Microsoft promises patch to block BEAST attacks
But downplays feasibility of SSL/TLS attacks using proof-of-concept tool
Computerworld - Microsoft today said it will issue a Windows security update to plug a long-known hole in the protocol that secures websites.
Although the flaw in SSL (secure socket layer) 3.0 and TLS (transport layer security) 1.0, the follow-on Web encryption protocol to SSL, has been known for about a decade, a practical exploit only surfaced last week when a pair of researchers demonstrated what they called BEAST, for "Browser Exploit Against SSL/TLS," a hacking tool that attacks browsers and decrypts cookies, potentially giving attackers access to encrypted website log-on credentials.
Opera Software's flagship desktop browser relies on TLS 1.1, which is not vulnerable to such attacks, but others have either not made that move or as in Microsoft's case, have left TLS 1.1 support disabled by default.
In a security advisory issued Monday, Microsoft said it is working on an update for Windows, but did not say what it would patch or modify, or when it would deliver the fix.
"Microsoft is currently working to develop a security update for Windows to address this vulnerability," the advisory stated. "Microsoft will release the security update once it has reached an appropriate level of quality for broad distribution."
All versions of Windows, from the 10-year-old Windows XP to 2009's Windows 7, are vulnerable to BEAST attacks, Microsoft said.
Andrew Storms, director of security operations at nCircle Security, doesn't believe Microsoft will rush out an emergency update -- usually called "out-of-band" -- unless real world attacks begin circulating in large numbers.
"Until we see wide-spread attacks, I don't think there will be much pressure on them to go out-of-band," said Storms in an interview conducted via instant message. "And remember, it's not a Microsoft problem per se. It's more systemic with the implementation of cryptography that affects a wide variety of vendors."
Internet Explorer (IE) relies on Windows' implementation of SSL and TLS, the reason why Microsoft will patch the operating system and not its browser.
Windows 7 and Windows Server 2008 R2 support TLS 1.1, but the newer protocol is not enabled by default because of website compatibility issues: Relatively few of the servers that power sites use TLS 1.1.
Microsoft advised server and desktop users running those editions of Windows to switch on TLS 1.1, but warned them of possible problems if they did. It also published a pair of "Fix-it" tools that automate the process of turning on TLS 1.1.
While others have said that BEAST doesn't mean that users should panic, Microsoft acknowledged the theoretical danger even as it downplayed the practicality of attacks.
"Under certain circumstances, the attacker can decrypt the encrypted SSL traffic ... [but] there are significant mitigating factors that would make the attacks difficult or impossible," said a trio of Microsoft engineers from the company's security center.
Users can avoid attacks by closing the browser tabs for all websites before browsing to an encrypted URL -- designated by "HTTPS" at the front of the address -- to, say, log onto Hotmail or Gmail. "[If the user then] logs out of that HTTPS session before browsing any other HTTP sites or untrusted HTTPS sites, the user will NOT be at risk for this attack," said Chengyun Chu, Jonathan Ness and Mark Wodrich of the Microsoft Security Response Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts