Tag Archives: SSL

Vulnérabilité SSL 3.0 – bug POODLE (ou POODLEbleed)

Hacker Medic October 15, 2014 No Comments

Chez Google, trois chercheurs en sécurité ont découvert une faille dans le protocole de cryptage Secure Sockets Layer (SSL) 3.0 (SSLv3), qui pourrait servir à intercepter des données a priori cryptées entre des ordinateurs et des serveurs. Ils l’ont baptisée POODLE (Padding Oracle On Downgraded Legacy Encryption), qui accessoirement veut aussi dire « caniche » (CVE-2014-3566).

Avant toute chose, notons que cette vulnérabilité touche l’ancien protocole SSLv3, et NON les certificats SSL, leurs clés privées, ou leur conception intrinsèque. Nos clients équipés de certificats sur des serveurs compatibles SSL 3.0 n’ont donc aucune raison de les remplacer.

Il semble également que cette faille s’avère moins nocive que le bug Heartbleed dans OpenSSL car son exploitation requiert des droits d’accès privilégiés au réseau. Toutefois, l’utilisation des hotspots et du WiFi public pose ici un réel problème puisque POODLE suit un schéma d’attaque par interception (Man In The Middle, MITM).

Contexte

L’introduction de SSL 3.0 remonte à 1996. Or, selon le dernier rapport Netcraft, ce protocole est encore pris en charge par 95 % des navigateurs Web. De nombreux clients TLS (Transport Layer Socket) utilisent l’ancien protocole de cryptage SSL 3.0 pour communiquer avec des serveurs plus anciens. D’après Google, un pirate qui contrôle le réseau situé entre un ordinateur et un serveur peut s’immiscer dans le processus de négociation SSL (handshake SSL) utilisé pour vérifier les protocoles de cryptographie pris en charge par un serveur. C’est ce que les chercheurs appellent la « danse en marche arrière » (downgrade dance). Il pourra alors contraindre les ordinateurs du réseau à utiliser le protocole SSL 3.0 pour protéger les données en transit. Ensuite, libre à lui de lancer une attaque MITM pour intercepter des cookies HTTPS à la volée. Ainsi, il pourra voler des informations, voire prendre le contrôle des comptes en ligne de ses victimes. Et même si, à l’heure où nous écrivons ces lignes, les webmasters ne ménagent pas leurs efforts pour désactiver SSL 3.0 et migrer vers TLSv1 et des versions plus récentes, beaucoup reste encore à faire. De même, s’il est une leçon que l’on a pu retenir de l’affaire Heartbleed, c’est que les grandes entreprises sont beaucoup plus rapides que les petites structures pour corriger des vulnérabilités critiques.

Conseils aux entreprises

Il existe un certain nombre de mesures pour neutraliser la menace :

Pour savoir si vos serveurs Web courent un risque, utilisez notre service gratuit SSL Toolbox.
Servez-vous d’outils compatibles TLS_FALLBACK_SCSV, un mécanisme qui empêche les pirates de forcer les navigateurs Web à utiliser SSL 3.0.
Désactivez complètement le protocole SSL 3.0 ou désactivez le cryptage en mode CBC SSL 3.0.
Un pare-feu applicatif Web (WAF) vous protège contre ce type de vulnérabilités. Pour en savoir plus, rendez-vous sur notre site.
Méfiez-vous des e-mails d’arnaqueurs qui tenteraient de capitaliser sur le climat d’incertitude et un éventuel manque de connaissances techniques de votre part.

Pour combler la faille sur Apache, suivez les conseils de mon collègue Christoffer Olausson :

> SSLProtocol All -SSLv2 -SSLv3 <- Désactivez SSLv2 et SSLv3

> apachectl configtest <- Testez votre configuration

> sudo service apache restart <- Redémarrez le serveur

Pour sa part, Google a annoncé la fin du support de SSL 3.0 sur tous ses produits dans les prochains mois. Mozilla a également déclaré vouloir désactiver SSL 3.0 dans Firefox 34, dont la sortie est prévue courant novembre.

Conseils aux internautes

Symantec émet plusieurs recommandations à l’attention des internautes :

Assurez-vous que SSL 3.0 est désactivé dans votre navigateur (dans Internet Explorer, allez dans Options Internet, puis dans Paramètres avancés).
Pour vous prémunir contre les attaques MITM, veillez à la présence du préfixe « HTTPS » dans la barre d’adresse de votre navigateur.
Restez attentifs aux avis des éditeurs et constructeurs dont vous êtes client concernant d’éventuelles mises à jour logicielles ou demandes de modification de mot de passe.
Méfiez-vous des éventuels e-mails de phishing vous demandant de modifier votre mot de passe. Pour éviter de vous retrouver sur un site Web frauduleux, limitez-vous au domaine du site officiel.

Pour plus d’informations

Reportez-vous aux articles de la base de connaissances Symantec sur le sujet :

Utilisateurs Symantec Managed PKI for SSL

https://knowledge.verisign.com/support/mpki-for-ssl-support/index?page=content&id=AR2182

Utilisateurs Symantec Trust Center/Trust Center Enterprise

https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=AR2183

Restez connecté

Pour plus d’infos sur cette vulnérabilité et toute l’actualité sécurité, suivez-nous sur Twitter et Facebook. En cas de problème de gestion de vos certificats SSL et Code Signing, rendez-vous sur nos forums techniques.

