|
A vulnerability in the most common data security protocol on the Internet could allow secure Web sessions to be hijacked
By Thomas Claburn, InformationWeek, November 6, 2009, 1230 hrs
Two security researchers with PhoneFactor, a provider of phone-based two-factor authentication, recently said that they had discovered a serious flaw in the SSL protocol, which is used to protect sensitive data in online transactions.
SSL, short for Secure Sockets Layer, is used for online banking and for secure e-mail and database access, among other things.
This vulnerability was discovered in August and disclosed by PhoneFactor researchers Marsh Ray and Steve Dispensa to a consortium of major tech industry companies and standards groups in September. The vulnerability was slated for disclosure next year, to give affected vendors time to patch their software.
But an independent security researcher discovered the vulnerability on his own and posted it to an Internet Engineering Task Force mailing list on November 4th.
The vulnerability could allow an attack to conduct a man-in-the-middle attack, whereby an attacker could hijack an authenticated SSL session and execute commands. In theory, neither the Web server nor the Web browser would provide any indication that the session had been subverted.
"Because this is a protocol vulnerability, and not merely an implementation flaw, the impacts are far-reaching," said Steve Dispensa, CTO of PhoneFactor, in a statement. "All SSL libraries will need to be patched, and most client and server applications will, at a minimum, need to include new copies of SSL libraries in their products. Most users will eventually need to update any software that uses SSL."
Other SSL vulnerabilities have been identified recently. Over the summer, at the Black Hat security conference in Las Vegas, Mike Zusman, principal consultant at Intrepidus Group, and Alex Sotirov, an independent security researcher, disclosed a Web browser design flaw that allowed an attacker to conduct a man-in-the-middle attack against websites with Extended Validation (EV) SSL certificates.
Another security researcher, Moxie Marlinspike, demonstrated a separate SSL flaw at the Black Hat conference in Washington, in February.
|