This document describes Ofer Rivlin's career path in cybersecurity and his involvement in discovering vulnerabilities. It details his role in identifying the OpenSSL Heartbleed vulnerability in 2014 and describes how it worked. It also outlines the Ticketbleed vulnerability he discovered in 2017 affecting F5 BIG-IP load balancers, which could leak up to 31 bytes of memory and potentially expose secret session keys. The document emphasizes lessons learned around the importance of security reviews, testing, and following standards and best practices in development and product security.

1. 1
Ofer Rivlin
Product security lead, Cyberark

2. AI Dev
Dev Team
Lead
Security
Architect
Product
Security Lead
Dev Architect
Security
Researcher & Architect
AI Dev
My path

3. 3

4. 4

5. 5

6. 6
This is how it all began…

7. 7
Apr 7, 2014

8. 8
Openssl 0day

9. 9

10. 10

11. 11

12. 12
OpenSSL Heartbeat
Client
Message
Create Message
1
Message
Encrypt the
Message
2
Message
Decrypt the
Message
3
Response
Includes the
client message
Create Response
4
Response
Encrypt the
Message
5
Compare Response
with sent Message
6
Server
7
Response
Decrypt the
Response

13. 13

14. 14

15. 15

16. 16

17. 17

18. 18
What went wrong

19. 19
OpenSSL Heartbeat
Client
Message
Create Message
1
Message
Encrypt the
Message
2
Message
Decrypt the
Message
3
Response
Includes the
client message
Create Response
4
Response
Encrypt the
Message
5
Compare Response
with sent Message
6
Server
7
Response
Decrypt the
Response

20. 20
char *message-payload
int payload-length
Message Struct
Prepare the Response with the Client message
Client Server
Copies the message data to its memory

21. 21
char *message-payload
int payload-length
Message Struct
Prepare the Response with the Client message
Client Server
char *pl
int payload
// pointer to the payload (message data)
// the length of the payload

22. 22
char *message-payload
int payload-length
Message Struct
Prepare the Response with the Client message
Client Server
char *pl
int payload
buffer = malloc(payload)
// allocate memory as the payload length
// pointer to the payload (message data)
// the length of the payload

23. 23
char *message-payload
int payload-length
Message Struct
HAT
3
Prepare the Response with the Client message
Client Server
char *pl
int payload
buffer = malloc(payload)
memcpy(buffer, pl, payload)
// allocate memory as the payload length
// copy the payload into the new allocated memory
// pointer to the payload (message data)
// the length of the payload
3H

24. 24
char *message-payload
int payload-length
Message Struct
HAT
3
Prepare the Response with the Client message
Client Server
char *pl
int payload
buffer = malloc(payload)
memcpy(buffer, pl, payload)
// allocate memory as the payload length
// copy the payload into the new allocated memory
// pointer to the payload (message data)
// the length of the payload
3H

25. 25
Prepare the Response with the Client message
Eve Server
char *pl
int payload
buffer = malloc(payload)
memcpy(buffer, pl, payload)
// allocate memory as the payload length
// copy the payload into the new allocated memory
// pointer to the payload (message data)
// the length of the payload
char *message-payload
int payload-length
Message Struct
HAT
500
Give me all your
secrets !
500H

26. 27

27. 28

28. 29

29. 30
The server
sends its secrets
to the client

30. 31

31. 32
Worst case scenario !
Cloudfalre had set up a nginx server with a vulnerable version of OpenSSL
and challenged the community to steal its private key

32. 33

33. 34
OpenSSL Heartbeat

34. 35
Lessons Learned

35. 36
{review}
Review is a responsibility!

