Browsers to End SHA-1 Support in 2017

Security vendor Venafi surveyed 11 million publicly available IPv4 sites and found that 35 percent still use Secure Hash Algorithm 1 (SHA-1) certificates. That’s surprising, because the hash function has been considered cryptographically weak for the last decade or so. It is highly vulnerable to collision attacks, which enable attackers to spoof websites.

SHA-1: An Insecure Hash Algorithm

SecurityWeek reported that Google, Microsoft and Mozilla will stop accepting the outdated certificates in January 2017. Certificate authorities (CAs) will stop issuing them and shift to SHA-2 around the same time.

Google, however, plans to offer a workaround, Threatpost reported. Chrome will be able to discern whether certificates are chained to public or local CAs. Those linked to local trust anchors may still be used even after the deadline. Certificates are also used to decide what can and cannot be trusted during an online transaction.

According to Venafi, after January this kind of certificate use will cause major performance disruptions. For example, browsers will alert users that sites using SHA-1 are insecure and won’t display a green padlock or other symbol for secure HTTPS transactions. Browsers may even block access to sites that use the outdated certificates.

“Leaving SHA-1 certificates in place is a like putting up a welcome sign for hackers that says, ‘We don’t care about security of our applications, data, and customers,'” Kevin Bocek, chief security strategist at Venafi, wrote on the company’s blog.

Nowhere to Hide

It may not be as simple as Bocek suggested. The average organization has over 23,000 keys and certificates, and many lack the tools and visibility to detect all SHA-1 certificates present in their sites. Still, it’s critical to get ahead of the potential problems.

“Unfortunately, in January there will be nowhere for these businesses to hide,” Bocek noted. “My advice is to get a plan in place now because it will be even more difficult to fix after the deprecation deadline when things start to break.”

That’s sound advice. Things are always harder to fix when they’re broken.

Larry Loeb

Principal, PBC Enterprises

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Evolving red teaming for AI environments

2 min read - As AI becomes more ingrained in businesses and daily life, the importance of security grows more paramount. In fact, according to the IBM Institute for Business Value, 96% of executives say adopting generative AI (GenAI) makes a security breach likely in their organization in the next three years. Whether it’s a model performing unintended actions, generating misleading or harmful responses or revealing sensitive information, in the AI era security can no longer be an afterthought to innovation.AI red teaming is emerging…

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

SHA-1: An Insecure Hash Algorithm

Nowhere to Hide

More from

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

Evolving red teaming for AI environments

What we can learn from the best collegiate cyber defenders

Topic updates