There is a problem with these keys, however, if they are not truly random. This is detailed in a paper I stumbled upon entitled “Brute-Force Exploitation of Web Application Session IDs” by David Endler. It covers ways in which these keys can be “hacked” because they are not unique, but rather follow some sequence which can be guessed. He lists some major websites which he was able to get access to information that should have been private.

The paper got me thinking about how to generate random session keys, so I created some quick Python scripts using Twisted which demonstrates my solution. (This was my first time using Twisted, so it’s very possible that there is a better way to structure the code).

Solution

The character buffer in the server is used to generate new keys.

To fill the buffer:

0. Create a list of websites which themselves deliver random web pages (eg, wikipedia)
1. Select a website from random and ask for a random page
2. Grab the data within the HTML body tags and put that string in the character buffer
3. When the buffer needs more data, go back to 1.

To generate X number of keys:

0. Grab two random lengths of the character buffer. Use one to re-seed the random generator and the other as the basis for the new session key. Create the session key using MD5 and the key seed
1. Update() the current MD5 session key using a generated random character / string
2. Add that key to the buffer.
3. When the key buffer needs more keys, go back to Step 1. For every Y number of keys generated, go back to Step 0.

Notes

We don’t use a a new seed for each MD5 session key because the buffer will be emptied too quickly. Of course, the settings for the buffer size, etc could be tweaked.

Performance

Running the server code on my Mac Mini (2.16GHz Dual Core) and 5 clients on another machine, I was able to service ~8000 keys/sec (~750 million keys/day).

Conclusion

My experiment satisfied my curiosity and answered the questions from my own project.

There are, of course, many tweaks that can be made. Send me the code changes to your favorites and I’ll include them.

Click to download the client server files.

Resources

• Brute-Force Exploitation fo Web Application Session IDs (PDF)

Normally one would simply follow the Metakit installation instructions, but they are old and didn’t work correctly with 10.5 Leopard. I scraped enough information together from the Internet to get it working, but I had to do a lot of research. To save others the same hassle, I have put together all of the changes and put them here in their entirety:

Building Metakit

Make sure you have Xcode installed on your system before starting.

Get the latest source from the Metakit downloads page. At this time the latest version is metakit-2.4.9.7.tar.gz.

Uncompress the archive in a work directory and run the following commands:

> cd builds
> ../unix/configure --with-python=/System/Library/Frameworks/Python.framework/Versions/2.5

Note: Your Python install might be in a different location. If so, give the --with-python arg the proper value.

“Fat” binary setup

If you need this to run on the PPC architecture you will need to make a couple of modifications to ./builds/Makefile after running configure, otherwise you can skip this step and build the binaries with make.

Find CXXFLAGS = $(CXX_FLAGS) and change to the following:

CXXFLAGS = $(CXX_FLAGS) -arch ppc -arch i386 -isysroot /Developer/SDKs/MacOSX10.5.sdk

Find SHLIB_LD = g++ -dynamiclib -flat_namespace -undefined suppress and change to the following:

SHLIB_LD = g++ -dynamiclib -flat_namespace -undefined suppress -arch ppc -arch i386

Build the binaries

Run your typical Makefile commands:

> make
> make test

Installing Metakit

Rename the shared library which is now in the ./builds directory:

> mv Mk4py.dylib Mk4py.so

And copy the following files to /System/Library/Frameworks/Python.framework/Versions/2.5/Extras/lib/python (be sure to adjust the path name for your version of Python):

../python/metakit.py
./Mk4py.so

Testing Metakit

At this point you should have a working system and ought to be able to run the following command in a Python shell without issue:

>>>from metakit import *

Enjoy !

Resources

• Metakit for Python website

• helpful instructions from www.ospace.net

…I won’t go into too much detail about why I decided to put my phone in the freezer, though the seed was planted after a conversation with my friend Simon regarding my phone issues.

…A couple of days later, I was ready to try and reformat the internal memory to see if that would cure my reboot problems. I turned off the phone to start the process, but I then remembered that I had forgotten to synchronize the latest changes in my address book with my computer.

…Just to make sure it wasn’t a fluke, I turned the phone off and on several times and it booted without any problems (though the display/CPU were a little sluggish because of the cold).

In the end I was able to make a final backup and do a synchronization before I started doing other radical fix-it things with my phone.

As final words I will say that there was a little more condensation buildup on the phone than I felt comfortable with only because moisture and electronics don’t mix. So midway through the process I started to put the phone in a plastic Zip-lock bag and squeezed out most of the air to keep the condensation to a minimum.

Symptoms

• The phone won’t boot up when I put in a freshly recharged battery, though the backlight will come on like it’s trying. Sometimes it takes 20 attempts before the Nokia logo will appear (the logo signals that the phone is booting up). Also I’ve found that, when there are these startup problems, the phone won’t charge when the power adapter is connected directly to it.

Possible Causes

• Old batteries

I’m starting to think that my two batteries are getting old and don’t have the maximum voltage that for which they are rated. I have the original and also bought a spare almost exactly one year ago from Malcomwireless.

