Independent experts have discovered a number of serious vulnerabilities in popular programming languages ​​for web pages

The group of information security experts found in a number of web technologies used in creating Internet sites, a serious vulnerability that allows hackers to organize attacks of the type “Refusal for maintenance”, without using significant resources, RIA Novosti reports with reference to the Naked Security website.

Experts told about their discoveries at the "hacker" conference of Chaos Communication Congress in Berlin. The main vulnerability is detected in the hashing mechanism, which is used in many software environments to accelerate the conservation and extraction of data.

The vulnerability found by independent information security experts Alexander Klink and Julian Valde allows you to "collapse" the attacking server using just a few "correctly formed" requests.

The hole was found in popular technologies PHP, Java, ASP.net, Python, Ruby and a number of others.

After the announcement of vulnerability, many of the largest software manufacturers, in particular, Microsoft and Oracle, announced that in the near future they would release updates that eliminate the vulnerability in their products.

According to Walde, the Ruby developers team have already corrected most of the stated problems, however, PHP, Oracle, Python, Google and Microsoft products are still vulnerable.

How does this work

In the process of web applications in the PHP, Java, Python, JavaScript languages, and many others are used to create the so-called numerical value of input and output data. For example, when the user on the site enters the password, the program takes it and, using a hash function (mathematical calculation method), calculates the numerical value (hash) of this password.

After that, the system compares the resulting number with the one that is stored in the database (it was obtained when the user only registered on the site and first entered the password), and if the hash from the archive coincides with the hash just received, then the password is considered correct.

A password hash is stored in a hash table along with the user name, the account of which belongs to the password. Thus, the use of hashing allows, on the one hand, to additionally protect the user's personal data (the hash-function is irreversible, by its value you cannot calculate the password). On the other hand, the use of Hashi allows you to accelerate the operation of the application, since the system in many cases does not work with the data itself, but with their related numerical "digest".

The disadvantage of this method is the likelihood of a situation in which different passwords (or other data) have the same hash.

Such situations are not rare for the resolution of “conflicts” (the so -called harsh values ​​are called) special software tools carry out an additional comparison of the input data and hash generated on their basis. This method works when the number of collisions is relatively small.

The hacker can increase their number to critical, knowing the function with which the hash is calculated. In this case, it can generate a relatively small amount of data (for example, several posts in a blog built on the basis of microsoft Asp.net technology) in such a way that the hash-function will give the same values ​​for them and force the system to begin additional verification.

When a large number of conflicts appear, the audit begins to take away too many server computing resources and, ultimately, leads to a refusal to maintain.

To protect against such attacks, there are several technologies that allow you to hide a hash-function from the attacker or to recognize the conduct of attacks using multiple conflicts in time.

However, according to the researchers, in most modern programming languages ​​used to create web applications, there are no these tools, but a simple mathematical hash-function is used, which a capable hacker can calculate