<story><title>How we broke PHP, hacked Pornhub and earned $20k</title><url>https://www.evonide.com/how-we-broke-php-hacked-pornhub-and-earned-20000-dollar/</url></story><parent_chain><item><author>justinlardinois</author><text>Hash functions designed for hash tables are generally not hard to find collisions for, so there&amp;#x27;s not much that can be done. You could shoehorn in a secure hash function, but that would hurt performance.</text></item><item><author>nickpsecurity</author><text>Dude, that&amp;#x27;s horrific. I figured some secure coders wouldve at least implemented a better JSON one by now since it&amp;#x27;s relatively simple. Or are they already available but dev&amp;#x27;s often rely on these broken ones?</text></item><item><author>CiPHPerCoder</author><text>Even JSON isn&amp;#x27;t great. It&amp;#x27;s still a hash-collision DoS attack vector.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;paragonie.com&amp;#x2F;blog&amp;#x2F;2016&amp;#x2F;04&amp;#x2F;securely-implementing-de-serialization-in-php&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;paragonie.com&amp;#x2F;blog&amp;#x2F;2016&amp;#x2F;04&amp;#x2F;securely-implementing-de-...&lt;/a&gt;</text></item><item><author>krapp</author><text>The takeway:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    You should never use user input on unserialize. Assuming that 
    using an up-to-date PHP version is enough to protect 
    unserialize in such scenarios is a bad idea. Avoid it or use 
    less complex serialization methods like JSON.&lt;/code&gt;&lt;/pre&gt;</text></item></parent_chain><comment><author>Scaevolus</author><text>Having per-table random seeds and properly designed hash function prevents remotely forced collisions. This is the typical defense against hashtable DOS.&lt;p&gt;It has to be done properly, of course -- for example, a poorly designed hash function could have characteristic collisions for many different seeds.</text></comment>
<story><title>How we broke PHP, hacked Pornhub and earned $20k</title><url>https://www.evonide.com/how-we-broke-php-hacked-pornhub-and-earned-20000-dollar/</url></story><parent_chain><item><author>justinlardinois</author><text>Hash functions designed for hash tables are generally not hard to find collisions for, so there&amp;#x27;s not much that can be done. You could shoehorn in a secure hash function, but that would hurt performance.</text></item><item><author>nickpsecurity</author><text>Dude, that&amp;#x27;s horrific. I figured some secure coders wouldve at least implemented a better JSON one by now since it&amp;#x27;s relatively simple. Or are they already available but dev&amp;#x27;s often rely on these broken ones?</text></item><item><author>CiPHPerCoder</author><text>Even JSON isn&amp;#x27;t great. It&amp;#x27;s still a hash-collision DoS attack vector.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;paragonie.com&amp;#x2F;blog&amp;#x2F;2016&amp;#x2F;04&amp;#x2F;securely-implementing-de-serialization-in-php&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;paragonie.com&amp;#x2F;blog&amp;#x2F;2016&amp;#x2F;04&amp;#x2F;securely-implementing-de-...&lt;/a&gt;</text></item><item><author>krapp</author><text>The takeway:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    You should never use user input on unserialize. Assuming that 
    using an up-to-date PHP version is enough to protect 
    unserialize in such scenarios is a bad idea. Avoid it or use 
    less complex serialization methods like JSON.&lt;/code&gt;&lt;/pre&gt;</text></item></parent_chain><comment><author>JeremyBanks</author><text>I think that most major languages have fixed this for years.&lt;p&gt;Python in 2012: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;bugs.python.org&amp;#x2F;issue13703&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;bugs.python.org&amp;#x2F;issue13703&lt;/a&gt;</text></comment>