Zero-day flaw found in web encryption

[DKT27]

Zero-day flaw found in web encryption

A zero-day flaw in the TLS and SSL protocols, which are commonly used to encrypt web pages, has been made public.

Security researchers Marsh Ray and Steve Dispensa unveiled the TLS (Transport Layer Security) flaw on Wednesday, following the disclosure of separate, but similar, security findings. TLS and its predecessor, SSL (Secure Sockets Layer), are typically used by online retailers and banks to provide security for web transactions.

Ray, who along with Dispensa works for two-factor authentication company PhoneFactor, explained in a blog post on Thursday that he had initially discovered the flaw in August, and demonstrated a working exploit to Dispensa at the beginning of September.

The flaw in the TLS authentication process allows an outsider to hijack a legitimate user's browser session and successfully impersonate the user, the researchers said in a technical paper.

The fault lies in an "authentication gap" in TLS, Ray and Dispensa said. During the cryptographic authentication process, in which a series of electronic handshakes take place between the client and server, there is a loss of continuity in the authentication of the server to the client. This gives an attacker an opening to hijack the data stream, they said.

In addition, the flaw allows practical man-in-the-middle attacks against hypertext transfer protocol secure (Https) servers, the researchers said. Https is the secure combination of http and TLS used in most online financial transactions.

The flaw will prove a problem for a long time to come, security researcher Chris Paget wrote in a blog post, as it also affects SSL.

"How about the thousands of different software update mechanisms out there that depend on SSL being secure in order to function?" wrote Paget. "This is a protocol-level breach; one that requires a modification to the way that SSL and TLS function in order to repair."

After they found the flaw, Ray and Dispensa disclosed their findings to the Industry Consortium for the Advancement of Security on the Internet (Icasi), a tech association that consists of Cisco, IBM, Intel, Juniper Networks, Microsoft and Nokia. The researchers also alerted the Internet Engineering Task Force (IETF) and a number of open-source SSL implementation projects.

On 29 September, the various groups involved met and decided to set up a project, called Project Mogul, to handle remediation efforts. It will first concentrate on creating a protocol extension as a preliminary solution. Ray said in his blog that he expected to see announcements from the multi-vendor collaboration "shortly", including an internet draft proposal for the fix.

At the September meeting, Ray and Dispensa were informed about research being done by the IETF TLS Channel Bindings working group, which was following a similar line of inquiry into the TLS protocol.

On Wednesday, Martin Rex, a member of the IETF TLS Channel Bindings working group and researcher at SAP, published a man-in-the-middle TLS renegotiation flaw in Microsoft IIS. The flaw, which is essentially the same as the one discovered by Ray, was publicised on Twitter by security researcher HD Moore.

Ray and Dispensa decided on Wednesday that the flaw was in the public domain, and so decided on full disclosure of their work.

Source

[LeetPirate]

This is serious, I wonder when they will fix it. I depend on online transactions alot.

[DKT27]

This is indeed serious. I wanted to post it from the time I got the news but didn't got the time. :mellow:

[shought]

Big news indeed...

[Toshiro]

This is serious, I wonder when they will fix it. I depend on online transactions alot.

Same here, got to warn my dad not to use it all the time and to be careful.

I'm curious on this developing story, please keep it up-to-date :)

[DKT27]

I'm curious on this developing story, please keep it up-to-date :)

For sure. :)

[HX1]

This has actually been apparent for awhile...if I remember my research correctly.. and TLS.. which is quite difficult to fully enable in your Browser.. ( FF .. and may be the only one truly capable of ONLY using TLS by itself ) relies on an identification key/certificate.. It is what US Government establishments are required to use.. so this does have quite large scale implications...It is however the best possible and the least likely to be pulled off.. So while this is of concern you can bet it will take someone skilled.. I personally am not effected as I don't have anything that would/could be 'listened in on'.. Except my e-mail.. This was also when I started my search for SHA4-512 Hash Calculations and verification...Glad I don't have services, clientèle or information to worry about however..Be nice to have HTML5, new encryption..the whole new simpler.. but safer web available soon and at the same time...This would force mass upgrades.. and quite costly to some enterprises.. but I think it would be for the best..

For those of you using ESS, there is an option you can enable to filter the data transmitted through the POP3, and HTTP protocols, employing the ThreatSense scanning technology..allows you to block invalid or corrupt certificates/information....

[DKT27]

Showin positive in a negative news. I like it. ANW I hope it gets fixed soon. -_-