To all you cyber techies out there! You think you’re good at hacking? Then take a look at this: hackers have completely broken SSL using 200 PS3s. A team of security researchers and academics has broken a core piece of internet technology. They made their work public at the 25th Chaos Communication Congress in Berlin today. The team was able to create a rogue certificate authority and use it to issue valid SSL certificates for any site they want. The user would have no indication that their HTTPS connection was being monitored/modified.

Ever heard of Digital Fortress? It’s a great place to put your hacking skills to the test right here at Pragyan ’09! Click here for more details.

And, for those who want more details, read on below..

This attack is possible because of a flaw in MD5. MD5 is a hashing algorithm; each unique file has a unique hash. In 2004, a team of Chinese researchers demonstrated creating two different files that had the same MD5 hash. In 2007, another team showed theoretical attacks that took advantage of these collisions. The team focused on SSL certificates signed with MD5 for their exploit.

The first step was doing some broad scans to see what certificate authorities (CA) were issuing MD5 signed certs. They collected 30K certs from Firefox trusted CAs. 9K of them were MD5 signed. 97% of those came from RapidSSL.

Having selected their target, the team needed to generate their rogue certificate to transfer the signature to. They employed the processing power of 200 Playstation 3s to get the job done. For this task, it’s the equivalent of 8000 standard CPU cores or $20K of Amazon EC2 time. The task takes ~1-2 days to calculate. The tricky part was knowing the content of the certificate that would be issued by RapidSSL. They needed to predict two variables: the serial number and the timestamp. RapidSSL’s serial numbers were all sequential. From testing, they knew that RapidSSL would always sign six seconds after the order was acknowledged. Knowing these two facts they were able to generate a certificate in advance and then purchase the exact certificate they wanted. They’d purchase certificates to advance the serial number and then buy on the exact time they calculated.

The cert was issued to their particular domain, but since they controlled the content, they changed the flags to make themselves an intermediate certificate authority. That gave them authority to issue any certificate they wanted. All of these ‘valid’ certs were signed using SHA-1.

I’m sure many of us would’ve had experience with Lego blocks either as a kid or even recently. I’ve had tons of great times playing with these wonderful toys. What was interesting is that they evolved and grew with me. As we grow up, so does technology! It started with standard blocks and now involves complex robotics! Side by side, Lego builders grow more and more innovative. Just when you probably figured you’d seen them all, something amazing comes up. An example of the Lego Mindstorms set in action below. This is a working safe which has a five number combination lock (over 305 billion different codes) and even a motion senser which triggers an alarm when moved! Phew, now that’s neat. Do you have what it takes to crack the Digital Fortress at Pragyan? (Check out the links, there’s some neat stuff you can look forward to this time in Pragyan!)