Insecurity experts have found a key weakness in the Internet infrastructure that could let hackers launch undetectable attacks on commerical web sites. Boffins from the Netherlands, Switzerland and the United States think they can mimic the digital identity and authority assigned to RapidSSL. RapidSSL is an outfit that helps users spot the difference between legitimate Web sites from phishers. Since RapidSSL is trusted by makers of Internet browsers, they give them a security certificate. According to the Washington Post, E-commerce and banking sites use these certificates in combination with secure sockets layer (SSL) technology. However, RapidSSL uses a flawed cryptographic method, called MD5. All the boffins used a collection of techniques including building a supercomputer of 200 PlayStation 3s to reproduce a virtual clone of the digital signature RapidSSL uses to sign SSL certificates. Basically, a hacker has all they need to take control of a large network, and redirect the users to counterfeit versions of sites designed to steal the user's credentials. The user may never know the difference, because the attacker would have presented the victim's web browser with an SSL certificate. Verisign said it was ok with the boffins hacking about its RapidSSL. Yesterday they announced that they have fixed the flaw. Besides they are not going to use MD5 certificates after the end of January, so all that effort hacking it was a waste time. ( www.theinquirer.net )Source
Post a Comment