A long-known but little-discussed vulnerability in the modern Internet's design was highlighted yesterday by a report that hackers traced to Iran spoofed the encryption procedures used to secure connections to Google, Yahoo, Microsoft, and other major Web sites.
This design, pioneered by Netscape in the early and mid-1990s, allows the creation of encrypted channels to Web sites, an important security feature typically identified by a closed lock icon in a browser. The system relies on third parties to issue so-called certificates that prove that a Web site is legitimate when making an "https://" connection.
The problem, however, is that the list of certificate issuers has ballooned over the years to approximately 650 organizations, which may not always follow the strictest security procedures. And each one has a copy of the Web's master keys.
"There is this problem that exists today where there are a very large number of certificate authorities that are trusted by everyone and everything," says Peter Eckersley, senior staff technologist at the Electronic Frontier Foundation who has compiled a list of them.
This has resulted in a bizarre situation in which companies like Etisalat, a wireless carrier in the United Arab Emirates that implanted spyware on customers' BlackBerry devices, possess the master keys that can be used to impersonate any Web site on the Internet, even the U.S. Treasury, BankofAmerica.com, and Google.com. So do more than 100 German universities, the U.S. Department of Homeland Security, and random organizations like the Gemini Observatory, which operates a pair of 8.1-meter diameter telescopes in Hawaii and Chile.
It's a situation that nobody would have anticipated nearly two decades ago when the cryptographic protection known as SSL (Secure Sockets Layer) began to be embedded into Web browsers. At the time, the focus was on securing the connections, not on securing the certificate authorities themselves--or limiting their numbers.
"It was the '90s," says security researcher Dan Kaminsky, who discovered a serious Domain Name System flaw in 2008. "We didn't realize how this system would grow." Today, there are now about 1,500 master keys, or signing certificates, trusted by Internet Explorer and Firefox.Read more: http://news.cnet.com/8301-31921_3-20046588-281.html#ixzz1K02xuT7Z