Latest OpenSSL bug ‘may be more dangerous than Heartbleed’
More critical weaknesses have been uncovered in the OpenSSL web encryption standard, just two months after the disclosure of the notorious Heartbleed vulnerability affecting the same technology.
Tatsuya Hayashi, the researcher who found one of the critical bugs, told the Guardian that the latest flaw "may be more dangerous than Heartbleed" as it could be used to directly spy on people's communications.
Heartbleed was deemed to be one of the most critical internet vulnerabilities ever when it was uncovered in April. OpenSSL is supposed to protect people’s data with digital keys but has been exposed as flawed numerous times in recent months.
The latest vulnerability was introduced in 1998 and has been missed by both paid and volunteer developers working on the open-source project for 16 years.
Meanwhile, one of the other severe vulnerabilities in OpenSSL detailed this week was introduced by the same man responsible for the Heartbleed flaw, researchers said.
Using the vulnerability found by Hayashi, attackers sitting on the same network as a target, such as on the same public Wi-Fi network, could force weak encryption keys on connections between victims’ PCs and web servers.
With knowledge of those keys, the attacker could intercept data. They could even change the data being sent between the user and the website to trick the victim into handing over more sensitive information, such as usernames and passwords. This is known as a "man-in-the-middle" attack.
“Under the public Wi-Fi network situations, attackers can very easily eavesdrop and make falsifications on encrypted communications,” Hayashi added. “Victims cannot detect any trace of the attacks.”
The vulnerability affects all PC and mobile software using OpenSSL prior to the latest version, believed to include the Chrome browser on Android phones, and servers running OpenSSL 1.0.1 and the beta version for 1.0.2.
Many website owners will be running OpenSSL 1.0.1 as it fixed the Heartbleed vulnerability. Fixes have been issued by the team managing OpenSSL, which encrypts people’s internet traffic going to and from millions of web services around the world.
Internet users running vulnerable versions have been urged to install the patches, as detailed on the OpenSSL advisory, which included fixes for range of other flaws.
One of those other vulnerabilities, which could have allowed an attacker to send malicious code to affected machines running OpenSSL and therefore have them leak data, was introduced by the same developer as Heartbleed, Robin Seggelmann, four years ago, according to an HP blog post.
The job of fixing the bug found by Hayashi is likely to be far bigger than Heartbleed, warned Nick Percoco, vice president of strategic services from security firm Rapid7.
“From a remediation standpoint it is actually worse for organisations running OpenSSL on the server side. Heartbleed only affected versions back about two years," he said.
"This issue goes back to the first release of OpenSSL in 1998. That means there were likely many people running version that were not affected by Heartbleed that didn’t patch last time."
Many popular browsers appear to be safe from attack, however, noted Google security engineer Adam Langley, in another blog post. “Non-OpenSSL clients (Internet Explorer, Firefox, Chrome on Desktop and iOS, Safari, etc) aren't affected. None the less, all OpenSSL users should be updating,” he said.
Prof Alan Woodward, security expert from the department of computing at the University of Surrey, said he wasn’t sure the bug was as bad as Heartbleed due to its constraints - for example, both the server and the client must be vulnerable at the time of the attack. But the flaw has been left open for so long and affects so many servers that it showed OpenSSL was heading towards its death as a reliable form of protection, he said.
“It’s been there all along since OpenSSL first launched and no one has found it before, which tells you something about how thoroughly these open-source tools are checked,” Woodward told the Guardian.
“It does seem like another nail in the coffin for OpenSSL. It may not be dead but this must be another blow to people’s confidence.”
Heartbleed bug: what do you need to do to stay secure?