How to secure SSL following new man-in-the-middle SSL attacks

It's true that Moxie Marlinspike presented some new SSL attack techniques at Black Hat DC this year. Moxie's attack...

is a variation on the traditional man-in-the-middle attack in which an attacker intercepts a client's requests to a Web server, establishes his or her own connection to the Web server, makes the request on behalf of the client, and then passes the results back to the originator. This allows the client to interact with the website normally, seeing the expected data while the attacker monitors the communication and can, in fact, issue whatever commands to the website he or she wishes.

Normally, man-in-the-middle attacks are easily detected because the attacker can't forge the SSL certificates necessary to create a secure connection to the remote website. This causes the user to see a bunch of error messages and warnings regarding the validity of the SSL certificate.

How did Moxie defeat this problem? By simply removing the SSL from the user's connection! This attack uses a tool called SSLstrip that changes all of the user's requests to HTTP connections, which are passed to the man-in-the-middle attacker in the clear. The attacker then establishes a real SSL connection to the server and makes the request on behalf of the client. From the server's perspective, everything looks like a legitimate, secure connection. If the user isn't paying careful attention, looking for the HTPPS URL or the lock icon, there aren't any obnoxious warning errors alerting them to the problem.

The solution to this problem lies in user education. Users must understand the importance of looking for the lock to verify the website is using secure HTTPS communication with a valid SSL certificate. So what's the bottom line? There's nothing wrong with SSL. Security teams simply need to ensure users understand when it's in place.

For more information:
 

• Should iPhone email be sent without SSL encryption? Read more.
• Learn more about the risks of connecting a Web service to an external system via SSL.