I theory is that that the phone the circuitry can’t power up unless there is sufficient voltage. Consequently it takes several tries to get the phone to turn on.

I wish that I had my voltmeter handy to test this.

• Memory issues

I initially thought that the crashing Messages application was due to the fact that I had saved too many messages in the ‘My Folders’ area on the external memory card. Even though I had over 300 messages in a single folder, this doesn’t seem like a lot because the phone has a somewhat ‘modern OS’ on it – Symbian Series 60. I checked the manual for folder limits, but there was nothing written.

Conclusion

I wanted the home page of my web site to show my blog entries and also be a little more dynamic by displaying other related content.

The default index_html page for my blog software, Quills, does display the current entries, but from what I read online there was no great solution to get its default page to show at the root.

Plan B was to replace my generic index_html page with one which would query the Quills weblog object for all of its entries and then display them one at a time. I wanted to use one of Plone’s built-in user-addable types for the script but as far as I can tell they are only used to display formatted text and won’t execute any code. I finally used the Zope Management Interface (ZMI) to add a single Zope Page Template (ZPT) called index_html.

Understanding how Plone draws a page

I read several chapters in the book The Definitive Guide to Plone to figure out how to proceed, but the one which gave the most pertinent information was Chapter 7 – Customizing the Main Template.

In short, Plone has a special Zope Page Template (ZPT) at /your_plone_site_folder/portal_skins/plone_templates/main_template which contains the HTML and special markup used to render the basic structure of each page in the site. Among other things, the markup defines regions within the page called define-slots. These slots are filled in by an object as it is being rendered for view in the browser. Using a master template like this assures that the site has a consistent page layout.

Within this master template there are slots defined for different sections of the HTML like head_slot, css_slot, column_one_slot, and content. Some examples of these slot definitions follow. Notice that they can be within different types of tags.

  This content will be replaced.

<td>...</td>

When you are rendering your ZPT, you define the areas which will “fill” these slots and place the pertinent content within them. These areas are appropriately called fill-slots. Here are some examples:

  your stuff here


<div>
  your stuff here
</div>

There are other things to know about how a page gets rendered, but this is the basic idea.

Creating the page

With define-slots and fill-slots in mind, I created my ZPT at the root of my Plone site called index_html so I could start hacking. For my purposes I was only interested in changing the fill-slot main so I defined my fill-slot like above and put some bogus content in it to make sure I was on the right track. I filled out the rest of the code with guidance from examples in the book, other code in the Plone portal_skins area as well as in the Quills product directory.

Getting the entries

The Quills file /Zope/Products/Quills/WeblogArchive.py had two methods defined which return a list of blog entries – getEntries() and getLazyEntries(). The difference being that the latter only returns the catalog search objects, so it’s fast but the data which can be displayed is limited to the metadata definitions in the portal_catalog. I was hoping to get the full text of the entry so initially used getEntries(), but it turned out to be too slow.

Keeping with the site look

Next I wanted to use as much of the site style sheet as possible too keep the look consistent. Most of the important entries are in the main style sheet which is found at /your_plone_site_folder/portal_skins/plone_styles/plone.css.

Extras

I added this page to the site RAM Cache since this is the front page and the entries don’t change very often. ZMI > Cache Tab > Cache Object Using RAM Cache > Save Changes. Easy.

I also hacked together an RSS icon and feed in the h1 title.

Things to update

My page works, but I should tidy up some of the CSS and change the design to be a little more interesting. I also have hard-coded the name of my weblog object instead of using the portal_catalog to find it for me.

You can click here to download the template.

The performance of Python is important because my web server of choice is Zope and it’s written in Python. Within the next year I’d like to have my web sites on a hosted server instead of sharing space, and I’d rather it be running on a Macintosh. I like the idea of having a Mac because they’re easier to administer when you’re not a system administrator in real life. On the other hand I’d hate to buy a Mini and have it sitting in a dark colocation somewhere with no one to fully appreciate its classy exterior. It would better serve me running Front Row, sitting on top of my entertainment center right next to my Airport Express, and then I could ship a “Dull” to the data center.

Here are examples of necessary configuration:

Name: MyBlog
Home URL: http://www.davidmccuskey.com/weblog
Software: Other Blogger-compatible
RPC URL: http://www.davidmccuskey.com/weblog
Blog ID: weblog.2006-01-10.2395214781

The tricky part is obtaining the Blog ID. Plone uses an immutable identifier for all objects so that they can be found even after renaming them. Quills in turn uses this ID to get at your weblog object.

In order get this ID you’ll need to login to your Zope Management Interface (ZMI) and go digging through the uid_catalog in Plone. When you have clicked on the catalog object, click on the tab labeled Catalog. Find your blog object in the list of results and click on its link.

Search on the resulting popup page for the key named UID. The value of this key is what you will need to use for the Blog ID.

Note: Because of errors in the implementation of the MetaWeblog API, you will see a Zope error after posting, however the post will be correctly saved.