Risk
3/19/2013
09:37 AM
50%
50%

HTTPS Security Encryption Flaws Found

Security researchers find weaknesses that could be exploited to crack some types of encrypted Web communications.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
Security researchers have discovered weaknesses that could be exploited to crack some types of encrypted Web communications.

The flaw exists in the RC4 encryption algorithm that's often used to help secure the SSL/TLS communications that underpin secure (HTTPS) Web pages. The flaw was first disclosed last week by University of Illinois at Chicago professor Dan Bernstein at the Fast Software Encryption conference in Singapore, in a talk titled "Failures of secret-key cryptography" that's based on research he conducted with researchers from University of London's Royal Holloway and the Eindhoven University of Technology in the Netherlands.

"The transport layer security (TLS) protocol aims to provide confidentiality and integrity of data in transit across untrusted networks like the Internet," according to the group's research presentation. "It is widely used to secure Web traffic and e-commerce transactions on the Internet."

[ Are hackers hacking for fun or for profit? Celeb Data Breach Traced To Credit Reporting Site. ]

But RC4, the researchers found, isn't sufficiently random, and with enough time and effort, an attacker could recover some plaintext from a communication secured using TLS and RC4. "We have found a new attack against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used," they said. "The attacks arise from statistical flaws in the keystream generated by the RC4 algorithm, which become apparent in TLS ciphertexts when the same plaintext is repeatedly encrypted at a fixed location across many TLS sessions."

The vulnerability has wide-ranging repercussions, given current RC4 use. "Around 50% of all TLS traffic is currently protected using the RC4 algorithm," they said. "It has become increasingly popular because of recent attacks on CBC-mode encryption on TLS, and is now recommended by many commentators." Those CBC-mode encryption attacks have included padding oracle attacks, the BEAST attack against browsers and the Lucky 13 attack that was first disclosed last month.

Some cryptography experts have moved to reassure Internet users that they're in no immediate danger from the RC4 vulnerabilities. "While interesting, the attacks don't represent an immediate practical threat to users of SSL/TLS (including online banking, e-commerce, social networking, etc.)," said Symantec technical director Rick Andrews in a blog posted to the Certificate Authority Security Council website. "Such attacks require an attacker to run malicious software on a user's computer, which would connect to a particular website and send the same message over and over again many times. In fact, if the attacker's software could send the same message over and over 10 times per second, it would still take more than three years for the attack to succeed."

Still, once easily exploitable vulnerabilities have been discovered in an encryption algorithm, it's only a matter of time before more rapid and effective attack techniques get discovered. Furthermore, other researchers -- working at intelligence agencies, for example -- could have already discovered these vulnerabilities and put them to use.

"RC4 shouldn't be around," said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a blog post. "Experts have recommended avoiding it completely, at least for any newly written applications, for several years. But replacing or banning RC4 in existing cryptographic implementations is a much trickier problem."

What's the solution? "The most effective countermeasure against our attack is to stop using RC4 in TLS," according to the researchers. "There are other, less-effective countermeasures against our attacks and we are working with a number of TLS software developers to prepare patches and security advisories."

Instead of using RC4, the researchers strongly recommend switching to AEAD cipher suites such as AES-GCM, which are supported in TLS 1.2, which hasn't yet been widely adopted. Another approach, however, could be to use a CBC-mode cipher suite that's been patched against the BEAST and Lucky 13 attacks, and they said many versions of TLS 1.0 and 1.1 do now have such patches.

Symantec's Andrews also emphasized that the discovery of vulnerabilities in RC4 doesn't reveal weaknesses in SSL/TLS. "The designers of the SSL/TLS protocol anticipated that algorithms would become weaker over time, so the protocol was designed to support the easy addition of new algorithms," he said. "Hence a weakness in one algorithm does not mean that SSL/TLS is broken. Newer, stronger algorithms have already been developed and incorporated into the latest implementations of SSL/TLS. What's needed now is for users of Web server and browser software to update to the newest versions to minimize or eliminate the use of weakened algorithms."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

CVE-2014-7880
Published: 2014-12-17
Multiple unspecified vulnerabilities in the POP implementation in HP OpenVMS TCP/IP 5.7 before ECO5 allow remote attackers to cause a denial of service via unspecified vectors.

CVE-2014-8133
Published: 2014-12-17
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.