Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Chrome Encryption Security IT

Google Prepares Fix To Stop SSL/TLS Attacks 122

Posted by samzenpus from the raise-shields dept.
OverTheGeicoE writes "It was reported Tuesday that researchers had found a way to break the most commonly used SSL/TLS encryption in browsers. According to the Register, Google is pushing out a patch to fix the problem. The patch doesn't involve adding support for TLS 1.1 or 1.2. FTFA: 'The change introduced into Chrome would counteract these attacks by splitting a message into fragments to reduce the attacker's control over the plaintext about to be encrypted. By adding unexpected randomness to the process, the new behavior in Chrome is intended to throw BEAST off the scent of the decryption process by feeding it confusing information.' The fix is supposedly in the latest developer version of Chrome."
This discussion has been archived. No new comments can be posted.

Google Prepares Fix To Stop SSL/TLS Attacks More

Google Prepares Fix To Stop SSL/TLS Attacks

Comments Filter:

  • Call me ignorant here, but how hard would it be for people to enable TLS 1.1 or 1.2 support in browsers and sites, since that apparently isn't vulnerable?

    • Re:TLS 1.1 or 1.2? (Score:4, Insightful)

      by wisesifu ( 1358043 ) on Thursday September 22, 2011 @04:54AM (#37477592)
      Its not the only the browsers that need to support the newer versions of these protocols, but also the servers.

      • Re:TLS 1.1 or 1.2? (Score:5, Informative)

        by dachshund ( 300733 ) on Thursday September 22, 2011 @07:25AM (#37478394)

        Its not the only the browsers that need to support the newer versions of these protocols, but also the servers.

        Maybe not. It appears that OpenSSL in 0.9.6d implemented a "fix" to TLS 1.0 that may not require a change to the server. The basic idea is that the browser injects message prefixes into the stream as a kind of "fake" IV, to keep the Javascript from having control of which messages get encrypted. This may stop the attack.

        Furthermore, if the prefixes are formatted in a certain way --- total speculation --- it may be possible to get the server to filter them out even if it's not running the same software. Anyway, I can't imagine how OpenSSL would implement this fix if the servers don't support it. But I admit I'm just catching up on this aspect.

        Here's a brief post describing the "fix":

        http://article.gmane.org/gmane.network.openvpn.user/32566 [gmane.org]

        And my speculation on how the attack works, in detail:

        http://practicalcrypto.blogspot.com/2011/09/brief-diversion-beast-attack-on-tlsssl.html [blogspot.com]

    • Wikipedia tells me TLS 1.1 came out in 2006 and 1.2 came out in 2008, yet still there are many sites that don't support them. It doesn't matter if your browser supports it if the people running the servers it's communicating with are too lazy to update, even after 5 years.

      • Re: (Score:2, Interesting)

        by Anonymous Coward

        Will you kindly explain to the unwashed masses how you would implement TLS 1.1 and 1.2 support in a world where the dominant library OpenSSL does not yet support either of the protocols in its stable releases? Sure, you can use GnuTLS and mod_gnutls, and I have tried it, but there was no point, as no browser apart from Opera supported it and there were some weird glitches in the module. IE 8/9 were supposed to support them under Vista and 7, but failed to access the site served by mod_gnutls when 1.1 and 1.

        • Re: (Score:2, Informative)

          by Kjella ( 173770 )

          AC said it, the standard may be many years old but no released version of OpenSSL supports anything higher than TLS 1.0....

    • Re: (Score:1)

      by Anonymous Coward

      Call me ignorant here, but how hard would it be for people to enable TLS 1.1 or 1.2 support in browsers and sites, since that apparently isn't vulnerable?

      Surprisingly hard, because there is still around 1-2% of HTTPS servers that are not compliant with the TLS protocol specification and reset the connection when a client attempts to negotiate a version higher than they can understand. Usually in these cases TLS 1.1 means too high, client developers are mainly just waiting for the broken servers to disappear or get upgraded before they can turn on the switch and start using new TLS versions. TLS 1.2 is also a bit different from TLS 1.1, and TLS 1.0 for that m

      • well, since it's such a small percentage, why not turn it on, let those sites fail, then when the owners of those sites complain, tell them to upgrade their shite servers and whilst their at it to get with the effing program. 1-2% of the servers in the world is enough to hold the world to ransom technologically is a stupidly simple problem to solve. why should we all suffer because of a few holdouts? cut the cord already!
        • More importantly, deploy it in browsers, don't display the padlock, and do print a warning when using TLS 1.0. I'm sure sites will get upgraded nice and quickly once their customers start telephoning and saying 'my browser gave a scary warning when I tried to enter my credit card details!'

