Feeds

SSL spoof bug still haunts IE, Safari, Chrome

Thanks to Microsoft

5 things you didn’t know about cloud backup

Nine weeks after a hacker demonstrated how to spoof authentication certificates for virtually any website on the internet, users of Internet Explorer and many other applications remain susceptible because Microsoft hasn't patched the underlying vulnerability.

The bug, which resides in an application programming interface known as CryptoAPI, causes IE and other applications that rely on the code to be tricked by fraudulent secure sockets layer certificates. It can be exploited to impersonate websites, virtual private networks, and email servers by adding a null character to the prefix of an address in a legitimate SSL credential.

"There are thousands of products on Windows right now that are still vulnerable to this SSL attack, and if someone were to publicly publish a targeted null prefix certificate, they'd be in trouble," said the white-hat hacker, who goes by the moniker Moxie Marlinspike. "Basically, everything that runs on Windows would be vulnerable with that one certificate."

Among the browsers that rely on the Microsoft library to parse SSL certificates are Google Chrome and Apple Safari for Windows. The bug would cause both - and IE as well - to display a fraudulently authenticated website with no warning that anything was amiss. The Firefox browser, by contrast, fixed vulnerabilities related to the null character bug a few days after Marlinspike presented his demo at the Black Hat security conference in late July.

The bug stems from code that causes browsers, email clients, and other SSL-enabled apps to ignore all characters following the \ and 0 characters, which are used to denote the end of a sequence of characters in C-based languages. Some issuers of SSL certificates, by contrast, look at the entire domain name whether or not it contains the null character.

The discrepancy allows an attacker to obtain a certificate for a website under his control and then append the target site and a "\0" to the the address. Marlinspike, who holds legitimate claim to the domain thoughtcrime.org, said the common name field for a certificate targeting Bank of America's site would read:

www.bankofamerica.com\*thoughtcrime.org

"The thing that would be damaging for them would be if somebody released a targeted null prefix certificate for Bank of America," he said. "That would affect all Microsoft products that are still unpatched."

It remains unclear when the bug will be fixed.

"Microsoft is investigating a possible vulnerability in Windows presented during Black Hat," a spokesman for the company wrote in an email to The Reg. "Once we’re done investigating, we will take appropriate actions to protect customers."

Marlinspike's comments on Wednesday came as fellow hacker Jacob Appelbaum published a single wildcard SSL certificate that tricks older versions of the Network Security Services library into authenticating any website on the internet. Microsoft's CryptoAPI was never vulnerable to that attack.

While the bug has been fixed in NSS, and in the Firefox browser, Marlinspike speculated that many applications that rely on it have yet to apply the patch. Readers who are aware of specific programs that are still vulnerable are invited to contact your reporter here.

Both the wildcard and the more limited prefix attacks are serious because even if a fraudulent certificate is later revoked, there are ways to fool browsers into believing it's still valid. That's because of a separate attack targeting the Online Certificate Status Protocol, which Marlinspike also demonstrated at Black Hat.

No doubt, Microsoft engineers want to tread carefully when rewriting a core API, lest they break the countless programs that rely on it. But as the alacrity demonstrated by Mozilla showed in patching Firefox, the fix is possible. Redmond, are you listening? ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.