Two security researchers with PhoneFactor, a provider of
phone-based two-factor authentication, recently said that they had
discovered a serious flaw in the SSL protocol, which is used to
protect sensitive data in online transactions.
SSL, short for Secure Sockets Layer, is used for online banking
and for secure e-mail and database access, among other things.
This vulnerability was discovered in August and disclosed by
PhoneFactor researchers Marsh Ray and Steve Dispensa to a
consortium of major tech industry companies and standards groups in
September. The vulnerability was slated for disclosure next year,
to give affected vendors time to patch their software.
But an independent security researcher discovered the
vulnerability on his own and posted it to an Internet Engineering
Task Force mailing list on November 4th.
The vulnerability could allow an attack to conduct a
man-in-the-middle attack, whereby an attacker could hijack an
authenticated SSL session and execute commands. In theory, neither
the Web server nor the Web browser would provide any indication
that the session had been subverted.
"Because this is a protocol vulnerability, and not merely an
implementation flaw, the impacts are far-reaching," said Steve
Dispensa, CTO of PhoneFactor, in a statement. "All SSL libraries
will need to be patched, and most client and server applications
will, at a minimum, need to include new copies of SSL libraries in
their products. Most users will eventually need to update any
software that uses SSL."
Other SSL vulnerabilities have been identified recently. Over
the summer, at the Black Hat security conference in Las Vegas, Mike
Zusman, principal consultant at Intrepidus Group, and Alex Sotirov,
an independent security researcher, disclosed a Web browser design
flaw that allowed an attacker to conduct a man-in-the-middle attack
against websites with Extended Validation (EV) SSL
certificates.
Another security researcher, Moxie Marlinspike, demonstrated a
separate SSL flaw at the Black Hat conference in Washington, in
February 2009.