Risk
3/19/2013
09:37 AM
Connect Directly
RSS
E-Mail
50%
50%

HTTPS Security Encryption Flaws Found

Security researchers find weaknesses that could be exploited to crack some types of encrypted Web communications.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
Security researchers have discovered weaknesses that could be exploited to crack some types of encrypted Web communications.

The flaw exists in the RC4 encryption algorithm that's often used to help secure the SSL/TLS communications that underpin secure (HTTPS) Web pages. The flaw was first disclosed last week by University of Illinois at Chicago professor Dan Bernstein at the Fast Software Encryption conference in Singapore, in a talk titled "Failures of secret-key cryptography" that's based on research he conducted with researchers from University of London's Royal Holloway and the Eindhoven University of Technology in the Netherlands.

"The transport layer security (TLS) protocol aims to provide confidentiality and integrity of data in transit across untrusted networks like the Internet," according to the group's research presentation. "It is widely used to secure Web traffic and e-commerce transactions on the Internet."

[ Are hackers hacking for fun or for profit? Celeb Data Breach Traced To Credit Reporting Site. ]

But RC4, the researchers found, isn't sufficiently random, and with enough time and effort, an attacker could recover some plaintext from a communication secured using TLS and RC4. "We have found a new attack against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used," they said. "The attacks arise from statistical flaws in the keystream generated by the RC4 algorithm, which become apparent in TLS ciphertexts when the same plaintext is repeatedly encrypted at a fixed location across many TLS sessions."

The vulnerability has wide-ranging repercussions, given current RC4 use. "Around 50% of all TLS traffic is currently protected using the RC4 algorithm," they said. "It has become increasingly popular because of recent attacks on CBC-mode encryption on TLS, and is now recommended by many commentators." Those CBC-mode encryption attacks have included padding oracle attacks, the BEAST attack against browsers and the Lucky 13 attack that was first disclosed last month.

Some cryptography experts have moved to reassure Internet users that they're in no immediate danger from the RC4 vulnerabilities. "While interesting, the attacks don't represent an immediate practical threat to users of SSL/TLS (including online banking, e-commerce, social networking, etc.)," said Symantec technical director Rick Andrews in a blog posted to the Certificate Authority Security Council website. "Such attacks require an attacker to run malicious software on a user's computer, which would connect to a particular website and send the same message over and over again many times. In fact, if the attacker's software could send the same message over and over 10 times per second, it would still take more than three years for the attack to succeed."

Still, once easily exploitable vulnerabilities have been discovered in an encryption algorithm, it's only a matter of time before more rapid and effective attack techniques get discovered. Furthermore, other researchers -- working at intelligence agencies, for example -- could have already discovered these vulnerabilities and put them to use.

"RC4 shouldn't be around," said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a blog post. "Experts have recommended avoiding it completely, at least for any newly written applications, for several years. But replacing or banning RC4 in existing cryptographic implementations is a much trickier problem."

What's the solution? "The most effective countermeasure against our attack is to stop using RC4 in TLS," according to the researchers. "There are other, less-effective countermeasures against our attacks and we are working with a number of TLS software developers to prepare patches and security advisories."

Instead of using RC4, the researchers strongly recommend switching to AEAD cipher suites such as AES-GCM, which are supported in TLS 1.2, which hasn't yet been widely adopted. Another approach, however, could be to use a CBC-mode cipher suite that's been patched against the BEAST and Lucky 13 attacks, and they said many versions of TLS 1.0 and 1.1 do now have such patches.

Symantec's Andrews also emphasized that the discovery of vulnerabilities in RC4 doesn't reveal weaknesses in SSL/TLS. "The designers of the SSL/TLS protocol anticipated that algorithms would become weaker over time, so the protocol was designed to support the easy addition of new algorithms," he said. "Hence a weakness in one algorithm does not mean that SSL/TLS is broken. Newer, stronger algorithms have already been developed and incorporated into the latest implementations of SSL/TLS. What's needed now is for users of Web server and browser software to update to the newest versions to minimize or eliminate the use of weakened algorithms."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio