MD5 Considered Harmful Today or Don't Put Too Much Faith in PKI

A group of 7 security researchers from the United States, Switzerland, and the Netherlands has released details of an exploitation ("MD5 considered harmful today") in the now well-known MD5 Hash Collision vulnerability that would allow a rogue web site to issue a rogue SSL certificate... as well as a rogue signing certificate that is trusted by a valid root Certificate Authority.

Putting that all into English (or at least non-geekspeak):

"Secure" web sites can be impersonated by evildoers, even with the cute little lock icon and a completely "valid" certificate as far as your browser is concerned. This web site could be your bank.

The paper discusses countermeasures, mostly aimed at Certificate Authorities (CAs) and browser vendors. One thing you can do is look at your certificate chain for critical sites to see if MD5 is used by the CA's signing certificate.

The Mozilla developers are already working on a patch for Firefox, et al.:
https://bugzilla.mozilla.org/show_bug.cgi?id=471539


--john

strip=1 ftw

I use lots of browser flame-retardant suit layers these days... NoScript, AdBlock, etc. I even tend to NoScript google.com by default. If you only go to "normal" web sites this might seem extreme, but if you are poking around the seedy back streets of the intertubes, you probably know what I mean.

Here is another good pair of tips for safer browsing:

1. Use the cache, Luke, and
2. Always use strip=1

You can use the google cache to search for your topic of interest, and the oracle will return some hits (e.g., "100th monkey"):

1. Hundredth Monkey Effect - Wikipedia, the free encyclopedia

   The “Hundredth Monkey Effect” is a supposed phenomenon in which a learned behaviour spreads instantaneously from one group of monkeys to all related monkeys ...
   en.wikipedia.org/wiki/Hundredth_Monkey - 32k - Cached - Similar pages - Note thisgqqw9kMHZRoFt8OyvG9JlHlDgwW5sgV299RIBg3DVr8DolLpJiLqsJelqosQMCWJe3ghxm2XTUvAtSU1k0AvRYTKu3ZWsO88HHco

2. The 100th Monkey Studio

   An open art studio using art therapy and creativity in Portland Oregon.
   www.the100thmonkeystudio.com/ - 14k - Cached - Similar pages - Note this

Then, click on the "Cached" link to view the page from the Google servers -- and avoid nastiness that might be found and the listed web sites themselves.

However...

That little trick doesn't completely protect you. Don't believe me? Just start up your favorite network sniffer (tcpdump, wireshark, etc.). You will see, if the page has certain types of content -- such as images, they will still come from the original web site. Oops! You have been identified, and hopefully not served.

The way to avoid this is to Right Click on that "Cached" link, past it into a browser's URL bar and add "&strip=1" to the end of it, such as...

http://www.google.com/search?q=cache:en.wikipedia.org\
/wiki/Hundredth_Monkey+100th+monkey&strip=1

Now your sniffer will happily report that all information comes only from Google.

Happy browsing!

SANS Forensics Blog is up!

Okay, you heard it here first!  

SANS has created a new blog on digital forensics, and yours truly is the first poster.

SANS has chosen a team of about 25 contributors to provide the latest news, tips, and techniques on the topic of forensics.  There are some great posts on the way, so enjoy!