Patch for flaw in key Internet protocol

Jan 15, 2010 by Lin Edwards report
Internet map as of 16th January. Image: Internet Mapping Project, Bell Labs/Lumeta Corporation

(PhysOrg.com) -- A flaw was found in November in a key Internet protocol that encrypts most sensitive online transactions and communications, including credit card and banking transactions. A patch has now been developed by the Internet Engineering Task Force (IETF), but it may take some time to be fully implemented.

The flaw is in the Transport Layer Security (TLS) protocol, which is the IETF term for the Secure Socket Layer (SSL) protocol. SSL/TLS is built into Web servers and browsers to protect sensitive information. The flaw was found by Steve Dispensa and Marsh Ray of an authentication company in Kansas called Phone Factor, and allows an attacker to hijack and insert commands into the start of the encrypted conversation between a web browser and the web server.

The flaw exploits a feature of TLS that allows a to change some parameters of an encrypted session while the session is in progress. This has serious implications, as demonstrated on by one researcher. who demonstrated it could be used to order the server to reveal the victim's password. It could also potentially be used to draw money out of a victim's bank account.

One of the authors of the draft security extension for the protocol, Eric Rescorla, said the flaw in TLS shows how difficult it is to design security protocols to protect communications on the Internet. The flaw could not be exploited without considerable technical knowledge on the part of the attacker, but it is still significant because servers and clients are open to attack even if they have implemented the protocol perfectly.

The IETF has not published its official Request for Comments (RFC) document for the security extension, which is to be known as the TLS renegotiation indication extension, but Ray say the fix is stable and several groups and vendors are working on implementing it.

Deployment of the fix for commercial products that include SSL/TLS will take time because much interoperability testing will be required before vendors can ship it, and it affects a large range of products. As a workaround, most vendors have simply turned off TLS renegotiation, which does not appear to have caused many problems. Some devices, such as printers and webcams will probably never be patched because they are rarely handling critical information that would make a "man-in-the-middle" attack such as this worth worrying about.

Explore further: Turkey still hopes Twitter will open local office

More information: Internet Engineering Task Force: www.ietf.org/

Related Stories

Improving the security of Internet exchanges

Mar 20, 2009

(PhysOrg.com) -- TLS is the main protocol used today to secure exchanges over the Internet. The protocol has been subject to attacks in recent years, resulting in identity theft and data tampering. To address these problems, ...

Automated analysis of security-sensitive protocols

Oct 25, 2005

The sheer number and variety of security protocols for Internet applications under development makes it difficult to be sure that any one protocol is 100 per cent secure from attack. Now an automated tool can systematically ...

Recommended for you

White House updating online privacy policy

3 hours ago

A new Obama administration privacy policy out Friday explains how the government will gather the user data of online visitors to WhiteHouse.gov, mobile apps and social media sites. It also clarifies that ...

Net neutrality balancing act

22 hours ago

Researchers in Italy, writing in the International Journal of Technology, Policy and Management have demonstrated that net neutrality benefits content creator and consumers without compromising provider innovation nor pr ...

Twitter rules out Turkey office amid tax row

Apr 16, 2014

Social networking company Twitter on Wednesday rejected demands from the Turkish government to open an office there, following accusations of tax evasion and a two-week ban on the service.

How does false information spread online?

Apr 16, 2014

Last summer the World Economic Forum (WEF) invited its 1,500 council members to identify top trends facing the world, including what should be done about them. The WEF consists of 80 councils covering a wide range of issues including social media. Members come ...

User comments : 4

Adjust slider to filter visible comments by rank

Display comments: newest first

tkjtkj
3 / 5 (2) Jan 15, 2010
we note that the Diffie-Hellman algorithm also suffers from a risk of a MITM attack, and even though it was fixed with the newer 'Authenticated DH', its STILL not widely implimented/disseminated!!!!
So, how many years will this lil project require!?
tkjtkj@gmail.com
PinkElephant
not rated yet Jan 15, 2010
As a workaround, most vendors have simply turned off TLS renegotiation, which does not appear to have caused many problems.


Stupid question #68: so why the hell does this feature even exist, if it adds complexity, presents a security risk, yet nobody really uses it for anything worthwhile?

Just get rid of the thing, instead of trying to fix it!
Rynox77
not rated yet Jan 15, 2010
Pink... you are correct that any element of complexity inherently adds a security risk. My guess, not knowing all the details, is this is some old feature that is used for backwards compatibility.
PinkElephant
not rated yet Jan 15, 2010
@Rynox77,

I'd buy the "backwards compatibility" argument, if they didn't state in the article that the feature has been disabled without any major disruption for customers.

Besides, even if there was a backward compatibility concern, for such things there's at least the concept of "deprecation": assert that the feature will go away 5 years from now, so all new devices will omit it while old devices will be retired/replaced by then...

Frankly, in this case it smells to me more like an over-engineered system than anything else. To which my response is always: KISS

More news stories

Hackathon team's GoogolPlex gives Siri extra powers

(Phys.org) —Four freshmen at the University of Pennsylvania have taken Apple's personal assistant Siri to behave as a graduate-level executive assistant which, when asked, is capable of adjusting the temperature ...

Venture investments jump to $9.5B in 1Q

Funding for U.S. startup companies soared 57 percent in the first quarter to a level not seen since 2001, as venture capitalists piled more money into an increasing number of deals, according to a report due out Friday.

White House updating online privacy policy

A new Obama administration privacy policy out Friday explains how the government will gather the user data of online visitors to WhiteHouse.gov, mobile apps and social media sites. It also clarifies that ...

Male monkey filmed caring for dying mate (w/ Video)

(Phys.org) —The incident was captured by Dr Bruna Bezerra and colleagues in the Atlantic Forest in the Northeast of Brazil.  Dr Bezerra is a Research Associate at the University of Bristol and a Professor ...

Scientists tether lionfish to Cayman reefs

Research done by U.S. scientists in the Cayman Islands suggests that native predators can be trained to gobble up invasive lionfish that colonize regional reefs and voraciously prey on juvenile marine creatures.