Hello, everyone. Me and my teammates worked on XCOS on web project this summer. XCOS is a silab tool, which is dedicated to simulation of dynamic hybrid system. XCOS is equivalent to semulink of MATLAB. So XCOS on web is a project which puts the core functionalities of XCOS to a browser-only version so that anyone who has an internet connectivity can use XCOS and its functionalities without further installations. But there were some limitations in the previous version of XCOS on web. Like there was no two-way communication for TK scales and dynamic graph generation was not there for 3D graphs. And modification of block parameters was not there for the blocks. So the user cannot change the parameters. And some blocks were not draggable to the graph area. Block images were getting disappeared after dragging or setting the parameters. And some 3D graphs were not available. And there was no option to download the XCOS file so that user can download the XCOS file and run that file in the XCOS desktop version of silab. So we try to overcome these limitations. Now Shishank will continue. We try to overcome all the limitations. So these were the features we implemented. So there are some syncs block. Syncs block are those which give output to the user. So we implemented the following syncs block, these which are listed here. And the change in block parameters, which was not reflected earlier, we made that to reflect in the output. Also, we maximize the size of output if the user wanted that the size of the output should be maximized. That was not done, but we did that. And the 3D charts was implemented. We used high charts 3D for that. And for implementing the 2D charts and all, we used high charts. We added the zoom and exporting feature through which if the user wants a particular chart to be printed for him in PDF format or JPG or PNG, he could get that. He or she could get that. And the dynamic output generation was also done. So earlier it was like the whole XCOS file was simulated in the silab version. And then the output was given to the user. So imagine if for a short amount of time, it doesn't matter if for 60 milliseconds or somewhat. But if the simulation time is too long, like one lakh millisecond or one lakh seconds or so, then the user would have to wait so much long for that. But we have overcome that thing. So we have implemented that feature. So these were some more syncs block which we implemented. And block identification was also added. So if the user wanted to, if we want to know that the XCOS file contains some blocks in before simulating, we could know that now. And functionality for file download, like for binary files, for audio files, that was also added. And access to workspace. Basically XCOS contains a workspace also. So where we can save a variables. So we added that feature too. And now multiple graphs could be displayed. Like previously, no matter how many output blocks was there, only one output was given. Now the output is given for all the blocks. And we can even differentiate between different blocks of the same type. I will show you that in demo. So this is a sample output. I will just show the demo. Because we were having lack of time. In lunchtime, we prepared a video for this demo. If you want, we can show, but there will be unnecessarily time lag between the block connections. So we have made a video in lunch. If you want, so this is a video of outputting a C-scope. So this file contains a CM-scope block and two C-scope blocks. So here the output has come. And in the original version, we cannot see the points which comes. Like user sees a simulation, but he cannot hover over the point to see the values. We can do that through high charts or GS. Now I have changed the parameter to change the simulation time from to 600. So it will show the feature we implemented that we will show dynamic generation. Like the user did not have to wait for such long time 600 to get it simulated. It is being simulated simultaneously in the server as well as here. I just cross that to Kilsa-Cyler. This is the bar XY diagram. And I've shown the parameters. Now the parameters change will be reflected here. This is also done in a dynamic passion. Now we can zoom also and we can see the points too. So one last 3D diagram. This is a 3D block. Earlier the graph that will be generated is a 3D graph. Earlier only a PNG image was transferred from the server. So you cannot see the dynamic generation of the 3D graph. So 3D graph was also implemented. And we can also hover over the points. In original X-Cos we can't do that. Now Dutta will continue further. Doesn't that increase the server communication? Yes sir.  Yes sir, server. Thus simultaneously the thing is getting executed on server also and here also. Simultaneous execution or just transfer of data? So transfer the file is simulated there. It is executed once and then Dutta is only done. We implemented two way communication for TK scale. Let us first I will explain about what is TK scale block. TK scale block is a scale widget which allows user to choose a numeric value to the slider. And user can change the input during simulation or runtime. Mainly TK scale has three parameters. Minimum maximum normalization. Minimum maximum represent the input range and the output of the block is determined by the slider current value divided by the normalization factor. And the two way communication. Generally the two way communication is done by taking the values from the slider and generating the graph. And for this we first will generate the sliders based on the number of TK scale blocks. Also the plotting of the graph is dependent on the period parameter of the clock. So we found all the connections between TK scales and clock. That is the means TK scale means the clock one is the clock which has a parameter period. So the plotting of the graph is dependent on the period parameter. So we found in an experiment we found all the connections between TK scale and clock we found the parameters and used it and we create and we generate the slider. When the slider generates, we will take the value from the slider and we store in the file. So we will update every, we will update the file every time. Means whenever user changes the slider, we will update a new value, else the present value will be updated. Now for the two-way communication, the second phase will be plotting of the graph from these values. Basically the plotting of the graph should be done by taking values from the TK. Means the TK will send the values to the connected block. But we actually do not know how TK scale will send the values. Means we do not know the sending part. We only know about the receiving part. So we implemented in the backend which user cannot see. We replace the TK block by the, by another new block called R file read block which will take the input file and send it to the connected block. So this way means we are updating the values to a file and we'll send the file to the read block and it will send the values to the connected blocks like CM scope and CScope which will generate the graph. And this is the sample photo of our experiment and we'll show the demo. Means there are, we used in, considered this experiment. We used two CK blocks, one clock and CM scope. CM scope we generate the graph. We generate the sliders according to the count of TK scale. We used two TK scales so we generated two sliders. So whenever user changes the slider it should generate, it should reflect to the graph. This is how the two-way communication is done. Means we are changing, we are changing the values. Change in the values and TK scale are reflected in the graph that is written. Actually we are doing simultaneously read and write from the file for TK school. See in the, in the seconds, in the, in the second TK, in the TK scale too the present value is minus 3.8 and the output is minus 1.94 because it is because of the normalization factor. The output of the slider will be the input to the graph. Since it's a website, so how much time to render of the client's data? Sir, actually we are writing the whole data to the slider and we, and the file should be read, read and it should, and we should plot. So it will, it will take whole time. Means for writing, we are taking 0.1 second and for reading we calculated. Sir, it has to send the reference data to the scale scope. Yes, sir. Sir, no