» Support from SmoothWall
» Submit a Support Ticket 
» FAQ & Knowledge Base
» Hardware Compatibility
» Manuals
» Supported Products
» Blocklist Addition/Removal
» Password Generator
» FAQ & Knowledge Base
» Hardware Compatibility
» Manuals
» Supported Products
» Blocklist Addition/Removal
» Password Generator
|
home » news »
More Certificate Woes Tuesday 11th August 2009 At the recent BlackHat computer security conference, researcher Moxie Marlinspike revealed yet another attack on the SSL certificate management infrastructure that underpins much of the web's security. The problem exploits the trend towards automated verification of certificate requests. Due to the increased volume it is not feasible for certification authorities to manually verify requests, so they typically use an automated process that contacts the appropriate administrative contact for the domain. For example, asking for a certificate for mysite.honestnik.org would result in an email to (for example) root@honestnik.org for verification. Due to peculiarities in the notoriously complex X.509 certificate standard, it is possible to ask for a certificate for a site name containing bogus characters, such as the ASCII null. For example, asking for: www.paypal.com\0mysite.honestnik.org Would result in a certificate that most browsers would see as "www.paypal.com", but the verification request would go to root@honestnik.org, making it a valuable trick for would-be Phishers. This doesn't actually breach the X.509 standard, but clearly breaches common domain naming rules. While there may be some debate on the legality of certain printable characters in domain names, I think it's safe to say no-one is proposing ASCII NUL as a sensible choice. Marlinspike expands on this and various other attacks on SSL in his excellent paper and presentation. Fortunately most current browsers have now been patched to handle this particular issue. Guardian also (following an update released last week) now does additional checks to prevent users visiting sites with dubiously produced certificates. More worrying is the failure of the certification authorities to follow standard industry practice in handling untrusted data; even more critical when the process is automated. More information: BlackHat.com: Marlinspike Presentation Nik Barron www.virus.org
The SmoothWall family of Internet security solutions helps schools,
enterprises and small/medium businesses to prevent misuse, block
objectionable content and protect against web related threats.
Delivered and supported via a global network of partners in over 60
countries, SmoothWall's commercial and open source solutions now
safeguard more than a million networks worldwide.
|
 | ||||||||||||
