Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › ChicagoVPS hacked, bunch of VPS customers offline - Page 8
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

ChicagoVPS hacked, bunch of VPS customers offline

1…5681011…16

Comments

  • KuJoeKuJoe Member, Host Rep

    My partner convinced me to err on the side of caution so we're treating this like a real exploit until informed otherwise. Better safe than sorry.

  • plueschopathplueschopath Member

    @KuJoe said: My partner convinced me to err on the side of caution so we're treating this like a real exploit until informed otherwise. Better safe than sorry.

    +1

  • KuJoeKuJoe Member, Host Rep

    @rds100 said: From what soluslabs said both the ID and Key are somehow derived from the "installation ID". Which is generated when you are installing the Master. Using a perl program with perl's rand() function - it is seeded from /dev/urandom reading 4 bytes from there.

    I understand that but my question was is the "4 billion" estimate you made based on a single value or is that based on both values? If it's just for one value then you can see how 4 billion turns into an unrealistic number (4 billion for the ID + 4 billion for the Key * possible combinations of both).

  • AlexBarakovAlexBarakov Patron Provider, Veteran

    @KuJoe said: My partner convinced me to err on the side of caution so we're treating this like a real exploit until informed otherwise. Better safe than sorry.

    It mgiht be a real exploit..However bruteforcing the API and Key seems a bit impossible on my end.

    It would be easier to bruteforce one of my passwords (whmcs/solusvm/etc.)

  • KuJoeKuJoe Member, Host Rep

    @Alex_LiquidHost said: However bruteforcing the API and Key seems a bit impossible on my end.

    Nothing is impossible, just improbable. ;)

  • rds100rds100 Member

    @KuJoe said: I understand that but my question was is the "4 billion" estimate you made based on a single value or is that based on both values? If it's just for one value then you can see how 4 billion turns into an unrealistic number (4 billion for the ID + 4 billion for the Key * possible combinations of both).

    Ifff (i am saying IF since i haven't seen the code Solus uses).
    But if:
    ID = function1(InstallationID)
    Key = function2(InstallationID)
    And InstallationID=function3(32bit number)

    Then all possible values of the (ID, key) pair combinations are not more than 2^32

    Now if the functions used have some flaws then it could be an even lower number. Theoretically.

  • AlexBarakovAlexBarakov Patron Provider, Veteran

    @KuJoe said: Nothing is impossible, just improbable. ;)

    Yeah, true :)

    But pretty sure you understand what I meant.

  • CoreyCorey Member
    edited November 2012

    @rds100 said: ID = function1(InstallationID)

    Key = function2(InstallationID)
    And InstallationID=function3(32bit number)

    Then all possible values of the (ID, key) pair combinations are not more than 2^32

    Now if the functions used have some flaws then it could be an even lower number. Theoretically.

    I think they explained something more like this...

    ID = function1(InstallationID.(/dev/urandom 4bits perl function))
    Key = function2(InstallationID.(/dev/urandom 4bits perl function))
    And InstallationID=function3((/dev/urandom 4bits perl function))

  • KuJoeKuJoe Member, Host Rep

    @rds100 said: InstallationID=function3(32bit number)

    If the SolusVM Master ID is generated the same way as the Slave IDs, then (based on my Slave IDs) it ranges from 125-135bits but my API ID and Keys are only a little over 100bits.

  • rds100rds100 Member

    @Corey as i said i haven't seen that code so don't really know. Here is what they said:

    @rds100 said: @soluslabs I haven't done a solusvm master installation in a very long time, but IIRC the API user/key is automatically generated and looks random. What random generator function is used for this? How is the random generator seeded at that point?

    soluslabs

    @soluslabs said: @rds100 We use our own function for that. It's based around the installs unique key.

    They don't say anything about mixing it with more randomness. Then they also don't say anything about not mixing it. So we don't really know until someone sees the code.

  • rds100rds100 Member

    @KuJoe said: If the SolusVM Master ID is generated the same way as the Slave IDs, then (based on my Slave IDs) it ranges from 125-135bits but my API ID and Keys are only a little over 100bits.

    perl -le 'print map+(A..Z,a..z,0..9)[rand 62],0..25'

    How many bits is this?

  • KuJoeKuJoe Member, Host Rep

    @rds100 said: How many bits is this?

    It generated a value of 136 bits accord to KeePass.

  • KuJoeKuJoe Member, Host Rep

    Also, here's a good post about how long it could take to brute force SolusVM's API: http://www.webhostingtalk.com/showpost.php?p=8408232&postcount=8

  • rds100rds100 Member

    @Kujoe now strace that perl and think again :)


    
open("/dev/urandom", O_RDONLY|O_LARGEFILE) = 3
    
read(3, "\345\237\350\204", 4)          = 4
    
close(3)                                = 0
    
write(1, "uUd7olwUiQD2JwppvHvC6dOvAP\n", 27) = 27

    The rand() function is seeded once, with 4 bytes (32 bits) of pseudo random data. All numbers after that are 100% predictable and reproducable if you know this 32 bits seed.

  • KuJoeKuJoe Member, Host Rep

    @rds100 said: All numbers after that are 100% predictable and reproducable if you know this 32 bits seed.

    Very true, but if you had access to the SolusVM Master ID then you wouldn't need to bruteforce the API. :P

  • rds100rds100 Member

    Hmm don't know how the SolusVM master ID could be used. But it can be predicted with a probability of 2^-32

  • KuJoeKuJoe Member, Host Rep

    I guess you lost me then. :)

  • miTgiBmiTgiB Member

    @Zen said: Maths vs DRAGONMATHS!

    Well that is easy, Dragons beat all

  • eastoncheastonch Member

    @Zen said: Maths vs DRAGONMATHS!

    I wish I could be as cool as you.

  • ErawanArifNugrohoErawanArifNugroho Member

    I wish there a Thanks button :)

  • mojedamojeda Member

    @ErawanArifNugroho said: I wish there a Thanks button :)

    Maybe we can get one for christmas?

  • John_RJohn_R Member

    "tits.or.gtfo" is not a secure password.

  • TazTaz Member

    Wait what?

  • mattgrifmattgrif Member

    @John_R it should have been TITS.or.gtfo!123 that's a secure password!

    @John_R said: "tits.or.gtfo" is not a secure password.

  • KuJoeKuJoe Member, Host Rep

    @Zen

    DRAGONMATHS:
    1+1=ROAR!
    2+2=FIRE!

  • AsadAsad Member

    @KuJoe ROAR+ROAR=FIRE

  • KuJoeKuJoe Member, Host Rep

    @AsadHaider EXCELLENT! Dragonmaths is fun! :)

  • AsadAsad Member
    edited November 2012

    ROAR^2=FIRE

    I like this. Unfortunately @KuJoe this is the stuff I have to do irl :(

    image

  • ExpertVMExpertVM Member, Host Rep

    @AsadHaider looks like cryptographic formula =) Cool stuff!

  • unusedunused Member

    @mattgrif said: So if I really was concerned about high availability I would have VMWare host or be hosted through AWS or Azure.

    ROFL

This discussion has been closed.