sir, what we are doing is actually when the user changes the slider, then only we'll update the data. Otherwise, we use the whole same data present in the file. Present, static, I can understand. That you don't have to do anything. But, that dynamic data is the same for when the moment you move the slider, the graph is changing, whatever is happening. That is great dynamic data. Yes, sir. Sir, it has to send the data from the server. Because the single user it is there. You must see any difference. But it has a number of users. It doesn't work. From 1 to 10. That's it will lag. But. We have to instantiate the users based on the session, session idea. So different users will, means, it will function. No. It will come to the same data what we have here. The session area is not up to. Sir, that data is just, it's just a logging of, logging to a file and reading. So I don't think it would take much lag. Yeah, we tried on two, means three simultaneous things. So, okay, we'll try for more, about 10. So we can try for at least five. Because we are six members, we can try for six. We'll definitely try and see what time lag is. In another new feature we implemented is XCOS for textbook companion. For this, we implemented a genetic method through which we will take the file contents and we'll directly generate a diagram without dragging and dropping the blocks. And, means, for this we have some features or specifications like each XCOS file should have a unique ID. And, we implemented a method called import XCOS which will make the, which will take the file contents and directly import on the web page. So, this can be further implemented or we can say that the future scope means implementing all the storing of files in the database and fetching the data directly from the database so that any user can view the examples on the server, on the cloud. And, this can be implemented. Thank you. There are 230 blocks in XCOS and there's defined get and set functionality for all these blocks which is written in SyLab language. Now, for the web version, we have to make code for all the blocks in JavaScript, but it was very difficult to manually write the JavaScript files for all 230 blocks. So, I developed a parser which directly converts the SyLab code which is already written into JavaScript file. And, so, now after the parser, after I made parser, the JavaScript files has been made and get and set functionalities are there for all the blocks. And, for the set and get functionalities, I had to implement some SyLab functions which are written in SyLab language into JavaScript language. And now, do we? So, adding to what my friends have done, after we set the parameters to change the block, to change the block parameters, this is how we submit them. So, after we click the submit button to the previous implementation, you can see that in the CM scope block, it shows that there are three input ports, but actually there are two input ports and the image is also getting lost. So, the previous implementation wasn't compatible with all kinds of blocks and moreover, image was getting lost. So, we have implemented it in order to reflect the correct changes which is to be expected. And the other problem we have faced is in the previous implementation, dynamic display of blocks were like, if the, this is constant, the value on the block keeps changing, but then the value is displayed as percentages. So, we have modified it so that the dynamic display of blocks will have the proper numericals. Then, like my friend has previously told that before, like, there were some blocks which weren't draggable. So, you can see that here, the block wasn't droppable on the graph. So, we have changed these blocks such that they are properly dragg and droppable and moreover, 73 blocks of the previous implementations were modified to.


Hi guys, what is up? Welcome to my channel. So for today's video, we are going to be doing a shop or drop where I go through trend moods Instagram page and I talk about the new makeup releases and whether or not I will be shopping them or dropping them from my wish list. Of course, this idea was originally inspired from Samantha March's Will I Buy It series? And I don't know, I really love it. It's just fun to sit and talk about makeup. I hope you all are continuing to stay healthy. I know I just talked about this two days ago, but it, I feel like so much is changing every single day. Like two days ago, they were limiting gatherings of 250 people and now it's like 10. All of a sudden, all of the bars and restaurants and movie theaters and gyms are closing down. Like it's really crazy. It's very scary. So I hope all of you are doing what you need to do to keep yourself healthy and your loved ones healthy. Crazy times, I feel like as far as my job goes, I'm like in limbo, it's a lot. It's very stressful. So let's distract ourselves with some makeup and talking about makeup releases. Also, I haven't worn false lashes this big in like months, I feel like. I've been so into natural lashes or very light false lashes. So dang, I feel like these are taking up my whole face. Everything I'm wearing will be down in the description box. I'm sorry, I didn't film a tutorial. I think the eyeshadow palette I'm using is limited edition. Don't hate me. Let's scroll down. It's been a few weeks since I've done a shopper drop if you don't know how it works. I talk about an item. I tell you if I will be shopping it or dropping it and giving you my reasons why. So the first product that I want to talk about are the Hooda Beauty Little New Obsessions Palettes. And these are the pastel ones. So you have a pastel rose, a pastel lilac, a pastel mint. At first, I was very uninterested. And then, you know, I got in my own head and I was like, do I need these? Maybe I do. Like I already have all the other ones. Shouldn't I pick these up? And you know what, at the end of the day, I don't need these. I stayed strong. I didn't pick these up because these are available now. And me staying strong and not purchasing these was the right thing to do because my friend here on YouTube, Patti Alonso, she posted a review recently of all these and they just didn't look that impressive. I did pick up this Morphe palette where pretty much it's all pastels. So I think I'm set as far as pastel goes. And I don't know, these little guys from Hooda Beauty, they seem to be a little bit inconsistent. I'm just not that impressive. You never know what you're gonna get. And I'm sure you can create some pretty looks with them. But at the end of the day, I will film a video with these and never use them again. So I'm just gonna save my money, pass on these. Not that interested in them. They don't look that good. So those were dropped from my shopping list. So next item that we have is from Too Faced. And these are the Peach Perfect Instant Coverage Matte Concealers. These look quite reminiscent of those Nars Concealers that are in a jar, which I do like that concealer. I really like Too Faced's concealers. So I'm very tempted with this one. I'm still unsure whether or not I want these. I feel like it's one of those items where I'm not gonna purchase them on initial release, but I know I'm going to purchase it once I see it in store. So right now it's on the drop part of my list. But I am intrigued because I do really enjoy the concealers that Too Faced comes out with, just their complexion products in general. I seem to have a lot of success with. So I am interested in these, especially for spot concealing because my acne scars right now are making me not happy. So I am interested in this, but I also like it's Too Faced and I kind of don't want to support them. I don't know. I don't know. We'll see. All right. So these new Persona blushes have come out. And I do have a few items from Persona that I really do enjoy. I really like their highlighters and they have very beautiful lip products. So you have these new blushes that are for the summer I guess. You have Georgia, which is a peach and then Karma, which is a rosy mauve. Those colors look so stunning. These are the last thing that I need, but they look like such great everyday colors. So far I have heard a lot of good things about these blushes as well. And I think it's a great company to support. I am going to pass on these for now, drop them from my list because quite honestly, I don't