HTTPS: Ideally, it’s the solution to insecure Web browsing, man-in-the-middle (MitM) attacks and
indiscriminate content blocking. Big names such as Google and Mozilla are taking steps to phase out
HTTP pages, while projects like Let’s Encrypt hope issuing free certificates will spur adoption.
As noted by SecurityWeek, however, there’s a new problem on the horizon: Just 5 percent of all servers
correctly implement HTTP Strict Transport Security (HSTS), meaning 95 percent are vulnerable to
attack when attempting to redirect HTTP queries.
One big advantage of using HTTPS comes from its use of TLS certificates. It’s hard for attackers to
obtain legitimate certs for domains they don’t own, meaning they’re forced to spoof one if they want to
trick users and fire up a MitM, phishing or pharming attack.
Typically, these spoofs aren’t high-quality. HTTPS-enabled browsers can quickly detect the fake and
send out a warning to users. But here’s the problem: Not all users are directly connecting to secure sites.
Many still come in through HTTP portals if a site offers both protocols or if they’re using a cached
version of the page. In trying to beef up security, sites are understandably looking to redirect these users.
But without HSTS properly implemented, they’re actually putting visitors at risk.
HSTS uses a site’s header to provide browser instructions that only allow a connection over HTTPS, even
if a user manually types the link. Without HSTS in place, HTTP connections may inadvertently occur,
and it’s possible for cybercriminals to compromise HTTP-based redirection sites and execute MitM
attacks. Although the protocol was released over three years ago, adoption reached 5 percent and stuck
there — in large part because HTTPS has taken the spotlight while making connections to secure sites
has taken a back seat.
HTTPS Going Under?
As noted by The Register, even HTTPS sites aren’t always safe. With SSLv2, it’s now possible for
attackers to crack TLS and implement the DROWN attack — and recent data suggests that one-third of
all secure servers are vulnerable to this attack.
According to researchers, if attackers observe 1,000 TLS handshakes, initiate 40,000 SSLv2 connections
and then put in the time offline, it’s possible to decrypt a 2048-bit RSA TLS ciphertext. While this
sounds complicated, it only takes around eight hours using a public cloud service for a cost of less than
So what’s the final word? Is this security broken before it ever went mainstream? Not exactly. OpenSSL
has a patch for SSLv2 right around the corner. As long as servers correctly implement the HSTS
protocol, users shouldn’t get spoofed.
Next-gen browser security isn’t perfect. It’s better, faster and more flexible, but it isn’t unassailable.
Better to find and fix these flaws as servers and users transition rather than after adoption — and risk —