Security vendor Venafi surveyed 11 million publicly available IPv4 sites and found that 35 percent still use Secure Hash Algorithm 1 (SHA-1) certificates. That’s surprising, because the hash function has been considered cryptographically weak for the last decade or so. It is highly vulnerable to collision attacks, which enable attackers to spoof websites.
SHA-1: An Insecure Hash Algorithm
SecurityWeek reported that Google, Microsoft and Mozilla will stop accepting the outdated certificates in January 2017. Certificate authorities (CAs) will stop issuing them and shift to SHA-2 around the same time.
Google, however, plans to offer a workaround, Threatpost reported. Chrome will be able to discern whether certificates are chained to public or local CAs. Those linked to local trust anchors may still be used even after the deadline. Certificates are also used to decide what can and cannot be trusted during an online transaction.
According to Venafi, after January this kind of certificate use will cause major performance disruptions. For example, browsers will alert users that sites using SHA-1 are insecure and won’t display a green padlock or other symbol for secure HTTPS transactions. Browsers may even block access to sites that use the outdated certificates.
“Leaving SHA-1 certificates in place is a like putting up a welcome sign for hackers that says, ‘We don’t care about security of our applications, data, and customers,'” Kevin Bocek, chief security strategist at Venafi, wrote on the company’s blog.
Nowhere to Hide
It may not be as simple as Bocek suggested. The average organization has over 23,000 keys and certificates, and many lack the tools and visibility to detect all SHA-1 certificates present in their sites. Still, it’s critical to get ahead of the potential problems.
“Unfortunately, in January there will be nowhere for these businesses to hide,” Bocek noted. “My advice is to get a plan in place now because it will be even more difficult to fix after the deprecation deadline when things start to break.”
That’s sound advice. Things are always harder to fix when they’re broken.
Principal, PBC Enterprises
Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE mag...