need them at all. I have so many blushes, but I'm really on the struggle bus with these because they look absolutely stunning. And I don't own a ton from Persona, but it is a brand that I do want to support. Tentatively dropping it from my list. But if I ever see it like an Ulta or something, I can definitely see myself picking it up. So right now I'm not going to get it, but it hurts me to say so. Ooh, okay. So I've been wanting to talk about the ABH and Nicole Guerrero kit coming back. I was at first going to purchase a fresh one because I did purchase the original palette when it came out a couple of years ago. And I loved it. It was my go-to highlight palette when I was in college because back then it was all about how bright and obnoxious you could get your highlighter. Now I'm not so into it. So that is why I'm like, maybe I shouldn't pick it up. I still have that palette. It's so fine. It still works. And I haven't reached for it because I loved it so much. I didn't want to run out. So I was like, let me buy a second one. But I honestly decided I do want to save my $40. I already have a palette. I'm not so into super blinding highlights anymore. So I'm just going to keep what I have. But I do really enjoy it. If you like a really blinding highlight, I think you will like it.  I find that you can kind of just brush them away and it's fine for the shades that do have glitter. But it is a very blinding, very beautiful highlight palette. And I actually featured that palette in a video when I talked about limited edition products that I wish would come back. Like my dreams came true. That one came back and I still didn't repurchase it just because I don't need it. It's $40. I'm going to save my money towards another item that I feel would be more beneficial for me and for my channel.  I really did enjoy it. Also, a benefit is coming out with a new stick foundation to their Hello! Happy line. In the past couple of years, I have reviewed the Hello! Happy foundation complexion line. And so this is supposed to come in 12 shades, which is very limited as all other benefit products are. And I was absolutely going to pick this up and purchase it and review it for you guys. And then I wore my Hello! Happy foundation the other day. And I think it gave me horrible cystic acne. And it had been a while since I'd worn that foundation, but a suspiciously large number of cystic acne bumps showed up on my face after using that foundation. So I'm scared to try it again because I don't want that to happen again. But I also want to know because I do like that foundation. So I don't know what I'm going to do, but I'm suspicious of this foundation now because I hope there's not a common ingredient between the two foundations that would lead to cystic acne again. I probably will end up picking this one up. Right now I kind of want to brave that Hello! Happy foundation and see how that goes and then kind of compare the ingredients before I go out and purchase this stick foundation. But I am intrigued. Right now I do want to shop it, but tentatively. I have some things I need to work through first. In a couple of weeks, Fenty is coming out with some cream product. Yes, absolute shop, no hesitations. I'm so excited. She's coming out with cream bronzers and cream blushes. Like I couldn't ask for anything more. I have such high hopes for this formula. I'm not a huge fan of her matchsticks. And I'd always said if she had just softened and made that formula a little bit more creamy, she would be onto something. Like that product would be amazing. There's so many different colors. They're so versatile, but I am so happy to see that she's coming out with actual cream product. So I am assuming they're going to be way more creamy than the matchsticks. I am so excited for these. I want to pick up two or three colors of the blushes. Maybe one or two bronzer colors because I love cream bronzer and blush. I've never been a huge cream highlight person, but cream bronzer and blush, there is nothing more natural on the skin than a cream product. It just looks like your skin. I know I love my powder products, but oh my gosh, I just love the way that cream products blend into the skin, especially bronzer and especially blush. And she looks like she has a lot of fun colors in here. And I'm so excited for these. I absolutely will be shopping these. Will be spending a pretty penny on these items. So super excited. So it looks like Patrick Taw is coming out with some new eyebrow products. So these look very interesting. So you have a tinted shaping wax. I'm probably going to be dropping these, though I am intrigued because Patrick Taw does a beautiful fluffy brow. And even though I don't think I will ever have thick enough brows to achieve a fluffy brow look, you know, if he can do it, like why can't I, you know, if I have his products? For the most part, I would say the Patrick Taw line hasn't super impressed me. I think he has some nice products in his line, just kind of nothing exceptional, but nothing bad at the same time. Every product that I've had, I've had things that I could say could have been better. I still find myself using them because he does come out with such beautiful wearable colors. So I'm going to say drop just because I really don't need this. But if reviews come out and they say this is incredible, I'm totally going to eat my words and buy it. For now, I'm going to say no, I don't have nice enough thick, fluffy brows to be able to pull off a product like that. I need to fake it with actual real pencil color in my brows. So drop for now. Ooh, this one I am so excited to talk about. This is the Ofra Cosmetics and Samantha March collaboration. And of course, how fitting. I'm doing a video that Samantha March created, like this whole type of video of Samantha March. She's the reason why everybody does these videos, but she's coming out with a collaboration with Ofra, which freaking congratulations.  So you have a highlighter duo, a blush duo, a bronzer duo, and some lip duos. And I've already purchased this today, actually the day that I'm filming this, the PR box came out and I purchased that for pre-sale. Of course, I'm so excited for her. And these products look stunning, that blush duo. Oh my goodness. Now I don't have much experience with Ofra products. I only have like a liquid lipstick from them, which I've only used once, so I don't know. But I've heard good things about their Prouder products, their highlighters in particular. So I'm excited for this to be my real introduction into Ofra. And yeah, I'm just so excited for her. The collection looks beautiful. I think it shows a lot about Ofra as a company, that they're collaborating with somebody that doesn't have a million followers. Like, hurrah! Brands are seeing the value in these smaller influencers. And she's not that small. She is quite large to me. But she doesn't have a million followers and kudos to them for collaborating with her. And I definitely think, you know, if you have the money and you enjoy her videos, please support her, so that brands can see that there are value in smaller creators. I think that if brands were to focus more on smaller creators, the entire integrity of this community would change. So Melt's Cosmetics is releasing a rust eyeshadow palette. I did have a very bad experience with the most recent palette that they released. So I'm not too moved by this one. But just in general, the tones in here, they don't really speak to me. I'm not a huge, huge fan of warm shades. I mean, I am wearing all of these cool tones right now. Like, I kind of look dead, but I like cool tones. So not a huge fan of the colors in here. Now, these are inspired from the original rust stack from Melt that everybody was obsessed with. I didn't try that either. I do like their palettes for the most part. I have a couple eyeshadow palettes that I really do love from them. But this one, color story-wise, it just doesn't speak to me. It's just too warm. I have so many warm palettes. I'm over it. I don't feel inspired by that palette. It just looks like a lot of other palettes that I own. So I'm going to be dropping that from my list. I know a lot of you guys are excited for it, and I'm sure it looks to be like it's going to be really good quality. Just kind of from the picture. So that doesn't really say much, but I'm pretty sure it's going to be a