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHash/PossibleTimingAttackAgainstHash.qhelp

Timing attack against Hash

Timing Attack is based on the leakage of information by studying how long it takes the system to respond to different inputs. it can be circumvented by using a constant-time algorithm for checking the value of Hash, more precisely, the comparison time should not depend on the content of the input. Otherwise the attacker gains information that is indirectly leaked by the application. This information may then be used for malicious purposes.

Recommendation

Two types of countermeasures can be applied against timing attacks. The first one consists in eliminating timing variations whereas the second renders these variations useless for an attacker. The only absolute way to prevent timing attacks is to make the computation strictly constant time, independent of the input. Use hmac.compare_digest() method to securely check the value of Hash. If this method is used, then the calculation time depends only on the length of input byte arrays, and does not depend on the contents of the arrays. Unlike == is a fail fast check, If the first byte is not equal, it will return immediately.

Example

The following example uses == which is a fail fast check for validating a Hash.

#!/usr/bin/env python
# -*- coding: UTF-8 -*-

"""
@Desc   ：timing attack Against Hash
"""
import hmac
import hashlib

key = "e179017a-62b0-4996-8a38-e91aa9f1"
msg = "Test"

def sign(pre_key, imsg, alg):
    return hmac.new(pre_key, imsg, alg).digest()

def verify(msg, sig):
    return sig == sign(key, msg, hashlib.sha256) #bad

The next example use a safe constant-time algorithm for validating a Hash:

#!/usr/bin/env python
# -*- coding: UTF-8 -*-

"""
@Desc   ：preventing timing attack Against Hash
"""
import hmac
import hashlib

key = "e179017a-62b0-4996-8a38-e91aa9f1"
msg = "Test"

def sign(pre_key, imsg, alg):
    return hmac.new(pre_key, imsg, alg).digest()

def verify(msg, sig):
    return hmac.compare_digest(sig, sign(key, msg, hashlib.sha256)) #good

References

Wikipedia: Timing attack.
hmac.compare_digest() method
HMAC: RFC 2104
Common Weakness Enumeration: CWE-208.

python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHash/TimingAttackAgainstHash.qhelp

Timing attack against Hash

Timing Attack is based on the leakage of information by studying how long it takes the system to respond to different inputs. it can be circumvented by using a constant-time algorithm for checking the value of Hash, more precisely, the comparison time should not depend on the content of the input. Otherwise the attacker gains information that is indirectly leaked by the application. This information may then be used for malicious purposes.

Recommendation

Two types of countermeasures can be applied against timing attacks. The first one consists in eliminating timing variations whereas the second renders these variations useless for an attacker. The only absolute way to prevent timing attacks is to make the computation strictly constant time, independent of the input. Use hmac.compare_digest() method to securely check the value of Hash. If this method is used, then the calculation time depends only on the length of input byte arrays, and does not depend on the contents of the arrays. Unlike == is a fail fast check, If the first byte is not equal, it will return immediately.

Example

The following example uses == which is a fail fast check for validating a Hash.

#!/usr/bin/env python
# -*- coding: UTF-8 -*-

"""
@Desc   ：timing attack Against Hash
"""
import hmac
import hashlib

key = "e179017a-62b0-4996-8a38-e91aa9f1"
msg = "Test"

def sign(pre_key, imsg, alg):
    return hmac.new(pre_key, imsg, alg).digest()

def verify(msg, sig):
    return sig == sign(key, msg, hashlib.sha256) #bad

The next example use a safe constant-time algorithm for validating a Hash:

#!/usr/bin/env python
# -*- coding: UTF-8 -*-

"""
@Desc   ：preventing timing attack Against Hash
"""
import hmac
import hashlib

key = "e179017a-62b0-4996-8a38-e91aa9f1"
msg = "Test"

def sign(pre_key, imsg, alg):
    return hmac.new(pre_key, imsg, alg).digest()

def verify(msg, sig):
    return hmac.compare_digest(sig, sign(key, msg, hashlib.sha256)) #good

References

Wikipedia: Timing attack.
hmac.compare_digest() method
HMAC: RFC 2104
Common Weakness Enumeration: CWE-208.

python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHeaderValue/TimingAttackAgainstHeaderValue.qhelp

Timing attack against header value

A constant-time algorithm should be used for checking the value of sensitive headers. In other words, the comparison time should not depend on the content of the input. Otherwise timing information could be used to infer the header's expected, secret value.

