title: This is not a test: Fundamental vulnerability to SSL link: https://onemoretech.wordpress.com/2011/09/27/this-is-not-a-test-fundamental-vulnerability-to-ssl/ author: lembobro description: post_id: 1125 created: 2011/09/27 12:24:13 created_gmt: 2011/09/27 16:24:13 comment_status: closed post_name: this-is-not-a-test-fundamental-vulnerability-to-ssl status: publish post_type: post

This is not a test: Fundamental vulnerability to SSL

With the decrypting of a protected PayPal browser cookie at a security conference Friday, it became official: the internet's foundation of trust has suffered yet another serious fracture that will require the attention of the industry's best minds.

Dan Goodin, World takes notice as SSL-chewing BEAST is unleashed, The Register, 27 Sept 2011. Yeah. I know. Got my attention too. Post presentation discussion by the researchers, Juliano Rizzo and Thai Duong, can be found here on Thai's blog. Independent analysis by Eric Rescorla is here. Eric does everyone a favor by summarizing the problem and stating his conclusion at the beginning of that piece:

If you're familiar with network security and haven't been living under a rock you've probably seen the recent coverage of Rizzo and Duong's attack on SSL/TLS implementations. they've demoed the attack and information is starting to trickle out (the news articles above were written prior to release), we can begin evaluate the impact of this work. (See AGL's post on this). Unfortunately, there's no paper publicly available and the live chat during the talk raised more questions than were answered. [in large part due to the inadequacies of trying to ask questions over WebEx chat -- EKR 9/24] First, the bottom line: Don't Panic. Yes, this is interesting work, no SSL/TLS is not completely broken. In particular, your communications with your bank are quite likely to be fine. In particular, AGL suggests that Chrome is fine.

Some additional links: Attack against TLS protected communications TOR and BEAST SSL attack Man in the middle attack on SSL Chrome and BEAST

Copyright 2004-2019 Phil Lembo