Slashdot Mirror

← Back to Stories (view on slashdot.org)

SSL Renegotiation Attack Becomes Real

Posted by kdawson on from the laugh-a-while-you-can dept.

rastos1 and several other readers noted that the SSL vulnerability we discussed a couple of weeks back, which some researchers had claimed was too theoretical to worry about, has now been demonstrated by exploit. The attack description is available on securegoose.org. "A Turkish grad student has devised a serious, real-world attack on Twitter that targeted a recently discovered vulnerability in the SSL protocol. The exploit by Anil Kurmus is significant because it successfully targeted the so-called SSL renegotiation bug to steal Twitter login credentials that passed through encrypted data streams. All in all, a man in the middle is able to steal the credentials of a user authenticating himself through HTTPS to a trusted website."

8 of 97 comments (clear)

  1. Kinda bad summary by Virak · · Score: 5, Insightful

    Important part of the article:

    He did it by injecting text that instructed Twitter's application protocol interface to dump the contents of the web request into a Twitter message after they had been decrypted.

    The only reason it was exploitable was because of Twitter's API. Understandably, I'm not too worried about the rest of the Internet going down in flames any time soon.

    1. Re:Kinda bad summary by teh_commodore · · Score: 5, Insightful

      Oh good. We're totally fine. It only works on sites that are poorly designed. And Twitter's been patched, so that leaves, well, I guess no one.

      --
      --"insert clever quote here"
  2. The sky is falling by LBt1st · · Score: 3, Insightful

    It would be nice if FireFox updated with detection for sites that would allow this (and other) kinds of attacks.
    With shit like this in the wild it's hard to know what sites to trust. /Paranoid

    1. Re:The sky is falling by Frosty+Piss · · Score: 2, Insightful

      It would be nice if FireFox updated with detection for sites that would allow this (and other) kinds of attacks.

      FF already nags enough.

      --
      If you want news from today, you have to come back tomorrow.
    2. Re:The sky is falling by socceroos · · Score: 4, Insightful

      People ought to stop blaming "The Web" as being inherently insecure. As much as you drill down into it, when party1 communicates with party2 and party1 isn't intimately familiar with party2's identity then transactions of information will always be prone to being exploited. This goes for human interaction (face to face) as well as human-to-computer interaction.

      Frankly, I'd rather have an insecure internet than have an internet where everyone's identity was fully exposed and documented.

  3. Re:Not worried, fixed already by Anonymous Coward · · Score: 5, Insightful

    You are forgiven for the error. Anyone using a letter that could be mistaken for a number in any software version string should be cockpunched with brass knuckles coated in broken glass and lemon juice

  4. Re:Just one phrase that fits. by Anonymous Coward · · Score: 2, Insightful

    No it just means they will arrest him and throw him in jail next time he visits the USA on holiday.

  5. Re:Not worried, fixed already by Lennie · · Score: 2, Insightful

    You have to remember it's not a fix. It's a workaround, it just disables part of the protocol.

    Their are also new packages for Apache2 for Debian for some other parts that needed to be disabled/changed, but it too is just a workaround.

    Their isn't yet a real fix, because it's problem with the protocol it self.

    --
    New things are always on the horizon