          • I'm sure sites will get upgraded nice and quickly once their customers start telephoning and saying 'my browser gave a scary warning when I tried to enter my credit card details!'

            Except, of course, the customers don't do that. They simply figure this is one of the endless list of pointless natter comfirmations computers bombard them with, and click on it until it goes away.

            • Or, if they have one or two braincells working on critical thinking, they'll wonder and worry, call the support site for the organization whose server they're trying to use, and get told (after waiting on hold for several hours) "that warning doesn't mean anything; your connection is as private and secure as it always has." And that will be that.

              If we're gonna hypothesize some kind of public groundswell in support of long-delayed technological deployments, can we get it behind IPv6 first? kthxbye.

    • Re: (Score:2)

      by jonwil ( 467024 )

      There are many many servers that will totally fail if the client claims to support TLS 1.1 or 1.2.

      • Could clients detect this somehow and fall back to support the broken behaviour? For example on detection of an unexpected reset.

        • Sure, but then what's the point of the fix?

          • The point of the fix is that a whole lot of servers are now invulnerable to this.

            (Hopefully the important ones).

            • Re: (Score:2)

              by Yaur ( 1069446 )
              unless the attacker sends a reset when they observe the client claiming to support TLS 1.1/1.2
            • But if you have to renegotiate down to 1.0 because the server does not support it, you are still vulnerable.

              • Re: (Score:2)

                by egamma ( 572162 )

                But if you have to renegotiate down to 1.0 because the server does not support it, you are still vulnerable.

                Both browsers and servers should both be updated to support TLS 1.1 and 1.2, and both browsers and servers should negotiate the most secure, mutually supported protocols and cyphers.

                Adding that support will take some time, and it will take years to lose the old clients that aren't updated (Win XP with IE 6 still has another 2+ years of support, for example). But if we don't start adding support now with backwards compatibility so that nothing breaks then we're never going to get the newer protocols.

                Is b

                • the reason 1.1 and 1.2 protocols are more secure is cause they break the backwards capability of the protocol, one can nolonger downgrade to SSL3 or earlier. This means that 'till all servers run 1.0 or higher the browsers can't switch of SSL 3.0 and switch on TLS 1.1 and 1.2.

        • Re: (Score:3)

          by Kjella ( 173770 )

          Could clients detect this somehow and fall back to support the broken behaviour? For example on detection of an unexpected reset.

          Yes, but it opens you up to downgrade attacks. If both the client and server claims to support protocol X then it should not be possible to force them to use protocol Y which is considered less secure, even if both support that too. If you have a fully working TLS 1.1/1.2 client and server then all I have to do is cause a reset, the client will think it's a broken server and they'll use TLS 1.0 so you create a vulnerability where there was none.

    • Re: (Score:2)

      by Chrisq ( 894406 )

      Call me ignorant here, but how hard would it be for people to enable TLS 1.1 or 1.2 support in browsers and sites, since that apparently isn't vulnerable?

      I think it would be hard for them to do this quickly. The Google Chrome solution is really a stopgap until then.

    • Re: (Score:2)

      by shish ( 588640 )
      OpenSSL (which is what most open source software uses for SSL/TLS support) only supports TLS 1.0 (1.1 support has been added recently but not released) - GnuTLS (which some software can use as a compile-time option, normally defaulting to "off") supports 1.1 and 1.2

    • You're ignorant.

      You're welcome.

      • You forgot the "here", but thanks for the effort!

        • Thanks for asking the question though. It was my first thought when I read the /. summary. I learned a bit from the answers.

          • Indeed. Slashdot may have gone down in recent years and have a bit of a reputation for trolls and shills, but if you know how to navigate through the comments, it's still a golden source of insight, information and the occasional bit of wit. This comment thread shows that..

  • Acronym hell (Score:3)

    by Chrisq ( 894406 ) on Thursday September 22, 2011 @05:27AM (#37477706)
    Having looked up "1.2. FTFA" on google I now feel like a complete idiot

  • So....how long before they update BEAST?

    • They'll have to try a completely different approach.

      Smart workaround, I didn't know this was possible without changes on the server side.

  • If you use a VPN, you should be protected from "local" man-in-the-middle (MITM) attacks. By "local", I mean between your computer and the VPN server. A VPN doesn't protect you from a MITM attack between the VPN server and the webserver you are connecting to. But it does protect you to the VPN server if you are at an Internet cafe, hotel, or other untrusted network.

