Website danger as hacker breaks SSL encryption

published 19 February 2009

Independent hacker Moxie Marlinspike has unveiled new techniques to defeat SSL encryption, which would leave common web applications such as online banking or secure website logins vulnerable to attack.

This would mean that the padlock icon in the corner of supposedly safe' websites and touted as optimal security by companies like Verisign may not be as safe as people generally believe.

Marlinspike revealed his findings at the Black Hat security conference in Washington DC, showing a number of ways where the "chain of trust" fell apart around SSL encryption.

He looked at the possibilities for new vectors of attack against HTTPS, the combination of HTTP and a network security protocol, which are often used for payment and sensitive corporate transactions.

Marlinspike also revealed a free software tool called "SSL Strip", which could be deployed on a network and used for a man in the middle attack on all potential SSL connections.

It stripped away the SSL encryption, substituting a look-alike HTTPS site, while still convincing the user and website the security was in place.

He claimed that by using a real world attack on several secure websites such as PayPal, Gmail, Ticketmaster and Facebook, he garnered 117 email accounts, 16 credit card numbers, seven PayPal logins and 300 other miscellaneous secure logins.

Click here for a video interview with Marlinspike.

The SSL encryption hack wasn't the only threat highlighted at Black Hat. Zscaler security researcher Michael Sutton sounded a warning against features that allowed offline access to websites.

He stressed that offline web applications such Gmail and Gears were secure, but warned that other sites with poor security risked visitors losing their data.

As well, Vietnamese researcher Duc Nguyen also demonstrated how he and his partners cracked the facial recognition technology used by Lenovo, Asus and Toshiba on their laptops.

They cracked the tech simply by using a picture of a person instead of their real face, as well as by presenting multiple phony facial images.

The researchers concluded that it was sufficient evidence that the biometric authentication used by the manufacturers was not secure enough.