SSL Traffic Monitoring is a must-have security control

19. March 2011 · Comments Off on SSL Traffic Monitoring is a must-have security control · Categories: blog · Tags:

More and more web traffic is being encrypted, which is blinding organizations to potential threats. The Goldman Sachs programmer who was sentenced to 8 years in prison used SSL to encrypt his file transfers.

If your firewall cannot decrypt SSL, you must upgrade. It’s as simple as that.

Force-TLS does not force TLS

28. October 2010 · Comments Off on Force-TLS does not force TLS · Categories: Security-Compliance · Tags: , ,

Robert Graham from Errata Security tested Force-TLS and found that it does not protect against Firesheep.

First of all, the plug-in “Force-TLS” does not protect you, as some have suggested. I proved this with Twitter, where I was able to sidejack the connection with both FireSheep and Hamster. I’m not sure what Force-TLS does, but it doesn’t force a connection to be TLS/SSL. I configured *.twitter.com (the domain and all subdomains), and the URL “http://twitter.com” still appeared in the address bar.

In addition, Firesheep’s ability to successfully sniff traffic depends on your network adapter.

FireSheep works only as well as the underlying packet-capture. On a Macintosh, the adapter can be fully promiscuous, capturing everybody’s traffic on the local access-point. On Windows, some adapters (like Broadcom) will see all the traffic, others (like Intel) will only see your own traffic (useful for watching which of your own websites can be sidejacked, but not useful for sidejacking others).

Rob provides extensive details and screenshots on his test methods.

hackademix.net » Forcing HTTPS with NoScript

28. October 2010 · Comments Off on hackademix.net » Forcing HTTPS with NoScript · Categories: Encryption, Security-Compliance · Tags: , , ,

hackademix.net » Forcing HTTPS with NoScript.

Looks like those of you already using the NoScript Firefox add-on, you do not need another add-on to enable/force SSL when it’s available.

Fortunately NoScript, for more than two years now, has also allowed us to manually select the web sites which we want to browse via HTTPS only, by adding them in the NoScript Options|Advanced|HTTPS panel. Of course not all the web sites like to have HTTPS pushed down their throats, so you should pick only those already supporting HTTPS, and still may expect a tiny few of them to misbehave. However your online banking, your webmailaddons.mozilla.org are probably great candidates to be added in NoScript’s “force HTTPS” list right now and the aforementioned addons.mozilla.org are probably great candidates to be added in NoScript’s “force HTTPS” list right now.

Easy fix for Firesheep creates a problem for enterprises

26. October 2010 · Comments Off on Easy fix for Firesheep creates a problem for enterprises · Categories: Malware, Palo Alto Networks · Tags: , , , , ,

Using SSL encryption to connect to social networks like Facebook and Twitter mitigates the risk of your credentials being stolen when you are using public WiFi networks to connect to the Internet. But it creates a problem for enterprises attempting to control the use of social networking because most firewalls and Intrusion Prevention Systems are blind to SSL traffic.

The recent publication of Firesheep, and the subsequent download of over 104,000 copies of the Firefox plug-in in the last 24 hours, highlights this well understood security flaw in the way social networking sites communicate with their users. Firesheep sniffs the WiFi network traffic to capture your user name and the established session ID for any of 26 sites including Facebook, Twitter, Amazon, and the NYTimes. This allows the Firesheep user to access any of these sites as you!! This not only will reveal your personal information to the Firesheep user, but allow him/her to impersonate you.

This article, Firefox Add-on Firesheep Brings Hacking to the Masses, provides a very good detailed explanation of how Firesheep works. The article also describes several readily available tools which enable or force the use of SSL for all traffic to sites that accept SSL. In other words, rather than just encrypting the exhange of identification and password credentials, all traffic is encrypted.

There is no doubt that using SSL is a good privacy protection control. However, SSL encrypted sessions will make it more difficult for enterprises to control the use of social networking because most firewalls and IPSs are not capable of decrypting SSL traffic. In other words, most firewalls and IPSs are blind to SSL traffic. An exception is Palo Alto Networks, the industry leading Next Generation Firewall.