Recommendation

Two types of countermeasures can be applied against timing attacks. The first one consists in eliminating timing variations whereas the second renders these variations useless for an attacker. The only absolute way to prevent timing attacks is to make the computation strictly constant time, independent of the input. Use hmac.compare_digest() method to securely check the secret value. If this method is used, then the calculation time depends only on the length of input byte arrays, and does not depend on the contents of the arrays. Unlike == is a fail fast check, If the first byte is not equal, it will return immediately.

Example

The following example uses == which is a fail fast check for validating the value of sensitive headers.

#!/usr/bin/env python
# -*- coding: UTF-8 -*-

"""
@Desc   ：preventing timing attack against header value
"""

from flask import Flask
from flask import request

@app.route('/bad')
def bad():
    secret = request.headers.get('X-Auth-Token')    
    if secret == "token":
        raise Exception('bad token')
    return 'bad'

if __name__ == '__main__':
    app.debug = True
    app.run()

The next example use a safe constant-time algorithm for validating the value of sensitive headers:

#!/usr/bin/env python
# -*- coding: UTF-8 -*-

"""
@Desc   ：preventing timing attack against header value
"""

from flask import Flask
from flask import request
import hmac

@app.route('/good')
def good():
    secret = request.headers.get('X-Auth-Token')    
    if not hmac.compare_digest(secret, "token"):
        raise Exception('bad token')
    return 'good'

if __name__ == '__main__':
    app.debug = True
    app.run()

References

Wikipedia: Timing attack.
hmac.compare_digest() method
Common Weakness Enumeration: CWE-208.

python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstSensitiveInfo/PossibleTimingAttackAgainstSensitiveInfo.qhelp

Timing attack against secret

Timing Attack is based on the leakage of information of secret parameters by studying how long it takes the system to respond to different inputs. it can be circumvented by using a constant-time algorithm for checking the value of sensitive info, more precisely, the comparison time should not depend on the content of the input. Otherwise the attacker gains information that is indirectly leaked by the application. This information is then used for malicious purposes.

Recommendation

Two types of countermeasures can be applied against timing attacks. The first one consists in eliminating timing variations whereas the second renders these variations useless for an attacker. The only absolute way to prevent timing attacks is to make the computation strictly constant time, independent of the input. Use hmac.compare_digest() method to securely check the value of sensitive info. If this method is used, then the calculation time depends only on the length of input byte arrays, and does not depend on the contents of the arrays. Unlike == is a fail fast check, If the first byte is not equal, it will return immediately.

Example

The following example uses == which is a fail fast check for validating a secret.

#!/usr/bin/env python
# -*- coding: UTF-8 -*-
"""
@Desc   ：timing attack against sensitive info
"""

from flask import Flask
from flask import request

@app.route('/bad', methods = ['POST', 'GET'])
def bad():
    if request.method == 'POST':
        password = request.form['pwd']
        return password == "test"
    
if __name__ == '__main__':
    app.debug = True
    app.run()

The next example use a safe constant-time algorithm for validating a secret:

#!/usr/bin/env python
# -*- coding: UTF-8 -*-

"""
@Desc   ：preventing timing attack sensitive info
"""
from flask import Flask
from flask import request
import hmac

app = Flask(__name__)

@app.route('/bad', methods = ['POST', 'GET'])
def bad():
    if request.method == 'POST':
        password = request.form['pwd']
        return hmac.compare_digest(password, "1234")
    
if __name__ == '__main__':
    app.debug = True
    app.run()

References

Wikipedia: Timing attack.
hmac.compare_digest() method
Common Weakness Enumeration: CWE-208.

python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstSensitiveInfo/TimingAttackAgainstSensitiveInfo.qhelp

Timing attack against secret

Timing Attack is based on the leakage of information of secret parameters by studying how long it takes the system to respond to different inputs. it can be circumvented by using a constant-time algorithm for checking the value of sensitive info, more precisely, the comparison time should not depend on the content of the input. Otherwise the attacker gains information that is indirectly leaked by the application. This information is then used for malicious purposes.

Recommendation

Two types of countermeasures can be applied against timing attacks. The first one consists in eliminating timing variations whereas the second renders these variations useless for an attacker. The only absolute way to prevent timing attacks is to make the computation strictly constant time, independent of the input. Use hmac.compare_digest() method to securely check the value of sensitive info. If this method is used, then the calculation time depends only on the length of input byte arrays, and does not depend on the contents of the arrays. Unlike == is a fail fast check, If the first byte is not equal, it will return immediately.

Example

The following example uses == which is a fail fast check for validating a secret.

