SSL exploit turn Firefox into malware distributor
Security researcher Moxie Marlinspike gave one of the more interesting and terrifying presentations at BlackHat 2009 in Las Vegas yesterday. Marlinspike demonstrated how the X.509 digital certificates used by Secure Socket Layer (SSL) to secure online communications such as eCommerce and online banking were was completely broken. This allowed Marlinspike to pose as the Mozilla update server for users on the same local area network such as a hotspot which allows him to distribute malware in the guise of of a Mozilla Firefox update.
By taking advantage of a flaw in client-side certificate verification which treats a NULL character as a string terminator, Marlinspike is able to create what appears to be a completely legitimate looking X.509 digital certificate used in the vast majority of SSL implementations. He is able to submit a certificate signing request so a Certificate Authority (which he declined to name) with something like www.Mozilla.org(NULL-CHAR)www.HisOwnDomain.com. The Certificate Authority happily signs the certificate request because Moxie is the legitimate owner of his own domain but the SSL clients i.e., the computers that consumers operate only look at everything up to the null character. That means the client only sees www.Mozilla.org or even www.BankOfAmerica.com if Marlinspike wanted to create a certificate for an online bank. This technique allows anyone to create any kind of digital certificate with any name they want which means that SSL is completely broken for now.
Dan Kaminsky who is another famous security researcher independently came up with the same null character exploit along with several other weaknesses in X.509 digital certificates. I managed to get some video of the briefing he gave to the press after his presentation to a large crowd at BlackHat 2009.
This is truly one of the most serious implementation flaws in SSL we have seen and it needs to be addressed as quickly as possible. The fundamental problem lies in the client side behavior which treats null characters as end of string so every vulnerable SSL implementation with the exception of OpenSSL needs to patch this flaw as quickly as possible. In the mean time, there’s no legitimate reason for Certificate Authorities to sign certificate requests that contain null characters in the common name or subject line and they should filter out and reject all such requests. Mozilla is also looking to fix this problem in the next release of Firefox so that it won’t be susceptible to fake update servers. Internet Explorer is not susceptible to this because they operate their own root certificate authority for update services. In the mean time, it may be wise to avoid using Firefox on public wired and especially wireless hotspot networks.
[...] [...]
[...] [...]
From what i understand the idee is that somebody can send malware files using firefox update server (correct me if i m wrong).
I looked into this and i found some info from sites that have subject malware issues (ex malwarecity.com) and the ideea is for my antivirus bitdefender it say’s that it doesn t protect the user for sofware vulnerabilities but it keeps you safe by catching the malware file that the firefox server is sending by update .
I m safe and i wait for the firefox guy s to resolve the issue .
Jonny, the vulnerability allows attackers pose AS the Firefox update server. So as soon as you connect to a rogue wireless network or a valid wired network that has been hijacked through an ARP spoof, you get owned as soon as you launch Firefox.
Mozilla has released a patch for Firefox so you should upgrade immediately if you run Firefox.
[...] [...]
[...] [...]
[...] [...]
Leave your response!
Twitter Feed
About Us
Digital Society is a digital think tank that believes culture and commerce are inseparable, that the digital economy flourishes when people are free and rights are secure, and that free markets free people.
Digital Society is an independent 501(c)3 non-profit organization, funded by donations from Jon Henke and from Arts+Labs. We advocate for a pro-culture, pro-commerce digital society through research, analysis and debate on emerging technology issues.
Reply Comments
Transparency and interactivity are trademarks of the Internet era, and we aim to foster them here at Digital Society. It is inevitable that some people will disagree with the technology policy positions we take. We want to have that constructive debate.
The Reply Comments feature gives our critics a chance to respond to our viewpoints and the Digital Society audience convenient access to competing arguments. Any time we directly challenge the views of an individual or a group on this site, the party in question may substantively respond in a guest post.
Please contact executive director Jon Henke by e-mail.
Subscribe
Recent Posts
Recent Posts
Most Commented
Most Viewed