Featured Articles

Apple announces its Apple Watch

Apple announces its Apple Watch

Apple has finally unveiled its eagerly awaited smartwatch and surprisingly it has dropped the "i" from the brand, calling it simply…

More...
Skylake 14nm announced

Skylake 14nm announced

Kirk B. Skaugen, Senior Vice President General Manager, PC Client Group has showcased Skylake, Intel’s second generation 14nm architecture.

More...
Apple officially announces 4.7-inch iPhone 6 and 5.5-inch iPhone 6 Plus

Apple officially announces 4.7-inch iPhone 6 and 5.5-inch iPhone 6 Plus

The day has finally come and it appears that most rumors were actually spot on as Apple has now officially unveiled…

More...
CEO: Intel on target for 40m tablets

CEO: Intel on target for 40m tablets

Intel CEO Brian Krzanich just kicked off the IDF 2014 keynote and it started with a phone avatar, some Katy Perry…

More...
Aerocool Dead Silence reviewed

Aerocool Dead Silence reviewed

Aerocool is well known for its gamer cases with aggressive styling. However, the Dead Silence chassis offers consumers a new choice,…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Friday, 06 June 2014 11:02

Another Heartbleed flaw emerges

Written by Nick Farrell

Help, help the Internet is still broken

Before the Heartbleed flaw has been fully sorted out, another major bug has been found in SSL. The OpenSSL Foundation published an advisory warning to users to update their SSL yet again, this time to fix a previously unknown but more than decade-old bug in the software that allows any network eavesdropper to strip away its encryption.

The non-profit foundation, whose encryption is used by the majority of the Web’s SSL servers, issued a patch and advised sites that use its software to upgrade immediately.

Found by Japanese researcher Masashi Kikuchi, the flaw takes advantage of a portion of OpenSSL’s “handshake” for establishing encrypted connections known as ChangeCipherSpec, allowing the attacker to force the PC and server performing the handshake to use weak keys that allows a “man-in-the-middle” snoop to decrypt and read the traffic.

A FAQ published by Kikuchi’s boss, the software firm Lepidum said that the vulnerability allows malicious intermediate nodes to intercept encrypted data and decrypt them while forcing SSL clients to use weak keys which are exposed to the malicious nodes.

Unlike the Heartbleed flaw, which allowed anyone to directly attack any server using OpenSSL, the attacker exploiting this newly discovered bug would have to be located somewhere between the two computers communicating.

It is limited by the fact that it can only be used when both ends of a connection are running OpenSSL.

According to a blog post by Kikuchi, the roots of the OpenSSL flaw have existed since the very first release of the software in 1998. He said that OpenSSL’s code still hasn’t received enough attention from security researchers. “The biggest reason why the bug hasn’t been found for over 16 years is that code reviews were insufficient, especially from experts who had experiences with TLS/SSL implementation,” he wrote. “They could have detected the problem.”

Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments