A researcher has revealed ways that the SSL system could be subverted
The security of the Secure Sockets Layer (SSL) protocols widely used for e-commerce has been questioned again after a delegate at the Black Hat computer security conference showed how the system could be easily bypassed.
In his presentation, titled New Techniques for Defeating SSL in Practice, to the conference a researcher calling himself Moxie Marlinspike demonstrated a number of ways that the SSL system could be subverted by software he had written called sslstrip.
The software forms part of a ‘man in the middle’ attack which identifies HTTPS traffic and inserts itself between incoming data and the end user.
While this attack means the user will see HTTP rather than HTTPS in their browser, none of the test subjects noticed according to Marlinspike. The software can even leave the padlock icon displayed to further fool users.
Part of the problem lies in that people do not type in full URLs with the HTTP or HTTPS tag, rather just use www. and let the browser do the rest.
In a 24-hour test run, Marlinspike gathered 16 credit card numbers, the log-in information for 117 email accounts, seven PayPal logins and 300 other miscellaneous secure log-ins.
“I’ve explained a couple of things you might do, but really there’s a whole ecosystem of attacks out there,” said Marlinspike in a video interview.
He plans to release the code at the end of the week.
SSL is under constant attack as it provides malware writers with the most financially valuable information possible. Last month VeriSign said it was taking steps to beef up security on the standard.
© Incisive Media Investments Limited 2010, Published by Incisive Financial Publishing Limited, Haymarket House, 28-29 Haymarket, London SW1Y 4RX, are companies registered in England and Wales with company registration numbers 04252091 & 04252093
Do you agree?
more bad news from readers: title is wrong
As is typical of these SSL scare pieces, this is not about a weakness in SSL, but about tricking users into thinking they are using SSL when they are not. Although the details are scant, it appears that user interfaces that provide poor indications of whether SSL is in use or not are the problem. The strength of the SSL protocol itself is not in question here.
Posted by Sams, 20 Feb 2009
from my understanding...
"While this attack does mean the user will see HTTP rather than HTTPS in their browser none of the test subjects noticed according to Marlinspike. The software can even leave the padlock icon displayed to further fool users."
From my understanding (and according to an article in the Register, sslstrip CAN spoof the https url, but Moxie made a point of not bothering to do that just to show that folks aren't paying attention to their url bars (which is, admittedly, true, and the stuff you point out about typing in www is exactly right). I'm not sure if VeriSign will be "beefing" anything up, since the problem isn't with the encryption but the way that users are easily distracted from an encrypted site -- however, they and several other ssl merchants do already offer EV ssl, which may do a bit more to prevent man-in-the-middle attacks than your typical certs due to the unspoofable technology. Also, having the url bar turn green MAY get more folks to pay attention to how they're navigating their browser, but it'll only work when the grand majority of the internet is encrypted (we may soon be there).
Posted by carl_antos, 24 Feb 2009