![The Most Dangerous Code in the World:
Validating SSL Certificates in Non-Browser Software
Martin Georgiev Subodh Iyengar Suman Jana
The University of Texas Stanford University The University of Texas
at Austin at Austin
Rishita Anubhai Dan Boneh Vitaly Shmatikov
Stanford University Stanford University The University of Texas
at Austin
ABSTRACT cations. The main purpose of SSL is to provide end-to-end security
SSL (Secure Sockets Layer) is the de facto standard for secure In- against an active, man-in-the-middle attacker. Even if the network
ternet communications. Security of SSL connections against an is completely compromised—DNS is poisoned, access points and
active network attacker depends on correctly validating public-key routers are controlled by the adversary, etc.—SSL is intended to
certificates presented when the connection is established. guarantee confidentiality, authenticity, and integrity for communi-
We demonstrate that SSL certificate validation is completely bro- cations between the client and the server.
ken in many security-critical applications and libraries. Vulnerable Authenticating the server is a critical part of SSL connection es-
software includes Amazon’s EC2 Java library and all cloud clients tablishment.1 This authentication takes place during the SSL hand-
based on it; Amazon’s and PayPal’s merchant SDKs responsible shake, when the server presents its public-key certificate. In order
for transmitting payment details from e-commerce sites to payment for the SSL connection to be secure, the client must carefully verify
gateways; integrated shopping carts such as osCommerce, ZenCart, that the certificate has been issued by a valid certificate authority,
Ubercart, and PrestaShop; AdMob code used by mobile websites; has not expired (or been revoked), the name(s) listed in the certifi-
Chase mobile banking and several other Android apps and libraries; cate match(es) the name of the domain that the client is connecting
Java Web-services middleware—including Apache Axis, Axis 2, to, and perform several other checks [14, 15].
Codehaus XFire, and Pusher library for Android—and all applica- SSL implementations in Web browsers are constantly evolving
tions employing this middleware. Any SSL connection from any of through “penetrate-and-patch” testing, and many SSL-related vul-
these programs is insecure against a man-in-the-middle attack. nerabilities in browsers have been repaired over the years. SSL,
The root causes of these vulnerabilities are badly designed APIs however, is also widely used in non-browser software whenever
of SSL implementations (such as JSSE, OpenSSL, and GnuTLS) secure Internet connections are needed. For example, SSL is used
and data-transport libraries (such as cURL) which present devel- for (1) remotely administering cloud-based virtual infrastructure
opers with a confusing array of settings and options. We analyze and sending local data to cloud-based storage, (2) transmitting cus-
perils and pitfalls of SSL certificate validation in software based on tomers’ payment details from e-commerce servers to payment pro-
these APIs and present our recommendations. cessors such as PayPal and Amazon, (3) logging instant messenger
clients into online services, and (4) authenticating servers to mobile
applications on Android and iOS.
Categories and Subject Descriptors These programs usually do not implement SSL themselves. In-
C.2.0 [Computer-Communication Networks]: General—Secu- stead, they rely on SSL libraries such as OpenSSL, GnuTLS, JSSE,
rity and protection; K.4.4 [Computers and Society]: Electronic CryptoAPI, etc., as well as higher-level data-transport libraries,
Commerce—Security such as cURL, Apache HttpClient, and urllib, that act as wrappers
around SSL libraries. In software based on Web services, there is
Keywords an additional layer of abstraction introduced by Web-services mid-
dleware such as Apache Axis, Axis 2, or Codehaus XFire.
SSL, TLS, HTTPS, public-key infrastructure, public-key certifi-
cates, security vulnerabilities Our contributions. We present an in-depth study of SSL connec-
tion authentication in non-browser software, focusing on how di-
1. INTRODUCTION verse applications and libraries on Linux, Windows, Android, and
iOS validate SSL server certificates. We use both white- and black-
Originally deployed in Web browsers, SSL (Secure Sockets Lay- box techniques to discover vulnerabilities in validation logic. Our
er) has become the de facto standard for secure Internet communi- main conclusion is that SSL certificate validation is completely bro-
ken in many critical software applications and libraries. When
presented with self-signed and third-party certificates—including
Permission to make digital or hard copies of all or part of this work for a certificate issued by a legitimate authority to a domain called
personal or classroom use is granted without fee provided that copies are AllYourSSLAreBelongTo.us —they establish SSL connec-
not made or distributed for profit or commercial advantage and that copies tions and send their secrets to a man-in-the-middle attacker.
bear this notice and the full citation on the first page. To copy otherwise, to
republish, to post on servers or to redistribute to lists, requires prior specific
permission and/or a fee. 1
CCS’12, October 16–18, 2012, Raleigh, North Carolina, USA. SSL also supports client authentication, but we do not analyze it
Copyright 2012 ACM 978-1-4503-1651-4/12/10 ...$15.00. in this paper.](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-1-320.jpg)
![tion, making the problem hard to locate and repair, and effectively cates have not expired and that the certificates of the intermediate
taking it out of application developers’ hands. CAs have the CA bit set in the “Basic Constraints” field.
