Weak sigs found on one in seven SSL sites

Survey highlights serious spoofability

Securing Web Applications Made Simple and Scalable

One in seven digital certificates that stamp the authenticity of secure web sites use a vulnerable signature algorithm, according to a new survey. The shortcoming underlines the need to drop the insecure signing mechanism before its shortcomings are exploited in more convincing phishing attacks.

Netcraft reports that 14 per cent of the SSL Certificates it analysed during a recent survey were signed using an MD5 Algorithm recently discovered to be not just weak but vulnerable to practical attack. Last month security researchers at the Chaos Communication Congress showed how a fake certificate with the same digital signature (hash) as a valid certificate might be created. The issue arises because two different inputs to the weak MD5 hashing algorithm can produce the same output.

This "hash collision" creates a means for potential attackers to submit a normal certificate requests to a certificate authority (CA) before producing a second certificate with the same signature but different domain details. Worse still it might be possible to forge counterfeit credentials for websites providing they are signed using MD5, at least according to research presented at the CCC last month*.

The MD5 hash collision weakness has been known of for months, but it's only much more recently that security researchers have outlined how flaws in the MD5 checksum algorithm undermine the confidence of SSL certificates.

Netcraft's December 2008 SSL Survey found 135,000 valid third party certificates using potentially weak MD5 signatures, around 14 per cent of the total number of valid SSL certificates in circulation. Most (128,000) of the vulnerable SSL certs were signed by RapidSSL (owned by VeriSign since 2006).

A small number of certificates from Thawte and VeriSign also made use of the flawed algorithm, although most of their certificates were rubberstamped by the more secure SHA1 algorithm.

"Other affected CAs are likely to follow suit, as SHA1 is well established and is already in use for the majority of SSL certificate signing, so it should be simple to switch to using this more secure alternative," Netcraft reports. "Once it is impossible to obtain new certificates signed with MD5, this attack will be neutralised."

Extended Validation (EV) SSL websites are all signed by SHA1 or better signatures, so didn't appear as a problem in Netcraft's study.

But even the use of SHA1 digital signing offers no long-term guarantee. "Although there are no attacks as advanced as those against MD5, it is likely that SHA1 will also be increasingly threatened by collision attacks as research in this area continues," Netcraft continues. "There are more secure cryptographic hashes available, however, so we can expect to see CAs start to phase in newer, stronger hashes over the next few years."

One option, Netcraft adds, is for browser packages to distinguish certificates signed with MD5 from more secure algorithms "so that users can exercise caution". Given the confusion already generated by browser warnings about legit websites with out of date certificates, for example, we doubt such subtle warnings would be effective. ®

*According to Netcraft, the MD5 attack requires a collision between two newly created certificates deliberately created by the attacker that are bound together mathematically. The risk is not that existing domains can be spoofed, but much more than hackers might be able to create cryptographically identical pairs of valid and invalid domains, it reckons.

However, according to researchers from Centrum Wiskunde & Informatica in the Netherlands, EPFL in Switzerland, Eindhoven University of Technology in the Netherlands and independent labs in California who presented at CCC last month, the attack creates a means to spoof existing domains.

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story


Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.