SSL not so secure after all?
By Davey Winder in Editorial
Posted in Data Protection, Security, Internet, e-commerce on
With most of the media coverage from the Black Hat Las Vegas conference covering the Apple iPhone SMS hacking story there is always a danger that some other really rather important news gets rather buried away. Such as the small point that security researchers at Black Hat were demonstrating some really rather worrying vulnerabilities that impact upon that most sacred of security protocols, the Secure Sockets Layer.
Moxie Marlinspike showed how man-in-the-middle attacks can fool web browsers and email clients into thinking a fake site was legit, courtesy of flaws in SSL by intercepting traffic by way of a null-termination certificate. Marlinspike has adapted his SSLSniff tool to get spoofed SSL pages and log all incoming and outgoing traffic instead of it going via an encrypted channel. While Firefox 3.5 is protected against the attack, earlier versions are not, nor is Chrome or IE8 although because the latter has code signing certificates as an additional security layer it is harder to pull off.
Dan Kaminsky, yes the same Dan Kaminsky who uncovered the biggest DNS flaw ever last year, was also presenting on SSL insecurity. Along with Len Sassamna he managed to fool one Certificate Authority into issuing a certificate for a domain he did not own by using a naming trick that exploits a vulnerability in the X.509 protocol for generating SSL connections.
Rated: 60% (2 votes)
Loading ...Pingback by - August 2, 2009 on 10:27 pm
[…] approval, while other ODMs in china are pausing production to see what is actually released. SSL not so secure after all? - itpro.co.uk 08/02/2009 With most of the media coverage from the Black Hat Las Vegas conference […]
Comment by otherbizguy - August 4, 2009 on 6:17 pm
Not only is Firefox immune to sslsniff, but most of the major players also have safeguards in place to prevent this kind of attack. Really, null-termination is only effective on sites without the best encryption, or who use a combination of EV and DV certs, for example (the practice of which has been causing a bit of buzz lately). Really, it’s not SSL that isn’t secure — extended validation is still the strongest encryption around — it’s browser and website development. But, I agree that this shouldn’t be overlooked.
Comment by - October 9, 2009 on 8:02 am
i like this
Comment by - November 4, 2009 on 10:23 am
Hello, I want to thank you for this nice blog.
Trackback by - February 9, 2012 on 8:42 am
soap news general hospital…
[…]practice in the location of game[…]…
Make a comment
Tag cloud
Archives
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
Most commented posts
- 80 percent of viruses love Windows 7
165 comments
- Has Microsoft gone mental?
- Has the US Army declared war on Windows 7?
- Cuil frozen out: market share drops to next to nothing
- Xbox 360 FAIL
- The 24GB RAM Desktop is born
- Use old version of Windows instead of Linux, says teacher
- Microsoft reveals time-based licensing model
- How Marblecake Hacked Time
- Nexus Two - The Next Generation
Highest Rated Blog Posts
- Why ecommerce fails (100%)
- Google Chrome stands alone at PWN2OWN (100%)
- Betting on Hubdub technology (100%)
- Has Google gone insane as GMail goes back to beta? (100%)
- Chinese whispers as government implicated in UK hack attacks (100%)
- Crimeware toolkit targets 10,000 trusted sites (100%)
- Black Hat risk to migrating VMs (100%)
- Tough on cyber crime, tough on the causes of cyber crime (100%)
- Firefox 3, Beta 4, Enhancements 900, Tested 5 (100%)
- Has the US Army declared war on Windows 7? (100%)