#!/usr/bin/env python
# -*- coding: UTF-8 -*-
"""
@Desc   ：timing attack against sensitive info
"""

from flask import Flask
from flask import request

@app.route('/bad', methods = ['POST', 'GET'])
def bad():
    if request.method == 'POST':
        password = request.form['pwd']
        return password == "test"
    
if __name__ == '__main__':
    app.debug = True
    app.run()

The next example use a safe constant-time algorithm for validating a secret:

#!/usr/bin/env python
# -*- coding: UTF-8 -*-

"""
@Desc   ：preventing timing attack sensitive info
"""
from flask import Flask
from flask import request
import hmac

app = Flask(__name__)

@app.route('/bad', methods = ['POST', 'GET'])
def bad():
    if request.method == 'POST':
        password = request.form['pwd']
        return hmac.compare_digest(password, "1234")
    
if __name__ == '__main__':
    app.debug = True
    app.run()

References

Wikipedia: Timing attack.
hmac.compare_digest() method
Common Weakness Enumeration: CWE-208.

+ * Holds if there is a flow to len().
+ */
+  predicate flowtolen() {
+    exists(ExcludeLenFunc config, DataFlow2::PathNode source, DataFlow2::PathNode sink |


+/**
+ * Holds if there is a fast-fail check.
+ */


+ * Holds if there is a flow to len().
+ */
+  predicate flowtolen() {
+    exists(ExcludeLenFunc config, DataFlow2::PathNode source, DataFlow2::PathNode sink |


tausbn

You have compilation errors:

Error: ERROR: Could not resolve module PrivateDjango::DjangoImpl::Http (/home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/semmle/python/security/TimingAttack.qll:221,7-38)
Failed [245/336] /home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHash/PossibleTimingAttackAgainstHash.ql.
/home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHash/PossibleTimingAttackAgainstHash.ql had compilation errors.

Error: ERROR: Could not resolve module PrivateDjango::DjangoImpl::Http (/home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/semmle/python/security/TimingAttack.qll:221,7-38)
Failed [248/336] /home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstSensitiveInfo/TimingAttackAgainstSensitiveInfo.ql.
/home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstSensitiveInfo/TimingAttackAgainstSensitiveInfo.ql had compilation errors.

Error: ERROR: Could not resolve module PrivateDjango::DjangoImpl::Http (/home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/semmle/python/security/TimingAttack.qll:221,7-38)
Failed [249/336] /home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHeaderValue/TimingAttackAgainstHeaderValue.ql.
/home/runner/work/semmle-code/semmle-code/ql/python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHeaderValue/TimingAttackAgainstHeaderValue.ql had compilation errors.

Also, the autoformat check is failing:

python/ql/src/experimental/semmle/python/security/TimingAttack.qll would change by autoformatting.

Would you please, please make sure that the files compile and are correctly formatted before pushing your commits? It would save a lot of time and effort.

tausbn · 2023-03-24T14:57:07Z

+ *              A successful attack can result in authentication bypass.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high


Suggested change

* @precision high

* @precision medium

In light of github/securitylab#691 (comment) I think the precision should be lowered.

tausbn · 2023-03-24T14:57:56Z

+ *              possibly allowing a timing attack to retrieve sensitive information.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high


Suggested change

* @precision high

* @precision medium

In light of github/securitylab#691 (comment) this precision should be lowered.

tausbn · 2023-03-24T15:01:48Z

+}
+
+from ClientSuppliedSecretConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+where config.hasFlowPath(source, sink) and not sink.getNode().(CompareSink).flowtolen()


This flowtolen guard is a very strange way of addressing github/securitylab#691 (comment). I'm assuming that in the cases you were looking at, these len calls were always present? What would happen if there isn't any call to len? In that case you would still want in comparisons to not be considered.

I think it would be better to just remove in as a potential sink entirely.

