Skip to Content
Uncategorized

New Flaws Revealed In A Creaking Internet

Researchers at Black Hat reveal flaws in the infrastructure designed to keep sensitive information secure.
July 31, 2009

In separate presentations at the Black Hat computer security conference in Las Vegas this week, two researchers revealed flaws with the system that protects credit card and password transactions online.

The Secure Socket Layer (SSL) protocol implements the padlock that appears in a browser’s address bar–an outward symbol that the underlying communication between browser and server is secure and that the Web page is what it claims to be.

Dan Kaminsky and Moxie Marlinspike separately demonstrated a number of problems with SSL, some immediate and some that could become an issue within the next 18 months. Some of these issues are caused by inconsistencies in how SSL is implemented in the browser compared with how SSL is implemented by the certificate authorities that form the backbone of the system.

Rumblings about this infrastructure have been going on for some time–late last year, researchers Alexander Sotirov and Marc Stevens showed that an outdated algorithm could undermine the system. Later, Marlinspike released a tool that an attacker could use to capture supposedly secure information.

Later today at Black Hat, Sotirov plans to show further problems with “extended validation” SSL certificates, which are supposed to provide a more secure version of the system.

Last year at Black Hat, Kaminsky revealed a major flaw affecting a vital piece of Internet infrastructure that matches website addresses to the servers that hosts their pages. Kaminsky said in a press conference yesterday that the “creaking” of the SSL infrastructure is a sign that it’s time to look for a new solution. He suggests DNSSEC, a protocol meant to secure the system for looking up website addresses. Kaminsky believes that it could be designed to guarantee a page’s identity at the same time it links a user to a requested server. Other researchers, however, including some of Kaminsky’s collaborators, don’t agree that DNSSEC is the solution, and think there are ways to bolster SSL without discarding it.

Regardless of how people decide to fix the problems revealed at Black Hat, the takeaway is that much of the infrastructure supporting the Internet is straining with the weight of unintended responsibility.

Keep Reading

Most Popular

mouse engineered to grow human hair
mouse engineered to grow human hair

Going bald? Lab-grown hair cells could be on the way

These biotech companies are reprogramming cells to treat baldness, but it’s still early days.

Death and Jeff Bezos
Death and Jeff Bezos

Meet Altos Labs, Silicon Valley’s latest wild bet on living forever

Funders of a deep-pocketed new "rejuvenation" startup are said to include Jeff Bezos and Yuri Milner.

ai learning to multitask concept
ai learning to multitask concept

Meta’s new learning algorithm can teach AI to multi-task

The single technique for teaching neural networks multiple skills is a step towards general-purpose AI.

conceptual illustration showing various women's faces being scanned
conceptual illustration showing various women's faces being scanned

A horrifying new AI app swaps women into porn videos with a click

Deepfake researchers have long feared the day this would arrive.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.