good palette. So no worries there if you are worried. Colourpop is releasing another themed collection with Disney and this is Mulan. I'm- I gotta buy it, you guys. I do. Just as I had to buy Sailor Moon, which by the way, I have not yet picked up the blushes yet. I drove to Ulta yesterday, the day that it released in Ulta stores, and they had every slot of the palette filled no blushes. And then at that point, I had missed the online order because it sold out in like one minute again. I'm sorry, but this really angers me, all right? I'm just trying to buy some Sailor Moon blushes. Is it that hard? Anyways, okay, the Mulan collection, y'all. If you are Asian, I know you're trying to buy this, okay? I am a little half Asian girl. I was Mulan for Halloween, like five years in a row. So yes, I will be purchasing this collection. And I know the colors in here, they're kind of bleh, but I owe it to myself and to a little child me to purchase this collection. I mean, the eyeshadow palette is- it's bleh colors. The face products look very pretty. They look very wearable and subdued. And I don't- the packaging is so cute. Colourpop just does a fantastic job. So yeah, you definitely need to rush to pick this up because I am sure once again it's going to sell out in like five seconds. So this is available March 18th, so I will be purchasing this. I hope you don't so that I have a better chance of purchasing it. So don't purchase it. Don't get in my way of getting this collection because you will not hear the end of it. I'm still mourning from Sailor Moon. Last one that I'm gonna talk about, this is like the last collection kind of that's caught my eye. And this is from the Mac and Selena collection. Mac, you have been stepping your game up with these collections. So I purchased absolutely nothing from the first Selena collection because it didn't interest me. But the items in this collection are looking quite fancy, quite luxurious. So this collection is set to come out in April. So right now the only picture that I have to show you right now is this beautiful highlight. Does this not look like Chanel? Oh my. If it comes in a lighter colour, I will be purchasing it because that- that's not my colour. That's not gonna look good on me. But yeah, I've seen other pictures of lip glosses and some other colour products from the line where I'm like, Mac. It's gonna be a tragedy if the quality does not live up to how the products look. Like then it'll be huge dud for Mac. But if the quality of these products can live up to how pretty that they look, Mac's like here for the comeback. Honestly, very excited. Okay, okay. One last thing that I need to talk about that I just saw. So this is from Sol de Janeiro and they're coming out with a perfume, a perfume, oh, the perfume of their scent. I don't know, it's just their scent. And ooh, it is $78. I'm buying it. Maybe not now, but the next VIP sale, shopping that for sure because that smell is so shmami-yami. Ooh, we'll be purchasing that. I'm done.  So I don't want to make editing me any more angry than I am right now. So that's all I have for today's video. Things have slowed down. There's been a bit of a lull. The products aren't as exciting, but of course, you know, I always find them. So anyways, yeah, that is all I have for today's video. Let me know the items that you are eyeing to purchase. And you know, if you let me know that you're interested in a product that I said I wasn't, maybe I'll be more likely to buy it. So anyways, that is all I have for today's video. I hope you guys enjoyed it. If you aren't yet subscribed to my channel, I hope you take the time to do so. And I will see you guys in the next video. Bye guys, have a good one.


Okay, hi, I'm Robert. I'm from your University Bochon and I'm presenting our work on scalability scanning an automatic classification of tears padding or occur vulnerabilities this joint work with the people you can see on the slide and So before we start I would like to get you on the same page what this talk is about so that we all can understand What I'm talking about later. So stock is about tears that's the protocol which you use in your browser for example if you make an HTTPS connection and We are today trying to attack this protocol and for example steer cookie to break a user session and The protocol itself consists of mainly two phases a handshake phase and an application data phase and in the handshake phase The cryptographic algorithms are negotiated in the cryptographic keys while the keys and algorithms are then used in the application data phase to actually encrypt the application data and Today we try to attack the application data so we can actually steer the cookies for example So the tears uses this concept of cipher suits on most of you probably know But cipher suit is a set of cryptographic algorithms which you can negotiate in the tears session So this is an example cipher suit and in this example We choose RSA as a key exchange algorithm We use a as is a block cipher and this block cipher is used in the mode of operations CBC and We use sha one as an HMAC and in the pseudo random function So this talk is mainly about CBC padding or occurred So we will focus on all the cipher suits which use CBC So if you are negotiating a cipher suit, which is not CBC you are not vulnerable But if you do you might be so Let's talk about the CBC mode first So this tears and CBC mode uses a concept of Mac then pet then encrypt This means that your data is if you have some data you want to encrypt you first compute an HMAC And then you'd have to fill this data up with additional padding bytes So you had some padding and depending on how long your padding is your pending look a padding looks a little bit different So for example, if you have one bite of padding just add a zero bite If you have two bites of padding you just add two one bites and if you have three bites You had three two bites and so on So it's the basis structure and the padding so after that you put all your data into the CBC encryption function And then you get some cipher text when which you can then transmit But how does the CBC encryption look like so I have a CBC decryption you sorry So this is the decryption So if you want to decrypt block of cipher text what you can do is you can just put it through a block cipher And then you compute the exclusive or with some initialization vector And then you get the resulting plain text And if you have more than one by a block of cipher text what you do is you use the previous block Exoid with a result of a block cipher operation to get the next place in text message block and you continue with that to get all the plain text message block and Eventually there will be some padding at the end of the message because You have to fill the message up So the CBC mode has an interesting property meaning that it's Malibu what does this mean that if an attacker flips a bit in the cipher text He will know that he will also flip the corresponding a bit in the plain text of the next block so you can inject arbitrary Bit flips in the plain text. So why is this problematic? What an attacker can do is he can just cut off for example the last part of a Cipher text and then suddenly the receiving server will interpret the message as padding and this can get quite dangerous So This is an example of a padding Oracle where a server receives Malfold message from a attacker and what he can if a server responds with If either if the message was invalid of the message was valid an attacker can deduce Information about the plain text of the message in this case namely that m2 x on this modification from the attacker is a valid padding and This can allow the attacker if he Continues to send method messages to the oracle to decrypt the whole message and this is obviously bad. So we don't want that so Why is this applicable in TS? So if you may have noticed yes has an HMAC so you would think oh if you manipulate the cipher text the HMAC gets invalidated this might be true, but usually you cannot Tell if the HMAC is valid or invalid before you have checked the padding This is because The HMAC is in an arbitrary position in this plain text Do you have to check the padding to find out where the HMAC is before you can check it? so in TS and Wunderbar server actually does not leak valid padding invalid padding, but he leaks usually