6 ms·
CVE-2014-0224 looks the worst of this bunch. It seems openssl will accept ChangeCipherSpec messages much too early. CCS in TLS means "we've finished handshake
by ctz 12y ago
CVE-2014-0224 looks the worst of this bunch.
It seems openssl will accept ChangeCipherSpec messages much too early. CCS in TLS means "we've finished handshake/renegotiation and will now start using the new keys".
It looks likely that a MITM can send CCS to both ends during handshake, and have them agree on the empty master secret (and therefore trivial application data encryption keys). This is pretty bad as far as TLS bugs go (as bad as "goto fail", but not as bad as "heartbleed").
Given that accepting TLS messages only within the right constraints is fundamental to correctness of TLS and openssl seemingly can't get this right (this, and heartbeat messages before/during handshake), it seems likely this isn't the last problem of this kind.
- JacobAldridge 12y agoas bad as "goto fail", but not as bad as "heartbleed" Thank you for this excellent description for we who recognise this must be a problem, but lack the area knowledge to immediately appreciate how bad (or not) it may be.
- reaperhulk 12y agoI would even dispute it being as bad as goto fail. For this to work both client and server must be vulnerable and the attacker must be in a privileged network position. A malicious server can do it, but it's significantly more difficult to exploit this than goto fail. Edit: agl has a good writeup of the bug and what it might take to exploit https://www.imperialviolet.org/2014/06/05/earlyccs.html https://www.imperialviolet.org/2014/06/05/earlyccs.html
- mnw21cam 12y agoIt would mean (for example) that your local coffee shop could MITM their clients connecting to the bank through their free wifi. Being in a privileged network position isn't that hard, with all the mobile devices flying around everywhere.
- jacquesm 12y agoThat would be mostly limited to Konqueror (does anybody still use that?) and Google Chrome on Android. Which other browsers use OpenSSL?
- reaperhulk 12y agoI'm not claiming that being in a position to MITM is super difficult, but in your given example it's unlikely that you'd be vulnerable since web browsers (outside of Chrome on Android) don't use OpenSSL. Additionally, there is a degree of sophistication required to attempt this attack that exceeds that of goto fail. So again, bad, but not as bad as goto fail.
- ZoFreX 12y agoCompletely unscientific observation: More people in my local coffee shop are using phones than laptops, and more of those phones are Androids than iOS. I know anecdotally that the Chrome browser is very popular on Android. I would give even odds on there being more people to exploit with this than there were with goto fail.
- PhantomGremlin 12y agoI use coffee shop WiFi when I access useless sites such as Drudge Report. However, it's not hard to either a) switch to cellular on a phone before accessing something important like a banking site or b) use something like Personal Hotspot together with a phone switched to cellular to allow a laptop to access something important like a banking site That's what I do. I certainly don't trust random WiFi for sensitive communications. IMO you're much safer relying on AT&T or Verizon to connect you to key sites via cellular service rather than thru WiFi. OTOH I know that in the past AT&T has automatically switched my iPad from cellular to WiFi when I was at a coffee shop that had service from them. So this may be a little tricky in practice.
- thegeomaster 12y agoEven worse, from what I've observed, such networks are often not secure even against a trivial ARP spoof attack, so anyone connecting to the coffee shop Wi-Fi could mount this attack.
- ctz 12y agoYou're right. I was mainly talking about the impact of exploitation, rather than the conditions necessary for it.
- mentat 12y agoPrivileged network positions are sort of a joke with the current state of wifi security.
- Jare 12y agoNote also that this type of failure to strictly adhere to spec behaviour, for any specific case, is perfectly possible in other implementations, whereas coding errors like goto fail or heartbleed are much less likely to duplicate in different codebases. Thus, I wouldn't rule out other SSL implementations being vulnerable to this exact issue as well.
- hadoukenio 12y agoWas the person who commited ChangeCipherSpec the same person who commited HeartBleed?
- pera 12y agoNop => http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Inject...