March 21, 2016 By Douglas Bonderud 2 min read

HTTPS: Ideally, it’s the solution to insecure Web browsing, man-in-the-middle (MitM) attacks and indiscriminate content blocking. Big names such as Google and Mozilla are taking steps to phase out HTTP pages, while projects like Let’s Encrypt hope issuing free certificates will spur adoption.

As noted by SecurityWeek, however, there’s a new problem on the horizon: Just 5 percent of all servers correctly implement HTTP Strict Transport Security (HSTS), meaning 95 percent are vulnerable to attack when attempting to redirect HTTP queries.

Spoofed!

One big advantage of using HTTPS comes from its use of TLS certificates. It’s hard for attackers to obtain legitimate certs for domains they don’t own, meaning they’re forced to spoof one if they want to trick users and fire up a MitM, phishing or pharming attack.

Typically, these spoofs aren’t high-quality. HTTPS-enabled browsers can quickly detect the fake and send out a warning to users. But here’s the problem: Not all users are directly connecting to secure sites.

Many still come in through HTTP portals if a site offers both protocols or if they’re using a cached version of the page. In trying to beef up security, sites are understandably looking to redirect these users. But without HSTS properly implemented, they’re actually putting visitors at risk.

HSTS uses a site’s header to provide browser instructions that only allow a connection over HTTPS, even if a user manually types the link. Without HSTS in place, HTTP connections may inadvertently occur, and it’s possible for cybercriminals to compromise HTTP-based redirection sites and execute MitM attacks. Although the protocol was released over three years ago, adoption reached 5 percent and stuck there — in large part because HTTPS has taken the spotlight while making connections to secure sites has taken a back seat.

HTTPS Going Under?

As noted by The Register, even HTTPS sites aren’t always safe. With SSLv2, it’s now possible for attackers to crack TLS and implement the DROWN attack — and recent data suggests that one-third of all secure servers are vulnerable to this attack.

According to researchers, if attackers observe 1,000 TLS handshakes, initiate 40,000 SSLv2 connections and then put in the time offline, it’s possible to decrypt a 2048-bit RSA TLS ciphertext. While this sounds complicated, it only takes around eight hours using a public cloud service for a cost of less than $500.

So what’s the final word? Is this security broken before it ever went mainstream? Not exactly. OpenSSL has a patch for SSLv2 right around the corner. As long as servers correctly implement the HSTS protocol, users shouldn’t get spoofed.

Next-gen browser security isn’t perfect. It’s better, faster and more flexible, but it isn’t unassailable. Better to find and fix these flaws as servers and users transition rather than after adoption — and risk — becomes ubiquitous.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today