Lots of code excitement will spring from the Black Hat hacker conference this week, but already a huge controversy is erupting: Black Hat’s founder thinks SSL–the security code making much of online commerce safe–is broken.
SSL, Secure Sockets Layer (and its successor Transport Layer Security) is a Net-based security protocol that ensures communications between computers is safe and unhackable–essentially so that no one can “listen in.” It works like this: A server and computer connect together and say hello, digitally. This bit is unsecured. The two machines exchange a “key” which unlocks a private line that only they can communicate on.
These private exchanges are the basis of safe e-shopping, including credit card transactions. On the server side the site’s owners can be certain they’re speaking to a genuine customer, who’s data can be trusted (to an extent).
So when Black Hat’s keynote speaker Jeff Moss, founder of Black Hat and DEFCON, says that “SSL is broken,” it’s big news. Moss alleges that it’s been 13 years since the first hacker conference, and that it’s still not safe to do e-commerce. Moss wasn’t much more specific than that, but the implication is that hackers can easily breach SSL, and thus expose millions of supposedly secure transactions to potential thieves. Back in December 2008, for example, a group of hackers used the astonishing number-crunching powers of 200 PS3 games consoles to hack SSL, and in early 2009 hackers created fake “certificates” that would make an SSL interchange appear secure, even if it actually wasn’t. It’s been a while since these exploits, and as we know hackers continually refine their methods, so it’s plausible that much simpler exploits have been crafted in the interim.
The implications for e-commerce, and even businesses who rely on SSL code to make their communications safe, are potentially enormous. But is Moss right? V3.co.uk reports that security specialist Dan Kaminsky disagreed, and noted that there was still room to find some use from SSL–implying that clever code could still be secure, despite SSL’s weakness.
From a user point of view, there’s probably no need to panic right now. But the risk is that a sophisticated, coordinated hack (perhaps resembling the clever exploit the let Chinese hackers break Google’s systems) could result in mass theft of user data. The risk is small, but Black Hat exists to break news of potentially serious problems like this so that coders can fix the problems.
To keep up with this news, follow me, Kit Eaton, on Twitter.