Stock Android OS doesn’t come with an NFC toggle in the Quick Settings. When I switched to another phone with the stock Android OS, I realized how much I miss it. After doing a quick search on Reddit, I realized I am not the only one.

My first Android app

I thought, “What’s more satisfying than creating your own? :D” With the Android developer doc and ChatGPT, I was able to create an NFC shortcut tile for the Quick Settings without compromising Android’s NFC security design.

The NFC Shortcut tile looks like this:

Instead of toggling the NFC directly in the Quick Settings, clicking the tile will open the NFC settings page instead. This way, the app does not need to bypass the Android security restrictions:

The code is on GitHub under MIT license and you can follow the instruction here to install.

Support the project

If you find this project helpful or inspiring, consider supporting it with a tip!

Tip me a coffee

In this post, I will be using MD5 as the algorithm, but this attack also applies to SHA-1 and most of SHA-2 that are based on the Merkle–Damgård construction.

What is length extension attack?

The wiki explained it pretty well. It is a type of attack where the attacker can generate a new hash based on an existing hash, a part of a message, and the length of that message.

Let’s suppose you are on a website and you saw this link with the querystring “hash=13c8f2efdf301769b8b8da1b899a3207&userId=1234” and you guessed that the server is checking to see if you are pretending to be someone else.

You guessed that they are signing the userId with an unknown secret, perhaps something like this:

function validate() {   
   $hash = md5(SECRET . $_GET['userId]);   
   return $_GET['hash'] === $hash;
}

Wouldn’t it be cool if you can still pass the check if you use something like this querystring instead?

hash=3bbcff804938a42049d0899f074d2da2&userId=1234????????&userId=1

All you did above is to append the string with some “?” encoded characters and the admin userId, then replace hash with a new hash. The key point is you are able to calculate the new hash without even knowing the secret.

Understanding MD5

In order to do length extension attack, I think we first need to understand how MD5 generates a hash. Note, I will not go into the details of the MD5 algorithm, you can read that in the RFC.

First, MD5 takes a message and split it into 1 or more blocks, each block needs to be exactly 512-bit. If the message is too short to fill the block, then we will add padding until the block is full.

For example,

$secret = 'password123';
$message = 'In the stillness of the night, whispers of dreams weave through the fabric of time.';

echo md5($secret . $message);
// md5('password123In the stillness of the night, whispers of dreams weave through the fabric of time.');

Then, the message is long enough that it will get split into 2 blocks (64 bytes each) like this:

Padding

The last block needs padding. The padding works as follow, first, append a single bit 1 to the end of the message. Then, follow as many zeros as we need until there are 64 bits left. The last 64 bits are reserved to represent the length of the original message.

Let’s go back to the example at the beginning where we have only 1 block.

$secret = 'password777';
$userId= '1234';
$hash = md5($secret . $message); 

//Output: 13c8f2efdf301769b8b8da1b899a3207

The message “password7771234” is 15 characters long. In PHP, each character is a byte so this string is 15 bytes. Remember each block needs to be 64 bytes (512 bits) long? The block would look something like this:

In binary, password7771234 + padding will look like this:

How does MD5 hash all these 512 bit blocks?

MD5 runs the algorithm on the first block, then pass that output as the input to the second block. This process continues until it reaches the last block. The output from each block is like an “intermediate state”. When there is no more block left, we will convert the last state to little-endian which is the MD5 result. Here is an illustration:

What if…

What if we don’t output the last hash? Instead, we continue the algorithm with another block with the previous intermediate hash, with some additional message and padding. Can we then generate a new valid hash?

Yes. This is the length extension attack. You are able to generate a new hash based on an existing hash, a part of a message, and the length of that message.

The attack

Let’s use the original example, hash=13c8f2efdf301769b8b8da1b899a3207&userId=1234. Suppose you don’t know the secret but you are guessing that the hash is a result of md5( <secret> . $userId). You came up with a lucky guess that the length of the secret is 11 characters long (otherwise, you will have to brute force from length 0, 1, 2, …, but you are just lucky).

Your goal is to come up with a hash that validates by extending the URL with the admin userId by doing something like:hash=f67c2bcbfcfa30fccb36f72dca22a817&userId=1234????????&userId=1

Here we go.

Step 1) Generate the hash based on the hash you already know.

We can reverse the hash back to its intermediate state, and run the algorithm on the new block.

The reverse of little-endian 13c8f2efdf301769b8b8da1b899a3207 is eff2c813 691730df 1bdab8b8 07329a89. (Here is an example of how you can use my code to find reverse the little-endian).

Then, run the MD5 algorithm on the new block with eff2c813 691730df 1bdab8b8 07329a89 and message &userId=1. We will need to calculate the new padding but that won’t be hard. We know that the length of the original message is 15 (11 is the length of the secret you guessed, 4 is the length of “1234”, 11+4 = 15). 15 bytes is less than a block (64 bytes) and the new message length is &userId=1 which is 9 characters long. Therefore, the new message length is 64 + 9 = 73. Now you are ready to run the MD5 algorithm on this block by using its previous state, a new message, padding, and the length to fill the last 64 bits. This is explained in the padding section above. Or, you can use the function I wrote to make this much easier.

The new hash is 3bbcff80 4938a420 49d0899f 074d2da2.

Step 2). Find the new string to submit to the server

In order to perform the length extension attack, we will have to provide the string that includes the full first block characters plus the new block with our attack, something like this:

So that md5(???????????1234<padding>&userId=1) === 3bbcff804938a42049d0899f074d2da2

But how do we find the padding?

Well, we guessed the length of the secret is 11. We know it follows by 1 bit. Then we know what the last 64 bits are. We also know everything in between is 0s. In other words, we know it looks like this:

Therefore the “padding” are the blue, orange, green bits. If we convert them to ASCII and URL encoded, it will be

1234%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00x%00%00%00%00%00%00%00

Putting all of these together, our attack string will be:

hash=3bbcff804938a42049d0899f074d2da2&userId=1234%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00x%00%00%00%00%00%00%00&userId=1

To generate this padding string, you can also use the function I wrote so you don’t have to write out all these 0s and 1s.

Links

• The PHP library I wrote https://github.com/harriswong/md5-lea/
• MD5 RFC
• Length extension attack wiki
• Skullsecurity’s blog post – Everything you need to know about hash length extension attacks
• How does MD5 work in very simple terms
• Lots of Googling

Here we go again, my first post! Hello world!