Risk
3/19/2013
09:37 AM
50%
50%

HTTPS Security Encryption Flaws Found

Security researchers find weaknesses that could be exploited to crack some types of encrypted Web communications.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
Security researchers have discovered weaknesses that could be exploited to crack some types of encrypted Web communications.

The flaw exists in the RC4 encryption algorithm that's often used to help secure the SSL/TLS communications that underpin secure (HTTPS) Web pages. The flaw was first disclosed last week by University of Illinois at Chicago professor Dan Bernstein at the Fast Software Encryption conference in Singapore, in a talk titled "Failures of secret-key cryptography" that's based on research he conducted with researchers from University of London's Royal Holloway and the Eindhoven University of Technology in the Netherlands.

"The transport layer security (TLS) protocol aims to provide confidentiality and integrity of data in transit across untrusted networks like the Internet," according to the group's research presentation. "It is widely used to secure Web traffic and e-commerce transactions on the Internet."

[ Are hackers hacking for fun or for profit? Celeb Data Breach Traced To Credit Reporting Site. ]

But RC4, the researchers found, isn't sufficiently random, and with enough time and effort, an attacker could recover some plaintext from a communication secured using TLS and RC4. "We have found a new attack against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used," they said. "The attacks arise from statistical flaws in the keystream generated by the RC4 algorithm, which become apparent in TLS ciphertexts when the same plaintext is repeatedly encrypted at a fixed location across many TLS sessions."

The vulnerability has wide-ranging repercussions, given current RC4 use. "Around 50% of all TLS traffic is currently protected using the RC4 algorithm," they said. "It has become increasingly popular because of recent attacks on CBC-mode encryption on TLS, and is now recommended by many commentators." Those CBC-mode encryption attacks have included padding oracle attacks, the BEAST attack against browsers and the Lucky 13 attack that was first disclosed last month.

Some cryptography experts have moved to reassure Internet users that they're in no immediate danger from the RC4 vulnerabilities. "While interesting, the attacks don't represent an immediate practical threat to users of SSL/TLS (including online banking, e-commerce, social networking, etc.)," said Symantec technical director Rick Andrews in a blog posted to the Certificate Authority Security Council website. "Such attacks require an attacker to run malicious software on a user's computer, which would connect to a particular website and send the same message over and over again many times. In fact, if the attacker's software could send the same message over and over 10 times per second, it would still take more than three years for the attack to succeed."

Still, once easily exploitable vulnerabilities have been discovered in an encryption algorithm, it's only a matter of time before more rapid and effective attack techniques get discovered. Furthermore, other researchers -- working at intelligence agencies, for example -- could have already discovered these vulnerabilities and put them to use.

"RC4 shouldn't be around," said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a blog post. "Experts have recommended avoiding it completely, at least for any newly written applications, for several years. But replacing or banning RC4 in existing cryptographic implementations is a much trickier problem."

What's the solution? "The most effective countermeasure against our attack is to stop using RC4 in TLS," according to the researchers. "There are other, less-effective countermeasures against our attacks and we are working with a number of TLS software developers to prepare patches and security advisories."

Instead of using RC4, the researchers strongly recommend switching to AEAD cipher suites such as AES-GCM, which are supported in TLS 1.2, which hasn't yet been widely adopted. Another approach, however, could be to use a CBC-mode cipher suite that's been patched against the BEAST and Lucky 13 attacks, and they said many versions of TLS 1.0 and 1.1 do now have such patches.

Symantec's Andrews also emphasized that the discovery of vulnerabilities in RC4 doesn't reveal weaknesses in SSL/TLS. "The designers of the SSL/TLS protocol anticipated that algorithms would become weaker over time, so the protocol was designed to support the easy addition of new algorithms," he said. "Hence a weakness in one algorithm does not mean that SSL/TLS is broken. Newer, stronger algorithms have already been developed and incorporated into the latest implementations of SSL/TLS. What's needed now is for users of Web server and browser software to update to the newest versions to minimize or eliminate the use of weakened algorithms."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7830
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the mod/feedback:mapcourse cap...

CVE-2014-7831
Published: 2014-11-24
lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.

CVE-2014-7832
Published: 2014-11-24
mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by vi...

CVE-2014-7833
Published: 2014-11-24
mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.

CVE-2014-7834
Published: 2014-11-24
mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forum_get_discussions web service.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?