The most dangerous code in the world

Abstract

SSL (Secure Sockets Layer) is the de facto standard for secure Internet communications. Security of SSL connections against an active network attacker depends on correctly validating public-key certificates presented when the connection is established.We demonstrate that SSL certificate validation is completely broken in many security-critical applications and libraries. Vulnerable software includes Amazon's EC2 Java library and all cloud clients based on it; Amazon's and PayPal's merchant SDKs responsible for transmitting payment details from e-commerce sites to payment gateways; integrated shopping carts such as osCommerce, ZenCart, Ubercart, and PrestaShop; AdMob code used by mobile websites; Chase mobile banking and several other Android apps and libraries; Java Web-services middleware-including Apache Axis, Axis 2, Codehaus XFire, and Pusher library for Android-and all applications employing this middleware. Any SSL connection from any of these programs is insecure against a man-in-the-middle attack.The root causes of these vulnerabilities are badly designed APIs of SSL implementations (such as JSSE, OpenSSL, and GnuTLS) and data-transport libraries (such as cURL) which present developers with a confusing array of settings and options. We analyze perils and pitfalls of SSL certificate validation in software based on these APIs and present our recommendations.cations. The main purpose of SSL is to provide end-to-end security against an active, man-in-the-middle attacker. Even if the network is completely compromised-DNS is poisoned, access points and routers are controlled by the adversary, etc.-SSL is intended to guarantee confidentiality, authenticity, and integrity for communications between the client and the server.Authenticating the server is a critical part of SSL connection establishment. 1 This authentication takes place during the SSL handshake, when the server presents its public-key certificate. In order for the SSL connection to be secure, the client must carefully verify that the certificate has been issued by a valid certificate authority, has not expired (or been revoked), the name(s) listed in the certificate match(es) the name of the domain that the client is connecting to, and perform several other checks [14,15].SSL implementations in Web browsers are constantly evolving through "penetrate-and-patch" testing, and many SSL-related vulnerabilities in browsers have been repaired over the years. SSL, however, is also widely used in non-browser software whenever secure Internet connections are needed. For example, SSL is used for (1) remotely administering cloud-based virtual infrastructure and sending local data to cloud-based storage, (2) transmitting customers' payment details from e-commerce servers to payment processors such as PayPal and Amazon, (3) logging instant messenger clients into online services, and (4) authenticating servers to mobile applications on Android and iOS.These programs usually do not implement SSL themselves. Instead, they rely on SSL libraries such as OpenSSL, GnuTL...

Client-Focused Security Assessment of mHealth Apps and Recommended Practices to Prevent or Mitigate Transport Security Issues

“…By being able to repeat a test automatically, it was possible to issue different secure sockets layer (SSL) certificates to find out whether the client validated them correctly. These or similar test scenarios are also found in other relevant research [22,31]. This led to the incorporation of similar tests into the research presented in this paper.…”

GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier

“…One core problem is that revocation checks in browsers are not comprehensive: Chrome generally does not verify revocations, its CRLSet is limited to emergency revocations by design [48], and Mozilla's Firefox similarly limits revocation checks through OneCRL to CA intermediate certificates [49]. Certificate revocations in other software and libraries, which rely on the same certificate issuance processes and would also be required to adopt the new revocation checks, are rarely checked in practice [50]. Furthermore, revocations are reactive by nature and they provide a window of opportunity to an attacker by design: the time until the revocation has propagated plus the time until the attacker's certificate has been revoked by the issuing CA on request of the legitimate party, the latter of which is generally a manual process as additional verification is required.…”

How Usable Are Rust Cryptography APIs?

“…Many applications that use encryption or other cryptographic services end up being vulnerable because their developers knowingly or unknowingly misuse cryptographic libraries [3,4,5,6]. While the cryptographic algorithms themselves may not contain severe bugs, their application programming interfaces (APIs) are not resistant to misuse and in some cases they are very difficult to use at all without detailed cryptographic knowledge.…”