A powerful new type of Internet attack works like a telephone tap, but it operates between computers and Web sites they trust.
Hackersat the Black Hat and DefCon security conferences have revealed aserious flaw in the way Web browsers weed out untrustworthy sites andblock anybody from seeing them. If a criminal infiltrates a network, hecan set up a secret eavesdropping post and capture credit-card numbers,passwords and other sensitive data flowing between computers on thatnetwork and sites their browsers have deemed safe.
In an even more nefarious plot, an attacker could hijack theauto-update feature on a victim's computer, and trick it intoautomatically installing malware pulled in from a hacker's Web site.The computer would think it's an update coming from the softwaremanufacturer.
The attack was demonstrated by three hackers. Independentsecurity researcher Moxie Marlinspike presented alone, while DanKaminsky, with Seattle-based security consultancy IOActive Inc., andsecurity and privacy researcher Len Sassaman presented together.
They reached essentially the same conclusion: Thereare major problems in the way browsers interact with Secure SocketsLayer (SSL) certificates, which is a common technology used on banking,e-commerce and other sites handling sensitive data.
Browser makers and the companies that sell SSL certificates are working on a fix.
Microsoft Corp., whose Internet Explorer browseris the world's most popular, said it was investigating the issue.Mozilla Corp., which makes the No. 2 Firefox browser, said most of theproblems being addressed were fixed in the latest version of itsbrowser, and that the rest will be fixed in an update coming this week.
VeriSign Inc., one of the biggest SSL certificate companies, maintains that its certificates aren't vulnerable.
Tim Callan, a product-marketing executive in VeriSign's SSLbusiness unit, added that the "tap" won't work against so-calledExtended Validation SSL certificates, which cost more and involve adeeper inspection of a company's application for a certificate.
The attack falls into a class of hacks known as"man-in-the-middle," in which a criminal plants himself between avictim's computer and a legitimate Web site and steals data as it movesback and forth.
Jeff Moss, founder of the Black Hat and Defcon conferences whothis summer was appointed to the Homeland Security Department'sadvisory council, said the fact a hacker has to actually break into avictim's network for the attack to work can limit its usefulness.
"That's the nice mitigating thing," he said.
But he warned that "for targeted attacks it's absolutely deadly.This is the way you can get everything. If you can get in the middle,you can get everything. It's a big, giant wake-up call for theindustry."
SSL certificates are a critical technology in assigning trust on the Web.
Sites buy them to encrypt traffic and assure visitors it's OK toenter confidential information. Companies that sell SSL certificatesverify that someone trying to buy a certificate actually owns the sitethat certificate will be attached to.
The presence of an SSL certificate on a site is designated by apadlock in the address bar. But many people don't pay attention towhether a padlock is present or not.
Browsers do care, though, which is why last week's talks were significant.
Browsers are programmed to block sites that don't have a validSSL certificate, or have a certificate displaying a Web address thatdoesn't match the address a Web surfer was trying to reach (which canindicate someone has hijacked a person's Internet session). If thesites aren't blocked, users are warned about potential danger and havethe option to click through.
The problems outlined by researchers center on a quirk in the way browsers read SSL certificates.
Many SSL certificate companies will allow people to attach aprogramming symbol called a "null character" into the Web address ontothe certificates they receive. Web browsers generally ignore thatsymbol. They stop reading at that symbol when they're checking the Webaddress on a certificate.
The trick in the latest type of attack is that all a criminalwould need to do is put the name of a legitimate Web site before thatcharacter, and the browser will believe that the site it's visiting -which is under the criminal's control - is legitimate.
The criminal could then forward the traffic onto the legitimatesite and spy on everything the victim does on that site. It's acomplicated attack, but it highlights a significant weakness in thevery technology widely used to assure people it's safe to navigatesensitive sites.
Jon Miller, an SSL expert and director of Accuvant Labs, saidhe expects significant attacks against corporations using thistechnique in the coming months. Criminals who run "phishing" scams, inwhich people are tricked into visiting phony sites, will also likelylatch on.
"What kind of makes this earth-shattering is these aren't themost sophisticated attacks in the world," he said. "This is going tobecome a huge problem."
There are signs it's already starting.
VeriSign's Callan said within hours of the talks, his companygot a number of applications for SSL certificates featuring nullcharacters, but they were denied.