Hackers expose weakness in visiting trusted sites

Aug 02, 2009 By JORDAN ROBERTSON , AP Technology Writer

(AP) -- A powerful new type of Internet attack works like a telephone tap, except operates between computers and Web sites they trust.

Hackers at the Black Hat and DefCon security conferences have revealed a serious flaw in the way Web browsers weed out untrustworthy sites and block anybody from seeing them. If a criminal infiltrates a network, he can set up a secret eavesdropping post and capture credit card numbers, passwords and other flowing between computers on that network and sites their browsers have deemed safe.

In an even more nefarious plot, an attacker could hijack the auto-update feature on a victim's computer, and trick it into automatically installing malware pulled in from a hacker's Web site. The computer would think it's an update coming from the software manufacturer.

The attack was demonstrated by three hackers. Independent security researcher Moxie Marlinspike presented alone, while Dan Kaminsky, with Seattle-based security consultancy IOActive Inc., and security and privacy researcher Len Sassaman presented together.

They reached essentially the same conclusion: There are major problems in the way browsers interact with Secure Sockets Layer (SSL) certificates, which is a common technology used on banking, e-commerce and other sites handling sensitive data.

Browser makers and the companies that sell SSL certificates are working on a fix.

Corp., whose browser is the world's most popular, said it was investigating the issue. Mozilla Corp., which makes the No. 2 Firefox browser, said most of the problems being addressed were fixed in the latest version of its browser, and that the rest will be fixed in an update coming this week.

VeriSign Inc., one of the biggest SSL certificate companies, maintains that its certificates aren't vulnerable.

Tim Callan, a product marketing executive in VeriSign's SSL business unit, added that the "tap" won't work against so-called Extended Validation SSL certificates, which cost more and involve a deeper inspection of a company's application for a certificate.

The attack falls into a class of hacks known as "man-in-the-middle," in which a criminal plants himself between a victim's computer and a legitimate Web site and steals data as it moves back and forth.

Jeff Moss, founder of the and Defcon conferences who this summer was appointed to the Homeland Security Department's advisory council, said the fact a hacker has to actually break into a victim's network for the attack to work can limit its usefulness.

"That's the nice mitigating thing," he said.

But he warned that "for targeted attacks it's absolutely deadly. This is the way you can get everything. If you can get in the middle, you can get everything. It's a big, giant wake-up call for the industry."

SSL certificates are a critical technology in assigning trust on the Web.

Sites buy them to encrypt traffic and assure visitors it's OK to enter confidential information. Companies that sell SSL certificates verify that someone trying to buy a certificate actually owns the site that certificate will be attached to.

The presence of an SSL certificate on a site is designated by a padlock in the address bar. But many people don't pay attention to whether a padlock is present or not.

Browsers do care, though, which is why this week's talks were significant.

Browsers are programmed to block sites that don't have a valid SSL certificate, or have a certificate displaying a Web address that doesn't match the address a Web surfer was trying to reach (which can indicate someone has hijacked a person's Internet session). If the sites aren't blocked, users are warned about potential danger, and have the option to click through.

The problems outlined by researchers center on a quirk in the way browsers read SSL certificates.

Many SSL certificate companies will allow people to attach a programming symbol called a "null character" into the Web address onto the certificates they receive. Web browsers generally ignore that symbol. They stop reading at that symbol when they're checking the Web address on a certificate.

The trick in the latest type of attack is that all a criminal would need to do is put the name of a legitimate Web site before that character, and the browser will believe that the site it's visiting - which is under the criminal's control - is legitimate.

The criminal could then forward the traffic onto the legitimate site and spy on everything the victim does on that site. It's a complicated attack, but it highlights a significant weakness in the very technology widely used to assure people it's safe to navigate sensitive sites.

Jon Miller, an SSL expert and director of Accuvant Labs, said he expects significant attacks against corporations using this technique in the coming months. Criminals who run "phishing" scams, in which people are tricked into visiting phony sites, will also likely latch on.

"What kind of makes this earth-shattering is these aren't the most sophisticated attacks in the world," he said. "This is going to become a huge problem."

There are signs it's already starting.

VeriSign's Callan said within hours of the talks, his company got a number of applications for SSL certificates featuring null characters, but they were denied.

©2009 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

Explore further: Survey concludes Internet access should be a human right

add to favorites email to friend print save as pdf

Related Stories

System thwarts Internet eavesdropping

Aug 25, 2008

The growth of shared Wi-Fi and other wireless computer networks has increased the risk of eavesdropping on Internet communications, but researchers at Carnegie Mellon University's School of Computer Science and College of ...

Experts uncover weakness in Internet security

Dec 30, 2008

Independent security researchers in California and researchers at the Centrum Wiskunde & Informatica (CWI) in the Netherlands, EPFL in Switzerland, and Eindhoven University of Technology (TU/e) in the Netherlands have found ...

The Web: Mobsters extinguish firewalls

May 03, 2006

Firewall? Forgetaboutit. Cyber-criminals, including the mafia, are now so savvy they can penetrate past these supposedly sturdy security measures and hack your computer network, whether you work at a university, Fortune 500 ...

Tips for Staying Safe on the Internet

Nov 03, 2005

Dan Barker, the co-owner of Strategic Data Integration in Hillsborough, N.C., and an editor of “Certified Internet Webmaster Foundations for Dummies,” teaches the Duke Continuing Studies course "PC Threats: Spam, Scams ...

Recommended for you

UN moves to strengthen digital privacy (Update)

6 hours ago

The United Nations on Tuesday adopted a resolution on protecting digital privacy that for the first time urged governments to offer redress to citizens targeted by mass surveillance.

Spotify turns up volume as losses fall

6 hours ago

The world's biggest music streaming service, Spotify, announced Tuesday its revenue grew by 74 percent in 2013 while net losses shrank by one third, in a year of spectacular expansion.

Virtual money and user's identity

13 hours ago

Bitcoin is the new money: minted and exchanged on the Internet. Faster and cheaper than a bank, the service is attracting attention from all over the world. But a big question remains: are the transactions ...

User comments : 4

Adjust slider to filter visible comments by rank

Display comments: newest first

CSharpner
4 / 5 (1) Aug 02, 2009
Crap! Just a freaking null character and the browser(s) don't look any further? I hope the SSL cert authorities give notices to all cert owners with nulls that they'll be disabled, then actually disable them. The browser makers need to get this fix out ASAP!
gwrede
5 / 5 (1) Aug 03, 2009
The perils of the null character have been known to industry ever since the first crackers emerged. And that's decades ago.

It is a shame that most critical software today is still being developed in C/Cplusplus.[1] This affects the mind set of the programmer, as he daily works with null terminated strings.

It is high time for the industry to move on to newer languages (for example D), that are robust, more efficient, and inherently offer a better level of security.

Currently a programmer fights with pointer based data manipulation, language quirks, corner cases, gotchas and the like -- and all this means brain cells are devoted to things other than the actual task at hand. And the bosses aren't aware of the enormous difference in productivity, simply because "it's always been like this". They've never seen what it could/should be.

-----------

[1] Seems the pluses didn't stick, so I had to spell them out. !!
KCD
not rated yet Aug 03, 2009
Whoa! So that's how hackers get information that fast!
Well, there's something that the browser(s) can fix immediately for the people's safety.
Ricochet
not rated yet Aug 04, 2009
Yeah, there's a reason they use ADA for the software in aviation...

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.