Fifth, least interesting technically but still critically important, Hostname verification. After the chain of trust is established, the
we observed many cases of developers deliberately disabling cer- client must verify the server’s identity. RFC 2818 advises the im-
tificate validation, while assuring both users and higher-level pro- plementors to use “SubjectAltNames” as the main source of server
grams that SSL is being supported but not informing them that pro- identifiers and support “Common Name” for backward compatibil-
tection against active attacks has been turned off. ity only, but most of the software we tested does it the other way
around and checks “Common Name” first. After building the list
3. OVERVIEW OF SSL of server identifiers, the client attempts to match the fully qualified
DNS name of the requested server to one of the identifiers.
3.1 Threat model If the client finds an exact match in the list of server identi-
fiers, verification is done by straightforward string comparison. The
We assume an active, man-in-the-middle network attacker who
client may also find a wildcard name in the list of identifiers. The
may control network routers or switches, Wi-Fi access points, and/or
rules for wildcard matching are fairly complex [14, 17], especially
DNS. She may also control one or more servers and possess valid
concerning international character sets.
SSL certificates for these servers. When an SSL client attempts to
connect to a legitimate server, the attacker can mislead it about the Certificate revocation and X.509 extensions. This paper focuses
server’s network address (e.g., through DNS poisoning) and trick it on verifying the server’s identity, but full certificate validation in-
into connecting to an attacker-controlled server instead. volves many more checks. These checks are essential for security,
Our attacker (1) does not have access to the private keys of le- yet are handled poorly or not at all by non-browser software.
gitimate servers, (2) does not control any certificate authorities, (3) For example, some SSL libraries such as OpenSSL implement
cannot forge certificates. Even if she succeeds in spoofing the ad- certificate revocation, but require the application to provide the
dress of a legitimate server, a correctly implemented SSL client certificate revocation list (CRL). The applications we analyzed do
should refuse to accept the malicious server’s certificate because of not avail themselves of this facility. Furthermore, libraries such as
a mismatch between the name(s) on the certificate and the domain JSSE require the application to check validity of the CRL on its
to which the client is connecting. own. Most applications don’t bother. Other SSL libraries, such as
Python’s ssl, do not expose a method for CRL checking.
target of our attacks Some X.509 certificate extensions contain security-critical infor-
SSL Client SSL Server mation such as key usage (e.g., is the CA allowed to use this key for
client hello signing certificates?), name constraints (restricting the names that
a sub-CA can certify), and certificate policies, described in RFC
server hello 2527 [13]. For instance, a CA may assign different levels of trust
validate server cert.
server cert. client cert. request to different sub-CAs, but the application must provide a policy that
(optional) takes advantage of this information. In practice, these extensions
client key exchange
validate are largely neglected. For example, until recently OpenSSL did not
client cert. (optional)
client cert. validate name constraints correctly, while cURL does not even have
change cipher spec (optional)
an interface for specifying the application’s certificate policy.
encrypted data
Attacks exploiting improper treatment of certificate revocation
and X.509 extensions are somewhat different from the “pure” man-
Figure 1: Simplified overview of SSL handshake. in-the-middle model considered in this paper. We leave their de-
tailed analysis to future work.
