HTTPS: Ideally, it’s the solution to insecure Web browsing, man-in-the-middle (MitM) attacks and indiscriminate content blocking. Big names such as Google and Mozilla are taking steps to phase out HTTP pages, while projects like Let’s Encrypt hope issuing free certificates will spur adoption.
As noted by SecurityWeek, however, there’s a new problem on the horizon: Just 5 percent of all servers correctly implement HTTP Strict Transport Security (HSTS), meaning 95 percent are vulnerable to attack when attempting to redirect HTTP queries.
Spoofed!
One big advantage of using HTTPS comes from its use of TLS certificates. It’s hard for attackers to obtain legitimate certs for domains they don’t own, meaning they’re forced to spoof one if they want to trick users and fire up a MitM, phishing or pharming attack.
Typically, these spoofs aren’t high-quality. HTTPS-enabled browsers can quickly detect the fake and send out a warning to users. But here’s the problem: Not all users are directly connecting to secure sites.
Many still come in through HTTP portals if a site offers both protocols or if they’re using a cached version of the page. In trying to beef up security, sites are understandably looking to redirect these users. But without HSTS properly implemented, they’re actually putting visitors at risk.
HSTS uses a site’s header to provide browser instructions that only allow a connection over HTTPS, even if a user manually types the link. Without HSTS in place, HTTP connections may inadvertently occur, and it’s possible for cybercriminals to compromise HTTP-based redirection sites and execute MitM attacks. Although the protocol was released over three years ago, adoption reached 5 percent and stuck there — in large part because HTTPS has taken the spotlight while making connections to secure sites has taken a back seat.
HTTPS Going Under?
As noted by The Register, even HTTPS sites aren’t always safe. With SSLv2, it’s now possible for attackers to crack TLS and implement the DROWN attack — and recent data suggests that one-third of all secure servers are vulnerable to this attack.
According to researchers, if attackers observe 1,000 TLS handshakes, initiate 40,000 SSLv2 connections and then put in the time offline, it’s possible to decrypt a 2048-bit RSA TLS ciphertext. While this sounds complicated, it only takes around eight hours using a public cloud service for a cost of less than $500.
So what’s the final word? Is this security broken before it ever went mainstream? Not exactly. OpenSSL has a patch for SSLv2 right around the corner. As long as servers correctly implement the HSTS protocol, users shouldn’t get spoofed.
Next-gen browser security isn’t perfect. It’s better, faster and more flexible, but it isn’t unassailable. Better to find and fix these flaws as servers and users transition rather than after adoption — and risk — becomes ubiquitous.