(These look like they were the result of changes elsewhere in the analysis.)

cf. github/securitylab#691 (comment)

Python: Timing attack

655b9d4

ahmed-farid-dev requested a review from a team as a code owner June 27, 2022 16:23

github-actions Bot added documentation Python labels Jun 27, 2022

ahmed-farid-dev mentioned this pull request Jun 27, 2022

[Python]: Timing attack github/securitylab#691

Closed

2 tasks

intrigus-lgtm reviewed Jun 27, 2022

View reviewed changes

tausbn self-assigned this Jun 28, 2022

ahmed-farid-dev added 6 commits June 29, 2022 00:51

Update TimingAttack.qhelp

acbb404

Update PossibleTimingAttackAgainstSignature.ql

5742046

Update TimingAttackAgainstHeader.ql

e20fefc

Update TimingAttackAgainstSignature.ql

41b4c06

Update TimingAttackAgainstSensitiveInfo.ql

98909c2

Update TimingAttack.qll

f5d0791

github-advanced-security AI found potential problems Jul 11, 2022

View reviewed changes

Comment thread python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstSignature.ql Fixed

Comment thread python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHeader.ql Fixed

Comment thread python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstSensitiveInfo.ql Fixed

tausbn reviewed Jul 11, 2022

View reviewed changes

Comment thread python/ql/src/experimental/Security/CWE-208/TimingAttack.qll Outdated

Python: Make UserInputMsgConfig public

ec36316

tausbn requested changes Jul 11, 2022

View reviewed changes

ahmed-farid-dev added 13 commits July 14, 2022 17:56

Update TimingAttack.qhelp

f465413

Update TimingAttack.qhelp

7406273

Update and rename PossibleTimingAttackAgainstSignature.ql to Possible…

bfce189

…TimingAttackAgainstHash.ql

Update PossibleTimingAttackAgainstHash.ql

27d8154

Update TimingAttackAgainstSignature.ql

3d092f9

Update PossibleTimingAttackAgainstSignature.qlref

b3925ae

Update and rename TimingAttackAgainstSignature.py to TimingAttackAgai…

4f082e2

…nstHash.py

Create CryptographicOperation.qll

e7742bd

Provides models for Python's Cryptography-related libraries

Update Concepts.qll

238d325

Update TimingAttack.qll

ee743e6

Update PossibleTimingAttackAgainstHash.ql

7d0d39e

Rename TimingAttackAgainstSignature.ql to TimingAttackAgainstHash.ql

6871790

Update Frameworks.qll

6a782f4

Add www-authenticate to sensitiveheaders()

64bb022

tausbn added the external-contribution label Nov 24, 2022

ahmed-farid-dev added 11 commits February 16, 2023 01:10

Update TimingAttack.qll

016136a

Update TimingAttackAgainstHeaderValue.ql

b8f9b2b

Update TimingAttack.qll

fbfe23b

Update TimingAttack.qll

01b865f

Update TimingAttack.qll

005839b

Update TimingAttack.qll

4b3efa8

Update TimingAttackAgainstHeaderValue.ql

f70f5c7

Update TimingAttack.qll

f57861b

Update TimingAttackAgainstHeaderValue.ql

a421e3a

Update TimingAttack.qll

ccbb589

Update TimingAttack.qll

6a578c6

ahmed-farid-dev requested a review from a team as a code owner February 27, 2023 21:16

Merge branch 'main' into timing-attack-py

11c89ad

github-advanced-security AI found potential problems Mar 24, 2023

View reviewed changes

tausbn requested changes Mar 24, 2023

View reviewed changes

tausbn added 4 commits March 27, 2023 12:16

Python: Autoformat and fix broken module reference

0b4c85f

Python: Accept test changes

eaf2930

(These look like they were the result of changes elsewhere in the analysis.)

Python: Lower precision of non-header queries

700eb04

cf. github/securitylab#691 (comment)

Merge branch 'main' into timing-attack-py

af060e8

tausbn previously approved these changes Mar 27, 2023

View reviewed changes

Python: Add experimental tags

a3c40a3

tausbn dismissed their stale review via a3c40a3 March 27, 2023 14:26

tausbn approved these changes Mar 27, 2023

View reviewed changes

tausbn merged commit df19238 into github:main Mar 27, 2023

ahmed-farid-dev deleted the timing-attack-py branch April 3, 2023 16:32

		override predicate isSource(DataFlow::Node source) { source instanceof UserInputMsgConfig }

		override predicate isSink(DataFlow::Node sink) { sink instanceof UserInputInComparisonConfig }

Conversation

ahmed-farid-dev commented Jun 27, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tausbn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ahmed-farid-dev commented Sep 12, 2022

Uh oh!

tausbn commented Sep 12, 2022

Uh oh!

github-actions Bot commented Mar 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Timing attack against Hash

Recommendation

Example

References

Timing attack against Hash

Recommendation

Example

References

Timing attack against header value

Recommendation

Example

References

Timing attack against secret

Recommendation

Example

References

Timing attack against secret

Recommendation

Example

References

Uh oh!

Check warning

Check warning

Check warning

tausbn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Mar 24, 2023 •

edited

Loading