Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:04 PM
Connect Directly

The SSL Implementation Equation

Many SSL servers aren't as secure as you'd think, according to new data from Qualys' SSL Labs

Only about one-fifth of SSL websites actually redirect to SSL for authentication, according to new data released at Black Hat USA last week.

Click here for more of Dark Reading's Black Hat articles.

That's one deployment failure among several in today's SSL-secured websites. "In the security community, we talk about advanced attacks [in research], but today it's not advanced attacks that are making sites vulnerable," says Ivan Ristic, director of engineering for Qualys. Organizations are improperly implementing SSL on their servers, he says.

Ristic has been working on a project for Qualys' community project SSL Labs, which has been studying major SSL sites during the past year. Among the latest findings: Of the nearly 250,000 SSL sites, only 51,00 redirect to SSL, and the other 80 percent may or may not redirect to SSL for authentication, according to the SSL Labs data.

"So 80 percent of all [SSL sites are] vulnerable to a Firesheep attack or similar tool," Ristic says.

And when you visit an SSL site, you assume it protects your credentials. Well, not so much: Ristic says 70 percent of the servers handled the login in plain text, and 55 percent submitted passwords in plain text. "We looked for every authentication page in our crawler and tracked the implementation," he says. "They may have a well-configured SSL server, but they made a conscious choice not to use SSL in authentication.

"In most cases, developers are not aware of these issues ... Maybe they make mistakes. And there is a level of anxiety about performance," he says.

Ristic also looked at HTTP Strict Transport Security (HSTS) -- which provides a level of security against cookie-forcing attacks -- among the SSL sites he surveyed. Only 80 sites used it.

As for Extended Validation SSL (EV SSL), only nine sites had these certificates.

Ristic says, overall, he has not seen much improvement worldwide in SSL server deployments during the past two years. "The only thing that will cause the sites to improve is to attack them or show them how easily it is to be attacked," he says, noting that such a scenario was what helped Google shore up its defenses.

"I don't want to name any of the SSL websites" that aren't securely implemented, he says. "Everyone is guilty of this. There are so few sites that do it well."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Virginia a Hot Spot For Cybersecurity Jobs
Jai Vijayan, Contributing Writer,  10/9/2019
How to Think Like a Hacker
Dr. Giovanni Vigna, Chief Technology Officer at Lastline,  10/10/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-16
A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the tolang parameter, as demonstrated by the index.php/admin/translate/sa/index/surveyid/336819/lang/ PATH_INFO.
PUBLISHED: 2019-10-16
Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input...
PUBLISHED: 2019-10-16
The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payl...
PUBLISHED: 2019-10-16
The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. A...
PUBLISHED: 2019-10-16
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.