invalid HMAC Invalid padding so you can still deduce the information if the padding was valid or invalid A secure server should always respond the same way and should not give an attacker the opportunity To know if the padding was valid or invalid So this is actually an implementation vulnerability. It's not a vulnerability in the standard in TS So we have been quite a few padding oracles in the past in TS and I'm quickly going to talk about the various types So the first one is the Vodane padding oracle tech and it's basically the first padding oracle tech on cbc mode and was Discovered in 2002 and it was originally not really exploitable in TS because in TS if you Receive an error like the HMAC was invalid the connection is closed and Additionally the error messages are encrypted. So even if the server sends different error messages, you could not tell that Which error message you actually got so There were later improvements to this attack which use timing to deduce the different error states and so on But this was the first kind of this attack Then later on there was the Poodle attack. So maybe you have heard of this attack It's a tech against sv3, which is an early version of the TS protocol and Sv3 has the vulnerability that it does not enforce the padding to be very strict So you have a lot of freedoms and the other padding bytes to choose and this can be exploited by an attacker So what an attacker does if he sees if you see some Message which looks like data HMAC padding what he can do is he can transform this message and cut off the padding bytes in the end and Move a block from the plain text he wants to decrypt into the end and the receiving server Will interpret the data in the end as padding and if this worked and the HMAC is still valid He knows or he knows some information about the data So this is quite dangerous, but this attack also affects some TS versions And there's nothing in TS which forces a server to validate that each padding byte was actually valid So the server can actually just check the last padding byte and then just happily continue ever on work perfectly fine Without any problems, but this can again be exploited for the Poodle attack. So This was actually found in a lot of implementations in the past so there are many names for these attacks and they are mostly oftentimes usually off by one errors and what These attacks taught us that you need to check each byte of the padding and you also need to check each byte of the HMAC So some implementations do not check all the HMAC bytes, which is quite weird, but this and then this does happen so Then I would like to talk about this CVE. This is an open SCV from three years ago and It was introduced when we tried to fix the Lucky 13 attack, which I'm going to talk about later and The problem here is that TS allows you to do more padding bytes when you actually want a need So if you just need 13 padding bytes and you use a yes, you could also use 29 padding bytes Yeah, the idea was that you could hide the length of the message with this feature and This CVE taught us that you could also create for messages which only contain padding so they do not contain an HMAC at all and this could When be exploited also in a padding Oracle tech So if your normal message looks like this, you could also construct messages which look like this So they contain two blocks of padding and an HMAC and the receiver of such a message cannot tell that there's no Data in it before he checked the padding so you might be able to trick the implementation into showing different behavior And it also taught us that you could do this so you could also Get rid of the HMAC and just send padding bytes and the receiver Has no possibility to tell before because He cannot check the HMAC so this was quite dangerous and There's another open SCV. I want to talk about which was quite surprising to me it was from last year and The important part of this TV is this year so there was an implementation bug in some mem compare function and it effectively reduced to only comparing the least significant bit of each byte and I was always like, okay, this is some weird architecture So this is not affecting all the open message implementations, but I thought like okay I thought it does not matter which bit you actually check but This gave us the idea that you actually need to check that the implementation checks each bit because maybe they only check the most Significant bits. Maybe they choose and check the least significant bits. Maybe they only chose to check those bits so this was quite interesting for us and Then I want to talk about the lucky 13 attack so the lucky 13 attack is also a padding oracle attack and Exploits a side channel which is actually present in the TS specification And the core idea of attack is that if you have longer padding this might result in a faster h make Computation and if you have shorter padding in this result might result in a slower h make computation The reason for this is that if the padding is longer you actually have to h make less data But if the padding is shorter you have to h make more data and this can result in this timing difference So in order to fix this vulnerability You have to have a constant time implementation, which is quite hard to achieve in practice if you will still want to be reasonably fast So but these timing attacks Like in the lucky 13 where you have to measure some h make computation timing It's not relevant for the stock. So this is quite hard as you can imagine There's a lot of room for errors because there's some network intolerances and so on So we do not consider any timing at this level at also our timings are in the second range So like 10 seconds or something so you can see it with your bear eyes And finally I want to talk about the robot attack and the robot attack is not a cbc padding oracle vulnerability but it's a bleichenbacher vulnerability that was presented last year at usenix and The interesting part for our research from this attack was that they found some new side channels So they found that some servers do not show different error messages when you send invalid messages But they actually show different behavior on the underlying layer so on the TCP layer So namely they could see that some times the server was still leaving the TCP connection open So he didn't reclose it other times he normally closed the TCP connection with the TCP finished message and other times He terminated the connection with the TCP RST So there are different interfaces you can call in the operating system to show these different behaviors and This was quite nice and we thought oh, they might be also relevant for padding oracle vulnerabilities cbc padding oracle vulnerabilities so Let's now talk about our research and padding oracles in mobile so We know that these padding oracles are known since 2002. So it's quite a lot of time for developers and engineers to Figure this attack out, but we asked us how common are we today in 2018 2019? So our idea was let's scan the Alexa top one million list and find out how many servers actually vulnerable to this attack But then we asked ourselves also how how would you actually do this? So we're quite a few ways to do this So first of what we wanted to know is which map or messages should be sent So as I've already introduced there are multiple message formats which you could do So with H make without H make only padding you could flip different bits and bytes in the padding You could different flip different bytes bits and bytes in the H makes so we were not entirely sure which messages So we should actually send when we ask ourselves Doesn't matter if he tests different versions So if a service vulnerable on TS 1.2 is it also vulnerable on TS 1.0 or maybe the other way around or other some Some statistical properties here do we need to test actually everything so other servers which are only vulnerable on one version The same for block cipher. So if you are vulnerable on triple desk, are you also vulnerable on a yes So in our minds naturally you would think probably yes, but we were not so sure We have some indication that this is actually not the case and we asked us have doesn't matter which key exchange Algorithms you use so usually it should be independent if you use RSA or elliptic curft if you hang on if you are vulnerable either You should not be