Risk
3/19/2013
09:37 AM
50%
50%

HTTPS Security Encryption Flaws Found

Security researchers find weaknesses that could be exploited to crack some types of encrypted Web communications.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
Security researchers have discovered weaknesses that could be exploited to crack some types of encrypted Web communications.

The flaw exists in the RC4 encryption algorithm that's often used to help secure the SSL/TLS communications that underpin secure (HTTPS) Web pages. The flaw was first disclosed last week by University of Illinois at Chicago professor Dan Bernstein at the Fast Software Encryption conference in Singapore, in a talk titled "Failures of secret-key cryptography" that's based on research he conducted with researchers from University of London's Royal Holloway and the Eindhoven University of Technology in the Netherlands.

"The transport layer security (TLS) protocol aims to provide confidentiality and integrity of data in transit across untrusted networks like the Internet," according to the group's research presentation. "It is widely used to secure Web traffic and e-commerce transactions on the Internet."

[ Are hackers hacking for fun or for profit? Celeb Data Breach Traced To Credit Reporting Site. ]

But RC4, the researchers found, isn't sufficiently random, and with enough time and effort, an attacker could recover some plaintext from a communication secured using TLS and RC4. "We have found a new attack against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used," they said. "The attacks arise from statistical flaws in the keystream generated by the RC4 algorithm, which become apparent in TLS ciphertexts when the same plaintext is repeatedly encrypted at a fixed location across many TLS sessions."

The vulnerability has wide-ranging repercussions, given current RC4 use. "Around 50% of all TLS traffic is currently protected using the RC4 algorithm," they said. "It has become increasingly popular because of recent attacks on CBC-mode encryption on TLS, and is now recommended by many commentators." Those CBC-mode encryption attacks have included padding oracle attacks, the BEAST attack against browsers and the Lucky 13 attack that was first disclosed last month.

Some cryptography experts have moved to reassure Internet users that they're in no immediate danger from the RC4 vulnerabilities. "While interesting, the attacks don't represent an immediate practical threat to users of SSL/TLS (including online banking, e-commerce, social networking, etc.)," said Symantec technical director Rick Andrews in a blog posted to the Certificate Authority Security Council website. "Such attacks require an attacker to run malicious software on a user's computer, which would connect to a particular website and send the same message over and over again many times. In fact, if the attacker's software could send the same message over and over 10 times per second, it would still take more than three years for the attack to succeed."

Still, once easily exploitable vulnerabilities have been discovered in an encryption algorithm, it's only a matter of time before more rapid and effective attack techniques get discovered. Furthermore, other researchers -- working at intelligence agencies, for example -- could have already discovered these vulnerabilities and put them to use.

"RC4 shouldn't be around," said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a blog post. "Experts have recommended avoiding it completely, at least for any newly written applications, for several years. But replacing or banning RC4 in existing cryptographic implementations is a much trickier problem."

What's the solution? "The most effective countermeasure against our attack is to stop using RC4 in TLS," according to the researchers. "There are other, less-effective countermeasures against our attacks and we are working with a number of TLS software developers to prepare patches and security advisories."

Instead of using RC4, the researchers strongly recommend switching to AEAD cipher suites such as AES-GCM, which are supported in TLS 1.2, which hasn't yet been widely adopted. Another approach, however, could be to use a CBC-mode cipher suite that's been patched against the BEAST and Lucky 13 attacks, and they said many versions of TLS 1.0 and 1.1 do now have such patches.

Symantec's Andrews also emphasized that the discovery of vulnerabilities in RC4 doesn't reveal weaknesses in SSL/TLS. "The designers of the SSL/TLS protocol anticipated that algorithms would become weaker over time, so the protocol was designed to support the easy addition of new algorithms," he said. "Hence a weakness in one algorithm does not mean that SSL/TLS is broken. Newer, stronger algorithms have already been developed and incorporated into the latest implementations of SSL/TLS. What's needed now is for users of Web server and browser software to update to the newest versions to minimize or eliminate the use of weakened algorithms."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.