Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:04 PM
Connect Directly

The SSL Implementation Equation

Many SSL servers aren't as secure as you'd think, according to new data from Qualys' SSL Labs

Only about one-fifth of SSL websites actually redirect to SSL for authentication, according to new data released at Black Hat USA last week.

Click here for more of Dark Reading's Black Hat articles.

That's one deployment failure among several in today's SSL-secured websites. "In the security community, we talk about advanced attacks [in research], but today it's not advanced attacks that are making sites vulnerable," says Ivan Ristic, director of engineering for Qualys. Organizations are improperly implementing SSL on their servers, he says.

Ristic has been working on a project for Qualys' community project SSL Labs, which has been studying major SSL sites during the past year. Among the latest findings: Of the nearly 250,000 SSL sites, only 51,00 redirect to SSL, and the other 80 percent may or may not redirect to SSL for authentication, according to the SSL Labs data.

"So 80 percent of all [SSL sites are] vulnerable to a Firesheep attack or similar tool," Ristic says.

And when you visit an SSL site, you assume it protects your credentials. Well, not so much: Ristic says 70 percent of the servers handled the login in plain text, and 55 percent submitted passwords in plain text. "We looked for every authentication page in our crawler and tracked the implementation," he says. "They may have a well-configured SSL server, but they made a conscious choice not to use SSL in authentication.

"In most cases, developers are not aware of these issues ... Maybe they make mistakes. And there is a level of anxiety about performance," he says.

Ristic also looked at HTTP Strict Transport Security (HSTS) -- which provides a level of security against cookie-forcing attacks -- among the SSL sites he surveyed. Only 80 sites used it.

As for Extended Validation SSL (EV SSL), only nine sites had these certificates.

Ristic says, overall, he has not seen much improvement worldwide in SSL server deployments during the past two years. "The only thing that will cause the sites to improve is to attack them or show them how easily it is to be attacked," he says, noting that such a scenario was what helped Google shore up its defenses.

"I don't want to name any of the SSL websites" that aren't securely implemented, he says. "Everyone is guilty of this. There are so few sites that do it well."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio


Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-06-04
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attac...
PUBLISHED: 2020-06-04
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.
PUBLISHED: 2020-06-04
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Description Area.
PUBLISHED: 2020-06-04
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.
PUBLISHED: 2020-06-04
Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded ...