Welcome!

Blog Feed Post

SSL : Implementation Gone Wrong

Screenshot of Firefox 3.0 showing an error whe...

Image via Wikipedia

During the recent security conference Hack In The Box, security researchers from Qualys Labs showcased the fruits of their efforts to scan the Internet’s websites for proper implementation of security features like SSL and its successor TLS.  What they found could only be described as dismal.
SSL stands for Secure Sockets Layer, and TLS for Transport Layer Security.  While these two protocols share the same purpose, it’s important to note that TLS is a more secure version of SSL.  You may hear them used interchangeably because the first version of TLS (the most commonly used version of encryption on the internet) is backwards compatible with SSL 3.  These two protocols work off of public key infastructure or PKI, which requires a trusted third party to generate code that says that a website is who they say they are.
The end result is a secure and encrypted communications channel through which clients can talk to servers.  When it’s properly implemented.


The Good:

You may already be familiar with SSL and TLS through your experiences in logging into your bank.  All banking institutions utilize SSL or TLS to secure communications between client computers and the bank computers in case there are any eavesdroppers on the network the client is using.  Without it, clients may find their banking passwords swiped or their personal information leaked to criminals who leverage it to do everything from empty a checking account to getting a loan.

Banks typically use SSL and TLS protocols throughout your logged-on stay on their website.  In technical terms, this stay is referred to as a “Session”.  The goal of the encryption provided to you in TLS or SSL is to protect this session and the things you do while you are in the session. This way an eavesdropper can’t see how much money you have left on your mortgage, or see how much you’re paying for cable this month, or something more sinister, like your account numbers or social security number.


The Bad:

Many sites, especially some large and popular ones (Facebook, Twitter, Google), utilize TLS/SSL only during the login process so that your username and password can’t be seen by anyone else but you.  This works well in theory, but since the rest of the connection is still unencrypted, watchful eyes can still see what you’re doing on Facebook, who’s tweets you’re reading on Twitter, or what you’re doing today on Google.  Additionally, since websites remember who you are with tokens (a string of characters given to uniquely identify you for your current session after you log in) and tokens are sent every time you interact with a site while you are logged in, a criminal watching the network can steal and hijack your token and then instantly become logged in as you until you click the “log out” button.

It is unfortunate that websites as large as Twitter or Facebook do not do more to help protect their users, but some administrators make the argument that the users of a web service should be making sure themselves that they aren’t on compromised networks, since the protection offered by implementing SSL/TLS is exclusively for clients.  SSL and TLS don’t actually improve the security of a server or online service from an internal perspective.  In other words, since there are no security benefits to the company or computer, it’s not a prerogative to implement fully.


The Ugly:

Most of the users on the Internet have gotten into the (bad) habit of assuming that their personal information is kept private on the Internet so long as they keep their username and password to themselves and they stick to sites with padlocks on them. This is simply not the case, especially when they click through the browser warnings about SSL and TLS. I’ve noticed personally that many users will simply click through or add exceptions to security alerts to sign on because they are used to doing so. This means that they’re vulnerable to all sorts of basic attacks against SSL and TLS.

While these attacks are bad on their own, improper implementation is far and away the most to blame. It is the reason why users click through and ignore security warnings about SSL and the same reason why users feel good from a padlock in their browser window even as their credit card number is being stolen. Just because you have a form of SSL implementation on your website doesn’t mean that you’re securing your users. In fact, the illusion of security is far more damaging. Here are the highlights of the research done that illustrate how insecure some websites with SSL/TLS can be.

  • Over half of SSL-enabled websites allow users to use an insecure and outdated version of SSL (SSL 2).
  • About 28% support insecure renegotiation of encrypted sessions (allows an attacker to view your data even though it is “secure” according to your browser) called “The Closest thing to a serious TLS protocol Flaw so far”.
  • Over 80% of sites don’t force their users to use SSL/TLS
  • 10% of tested websites had incorrect certification chaining (the chain of trust that establishes a site is who they say they are)
  • Almost no websites use the newest version of TLS, opting for the SSL 3 (also known as TLS 1)
  • over 60% of the tested servers allow weak key lengths to be used (less than 128 bits. The lower the key length, the easier it is to crack.)


Think BEFORE You Click


Make your users aware of the need to read prompt boxes from web browsers, especially when first visiting a website.  Make sure that they know not to go on any common websites (Gmail, google, Facebook, twitter, yahoo, Myspace, ect..) if the web browser warns them that there is a problem with the certificate.  These websites are the most likely targets for a criminal to watch if he/she has compromised the network, and they are unlikely to let their security credentials for SSL/TLS expire due to their large user base and the problems that would cause.

Unfortunately smaller sites don’t always conform correctly, which is where the bigger problem in SSL and TLS security comes in — proper implementation.  So many sites are now improperly configured that it has taught users to ignore certificate security warnings.  This needs to be fixed so that the security model can operate properly, without users distrusting or ignoring warnings because of their day-to-day occurance.


Are You Part of the Problem?


System administrators should test to make sure that their implementation of the SSL or TLS protocols is proper and up-to-date.  To test that your implementation of TLS or SSL is secure, visit https://www.ssllabs.com/ssldb/analyze.html and input your domain name to see your score.
Recent statistics compiled by Qualys Labs and the EFF have shed some light onto the current state of SSL/TLS implementation, which shows that the vast majority of websites on the Internet haven’t properly secured their SSL/TLS servers for maximum security.

The slides from the Hack in The Box Security Conference can be found here: http://conference.hackinthebox.org/hitbsecconf2011ams/materials/D2T1%20-%20Ivan%20Ristic%20-%20A%20Study%20of%20What%20Really%20Breaks%20SSL.pdf

More information about SSL attacks and breaking SSL:
http://blog.ivanristic.com/2009/11/not-just-csrf-ssl-authentication-gap-used-for-credentials-theft.html
http://www.cupfighter.net/index.php/2011/05/hitb2011ams-what-breaks-ssl/

Read the original blog entry...

More Stories By Bob Gourley

Bob Gourley writes on enterprise IT. He is a founder and partner at Cognitio Corp and publsher of CTOvision.com

Latest Stories
As many know, the first generation of Cloud Management Platform (CMP) solutions were designed for managing virtual infrastructure (IaaS) and traditional applications. But that's no longer enough to satisfy evolving and complex business requirements. In his session at 21st Cloud Expo, Scott Davis, Embotics CTO, explored how next-generation CMPs ensure organizations can manage cloud-native and microservice-based application architectures, while also facilitating agile DevOps methodology. He expla...
SYS-CON Events announced today that Evatronix will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Evatronix SA offers comprehensive solutions in the design and implementation of electronic systems, in CAD / CAM deployment, and also is a designer and manufacturer of advanced 3D scanners for professional applications.
SYS-CON Events announced today that Synametrics Technologies will exhibit at SYS-CON's 22nd International Cloud Expo®, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Synametrics Technologies is a privately held company based in Plainsboro, New Jersey that has been providing solutions for the developer community since 1997. Based on the success of its initial product offerings such as WinSQL, Xeams, SynaMan and Syncrify, Synametrics continues to create and hone inn...
Cloud Expo | DXWorld Expo have announced the conference tracks for Cloud Expo 2018. Cloud Expo will be held June 5-7, 2018, at the Javits Center in New York City, and November 6-8, 2018, at the Santa Clara Convention Center, Santa Clara, CA. Digital Transformation (DX) is a major focus with the introduction of DX Expo within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive ov...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. In his session at @BigDataExpo, Jack Norris, Senior Vice President, Data and Applications at MapR Technologies, reviewed best practices to ...
DevOps promotes continuous improvement through a culture of collaboration. But in real terms, how do you: Integrate activities across diverse teams and services? Make objective decisions with system-wide visibility? Use feedback loops to enable learning and improvement? With technology insights and real-world examples, in his general session at @DevOpsSummit, at 21st Cloud Expo, Andi Mann, Chief Technology Advocate at Splunk, explored how leading organizations use data-driven DevOps to close th...
Continuous Delivery makes it possible to exploit findings of cognitive psychology and neuroscience to increase the productivity and happiness of our teams. In his session at 22nd Cloud Expo | DXWorld Expo, Daniel Jones, CTO of EngineerBetter, will answer: How can we improve willpower and decrease technical debt? Is the present bias real? How can we turn it to our advantage? Can you increase a team’s effective IQ? How do DevOps & Product Teams increase empathy, and what impact does empath...
Smart cities have the potential to change our lives at so many levels for citizens: less pollution, reduced parking obstacles, better health, education and more energy savings. Real-time data streaming and the Internet of Things (IoT) possess the power to turn this vision into a reality. However, most organizations today are building their data infrastructure to focus solely on addressing immediate business needs vs. a platform capable of quickly adapting emerging technologies to address future ...
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software. They hope to capture value from emerging technologies such as IoT, SDN, and AI. Ultimately, irrespective of the vertical, it is about deriving value from independent software applications participating in an ecosystem as one comprehensive solution. In his session at @ThingsExpo, Kausik Sridhar, founder and CTO of Pulzze Systems, discussed how given the magnitude of today's application ...
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, examined the regulations and provided insight on how it affects technology, challenges the established rules and will usher in new levels of diligence arou...
There is a huge demand for responsive, real-time mobile and web experiences, but current architectural patterns do not easily accommodate applications that respond to events in real time. Common solutions using message queues or HTTP long-polling quickly lead to resiliency, scalability and development velocity challenges. In his session at 21st Cloud Expo, Ryland Degnan, a Senior Software Engineer on the Netflix Edge Platform team, will discuss how by leveraging a reactive stream-based protocol,...
Mobile device usage has increased exponentially during the past several years, as consumers rely on handhelds for everything from news and weather to banking and purchases. What can we expect in the next few years? The way in which we interact with our devices will fundamentally change, as businesses leverage Artificial Intelligence. We already see this taking shape as businesses leverage AI for cost savings and customer responsiveness. This trend will continue, as AI is used for more sophistica...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and B...
In his general session at 21st Cloud Expo, Greg Dumas, Calligo’s Vice President and G.M. of US operations, discussed the new Global Data Protection Regulation and how Calligo can help business stay compliant in digitally globalized world. Greg Dumas is Calligo's Vice President and G.M. of US operations. Calligo is an established service provider that provides an innovative platform for trusted cloud solutions. Calligo’s customers are typically most concerned about GDPR compliance, application p...