Zero-Day Flaw Found in Web Encryption

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Well this can't be good. According to the report, the flaw in the Transport Layer Security authentication process allows anyone to "hijack a legitimate user's browser session and successfully impersonate the user."

Security researchers Marsh Ray and Steve Dispensa unveiled the TLS (Transport Layer Security) flaw on Wednesday, following the disclosure of separate, but similar, security findings. TLS and its predecessor, SSL (Secure Sockets Layer), are typically used by online retailers and banks to provide security for web transactions.
Click to expand...
 
I don't think they'd just release this information without having a patch or fix ready.

This is troubling though. :(
 
takt said:
I don't think they'd just release this information without having a patch or fix ready.

This is troubling though. :(
Click to expand...

You can't really patch the internet ;) The flaws discussed are protocol level flaws, they aren't something specific to IIS, or Apache, or Firefox, or IE, etc...

That said, after having read through it I think it sounds worse than it is. The attacks are quite real and all that, but the author discusses attacks based off of HTTPS client certificate authentication and HTTP authentication, which are very rare as far as public secure websites go (online banking, for example, uses neither).

Someone please correct me if I am wrong, but it sounds like regular HTTPS session with a valid server certificate is still secure and not vulnerable to the attacks discussed.
 
This flaw is still valid and can attack old software that relies on SSL or TLS. CA's been working around the clock to check certificates with null in them and browsers like firefox 3.5 had fix this issue. Overall if the HTTPS site have verisign or MS cert, you're probably safe.
 
kllrnohj said:
You can't really patch the internet ;) The flaws discussed are protocol level flaws, they aren't something specific to IIS, or Apache, or Firefox, or IE, etc...
Click to expand...

Yeah, but can't you patch the software that uses those protocols? The protocol is a framework, but you can change things on top of the framework to cover for inherent weaknesses.
 
takt said:
Yeah, but can't you patch the software that uses those protocols? The protocol is a framework, but you can change things on top of the framework to cover for inherent weaknesses.
Click to expand...

Of course, but understand all the stuff that needs to be patched. It will take years to correct everything that's potentially vulnerable.
 
Looks like my cac won't be going near the computer for a while :-p
 
heatlesssun said:
Of course, but understand all the stuff that needs to be patched. It will take years to correct everything that's potentially vulnerable.
Click to expand...

I'm not sure it will take years. Maybe for software not kept current or developers who are not active in their projects.

As an end user, I'm not really worried that everything be patched. It would be ideal, but not realistic. At the very least, protect the majority of users for the majority of uses.

If the problem is this pervasive, then the responsibility should lie on Mozilla and Microsoft to ensure their software which uses these protocols is fixed.
 
vengence said:
This still requires a man in the middle attack.
Click to expand...

It *IS* a man in the middle attack, which TSL/SSL attempts to prevent. The attack is that some of the man in the middle preventions have vulnerabilities themselves.

takt said:
Yeah, but can't you patch the software that uses those protocols? The protocol is a framework, but you can change things on top of the framework to cover for inherent weaknesses.
Click to expand...

Except this attack is basically to the protocol itself. The "patch" is really to change the protocol, which isn't really feasible. But as I said, it sounds like 99% of users and sites won't be affected by this in the first place.
 
kllrnohj said:
It *IS* a man in the middle attack, which TSL/SSL attempts to prevent. The attack is that some of the man in the middle preventions have vulnerabilities themselves.
Click to expand...
My word choice was poor. I was simply pointing out that this flaw does not allow an outside the loop attack.
 
Is it just me or is "Zero-day flaw" about the stupidest term ever. Basically all it means is that the flaw is not yet fixed.... Yeah, no DUH. If it is already fixed then it isn't a flaw, and if it is an active flaw it is not yet fixed.

Why isn't it just called a vulnerability, which is what it is?
 
Zero day flaw means that it is exploitable immediately. Day zero. Right now. No need to craft e-mails and have people click things, etc.
 
arentol said:
Is it just me or is "Zero-day flaw" about the stupidest term ever. Basically all it means is that the flaw is not yet fixed.... Yeah, no DUH. If it is already fixed then it isn't a flaw, and if it is an active flaw it is not yet fixed.

Why isn't it just called a vulnerability, which is what it is?
Click to expand...

Because if it is a bug on something like adobe flash, it is still a bug after they patch it in the next version of flash. It is still an active vulnerability untill every machine has patched their flash player.
 
GoldenTiger said:
Wikipedia is everything! NOTHING could be wrong on it, NOTHING!!! LOL :p.

His description is accurate.
Click to expand...

Just to add, I'd also add in there that it means it's a brand-new exploit that's not widely-known yet.
 
You must log in or register to reply here.
Back
Top