The Five Percent: HTTPS Redirects Under Threat Thanks to Slow HSTS Adoption

Print Version
Share to a friend

HTTPS: Ideally, it’s the solution to insecure Web browsing, man-in-the-middle (MitM) attacks and

indiscriminate content blocking. Big names such as Google and Mozilla are taking steps to phase out

HTTP pages, while projects like Let’s Encrypt hope issuing free certificates will spur adoption.

 

As noted by SecurityWeek, however, there’s a new problem on the horizon: Just 5 percent of all servers

correctly implement HTTP Strict Transport Security (HSTS), meaning 95 percent are vulnerable to

attack when attempting to redirect HTTP queries.

 

Spoofed!

 

One big advantage of using HTTPS comes from its use of TLS certificates. It’s hard for attackers to

obtain legitimate certs for domains they don’t own, meaning they’re forced to spoof one if they want to

trick users and fire up a MitM, phishing or pharming attack.

 

Typically, these spoofs aren’t high-quality. HTTPS-enabled browsers can quickly detect the fake and

send out a warning to users. But here’s the problem: Not all users are directly connecting to secure sites.

 

Many still come in through HTTP portals if a site offers both protocols or if they’re using a cached

version of the page. In trying to beef up security, sites are understandably looking to redirect these users.

But without HSTS properly implemented, they’re actually putting visitors at risk.

 

HSTS uses a site’s header to provide browser instructions that only allow a connection over HTTPS, even

if a user manually types the link. Without HSTS in place, HTTP connections may inadvertently occur,

and it’s possible for cybercriminals to compromise HTTP-based redirection sites and execute MitM

attacks. Although the protocol was released over three years ago, adoption reached 5 percent and stuck

there — in large part because HTTPS has taken the spotlight while making connections to secure sites

has taken a back seat.

 

HTTPS Going Under?

 

As noted by The Register, even HTTPS sites aren’t always safe. With SSLv2, it’s now possible for

attackers to crack TLS and implement the DROWN attack — and recent data suggests that one-third of

all secure servers are vulnerable to this attack.

 

According to researchers, if attackers observe 1,000 TLS handshakes, initiate 40,000 SSLv2 connections

and then put in the time offline, it’s possible to decrypt a 2048-bit RSA TLS ciphertext. While this

sounds complicated, it only takes around eight hours using a public cloud service for a cost of less than

$500.

 

So what’s the final word? Is this security broken before it ever went mainstream? Not exactly. OpenSSL

has a patch for SSLv2 right around the corner. As long as servers correctly implement the HSTS

protocol, users shouldn’t get spoofed.

 

Next-gen browser security isn’t perfect. It’s better, faster and more flexible, but it isn’t unassailable.

Better to find and fix these flaws as servers and users transition rather than after adoption — and risk —

becomes ubiquitous.

 

Source:https://securityintelligence.com/news/the-five-percent-https-redirects-under-threat-thanks-to-slow-hsts-adoption/