Major SSL Flaw Find Prompts Protocol Update

The Internet Engineering Task Force (IETF) is about to issue a proposed extension to Secure Sockets Layer (SSL) that addresses a major vulnerability in the protocol that was inadvertently disclosed publicly late yesterday -- a flaw that affects browsers, servers, smart cards, VPN products, as well as many lower-profile products that contain the protocol embedded in their firmware.

Marsh Ray, who first discovered the bug in August, has been working with the IETF, vendors including Google and Mozilla, and members of the Industry Consortium for the Advancement of Security on the Internet (ICASI) on a fix since last month. He says he expects the IETF to issue a proposed extension to its specification for SSL, known as Transport Layer Security (TLS) in IETF parlance, as early as today. Software vendors that use SSL can then create patches for the vulnerability.

"The bug results in a set of related attacks that allow a man-in-the-middle to do bad things to your SSL/TLS connection. The [attacker] in the middle is able to inject his own chosen text into what your application believes is an encrypted, secure communications channel," says Ray, a senior software development engineer for PhoneFactor. "This has implications for all protocols that run on top of SSL/TLS, such as HTTPS."

Dan Kaminsky, director of penetration testing for IOActive, says he doesn't think the flaw is limited to just injecting traffic. "HTTPS content will leak because of this bug," Kaminsky says. "Never underestimate the usefulness of a subtle cryptographic vulnerability. Nobody would say, 'Well, it's just an iceberg, and we're heading right for it, but it's not like it's cut a huge gash in the ship yet.'"

SSL has been under siege during the past year, with the groundbreaking man-in-the-middle hack by researcher Moxie Marlinspike, which dupes a user into thinking he's in an HTTPS session when in reality he has been taken elsewhere by the attacker, as well as Kaminsky's research exposing critical flaws in X.509 certificate technology used in SSL.

But this latest threat resides within the SSL protocol itself and will require fixes to browsers, Web servers, database servers, mail servers, SQL servers, smart cards, and other SSL-based software. "All the [SSL] attacks I've seen [recently] have been around the client or server software, or the way it handles a certificate," Ray says. "What's different with this [bug] is that both the client and server need to be patched to restore the full security guarantees that are expected with TLS."

Marlinspike maintains that the newly found SSL flaw is not earth-shattering. "The sky is not falling," he says. "This was some clever work, and it is interesting for those of us who are into secure protocols, but I have yet to see an example of how this could significantly impact the way that SSL/TLS is commonly deployed in ways that differ from simple CSRF [cross-site request forgery]."

PhoneFactor had kept the bug under wraps for several months as vendors worked on ways to fix it. But when another researcher stumbled across some of the same issues and posted them to a public mailing list yesterday, word got out fast, so Ray decided to reveal the details of his work.

The IETF will issue a new extension for the SSL/TLS protocol that fixes the bug, which is basically a gap in the authentication process that lets an attacker execute a man-in-the-middle attack. The gap occurs in the renegotiation process of the session -- a time when some applications require the encryption process be "refreshed" after a certain point.

The proposed SSL/TLS extension allows renegotiation but restores security during that process, Ray says. "It defines an extension header that lets a client and server indicate what they believe was going on over the communications channel before the renegotiation. It restores the continuity of authentication," he says.

More worrisome, meanwhile, is finding and fixing smaller products with embedded devices that use SSL. "There's a very long tail of smaller [SSL] implementations in embedded devices," Ray says. "We'll probably be tracking them down for years to come."

Ray says end users shouldn't worry too much about the attack for now, but should be ready to patch for the SSL bug. "It's important that everybody fix their software as soon as patches become available," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.