Feeds

Weak sigs found on one in seven SSL sites

Survey highlights serious spoofability

Choosing a cloud hosting partner with confidence

One in seven digital certificates that stamp the authenticity of secure web sites use a vulnerable signature algorithm, according to a new survey. The shortcoming underlines the need to drop the insecure signing mechanism before its shortcomings are exploited in more convincing phishing attacks.

Netcraft reports that 14 per cent of the SSL Certificates it analysed during a recent survey were signed using an MD5 Algorithm recently discovered to be not just weak but vulnerable to practical attack. Last month security researchers at the Chaos Communication Congress showed how a fake certificate with the same digital signature (hash) as a valid certificate might be created. The issue arises because two different inputs to the weak MD5 hashing algorithm can produce the same output.

This "hash collision" creates a means for potential attackers to submit a normal certificate requests to a certificate authority (CA) before producing a second certificate with the same signature but different domain details. Worse still it might be possible to forge counterfeit credentials for websites providing they are signed using MD5, at least according to research presented at the CCC last month*.

The MD5 hash collision weakness has been known of for months, but it's only much more recently that security researchers have outlined how flaws in the MD5 checksum algorithm undermine the confidence of SSL certificates.

Netcraft's December 2008 SSL Survey found 135,000 valid third party certificates using potentially weak MD5 signatures, around 14 per cent of the total number of valid SSL certificates in circulation. Most (128,000) of the vulnerable SSL certs were signed by RapidSSL (owned by VeriSign since 2006).

A small number of certificates from Thawte and VeriSign also made use of the flawed algorithm, although most of their certificates were rubberstamped by the more secure SHA1 algorithm.

"Other affected CAs are likely to follow suit, as SHA1 is well established and is already in use for the majority of SSL certificate signing, so it should be simple to switch to using this more secure alternative," Netcraft reports. "Once it is impossible to obtain new certificates signed with MD5, this attack will be neutralised."

Extended Validation (EV) SSL websites are all signed by SHA1 or better signatures, so didn't appear as a problem in Netcraft's study.

But even the use of SHA1 digital signing offers no long-term guarantee. "Although there are no attacks as advanced as those against MD5, it is likely that SHA1 will also be increasingly threatened by collision attacks as research in this area continues," Netcraft continues. "There are more secure cryptographic hashes available, however, so we can expect to see CAs start to phase in newer, stronger hashes over the next few years."

One option, Netcraft adds, is for browser packages to distinguish certificates signed with MD5 from more secure algorithms "so that users can exercise caution". Given the confusion already generated by browser warnings about legit websites with out of date certificates, for example, we doubt such subtle warnings would be effective. ®

*According to Netcraft, the MD5 attack requires a collision between two newly created certificates deliberately created by the attacker that are bound together mathematically. The risk is not that existing domains can be spoofed, but much more than hackers might be able to create cryptographically identical pairs of valid and invalid domains, it reckons.

However, according to researchers from Centrum Wiskunde & Informatica in the Netherlands, EPFL in Switzerland, Eindhoven University of Technology in the Netherlands and independent labs in California who presented at CCC last month, the attack creates a means to spoof existing domains.

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.