vulnerable in the other Or you should if you're vulnerable in one you should also want to be vulnerable in the other and we have a very round so But the robot paper had some indication that this is also not the case for all servers for blightmacher So it might also not be the case for padding or cbc padding or occurs So what we did is we did some brainstorming session and we came up with different math or messages Which I would like to present here. So the most trivial ones is this here So it has some data is that has some HMAC and it has some padding and the padding is actually flipped in the last position And we created variations of this attacks or what we could find was bit flip Errors so we flipped once a bit in the middle of the padding and once a bit in the end of the padding or We also did the same for the HMAC. So maybe some limitations are not checking the entire HMAC So we create the variance of that too and we also created combinations of the two so Some flip bit flip in the HMAC some bit flip in the padding When we came up with those special vectors Which do not contain Application data, but they still do contain padding and they are all actually the same length So a receiver of such a method messages would not be able to tell if it's one of these messages Or one of from the slide before before you can it has decrypted the message When we came up with these two messages So what we thought is so maybe if there is not after you deep headed the message There's not enough room for the complete HMAC. Maybe some servers would leak different behavior and what we did is we removed the first byte of the HMAC and once the last byte of the HMAC so So there's a partially valid HMAC in the record and Finally we came up with was mail from messages from CV I talked about earlier which contain only padding and once where they only contain valid padding and once where they Contown only padding but even that padding is invalid. So there's not enough room in the message to fit for whole padding So we came up with 25 mail from messages in total Then we built a tool based on TS attacker, which is the framework which was developed by URI in 2016 on for CCS and it allows you to send arbitrary TS Messages with arbitrary TS contents in an arbitrary order and this is quite nice for so we developed this framework since Three years now at our chair. So it's quite mature now and based on our tool we built on top of TS attacker we built TS crawler which is Distributed crawling infrastructure I'm not going to go into the details because not very interesting a lot of engineering just and it's built on top of MongoDB and Redis to basically crawl a large amount of service at the same time so Now I want to talk about some difficulties we had during scanning how we take it those problems So first off I wanted to talk about non-determinism So we had the problem that some servers if you send a mail from message to them They might respond with a bad record Mac, but if I send another mail from messages You might get no response. So It's the server vulnerable because we did not receive an answer yet. So maybe we should just wait longer Maybe it will answer eventually So this is quite bad if you want to scan a large amount of servers. So what we did is we said, okay We wait always one second after we send a mail for messages or whatever the server responded with we will take as the answer from the server So but this still has a problem It might be that the server was just on a high load and it eventually answers with a bad record Mac So it's actually not vulnerable even after one second. So it's not a silver bullet here So this confuses us if we want to say that service vulnerable or not But even worse we had servers which responded to a mail from message a with a bad record Mac And if you send the same message again, we suddenly get a different alert message So this makes it even worse for us and we are totally confused what we should say in this case It's the server vulnerable. I don't know So what we did is What we believe the reason for this is that there's some content distribution network or some router or no behind the scenes which is actually Distributing our packets to and our handshakes to different servers and these servers are Maintained in different configurations. So the one server might be not vulnerable and respond always with bad record Mac The other server might be not vulnerable and always respond with record overflow But we sometimes get this weird non-determinism our scanning results. So it was quite bad So if we think during the scanning process that the server is vulnerable We rescan the server twice and we check that he responded on each and every message every time identical And if he did this we consider the server is actually vulnerable and if it's not if it says some variants in its answers we consider it as Not relevant for the study. So we exclude it And we had another problem So if you have 25 messages and you want to scan all the available cipher suits to find all the possible vulnerabilities and Maybe to supported versions you end up with already a lot of handshakes You have to do for each server and with a rescanning on vulnerable servers Which gets even worse and if you want to scan the Alexa top 1 million list which may contain 1 million servers You end up with a lot of handshakes. So what we asked ourselves is actually necessary to scan all the different cipher suits This is necessary to scan with all 25 messages or maybe our messages Just bad and we did just choose them wrong. So we came up with a minute brainstorming session after all and our solution was that we test 50,000 servers and Check what is actually necessary to scan so maybe we can cut some corners for the larger skin of Alexa top 1 million list So what we did is with within this prescanning phase We scan with TS 1.0 and eva TS 1.1 or TS 1.2 because they look very similar We scan with all available cbc cipher suits from the server and we scan with all the 25 method messages and check for check the results for Yeah, so From the results with it shows that yes, you actually do need to check different TS version So some servers are only vulnerable on TS 1.2, but not vulnerable on TS 1.0 so If we want to find other routes, we need to check that Block ciphers. Yes, some servers are only vulnerable on triple desk for example and not on AES And the other way around but they still support the other mode so This bad and key exchange algorithms sadly. Yes So there are some servers which are only vulnerable if you use AES CBC and RSA, but they are not vulnerable or if you use AES CBC on ecliptic curved if you have one so if you want to find all the vulnerabilities also a key exchange algorithms have to be scanned and Finally, we looked at the messages which were required to find all the vulnerabilities So if you we would have sent only those four messages during the evaluation We would still found the same vulnerable servers. So there's quite a lot of Improvement we can do here. So all the other messages are not entirely relevant if you just want to know if the servers vulnerable or not So when we go went to scanning by Lexa top on million is with exactly this configuration so all the cipher suits two sets of versions and These four for messages and looked at those results. So this took us roughly 72 hours with all the rescanning and Roughly 78 percent of the servers responded on port 443 So they wanted to speak TS with us and from both servers at at least 1.83 percent are considered vulnerable So they responded identically to three rescans the same and they were vulnerable on all three of them in the exact same way and This is quite a lot for 2018-2019 so 17 year old vulnerability So what we asked ourselves is how many actually different vulnerable implementations that we had so this is all just one Vulnerable implementation are they actually multiple implementations at work So what we then did is we think I printed all the vulnerable servers in a way with where we send all the 25 mail from messages and Create some sort of finger print which you could use to compare the vulnerabilities so These fingerprints look like this so for in this example on the left side You can see the message we send and on the right side you can see response from the server so in this case it responded with a bad record Mac and the TCP thin and If you