It's true that Moxie Marlinspike presented some new SSL attack techniques at Black Hat DC this year. Moxie's attack...
is a variation on the traditional man-in-the-middle attack in which an attacker intercepts a client's requests to a Web server, establishes his or her own connection to the Web server, makes the request on behalf of the client, and then passes the results back to the originator. This allows the client to interact with the website normally, seeing the expected data while the attacker monitors the communication and can, in fact, issue whatever commands to the website he or she wishes.
Normally, man-in-the-middle attacks are easily detected because the attacker can't forge the SSL certificates necessary to create a secure connection to the remote website. This causes the user to see a bunch of error messages and warnings regarding the validity of the SSL certificate.
How did Moxie defeat this problem? By simply removing the SSL from the user's connection! This attack uses a tool called SSLstrip that changes all of the user's requests to HTTP connections, which are passed to the man-in-the-middle attacker in the clear. The attacker then establishes a real SSL connection to the server and makes the request on behalf of the client. From the server's perspective, everything looks like a legitimate, secure connection. If the user isn't paying careful attention, looking for the HTPPS URL or the lock icon, there aren't any obnoxious warning errors alerting them to the problem.
The solution to this problem lies in user education. Users must understand the importance of looking for the lock to verify the website is using secure HTTPS communication with a valid SSL certificate. So what's the bottom line? There's nothing wrong with SSL. Security teams simply need to ensure users understand when it's in place.
For more information:
- Should iPhone email be sent without SSL encryption? Read more.
- Learn more about the risks of connecting a Web service to an external system via SSL.
Dig Deeper on SSL and TLS VPN Security
Related Q&A from Mike Chapple
The OWASP Top Ten list is not a compliance standard but a set of best practices for enterprises looking to boost Web app security. Here's how to get ...continue reading
A data breach notification policy is important to have, but deciding how to alert customers can be tough. Expert Mike Chapple explains some best ...continue reading
Tokenization technology can be confusing. Expert Mike Chapple explains what the difference is between two types of tokens and how tokenization can ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.