Feeds

Weak sigs found on one in seven SSL sites

Survey highlights serious spoofability

Securing Web Applications Made Simple and Scalable

One in seven digital certificates that stamp the authenticity of secure web sites use a vulnerable signature algorithm, according to a new survey. The shortcoming underlines the need to drop the insecure signing mechanism before its shortcomings are exploited in more convincing phishing attacks.

Netcraft reports that 14 per cent of the SSL Certificates it analysed during a recent survey were signed using an MD5 Algorithm recently discovered to be not just weak but vulnerable to practical attack. Last month security researchers at the Chaos Communication Congress showed how a fake certificate with the same digital signature (hash) as a valid certificate might be created. The issue arises because two different inputs to the weak MD5 hashing algorithm can produce the same output.

This "hash collision" creates a means for potential attackers to submit a normal certificate requests to a certificate authority (CA) before producing a second certificate with the same signature but different domain details. Worse still it might be possible to forge counterfeit credentials for websites providing they are signed using MD5, at least according to research presented at the CCC last month*.

The MD5 hash collision weakness has been known of for months, but it's only much more recently that security researchers have outlined how flaws in the MD5 checksum algorithm undermine the confidence of SSL certificates.

Netcraft's December 2008 SSL Survey found 135,000 valid third party certificates using potentially weak MD5 signatures, around 14 per cent of the total number of valid SSL certificates in circulation. Most (128,000) of the vulnerable SSL certs were signed by RapidSSL (owned by VeriSign since 2006).

A small number of certificates from Thawte and VeriSign also made use of the flawed algorithm, although most of their certificates were rubberstamped by the more secure SHA1 algorithm.

"Other affected CAs are likely to follow suit, as SHA1 is well established and is already in use for the majority of SSL certificate signing, so it should be simple to switch to using this more secure alternative," Netcraft reports. "Once it is impossible to obtain new certificates signed with MD5, this attack will be neutralised."

Extended Validation (EV) SSL websites are all signed by SHA1 or better signatures, so didn't appear as a problem in Netcraft's study.

But even the use of SHA1 digital signing offers no long-term guarantee. "Although there are no attacks as advanced as those against MD5, it is likely that SHA1 will also be increasingly threatened by collision attacks as research in this area continues," Netcraft continues. "There are more secure cryptographic hashes available, however, so we can expect to see CAs start to phase in newer, stronger hashes over the next few years."

One option, Netcraft adds, is for browser packages to distinguish certificates signed with MD5 from more secure algorithms "so that users can exercise caution". Given the confusion already generated by browser warnings about legit websites with out of date certificates, for example, we doubt such subtle warnings would be effective. ®

*According to Netcraft, the MD5 attack requires a collision between two newly created certificates deliberately created by the attacker that are bound together mathematically. The risk is not that existing domains can be spoofed, but much more than hackers might be able to create cryptographically identical pairs of valid and invalid domains, it reckons.

However, according to researchers from Centrum Wiskunde & Informatica in the Netherlands, EPFL in Switzerland, Eindhoven University of Technology in the Netherlands and independent labs in California who presented at CCC last month, the attack creates a means to spoof existing domains.

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.