Last week two known researchers Juliano Rizzo and Thai Duong presented their work at Ekoparty conference in which they target TLS version 1.0 and SSL version 3.0. They exploit long-known vulnerability within TLS through which security credentials of SSL and TL get compromised. They developed a tool named “Browser Exploit against SSL/TLS ( BEAST) ” that can launch attack on AES algorithm used in SSL and TLS. Due to creation of this tool or we can say launching of this attack on TLS millions of web-sites get affected as these websites uses SSL or TLS to protect their transactions. Websites like Google and PayPal are also under threat as they are also using TLS version 1.0.
According to Kaspersky Lab, BEAST makes its way on target computer either by iframe injection or by injecting its JavaScript into victim browser. Once installed on target computer BEAST can capture HTTP cookies then decrypt it. So if attackers are able to make HTTP cookies decrypted than they can interrupt user sessions and all user data gets visible to them.
One thing which makes this attack considerable is that it hits the confidentiality of SSL or TLS protocol by decrypting HTTP requests. According to Duong, BEAST is first kind of attack that targets confidentiality of HTTP cookies. Before this attack, all the attacks were on authenticity of SSL/TLS.Besides threat to millions of web-sites that uses SSL or TLS based transactions, another drastic aspect to consider is fixing of the vulnerability that BEAST exploits. If attack exploits authenticity vulnerability than it can be patched by making a new trust model but patching of confidentiality vulnerability requires a major change in protocol of TLS/SSL. Security researchers are working with SSL and Browser vendors to fix this vulnerability but until now no solution appears that will be compatible with existing SSL application.
Every proposed solution results in incompatibility with any of existing SSL application. But according to resources Google already update its Chrome Browser that can now counter with BEAST.According to Kurt Baumgartner, Kaspersky Lab expert, this attack has been around from 10 years but its practical implementation has not been seen before BEAST attack. He added
“While they couldn’t get it to work in pure JavaScript or flash, they implemented the exploit in a Java applet and attacked the stream between Firefox and https://paypal.com. The “tricks” they used to bypass “Same Origin Policy” with Java were surprising, and they came up with the entire stolen session cookie with which to log in to paypal.com as the victim over http in under three minutes. While I am sure that the other browser vendors will update their CBC encryption routines to better randomize their IV and overcome this attack as suggested almost ten years ago, one could use Chrome and maintain secure communications in regards to this exploit. To me, this exploit is a low risk one because of its impracticality.”
According to Luis Corrons from panda Security, it is not easy to interrupt someone’s network traffic and obtain personal data. To carry out this attack attacker first has to become “man-in-the-middle” for the victim browser and then injects its payload there. But once attacker gains access to the computer than he can do whatever he wants i.e. he can install Trojan horse or disclose your confidential data etc.
Through set up of Wi-Fi hotspot attackers can capture users. Corrons added in his conversation with IT Pro that if attackers are able to create Wi-Fi hotspot then it will be very easy for them to redirect users to the welcome page of their services. One click of user on their page for startof browsing results in compromising of computer.Creation of BEAST makes security professionals to show concerns on the security of SSL. According to Philip Hoyer, director of strategy solutions at ActiveIdentity; development of BEAST means, end of transaction confidentiality in SSL and TLS.
Philip Hoyer also said that in order to get protection from fraudulent transactions that occur through BEAST, one temporary solution is to sign the transactions using a Public key Infrastructure (PKI) so that it becomes difficult for attacker to insert or change data. This solution can be achieved by the use of dedicated hardware token along with pin pad. This solution is proposed after the creation of BEAST as hacking SSL also means hack of Certificate Authorities (CA).
Last week DigiNotar a Certificate Authority was declared bankrupt as it issued 500 fake certificates which were used by hackers to intercept web communications. If anyone gets those fake certificates than they can cheat users by showing that internet transaction were being protected by SSL.
By: Rahat Masood.
Ref:
[1] http://www.actividentity.com/blog/transaction-confidentiality-based-on-ssl-is-dead
[2] http://www.itpro.co.uk/636304/ssl-under-threat-as-flaw-exploited
[3] http://www.securelist.com/en/blog/208193135/The_SSL_Sky_is_Falling