4. SSL ABSTRACTIONS
3.2 SSL certificate validation Depending on its needs, an application can “plug” into SSL at
An SSL connection starts with a handshake between the client different levels of abstraction. At the lowest level, there are many
and the server. The handshake protocol is summarized in Figure 1; popular SSL implementations with different features, licenses, and
see RFC 6101 [16] for a complete description. hardware requirements: OpenSSL, JSSE, CryptoAPI, NSS, yaSSL,
We focus on the client’s validation of the server certificate. All GnuTLS, BouncyCastle, and others. These libraries are mostly
SSL implementations we tested use X.509 certificates. The com- oblivious to protocols transported over SSL. Therefore, to avoid
plete algorithm for validating X.509 certificates can be found in having to parse HTTP messages on their own, applications that in-
RFC 5280 [15] and RFC 2818 [14]. In this paper, we consider two volve HTTP over SSL (HTTPS) typically do not use them directly.
of the checks; both are critical for security against active attacks. Instead, they employ one of the many HTTPS libraries (see Sec-
Chain-of-trust verification. Each X.509 certificate has an “issuer” tion 4.2), which in turn use SSL libraries internally. Applications
field that contains the name of the certificate authority (CA) that that use SOAP- or REST-based Web services require additional
issued the certificate. Every SSL client is configured with a list of middleware on top of HTTPS or WebSockets (see Figure 2).
certificates for trusted root CAs. 4.1 SSL libraries
In addition to its own certificate, the server sends the certificate
of the issuing CA. If the issuing CA is not a root CA, the server OpenSSL. OpenSSL only provides chain-of-trust verification; ap-
also sends a list of certificates of higher-level CAs all the way to plications must supply their own hostname verification code. This
a root CA. The client attempts to build a chain starting from the is typical for low-level SSL libraries. Different application-layer
server’s certificate at the bottom. Each certificate in the chain must protocols such as HTTPS, LDAP, etc. have different notions of
be signed by the CA immediately above it; the root CA must be one what constitutes a valid hostname and what it means for a hostname
of the client’s trusted CAs. The client also verifies that the certifi- to match the name(s) listed in the certificate. Therefore, hostname](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-3-320.jpg)
![SSL_CTX_set_verify_depth SSL_set_verify_depth
Applications Applications
SSL_CTX_set_verify SSL_set_verify SSL_set_fd
SSL_new
SOAP REST
Applications
Axis ... CXF Pusher ...
verify verify verify
HTTP Web Socket mode callback depth fd
... IM default: default: default:
HttpsClient ... cURL Weberknecht ... 0 None 9
SSL JSSE ... ... OpenSSL user−land SSL_CTX SSL
GnuTLS
libraries
kernel OpenSSL’s verify_result
TCP OS NetworkingStack
internal
data structures
Figure 2: Protocol stack.
SSL_get_verify_result SSL_connect
(see Algorithm 1)
verification must be managed either by the application itself, or by Figure 3: OpenSSL API for setting up SSL connections with
a data-transport wrapper such as cURL. the default chain-of-trust verification.
Proper hostname verification for OpenSSL and CryptoAPI is dis-
cussed in [21, Chap. 10.8], assuming the chain of trust has been
verified correctly. As discussed in [21, Chap. 10.5], the latter is
error-prone due to the complexity of the underlying API. OpenSSL
The certificate validation function in GnuTLS, gnutls_certif-
allows applications to customize chain-of-trust verification by pro-
icate_verify_peers2, has similarly atrocious error reporting. It
viding a callback function or modifying configuration variables such
takes a reference to tls_status as an argument and sets it to an
as “verify depth” and “verify mode” as shown in Figure 3.
appropriate error code if validation fails. For some errors (e.g.,
A program using OpenSSL can perform the SSL handshake by
insufficient credentials or no certificate found), it returns a negative
invoking the SSL_connect function. A high-level overview of the
value; for others (e.g., self-signed certificate), it sets the error code
handling of different configurations and callbacks is shown in Al-
but returns zero. In Section 7.4 we show that application developers
gorithm 1. They can have complex interactions.
misunderstand this complex relationship between the error status
Some certificate validation errors are signaled through the return
and the return value, resulting in broken certificate validation.
values of SSL_connect, while for other errors SSL_connect returns
OK but sets internal “verify result” flags. Applications must call JSSE. Java Secure Socket Extension (JSSE) provides numerous in-
SSL_get_ verify_result function to check if any such errors oc- terfaces through which Java applications—including Android mo-
curred. This approach is error-prone (see Section 7.6). bile apps—can establish SSL connections.
