Internet highly vulnerable to phishing attacksDecember 31st, 2008 - 3:49 pm ICT by IANS
London, Dec 31 (IANS) You are browsing a particular website thinking that it is perfectly secure, but it may not be the case as experts have uncovered chinks in Internet security.For instance, a weakness in the Internet digital certificate infrastructure allows attackers to forge certificates completely trusted by all commonly used web browsers.
Consequently, it is possible to impersonate secure websites and email servers and to perform virtually undetectable phishing attacks, implying that secure websites are porous and unsafe.
By presenting their results at the 25C3 security congress in Berlin Tuesday, the experts hope to increase the adoption of more secure cryptographic standards on the Internet and increase the safety of the Internet.
When you visit a website whose URL starts with “https”, a small padlock symbol appears in the browser window. This indicates that the website is secured using a digital certificate issued by one of a few trusted Certification Authorities (CAs).
To ensure that the digital certificate is legitimate, the browser verifies its signature using standard cryptographic algorithms. The team of researchers has discovered that one of these algorithms, known as MD5, can be misused.
The first significant weakness in the MD5 algorithm was presented in 2004 at the annual cryptology conference “Crypto” by a team of Chinese researchers.
They had managed to pull off a so-called “collision attack” and were able to create two different messages with the same digital signature. While this initial construction was severely limited, a much stronger collision construction was announced by the researchers from Wiskunde & Informatica (CWI) Netherlands, EPFL in Switzerland, and Eindhoven University of Technology, Netherlands in May 2007.
Their method showed that it was possible to have almost complete freedom in the choice of both messages. The team of researchers has now discovered that it is possible to create a rogue certification authority (CA) that is trusted by all major web browsers by using an advanced implementation of the collision construction and a cluster of more than 200 commercially available game consoles.
The researchers have thus managed to demonstrate that a critical part of the Internet’s infrastructure is not safe.
A rogue CA, in combination with known weaknesses in the DNS (Domain Name System) protocol, can open the door for virtually undetectable phishing attacks.
For example, without being aware of it, users could be redirected to malicious sites that appear exactly the same as the trusted banking or e-commerce websites they believe to be visiting, said a joint release of the three institutes.
The web browser could then receive a forged certificate that will be erroneously trusted, and users’ passwords and other private data can fall in the wrong hands. Besides secure websites and email servers, the weakness also affects other commonly used software.
“The major browsers and Internet players - such as Mozilla and Microsoft - have been contacted to inform them of our discovery and some have already taken action to better protect their users,” reassured Arjen Lenstra, head of EPFL’s Laboratory for Cryptologic Algorithms.
“To prevent any damage, the certificate we created had a validity of only one month - August 2004 - which expired more than four years ago. The only objective of our research was to stimulate better Internet security with adequate protocols that provide the necessary security.”
- Weakness in Internet security uncovered - Dec 31, 2008
- Indian IT experts devise technique to fight deadly bots - May 17, 2012
- Iranian state backed hackers accused of attacking online security systems to pry on opposition - Mar 25, 2011
- Microsoft web browser faces security risk - Feb 01, 2011
- Arrests made in malware fraud case which infected millions of computers worldwide - Nov 10, 2011
- US considers internet identity for its citizens - Jan 10, 2011
- 900m Internet Explorer users at risk as Microsoft warns of security flaw - Feb 01, 2011
- Cyber criminals to target social networks, mobile devices: Security Report - Apr 06, 2011
- Scientists think up way to beat smart hackers - May 02, 2012
- India tops in originating spam, phishing in Asia: Report - May 11, 2010
- Researchers work out new, safer login system - Feb 19, 2012
- Intel chips to power servers for cloud computing - Jul 15, 2011
- 300,000 computers with deadly virus to lose internet: FBI - Jul 08, 2012
- Phishing websites pocket $3 billion in China - Jan 15, 2011
Tags: certification authorities, chinese researchers, cryptographic algorithms, cryptographic standards, digital signature, eindhoven university of technology, email servers, initial construction, md5 algorithm, padlock symbol