A while a go Dominik and I gave an introductory presentation about SSL at the BASTA.NET conference, a developer-oriented event held in Darmstadt twice a year. At that time there were quite some enthusiastic participants but recently we’ve also gotten some inquiries asking for the relevant materials. Although there’s no recording of the session, we’ve decided to put the slides here for those interested who didn’t make it to the talk.
Continue reading Continue readingSSL
New SSL/TLS MiTM Attacks
A number of customers has approached us with questions like “Those new MiTM
attacks against SSL/TLS, what’s their impact as for the security of our SSL VPNs
with client certificates”?
In the following we give our estimation, based on the information publicly
available as of today.
On 11/04/09 two security researchers (Marsh Ray and Steve Dispensa) published a
paper describing some
previously (presumably/hopefully) unknown MiTM attacks against SSL/TLS.
CVE-2009-3555 was assigned to the underlying vulnerabilities within SSL/TLS.
The attacks described might potentially allow an attacker to hijack an
authenticated user’s (SSL/TLS) session. In an
IETF draft
published 11/09/09 and describing a potential protocol extension intended to
mitigate the attacks the following is stated:
“SSL and TLS renegotiation are vulnerable to an attack in which the attacker
forms a TLS connection with the target server, injects content of his choice,
and then splices in a new TLS connection from a client. The server treats the
client’s initial TLS handshake as a renegotiation and thus believes that the
initial data transmitted by the attacker is from the same entity as the
subsequent client data.”