Microsoft promises patch to block BEAST attacks

But downplays feasibility of SSL/TLS attacks using proof-of-concept tool

Microsoft today said it will issue a Windows security update to plug a long-known hole in the protocol that secures websites.

Although the flaw in SSL (secure socket layer) 3.0 and TLS (transport layer security) 1.0, the follow-on Web encryption protocol to SSL, has been known for about a decade, a practical exploit only surfaced last week when a pair of researchers demonstrated what they called BEAST , for "Browser Exploit Against SSL/TLS," a hacking tool that attacks browsers and decrypts cookies, potentially giving attackers access to encrypted website log-on credentials.

Opera Software's flagship desktop browser relies on TLS 1.1, which is not vulnerable to such attacks, but others have either not made that move or as in Microsoft's case, have left TLS 1.1 support disabled by default.

In a security advisory issued Monday, Microsoft said it is working on an update for Windows, but did not say what it would patch or modify, or when it would deliver the fix.

"Microsoft is currently working to develop a security update for Windows to address this vulnerability," the advisory stated. "Microsoft will release the security update once it has reached an appropriate level of quality for broad distribution."

All versions of Windows, from the 10-year-old Windows XP to 2009's Windows 7, are vulnerable to BEAST attacks, Microsoft said.

Andrew Storms, director of security operations at nCircle Security, doesn't believe Microsoft will rush out an emergency update -- usually called "out-of-band" -- unless real world attacks begin circulating in large numbers.

"Until we see wide-spread attacks, I don't think there will be much pressure on them to go out-of-band," said Storms in an interview conducted via instant message. "And remember, it's not a Microsoft problem per se. It's more systemic with the implementation of cryptography that affects a wide variety of vendors."

Internet Explorer (IE) relies on Windows' implementation of SSL and TLS, the reason why Microsoft will patch the operating system and not its browser.

Windows 7 and Windows Server 2008 R2 support TLS 1.1, but the newer protocol is not enabled by default because of website compatibility issues: Relatively few of the servers that power sites use TLS 1.1.

Microsoft advised server and desktop users running those editions of Windows to switch on TLS 1.1, but warned them of possible problems if they did. It also published a pair of "Fix-it" tools that automate the process of turning on TLS 1.1.

While others have said that BEAST doesn't mean that users should panic, Microsoft acknowledged the theoretical danger even as it downplayed the practicality of attacks.

"Under certain circumstances, the attacker can decrypt the encrypted SSL traffic ... [but] there are significant mitigating factors that would make the attacks difficult or impossible," said a trio of Microsoft engineers from the company's security center.

Users can avoid attacks by closing the browser tabs for all websites before browsing to an encrypted URL -- designated by "HTTPS" at the front of the address -- to, say, log onto Hotmail or Gmail. "[If the user then] logs out of that HTTPS session before browsing any other HTTP sites or untrusted HTTPS sites, the user will NOT be at risk for this attack," said Chengyun Chu, Jonathan Ness and Mark Wodrich of the Microsoft Security Response Center.

Some browsers -- including Google's Chrome, Mozilla's Firefox and Apple's Safari -- are vulnerable to attack because they don't support the more secure encryption protocols, according to researcher Thierry Zoller , who works for Verizon in his day job.

Google, however, has modified the rough-edged "dev" build and the more polished "beta" of Chrome to block BEAST-style attacks, and Mozilla on Tuesday said that while Firefox relies on TLS 1.0, the browser itself is not at risk.

"The technical details of the attack require the ability to completely control the content of connections originating in the browser, which Firefox does not allow," said Mozilla in an anonymous post to the company's security blog .

Mozilla did confirm that the researchers responsible for BEAST "found weaknesses in Java plugins that permit this attack."

To stymie those attacks, Mozilla urged users to disable Java in Firefox, and said it was "currently evaluating the feasibility of disabling Java universally in Firefox installs."

To disable Java in Firefox, users should choose "Add-ons" from the "Tools" menu, click the "Plugins" tab on the left, then click "Disable" for "Java Applet Plug-in."

BEAST has raised a long-held concern about website encryption, said Quentin Liu, the senior director of engineering for Symantec's authentication group, which is based on the company's acquisition of VeriSign a year ago. "In general, this vulnerability has been known for years, but [BEAST] is a very interesting proof-of-concept," Liu acknowledged. "However, it does not mean the death of SSL."

Expanding on that, Liu said that newer protocols, like TLS 1.1, which harks back half a decade, offer a proven path to stymie BEAST-style man-in-the-middle attacks. The problem is that all the parties -- browser makers, operating system developers, developer tool makers -- haven't gotten on the same page.

"What's needed is a thoughtful migration to TLS 1.1 and beyond, a coordinated and in-sync migration path," said Liu.

While Symantec isn't one of the players who need to sit at the migration table, Liu said the company could leverage its position as a certificate issuing authority (CA) to pull others along.

"As a leader in our industry, what we can do is get all the parties that can affect change together," said Liu. "That's something we can do to try to bring people to the table."

In the shorter term, Lie counseled users to keep their software -- browsers and operating systems, the latter on both the desktop and on servers -- updated, and if they're running a vulnerable browser, to beef up anti-malware defenses to block the JavaScript- or Java-based attacks demonstrated by BEAST.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , on Google+ or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com .

See more articles by Gregg Keizer .

Read more about security in Computerworld's Security Topic Center.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags applicationsopera softwareMicrosoftsecurityWindowsbrowserssoftwareMalware and Vulnerabilitiesoperating systems

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?