HashDoS

#hashDoS vulnerability in popular web platforms. Presented 2011/12/28 by @zeri42 and @alech at #28C3. Smug and delusional about our English accents.

[JP Aumasson @veorq]

Ubuntu security notice for 12.10 and 12.04 regarding the Ruby vulnerabilities we reported https://t.co/8CrMpi5Gk5 /cc @_emboss_ @hashdays

[Alexander Klink @alech]

And another case where #hashDoS cannot be exploited because something weird in parsing leads to a different DoS beforehand m(

[Dmitry Chestnykh ☮️ @dchest]

One idea for exploiting Cocoa hashDoS: .plist's are everywhere. Fill them with colliding keys.

[Dmitry Chestnykh ☮️ @dchest]

. @aumasson Cocoa #HashDoS demo https://t.co/WwERdgDz

[Dmitry Chestnykh ☮️ @dchest]

@aumasson and insert them into NSMutableDictionary. Inserting 10000 colliding strings: ~4 sec, non-colliding strings: 0.32 sec.

[Ryan McBride @_mcbride]

We began purging hashtables from #OpenBSD network stack 10+ years ago for this reason: CCC talk on hash-flooding DOS https://t.co/YhDV5DC3

[HashDoS @hashDoS]

HashDoS explained with cats: http://t.co/uoCzMggA (via @heartcrazed).

[Daniel J. Bernstein @hashbreaker]

If you're not tied to hash tables then I recommend crit-bit trees. See also http://t.co/Gu8xpoSv ("Data-structure lock-in"). @zooko

[Solar Designer @solardiz]

@aumasson @_emboss_ @hashbreaker Thank you for SipHash and the #hashDoS talk at #29c3. Nice quoting of my article passage from 1998.

[Solar Designer @solardiz]

@aumasson @_emboss_ @hashbreaker I just did a quick Google web search on #hashDoS timing attacks: http://t.co/Gs3AMcQT http://t.co/mvlTSsFE

[Martin Boßlet @_emboss_]

More details on the attack on MurmurHash presented during our hash-flooding presentation at #29c3: http://t.co/rn5ffsX3

[Martin Boßlet @_emboss_]

PoC code for our hash-flooding presentation at #29c3: https://t.co/eFmCjeaT

[JP Aumasson @veorq]

the video of our #29c3 talk is now on YouTube https://t.co/1O5dOIbl cc/ @_emboss_ @hashbreaker

[JP Aumasson @veorq]

slides of our #29c3 talk "Hash-flooding reloaded: attacks and defenses" http://t.co/JiiZ32eg with @_emboss_ @hashbreaker

[Tony "Abolish ICE" Arcieri 🦀🌹 @bascule]

btrfs is vulnerable to @hashDoS /cc @_emboss_ http://t.co/PS50ArHR

[Tony "Abolish ICE" Arcieri 🦀🌹 @bascule]

Exploiting hashDoS II: https://t.co/tlkodJED

[Tony "Abolish ICE" Arcieri 🦀🌹 @bascule]

Heads up: @_emboss_ announcing that random seeds aren't good enough to prevent hashDoS #rubyconf

[Alexander Klink @alech]

#Splunk 4.3.x is vulnerable to #hashDoS. Fixed in 5.0. http://t.co/r402NJtf

[Martin Boßlet @_emboss_]

hashDoS pt. II http://t.co/rVQKtNOx

[JP Aumasson @veorq]

Mozilla's Rust language now using SipHash https://t.co/UIhoKTh3