add all the other messages you suddenly get something like this and you can see that There the server is actually vulnerable because it has a behavior difference So it responds different to our mail for messages. So an attacker can observe this also In this case with a record overflow So in total we found 93 different vulnerable finger prints So if you assume that there's no possibility in implementation to change your fingerprint because why would there? This means that we are likely 93 different vulnerable implementations deployed in the Lexa top 1 million So this was quite bad, but we wanted to cluster those vulnerabilities even more So we've discovered that some servers are Not vulnerable in the same way even all if they have the same vulnerable fingerprint So in this example all the servers have the same vulnerability fingerprint So they all respond to the same mail from messages and they're exactly the same way But they are not vulnerable on all the cipher suits of their support in this example server a is only vulnerable on AES 256 cbc char and this is not vulnerable on triple desk, but it supports triple desk So the B is vulnerable on both cipher suits and server C is only vulnerable on AES 256 but it does not support triple desk. So we could not test if he's vulnerable at all So what do we know from this? So we know that server a is clearly not server B because You cannot configure your triple desk implementation to not be vulnerable. So they are likely using a different implementation And we also know that a could be the same server server C and B could be the same server services So they are not contradicting each other So what we did is to find even more vulnerabilities as we Rent some clustering. So what we did is we draw some graph where each node in the graph Is a server we scan for and when we drew an edge between these nodes if the server could be the same Implementation so if they could not be no edge if they could be the same They all drew an edge So then we asked ourselves, okay, there are quite a lot of service. How do you actually visualize this? So to do this we used the Gafi software, which is a graph software, which you can manipulate large graphs and the force at this to algorithm The force at this two algorithm is a simulation based Graph-trying algorithm. So what it does is it rent some sort of physical simulation where each nodes generally repel each other while edges force the nodes to attract each other and then it's just Let's the weights run out and there's some Distribution and this is what I'm actually going to show you now How this looks like so This is the Gafi software and here are is our graph and as you can see you can see not a lot because There are a lot of edges and a lot of nodes, but you can actually pull them aside So you get an idea of how many edges there and what I want to do now is I want to color these nodes So that you can actually seek a little bit more and what I'm going to do is I'm gonna color these nodes based on their degree So based on their number of edges So all the nodes which have the same number of edges get the same color and I can do this like this And suddenly you can still see not quite a lot, but a little bit more But now you can run the force at this to algorithm and I'm actually going to run its slow motion Because it looks quite cool if you do this But it will actually cluster the vulnerabilities for us, so I'm going to start this now And you get something like this As you can see this is a physical simulation sort of so you can see still see some movement So it will never stop to wiggle around But what we can actually see is that there are at least two big groups of servers and I'm going to analyze them now on the slides back again, so Okay, so this is basically our example. I just rotated it and shows different colors and What you can see is that the top group so the green group is actually the ones which is vulnerable on both surface suits While the tier group between the two bigger groups of the ones which are only vulnerable on triple desk So there could be an either group so either the big green group or the purple group So we have edges with both so we are torn apart by those larger groups and the group below is Not vulnerable on a yes, it's only one of the on triple desk So it clearly is not the same implementation as the green group But it could be the same as the tier group and also there's the one some service in red and at the bottom You can see so they are red because they have a different degree because they do not share Edges with the tier group. So they are very likely purple, but they are very likely not tier so You can use this information now To pick the biggest sides of each group and to contact the vendor to try to ask them Politely if they tell you which implementation is responsible for this So now let me talk quickly about exploitability. So a Big factor of if you're actually vulnerable to this the techniques actually apply to this the fact if it's observable, so This is an example of a vulnerable server So sometimes responds with a bad record Mac sometimes responds with record overflow, but in TS in general Those alert messages we during the scanning process We have the keys for the for those messages so we can decrypt them, but not during the exploitation phase So if we had the keys, we could also decrypt the message. So we have to See this difference without having the keys So what we actually see is we see two encrypted alerts and we as an attacker have to differentiate them So it's not trivially in some cases But in other cases we actually get some side channel for example this case We get the two encrypted alerts in both cases, but sometimes we get a TCP thin and sometimes we get none So in this case, it's clearly for an attacker You can just scan and look at the behavior of the server and then he knows if he receives a thin the padding was What was it a record overflow and in the other case? It was a bad record Mac So this can be explored by an attacker. So this is observable recall this and there are other cases where you have something like This so sometimes you get only one alert or two alerts. This is also clearly observed by by an attacker He does not need imperfect side channels to deduce if The padding was valid or invalid. He can directly see this So if you open wireshark, you can also see this. So there's no no sub nanosecond side channel or something So and then we classified our padding oracles in different groups namely weak strong and poodle oracles so the poodle oracles usually do not check all the padding bytes of the method messages and But they still require invalid h-max. So if you would want to exploit them You would need to run some poodle style attack so it's always differs a little bit depending on the exact vulnerability, but this is your general attack strategy here and They are definitely exploitable because the poodle oracle attack actually works. So This is definitely true and then there's the strong Oracles so these can be exploited with a classic Padding or okay as you would see it in a textbook. So there's no not much magic here But then there's the weak oracles and the weak oracles oftentimes require more than one block of padding to be To show this behavior difference And if you want to exploit this this can get quite problematic as I want to show you now So when I showed you this graphic where I showed you that an attacker can introduce bit flips I actually liked it quite a little bit. So maybe I've seen it because if an attacker flips a bit in C1 He also flips the plain text of message M1 to something completely random Which he cannot control and this makes it quite hard for the attacker to construct all arbitrary mail-for-messages from an HTTP request so And this is just one example So sometimes this attacker is limited in a way to create this mail-for-messages which create Show the behavior difference. So we call these oracle weak oracles and we consider them not exploitable because they oftentimes allow you only to reduce To decrypt one block of plain text or something and not consecutive blocks So in total we consider a server to be a padding oracle to be exploitable It's either a poodle or strong oracle and it is observable So an attacker does not need any additional side channels or tricks to see the behavior difference and from our scanning