The SSL 3.0 Vulnerability – POODLE Bug (AKA POODLEbleed)

Hacker Medic October 15, 2014 No Comments

A bug has been found in the Secure Sockets Layer (SSL) 3.0 cryptography protocol (SSLv3) which could be exploited to intercept data that’s supposed to be encrypted between computers and servers. Three Google security researchers discovered the flaw and detailed how it could be exploited through what they called a Padding Oracle On Downgraded Legacy Encryption (POODLE) attack (CVE-2014-3566).

avast! SecureLine VPN protects you from the Apple Exploit

Avast Blog February 24, 2014 No Comments

A major Apple security flaw allows cybercrooks and spies to grab personal information like email, credit card numbers, and other sensitive data. Apple confirmed researchers’ findings that the same SSL/TSL security flaw fixed with the latest iOS 7.0.2 update is also present in notebook and desktop machines running OS X. Please apply the patches as advised […]

Importance of key management

Hacker Medic January 9, 2014 No Comments

With the rise of Cybercrime, companies are investing significant amounts in Information Security in order to protect themselves, their employees and partners, but in the end that might not be enough.

Important changes to SSL certificates on intranets: what you need to know

Hacker Medic December 19, 2013 No Comments

If you use SSL certificates on intranet sites with internal server names, they may not work from 1 November 2015. For companies with complex infrastructures, the change may be challenging but now is the time to start getting ready.

Quick update….

Hacker Medic December 6, 2013 No Comments

I’d like to share two webinars with you that we delivered this week

The first was Attack of the Cyber Spies a webinar delivered as part of BrightTALK’s Hackers Summit which you can access here.

The second is the December update of the regular webinar series I do with my colleague Andrew Shepherd: Website Security Threats: December Update

I’ve also posted both webinar slide decks to Slideshare here

Finally, I’d also like to share this blog posted by Tom Powledge who is the VP of the Website Secuirty Solutions division here at Symantec Keeping Your Data Safe with SSL

We’ll be back next week with some new blogs.

The price of fame

Hacker Medic November 28, 2013 No Comments

In the past year we have seen a number of security related stories in the Finish media.

Spring saw one of the Nordic region’s largest banks forget to renew the SSL certificate that secured their new online banking site. This unfortunately is not a rare phenomenon ,and companies such as Google , Twitter, and LinkedIn have all experienced similar certificate expiry issues. Consumers are advised, however, to be cautious online and pay heed to warning messages they see in their web browsers, my colleague Andy Horbury wrote about a similar incident recently

Another blunder highlighted in the press happened a few weeks after, when the Certificate Authority used to issue certificates on some local government sites advised users that the site they were visiting was no longer to be trusted. This was simply due to the fact that they had used a CA whose root certificate was not trusted in the Mozilla browser – Firefox. Imagine securing your site with an SSL certificate that works for everyone apart from Firefox users cannot and then compounding that by giving visitors the horrendous advice to ignore any browser warnings they might see when visiting this site. Today this issue has been fixed and the site in question has changed the SSL to a to trusted CA. However, I can’t even imagine how this advice from a powerful entity affected consumers and what this means for trust online if they can simply ignore browser warnings in my opinion and that of any IT professional this is pure nonsense.

Shopping at your own risk

The third incident, in the news coverage was the report regarding the part that Finns were playing in an international group of hackers. The young man in question has hacked sites in relative peace and quiet for the last couple of years beavering away diligently scouring Finnish discussion forums and gaming sites, for user names, passwords and credit card information, as well as anything else he could find. Were the sites he targeted protected by SSL certificates ? Unfortunately, not.

Sadly in too many instances SSL encryption is often forgotten when securing servers and websites. By not taking security as seriously as they should companies are playing a dangerous game with their own brand and reputation. As we saw in the Symantec ISTR report cybercriminals are increasingly targeting not only banks and large organizations but also much smaller businesses because they are viewed as being very attractive and lucrative targets.

Brand building and winning consumer confidence does not happen overnight, but comes as a result of many hours of work , sleepless nights and meetings after meetings… yet all this can be put at risk from the simplest mistake you make. By letting a certificate expire, using a mistrusted CA and even giving the wrong advice about security online you are building your business on foundations of sand.

If they can’t see it, how can they know?

I myself was recently talking about the information security to business students . Before I told them about the existence of SSL certificates I showed them these two sites and asked which of the two sites are safe :

From there, came the reply like from the pharmacy shelf , one of the students pointed the one on the right hand side even thinking about it. When I asked the reasons for the choice he replied : ” Well.. there’s that green address bar there. ” Yes! Too bad I didn’t record this session, I would’ve forwarded the recording to some IT people..

Today’s online consumer , a young student chose the Extended Validation certificate certified site without knowing about all its technical features – intuitively they knew what looked safe and would put their money where their mouth is when it came to purchasing on a site like this.

Customers and the company’s protection of information is not a staggeringly large investment. Creating brand awareness and brand status are key when it comes to maintaining a trustworthy reputation part of the investment in your brand should be to make purchases from reliable partners – the same applies to security contracts. Security should no longer be purchased acquired with “as long as we have something there” attitude. If you feel that you don’t have the knowledge or resources you can always get this from your trusted service providers.

(Finnish) companies should be prouder of their brands – and protect them accordingly.

The Power to Destroy: How Malware Works

Hacker Medic November 14, 2013 No Comments

This blog post is based on the new Symantec Website Security Solutions free white paper, The Power to Destroy: How Malware Works which pulls together statistics from across Symantec’s global security network. The white paper is available in Frenc…

New Infographic: Six things that can kill your website and how to stop them.

Hacker Medic September 27, 2013 No Comments

Your website is your window on the world – it’s your shop front, your brand on display and a key route to market and perhaps your most essential sales and marketing tool. And as such it critical to your business: and if something bad were t…

ENCRYPTION AND DECRYPTION – THE NEVER-ENDING BATTLE

Hacker Medic August 21, 2013 No Comments

Ciphers have been in use since around 3,000B.C., but their importance and relevance for information security has really come to the mainstream with the growth of the Internet and the escalating volumes of data exchanged on line every day.
The history o…