Zero-day flaw found in web encryption

A zero-day flaw in the TLS and SSL protocols, which are commonly used to encrypt web pages, has been made public.

Security researchers Marsh Ray and Steve Dispensa unveiled the TLS (Transport Layer Security) flaw on Wednesday, following the disclosure of separate, but similar, security findings. TLS and its predecessor, SSL (Secure Sockets Layer), are typically used by online retailers and banks to provide security for web transactions.

Ray, who along with Dispensa works for two-factor authentication company PhoneFactor, explained in a blog post on Thursday that he had initially discovered the flaw in August, and demonstrated a working exploit to Dispensa at the beginning of September.

The flaw in the TLS authentication process allows an outsider to hijack a legitimate user's browser session and successfully impersonate the user, the researchers said in a technical paper.

The fault lies in an "authentication gap" in TLS, Ray and Dispensa said. During the cryptographic authentication process, in which a series of electronic handshakes take place between the client and server, there is a loss of continuity in the authentication of the server to the client. This gives an attacker an opening to hijack the data stream, they said.

In addition, the flaw allows practical man-in-the-middle attacks against hypertext transfer protocol secure (Https) servers, the researchers said. Https is the secure combination of http and TLS used in most online financial transactions.

The flaw will prove a problem for a long time to come, security researcher Chris Paget wrote in a blog post, as it also affects SSL.

"How about the thousands of different software update mechanisms out there that depend on SSL being secure in order to function?" wrote Paget. "This is a protocol-level breach; one that requires a modification to the way that SSL and TLS function in order to repair."

After they found the flaw, Ray and Dispensa disclosed their findings to the Industry Consortium for the Advancement of Security on the Internet (Icasi), a tech association that consists of Cisco, IBM, Intel, Juniper Networks, Microsoft and Nokia. The researchers also alerted the Internet Engineering Task Force (IETF) and a number of open-source SSL implementation projects.

On 29 September, the various groups involved met and decided to set up a project, called Project Mogul, to handle remediation efforts. It will first concentrate on creating a protocol extension as a preliminary solution. Ray said in his blog that he expected to see announcements from the multi-vendor collaboration "shortly", including an internet draft proposal for the fix.

At the September meeting, Ray and Dispensa were informed about research being done by the IETF TLS Channel Bindings working group, which was following a similar line of inquiry into the TLS protocol.

On Wednesday, Martin Rex, a member of the IETF TLS Channel Bindings working group and researcher at SAP, published a man-in-the-middle TLS renegotiation flaw in Microsoft IIS. The flaw, which is essentially the same as the one discovered by Ray, was publicised on Twitter by security researcher HD Moore.

Ray and Dispensa decided on Wednesday that the flaw was in the public domain, and so decided on full disclosure of their work.