Feeds

Weak sigs found on one in seven SSL sites

Survey highlights serious spoofability

Website security in corporate America

One in seven digital certificates that stamp the authenticity of secure web sites use a vulnerable signature algorithm, according to a new survey. The shortcoming underlines the need to drop the insecure signing mechanism before its shortcomings are exploited in more convincing phishing attacks.

Netcraft reports that 14 per cent of the SSL Certificates it analysed during a recent survey were signed using an MD5 Algorithm recently discovered to be not just weak but vulnerable to practical attack. Last month security researchers at the Chaos Communication Congress showed how a fake certificate with the same digital signature (hash) as a valid certificate might be created. The issue arises because two different inputs to the weak MD5 hashing algorithm can produce the same output.

This "hash collision" creates a means for potential attackers to submit a normal certificate requests to a certificate authority (CA) before producing a second certificate with the same signature but different domain details. Worse still it might be possible to forge counterfeit credentials for websites providing they are signed using MD5, at least according to research presented at the CCC last month*.

The MD5 hash collision weakness has been known of for months, but it's only much more recently that security researchers have outlined how flaws in the MD5 checksum algorithm undermine the confidence of SSL certificates.

Netcraft's December 2008 SSL Survey found 135,000 valid third party certificates using potentially weak MD5 signatures, around 14 per cent of the total number of valid SSL certificates in circulation. Most (128,000) of the vulnerable SSL certs were signed by RapidSSL (owned by VeriSign since 2006).

A small number of certificates from Thawte and VeriSign also made use of the flawed algorithm, although most of their certificates were rubberstamped by the more secure SHA1 algorithm.

"Other affected CAs are likely to follow suit, as SHA1 is well established and is already in use for the majority of SSL certificate signing, so it should be simple to switch to using this more secure alternative," Netcraft reports. "Once it is impossible to obtain new certificates signed with MD5, this attack will be neutralised."

Extended Validation (EV) SSL websites are all signed by SHA1 or better signatures, so didn't appear as a problem in Netcraft's study.

But even the use of SHA1 digital signing offers no long-term guarantee. "Although there are no attacks as advanced as those against MD5, it is likely that SHA1 will also be increasingly threatened by collision attacks as research in this area continues," Netcraft continues. "There are more secure cryptographic hashes available, however, so we can expect to see CAs start to phase in newer, stronger hashes over the next few years."

One option, Netcraft adds, is for browser packages to distinguish certificates signed with MD5 from more secure algorithms "so that users can exercise caution". Given the confusion already generated by browser warnings about legit websites with out of date certificates, for example, we doubt such subtle warnings would be effective. ®

*According to Netcraft, the MD5 attack requires a collision between two newly created certificates deliberately created by the attacker that are bound together mathematically. The risk is not that existing domains can be spoofed, but much more than hackers might be able to create cryptographically identical pairs of valid and invalid domains, it reckons.

However, according to researchers from Centrum Wiskunde & Informatica in the Netherlands, EPFL in Switzerland, Eindhoven University of Technology in the Netherlands and independent labs in California who presented at CCC last month, the attack creates a means to spoof existing domains.

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.