The low-level API is SSLSocketFactory. Depending on how the
Algorithm 1 Outline of SSL_connect control flow. SSL client is created, this API may or may not perform hostname
while chain of trust contains no trusted CA do verification. The following code sample is taken from X509Trust
if chain length <verify_depth then ManagerImpl.checkIdentity in Java 6 update 31:
Try to extend chain of trust by 1 level
private void checkIdentity(String hostname,
Set ERROR appropriately if any error X509Certificate cert, String algorithm)
else throws CertificateException {
Set ERROR to ‘incomplete chain’ if (algorithm != null && algorithm.length() != 0) {
end if ....
if ERROR then if (algorithm.equalsIgnoreCase("HTTPS")) {
verify_result = error HostnameChecker.getInstance(HostnameChecker.TYPE
if verify_callback == NULL then _TLS).match(hostname, cert);
if verify_mode != 0 then } else if (algorithm.equalsIgnoreCase("LDAP")) {
HostnameChecker.getInstance(HostnameChecker.TYPE
Print error and terminate connection. _LDAP).match(hostname, cert);
end if } else {
else throw new CertificateException(
ret = verify_callback(preverify_ok = 0, . . . ) "Unknown identification algorithm: " + algorithm);
if (verify_mode != 0) and (ret == 0) then }
Print error and terminate connection. }
end if }
end if
if ERROR is not related to incorrect parsing then The checkIdentity method throws an exception if the algorithm
return 1 field is set to anything other than HTTPS or LDAP. This is different
else from, for example, OpenSSL, which returns a value even if verifi-
return ERROR cation fails and expects the application to check this value.
end if JSSE APIs such as HttpsClient and HttpsURLConnection call
else
ret = verify_callback(preverify_ok = 1, . . . ) try SetHostnameVerification when creating SSL clients. This
if (verify_mode != 0) and (ret == 0) then method sets the algorithm field to HTTPS. The above code thus
Print error and terminate connection. invokes HostnameChecker and verifies the name in the certificate.
end if If the algorithm field in the client data structure is NULL or an
end if empty string, checkIdentity silently skips hostname verification
end while without throwing an exception. We conjecture that this behav-
return 1 ior is designed to accommodate implementors of certificate-based
protocols other than HTTPS or LDAP who may want to re-use](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-4-320.jpg)
![JSSE’s default trust manager for chain-of-trust verification but pro- nal consistency checks: for example, it allows connections to port
vide their own, protocol-specific hostname verification. 443 to have HTTP as the scheme. In Section 7.8, we show how this
On February 14, 2012, Java 7 update 3 was released. The code leads to errors even in code implemented by SSL experts.
for certificate validation is different from Java 6, but its behav- Weberknecht. Weberknecht4 is a Java implementation of the Web-
ior is similar: if the algorithm field is NULL or an empty string, Sockets protocol. It uses SSLSocketFactory but does not perform
checkIdentity is never invoked.
its own hostname verification. Any Java program that employs We-
private void checkTrusted(X509Certificate[] chain, berknecht is vulnerable to a man-in-the-middle attack.
String authType, Socket socket, boolean isClient)
throws CertificateException { cURL. cURL5 is a popular tool and library (libcurl) for fetching
... data from remote servers. Since version 7.10, cURL validates SSL
/ / check endpoint i d e n t i t y certificates by default. Internally, it uses OpenSSL to verify the
String identityAlg = sslSocket.getSSLParameters().
getEndpointIdentificationAlgorithm(); chain of trust and verifies the hostname itself. This functionality is
if (identityAlg != null && identityAlg.length != 0) controlled by parameters CURLOPT_SSL_VERIFYPEER (default value:
{ true) and CURLOPT_SSL_VERIFYHOST (default value: 2).
String hostname = session.getPeerHost();
checkIdentity(hostname, chain[0], identityAlg);
This interface is almost perversely bad. The VERIFYPEER param-
} eter is a boolean, while a similar-looking VERIFYHOST parameter is
} an integer. The following quote from the cURL manual explains
the meaning of CURLOPT_SSL_VERIFYHOST:
In SSL clients created using “raw” SSLSocketFactory (as op-
posed to HttpsClient or HttpsURLConnection wrappers), the algo- 1 to check the existence of a common name in the SSL
rithm field is NULL, thus JSSE does not perform hostname verifi- peer certificate. 2 to check the existence of a common
cation. The responsibility for hostname verification is delegated to name and also verify that it matches the hostname pro-
the software running on top of JSSE. This feature is not explained vided. In production environments the value of this
in the API documentation. Instead, the following warning can be option should be kept at 2 (default value).
found deep inside the JSSE reference guide:2
Well-intentioned developers not only routinely misunderstand
When using raw SSLSockets/SSLEngines you should these parameters, but often set CURLOPT_SSL_VERIFY HOST to TRUE,
always check the peer’s credentials before sending any thereby changing it to 1 and thus accidentally disabling hostname
data. The SSLSocket and SSLEngine classes do not verification with disastrous consequences (see Section 7.1).