    At least that's true for most VPNs that use software based on OpenVPN, which uses OpenSSL for encryption. A copy [gmane.org] of an email from James Yonan

    • Re:All the more reason to use a VPN (Score:4, Interesting)

      by ledow ( 319597 ) on Thursday September 22, 2011 @06:00AM (#37477818) Homepage

      I found out all that information for myself separately before you posted that, but it's interesting to see the problem. I had to make the same assumption that the attack described is actually the one that was published all those years ago, which is pretty likely at this stage.

      To summarise: Web browsers tend to use the NSS libraries, which have a "bug". The bug is subtle and actually part of the TLS 1.0 standard, but a tiny, standards-compliant, workaround virtually fixes the problem.

      It's the same bug that OpenSSL patched 9 YEARS ago, fully knowing what they were patching and based on a publicly available paper on attacking exactly what NSS/OpenSSL were designed for (so the name "Network Security Services" is a bit of a misnomer now). The workaround is pretty basic (throw empty junk into the conversation first) but by all accounts "works".

      A lot of browsers use NSS and thus are vulnerable. Some don't and thus aren't (Opera uses OpenSSL which was patched against this 9 years ago!). The "fix" that Google have committed to Chrome is basically identical to the OpenSSL fix from all those years ago.

      The bug was pretty much unforeseeable all that time ago, and thus TLS 1.1 etc. were born to supplant it. You can't really blame people for the bug existing in the standard - you CAN blame them for not fixing it 9 years ago when others did exactly that, in "open" code.

      Lessons to be learned:

      1) SSL library authors needs to READ publicly available exploits aimed at the code they are developing.

      2) They need to read other project's bug/commit-logs/security warnings if they are serious about being a competitor to their security.

      3) Don't use libraries that don't do the above if you want to be taken seriously, and certainly not in a mainstream millions-of-deployments browser.

      4) Update your libraries and recompile your code when they change.

      OpenSSL know what they are doing and have a good reputation. NSS are pretty much amateurs. Think of that next time you want to use an SSL library.

    • Re: (Score:1)

      by babtras ( 629678 )
      All you'd be accomplishing is changing which part of an untrusted network your traffic is carried by. As long as the traffic traverses Internet infrastructure that you don't personally control, it is untrusted and is subject to monitoring. Unless you set up a VPN tunnel to each website you frequent, this will remain a problem. VPN is no answer.

  • Speculation on the attack (Score:5, Informative)

    by dachshund ( 300733 ) on Thursday September 22, 2011 @06:09AM (#37477836)

    I had posted this in another thread, but in case it's helpful --- this is my best guess on how the attack works in detail:

    http://practicalcrypto.blogspot.com/2011/09/brief-diversion-beast-attack-on-tlsssl.html [blogspot.com]

  • Confusing it? Really? (Score:1)

    by Anonymous Coward

    That doesn't sound like a "fix" as much as it sounds like a "bandaid."

    It doesn't counteract the root functionality of the exploit. It simply reduces the chances of it being successful.

    It's like changing your windows password every day and calling that "invulnerable security" simply because someone is less likely to be able to guess it.

    • Although it has not been fully disclosed yet, it's my understanding that the attack is only practical because of a sort of implicit "trust chain" in the implementation of TLS 1.0 where knowledge of one block gives you all the information you need to decode the next block... but also that proper decryption of one block means that you know that you decrypted the previous block successfully. That's the kicker - if you are just making guesses at one block but know the contents of the next block, the encrypted r

  • Based on what is known about this attack, there are a number of ways it can be thwarted without the need for TLS v1.1/v1.2.

    1. Google's solution: by randomly sizing the TLS records, this adds randomness to the known plaintext through more frequent padding.

    2. OpenSSL's solution of refreshing the IV by adding an empty TLS record - but some MS products have issues with this.

    3. TLS v1 permits up to 255 bytes of padding. Most implementations add the minimum amount (up to 7 for 3/DES and 15 for AES). Using a rando

    • Re: (Score:2)

      by raynet ( 51803 )

      Could the server use compression and randomly vary it and not do optimal gzipping for the content?

      • It's apparently an issue with the client-sent data - that is the data that is analyzed. BEAST has no control over the server-sent data, so whatever the server does, short of closing the connection, has no effect.

        • Re: (Score:2)

          by raynet ( 51803 )

          Can clients send compressed data to servers?

          • Strictly-speaking, I don't believe so. There's no way to negotiate the compression method. In the case of the server sending data, the client is able to indicate acceptable compression algorithms (via Accept-type headers) before the server sends the data (with Content-Encoding headers indicating compression). With the client sending data first, there's no way for the server to tell the client what is acceptable.

            SSL does have support for compression, but there are no compression methods defined other than NU

    • Re: (Score:2)

      by mzs ( 595629 )

      Somebody please mod this up.

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (1) Gee, I wish we hadn't backed down on 'noalias'.

Close