One-Fourth Of SSL Websites At Risk

Many sites havent applied patches for well-known renegotiation flaw

More than a year after the Internet Engineering Task Force (IETF) issued a security extension to the Secure Sockets Layer (SSL) protocol for a flaw that affects servers, browsers, smart cards, and VPN products, as well as many lower-profile devices such as Webcams, more than one-fourth of SSL websites havent deployed the patch--leaving them vulnerable to a form of man-in-the-middle attack.
Of the 1.2 million SSL-enabled website servers recently surveyed by Ivan Ristic, director of engineering at Qualys, more than 25 percent were not running so-called secure renegotiation. Ristic also found that among 300,000 of the top one million Alexa websites, 35 percent were vulnerable to this type of attack, which basically takes advantage of a gap in the SSL authentication process and lets an attacker wage a MITM attack and inject his own text into the encrypted SSL session. The gap occurs in the renegotiation process, when some applications require that the encryption process be refreshed.
The IETF teamed up with the Industry Consortium for the Advancement of Security on the Internet, and several vendors, including Google, Microsoft, and PhoneFactor, and came up with a fix for SSL, known as Transport Layer Security (TLS) in the IETF standard. The fix -- Transport Layer Security (TLS) Renegotiation Indication Extension -- was
issued in January of 2010 by the IETF
.
Its a paradoxical that the security of the top sites is worse than the average, Ristic says of the findings, which he presented for the first time today at InfoSec Europe in London.
Ristic says these vulnerable sites basically didnt patch for the flaw. Secure renegotiation is automatically available after patching, he says. The vulnerable systems could have also implemented a workaround--typically by disabling client-initiated renegotiation--but they didnt do that, either.
PhoneFactors Marsh Ray, who discovered the flaw, says the data unfortunately shows a typical security pattern when it comes to deploying fixes. A certain number of sites fix it right away, and then [adoption] trails off after that, Ray says.
We did everything we could. We got the vendors in a position where they could offer patches. You can lead a horse to water, but you cant make him drink it, Ray says.
SSL security has been in the spotlight for some time, first with the MITM hack by researcher Moxie Marlinspike that dupes a user into thinking hes in an HTTPS session when he has actually been redirected by the attacker elsewhere. Then came researcher Dan Kaminskys research, which exposed critical bugs in the X.509 digital certificate technology used in SSL.
I think theres no chance of getting individual users to substantially improve SSL deployment. Theres too many and virtually no one cares. My take is that we should focus on library developers [such as] OpenSSL to get them to remove obsolete features and software vendors to ship with properly secure defaults, Ristic says.
He says longer term, other efforts will help secure SSL deployment. Long term, the approach used by Google will, I am sure, turn out very well. They are using performance improvements to sneak in security improvements. For example, their SPDY protocol is 100 percent encrypted by default. So all those people moving to SPDY for performance will also get extra security, Ristic notes. Overall, our combined efforts, SPDY, DNSSEC, HSTS, and similar smaller protocol improvements will in time provide results.
Ristic and his SSL Labs team surveyed some 1.2 million servers with valid SSL certificates.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ New threat discovered: Mobile phone ownership compromised. ◂ Discovered: 23/12/2024 Category: security	▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
One-Fourth Of SSL Websites At Risk