automatically verify that the hostname in a URL matches
the hostname in the peer’s credentials. An application PHP. PHP provides several methods for establishing SSL connec-
could be exploited with URL spoofing if the hostname tions. For example, fsockopen, which opens a raw socket to the
is not verified. remote server, can be used to connect to SSL servers by putting
“ssl://” in the URL. Even though fsockopen does not perform any
The prevalence of Java software that uses SSLSocketFactory to certificate checks whatsoever, PHP application developers routinely
create SSL clients yet does not perform hostname verification (see use it for SSL connection establishment (see Section 9).
Section 4.2) suggests that developers are not aware of this feature. PHP also provides a cURL binding, which uses cURL’s default
The existence of alternative JSSE interfaces that do perform host- settings to establish SSL connections with proper certificate valida-
name verification only increases the confusion. tion. As we show in Sections 7.1, 7.2, and 7.3, application develop-
ers often set cURL options incorrectly, overriding the defaults and
4.2 Data-transport libraries breaking certificate validation.
In practice, most applications rely on data-transport frameworks Python. Several Python modules can be used for SSL connection
to establish HTTPS connections. These frameworks use SSL li- establishment. urllib, urllib2, and httplib connect to SSL servers
braries internally in a way that is usually opaque to applications. but do not check certificates. This is clearly documented in a bright
Apache HttpClient. Apache HttpClient3 is a client-side HTTP(S) pink box on the urllib front page:6
Java library based on JDK. The latest version is 4.2.1, published
on June 29, 2012, but most existing software employs older, 3.* Warning: When opening HTTPS URLs, it does not
versions. Apache HttpClient is used extensively in Web-services attempt to validate the server certificate. Use at your
middleware such as Apache Axis 2 (see Section 8) because native own risk!
JDK does not support SOAP Web services. Furthermore, Apache
HttpClient provides better performance than JDK for functionali- Nevertheless, even high-security applications routinely use these
ties such as sending HTTP POST requests. modules for SSL connection establishment (see Section 9).
Apache HttpClient uses JSSE’s SSLSocketFactory to establish Python also has an ssl module. This module verifies the certifi-
SSL connections. As explained in Section 4.1, this means that cate’s chain of trust, but not the hostname. The application must do
Apache HttpClient must perform its own hostname verification. its own hostname verification. In Python version 3, the ssl module
This leads to numerous vulnerabilities in software based on older introduced the match_hostname method for hostname verification,
versions on HttpClient that do not verify hostnames (Section 7.5). but it must be explicitly called by the application.
Furthermore, Apache HttpClient uses HttpHost data structure to
describe HTTP(S) connections. HttpHost does not have any inter-
2
http://docs.oracle.com/javase/6/docs/
technotes/guides/security/jsse/JSSERefGuide. 4
html http://code.google.com/p/weberknecht/
3 5
http://hc.apache.org/httpcomponents-client- http://curl.haxx.se/
6
ga/ http://docs.python.org/library/urllib.html](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-5-320.jpg)
![Merchant’s
5. SSL IN NON-BROWSER SOFTWARE Website
Payment
Gateway
We analyze a representative sample of non-browser software ap-
plications and libraries that use SSL for secure Internet connec-
tions. Some programs, such as instant messenger clients and sim-
ple mobile banking apps, are fairly straightforward in their use of
SSL. Others, especially middleware libraries, use SSL as part of a 1 2
Customer SSL tunnel
multi-layer software stack. Many of the programs we analyze trans- 3
SDK
mit extremely sensitive data—private files of individual users in the Internet
case of cloud clients, financial information of customers in the case
of merchant SDKs, developer account credentials in the case of 1 Credit Card 2 Charge Request 3 Payment
Information Confirmation
mobile advertising software—over potentially insecure public net-
works, thus it is absolutely critical that they use SSL correctly.
Figure 4: Merchant SDK interacting with payment processor.
Cloud client APIs. As cloud-computing platforms such as Ama-
zon EC2 grow in popularity, their operators supply client SDKs
through which third-party software can transmit user data to cloud-
based storage, manage cloud-based computation (e.g., start and ter- carts are an important component of e-commerce websites. They
minate virtual instances), and access other cloud services. For ex- keep track of customers’ shipping and billing information and al-
ample, Amazon provides EC2 API tools in Java, PHP, Python, and low them to purchase multiple items in one transaction. When the
Perl. Apache Libcloud is an example of an independent library for customer checks out, the shopping cart generates a summary of the
accessing multiple cloud providers. purchases and the total price and sends it to the payment gateway.