We could show that sixty one point four percent of a vulnerable source actually observable So most of them and in total fifty seven Fifty-seven percent of the vulnerable source are practically exploitable So they have won't either a poodle oracle or strong oracle and they are also observable so Let me go to our findings now. So We found quite a few CVE. So we found over which is an open as C tricks a five sonic war oracle and We could not attribute all our vulnerability. So we politely ask the website owners if they could tell us which implementations They use but sometimes we tell told us sometimes we didn't and then we cooperate with the vendors to Actually fix the one to get a fix for vulnerability and the most prominent one is here the open as a vulnerability and it was actually found with help of the Amazon security team and This one which is very special because we obviously scanned open as a before in a lab setting. So we actually Checked and it was not vulnerable because there's an exam application with open as a which we tested and everything was fine So we were quite surprised when Amazon told us that this is actually open as a which was vulnerable and the problem is that Open as a response differently if you use the API in a certain unintended way so And this is how we saw the open as a vulnerability So you may you may be able to spot the vulnerability So as you can see the response from the servers There's the TCP finished message missing and the messages which do not contain application data but do contain valid padding but an invalid HMAC, so it's the Poodle style vulnerability and This is quite bad, but there might be other vulnerabilities which just showed to us differently because depending on the application They might respond a little bit differently, but the general pattern is the same so during this closure process we notified the biggest sites and and Try to get those problems resolved and as you can see we were quite unsuccessful with that So from five reports, we got to No response or they just didn't care and we have two times we get Non-applicable, which means You get negative points. You should not bother them with such attacks again and actually only one side Fix the vulnerability by disabling cbc cipher suits and they gave us seven points. So in total we got minus minus three points on Hacker one so If you also want to get minus points on Hacker one You can download our tool TS scanner. It's on Github You can also check for padding Oracle vulnerabilities and maybe you can help attribute those vulnerabilities because there's certainly a lot of vulnerabilities which are not attributed yet and What I'm going to do now is I'm going to show you a demo office to us. So you get an idea how this looks like So Yeah, I have Open a cell and an old vulnerable version So it's not the one that we found but it works quite well in this demo and on the left side You can see our tool TS scanner and what I'm going to do it's written in Java So excuse me, but what you can do is to specify to which server you want to connect So I'm running local hosts. I'm scanning that and When I say I want detailed Reports so we can actually look at the padding Oracle vulnerability so if I run this it will take some time because I'm running it in single-threaded mode because I Do not want to over them the single-threaded OpenSSS server with requests and After some time we should get a report if the server is vulnerable or not So let's wait some seconds. Yeah, it's quite a lot of handshake. Yes Okay, actually, I think I'm not going to let it run to the end. I think it takes like two minutes What I'm going to show you is this year. So this is the finished report. So So it gets a lot of noisy input because there are a lot of Cypher suits so you can see basic information from the tool like which Cypher suits it's a part similar to other TS can ask and it also reports you about the Vulnerability to service and as you can see this one has a lot of vulnerabilities But for us the most interesting one is this year and it's vulnerable to padding Oracle sets true And what you can see is oh, it could not identify which server this year was but I scanned and show you something like this So you can see the different Cypher suits will we scan for you can see the different version We scan for and you can see if we found a different behavior difference. So in this case RSA EDR and CBC mode seems not to be vulnerable but if you look here There's an AES Cypher suit and it's actually vulnerable because it says you can differentiate the alert message contents So it's vulnerable and what you can see below is the actual response fingerprint. We got so On the left side. There's this graphics I showed you before encoded in some strings and on the right side you can see the actual responses so to most messages it responded with a bad record Mac alert and it's In the Mac alert was encrypted and then it closed the connection with the TCP fin but for these two records it's responded with a record overflow and Also close the connection. So it's not observable But it's definitely one of them Okay, I think with time for another demo or I think I skipped it. So So let me come now to our contributions and conclusions. So we found 93 different vulnerabilities in that extra top 1 million We will try to responsibly disclose our findings as good as possible to the affected vendors and websites and We released open source tools that you can actually reproduce our research and Find the vulnerabilities yourself So in conclusion, I hope we are convinced you that large scale scans can help to uncover new vulnerabilities which do not show in lab settings because actually servers sometimes use for software in a different way and What I also want to emphasize is that cbc With an end Mac then in crypt scheme is really really hard to implement correctly So it has to be side-channel free completely. It has to be constant time. It's quite hard And so maybe it's time for us as a community to remove cbc support entirely from the client software as well as from the server software And with that, I'm Ready for questions Okay, if you have any questions, please come to the micro and maybe introduce yourself So I'm John Kelsey. Hi nice to you So I just wanted to ask you said that there were 93 different fingerprints that you found It's hard for me to imagine that there are really 93 entirely different implementations of TLS. Maybe that's just me being naive I'm a cryptographer. I'm not a software guy, but I was kind of wondering if it sounds like you found an instance Where just the same toolkit was being used slightly different ways Giving you like with open SSL I was wondering if you think that you where you think this large number comes from like could it be hardware, you know like I know sometimes you'll have assembly language Implementations for different hardware that seems like that's a place for you to get very different behavior. Yeah, so I think the most probably Reason for this is there's a long history of TS version. So even if you run a Now secure version and maybe run an order version of that same one which is one of them Maybe the vulnerability changed among different versions, but the most thing I learned Just recently is that there are some vendors which have multiple products in combination So they have some application firewall and some servers and maybe both are vulnerable and very do produce some weird combination of Vulnerability and this is why we sometimes see those those large numbers But if you would look at the distribution of our vulnerabilities, most of us have the same one which is so they're like 10 prominent ones or something And then there's a large number of vulnerabilities which are only affected by force or something I don't have any question. I just bought at your mistake on one of the slide. Can you go to the results slide? Excuse me. Can you can speak up? Sorry, I don't have question, but I just bought at your mistake in your one of your slide. Can you go to the results slide to which slide results? The narrating the results you are talking about, right? The previous one. Yeah, the third one six four nine three is probably is not a fi CVE. I think it's six five nine three Okay Okay, thank you, okay, thank you very much. I think we have to correct it on our website Okay, thank you, please think about again