36. 37
Macros
Bad param names
Hardcoded values
Misleading names

37. 38
Audit
Syslog

38. 39
Security
&
Open Source

39. 40
Feb 8, 2017

40. 41

41. 42

42. 43
Hello &
Session ID
use session key
Done
Okay
Done
Encrypted communication using session key
Check if Session
IDs are equal
Session ID
use session key
Done
Check if Session
ID is okay
ID=e7
ID=e7
ID=e7
ID=e7
Resume TLS
Session
ID
Session
Key
e7 e5 a8 79
dd 33 a2 d4
Session
ID
Session
Key
e7 e5 a8 79

43. 44
Hello &
Session ID
use session key
Done
Okay
Done
Encrypted communication using session key
Check if Session
IDs are equal
Session ID
use session key
Done
Check if Session
ID is okay
ID=a5
ID=a5ID=a5
ID=a5
Resume TLS
With Ticket
Session Key
Encrypted
STEK
Client generated!
session ticket
encryption key

44. 45

45. 46
The Ticketbleed Story
Railgun
agent
Edge Server
Cloudflare customer with F5 BIG-IP LB has issues with their TLS connection
TLS

46. 47
The Ticketbleed Story
Railgun
agent
Edge Server
TLS

47. 48
Try to Resume TLS
FATAL!

48. 49
Hello &
Session ID
Check if Session
IDs are equal
Session ID
use session key
Done
Check if Session
ID is okay
ID=e2
ID=e2ID=e2
ID=e2
Encrypted
Client generated ID!
Resume TLS
With Ticket
STEKSession Key
session ticket
encryption key

49. 50
Session ID debugging
RG 16 bytes

50. 51
Session ID debugging
RG 16 bytes
F5 32 bytes

51. 52
Session ID debugging
RG 16 bytes
F5 32 bytes
That's... Memory!
F5 always return 32 bytes
Potential of 31 bytes of sensitive data leak
(Heartbleed ~ 64KB)

52. 53
F5 vulnerable products:
Advanced Firewall Manager
Application Security Manager (WAF)
Access Policy Manager

53. 54
Lessons Learned

54. 55
Design & Code
Review

55. 56
Dynamic Analysis
&
Fuzzing

56. 57
Feb 17, 2017

57. 58
https://googleprojectzero.blogspot.com/

58. 59

59. 60

60. 61

61. 62

62. 63
if ( ++p pe )
goto eof_handler;
==
/* end of a buffer (file)? */
/* p = current character */
/* pe = character at end of buffer (file) */

63. 64
if ( ++p pe )
goto eof_handler;
==>=
Pointer may jump past the end of the buffer  buffer overrun
/* end of a buffer (file)? */
/* p = current character */
/* pe = character at end of buffer (file) */

64. 65
<script>
<script#
Read text until end-of-tag character
If found '>'
great!
parse this tag
--p;
goto check-if-eof
If found unexpected char
log "error"
goto check-if-eof
check-if-eof:
if ( ++p == pe )
stop
>
pe
pe
#
*p - current character
*pe - character at end
of buffer
(eof in this case)
Memory
eof

65. 66
pe
<script>
Read text until end-of-tag character
If found '>'
great!
parse this tag
--p;
goto check-if-eof
If found unexpected char
log "error"
goto check-if-eof
check-if-eof:
if ( ++p == pe )
stop
*p - current character
*pe - character at end
of buffer
(eof in this case)
Memory
eof

66. 67
Memory<script#
Read text until end-of-tag character
If found '>'
great!
parse this tag
--p;
goto check-if-eof
If found unexpected char
log "error"
goto check-if-eof
check-if-eof:
if ( ++p == pe )
stop
pe
*p - current character
*pe - character at end
of buffer
(eof in this case)
Continue…
?
X
eof

67. 68
<script#
Read text until end-of-tag character
If found '>'
great!
parse this tag
--p;
goto check-if-eof
If found unexpected char
log "error“
--p;
goto check-if-eof
check-if-eof:
if ( ++p >= pe )
stop
*p - current character
*pe - character at end
of buffer
(eof in this case)
Memory
eof

68. 69
Lessons Learned

69. 70
Code Review

70. 71
Unit Testing
Testing the
extreme cases

71. 72
Summary

72. 73
Summary
TLS TLS
Security
Services

73. 74
Summary

74. 75
Summary
TLS TLS
Security
Services

75. 76
Summary
TLS TLS
Security
Services

76. 77
Summary
TLS TLS
Security
Services
X X

77. 78
Conclusions
increase the attack surface!
Security products
like any other products

78. 79
Conclusions
▪Follow standards & best practices
￭ Design & Code Review
￭ Audit logs
￭ Clear secrets from memory
￭ Test: Unit Test, Static & Dynamic, PT, and more.
￭ Etc.

79. 80
Thank You!