Shopping carts include modules for many payment processors.
Merchant payment SDKs. Operators of e-commerce websites of-
ten rely on third parties such as PayPal and Amazon Flexible Pay- Web-services middleware. Many modern programs rely on Web
ments Service (FPS) to process their customers’ payments. Pay- services. A Web service is “a software system designed to support
ment processors provide merchant SDKs (software development interoperable machine-to-machine interaction over a network.”7 A
kits) in a variety of languages. These libraries are designed to be service has an interface described in a machine-readable XML for-
integrated into the back end of e-commerce websites. Merchant mat. Different providers may provide different concrete implemen-
software uses them to transmit customers’ payment details and/or tations of this interface. Other systems interact with the service by
receive notifications when payments are made by customers. sending and receiving messages.
An online store typically has two options for payment process- Messages to and from Web services are sent using XML-based
ing. The first option is to have the customer enter payment details Simple Object Access Protocol (SOAP) or REpresentational State
directly into the payment processor’s website. When the customer Transfer (REST). From the viewpoint of the client software, a Web
checks out, the merchant’s website redirects her browser to PayPal service can be thought of as providing a remote procedure call
or Amazon, where the customer enters her name, credit or debit (RPC) interface, while SOAP or REST middleware marshals and
card number, etc. The merchant never sees these details. Once the unmarshals arguments of RPC calls.
payment is complete, the payment processor redirects the customer To interact with such a Web service—for example, if a cloud
back to the merchant’s website and notifies the merchant. client implemented in Java wants to interact with Amazon EC2 —
The merchant’s site runs a daemon listening for IPN (Instant Pay- existing Java software often uses SOAP middleware such as Apache
ment Notification) calls from the payment processor. Upon receiv- Axis, Axis 2, or Codehaus XFire (see Section 8). Similarly, if
ing a notification, the merchant is advised to verify that the call in- an Android app needs real-time “push” notifications, it may use
deed originated from the processor (some merchants skip this step, a client-side library to connect to the REST-based Pusher service.8
opening the door to “shop-for-free” attacks [23]). The merchant These middleware frameworks are responsible for transmitting
then completes the transaction with the customer. Web-service messages over the network. If the connection must be
The second option is preferred by larger, more established stores. secure, the middleware typically uses SSL but delegates actual SSL
It does not require the customer to leave the merchant’s website and connection management to a data-transport library such as Apache
allows the merchant to collect payment details directly from the HttpClient or Weberknecht (see Section 4.2).
customer. The back-end software on the merchant’s website then Mobile advertising. Mobile advertising services such as AdMob
transmits these details to the payment processor’s gateway over an supply software that providers of mobile apps install on their sites.
SSL connection and receives the confirmation that the payment suc- When a new app instance is initialized on a customer’s phone, it
ceeded (often over the same SSL connection). connects to the provider’s site, which in turn notifies the AdMob
Fig. 4 shows schematically the interaction between the merchant’s server so that all ads shown to this app instance will be associated
server and the payment gateway. The SSL client is the merchant’s with the provider’s account (to enable ad revenue sharing, etc.).
back-end software (running on the merchant’s server), while the The connection from the app provider’s site to the AdMob server
payment gateway acts as the SSL server. contains the provider’s credentials and must be protected by SSL.
We analyzed SSL connection establishment in popular merchant
SDKs, including Java and PHP SDKs for Amazon Flexible Pay-
ments Service and multiple interfaces to PayPal: Payments Pro, 6. EXPERIMENTAL TESTBED
Transactional Information, and Mass Pay (all in Java), as well as Our primary methodology for the initial discovery of SSL cer-
Payments Standard and Invoicing (PHP). We also analyzed both tificate validation bugs is black-box fuzzing. We test applications
Amazon’s and PayPal’s utilities that merchants can use to verify and libraries implementing SSL client functionality on two Dell
the origin of IPN (Instant Payment Notification) calls. laptops running Microsoft Windows 7 Professional Service Pack
We also analyzed several open-source shopping carts written in 7
http://www.w3.org/TR/ws-arch/
PHP: osCommerce, ZenCart, Ubercart, and PrestaShop. Shopping 8
http://pusher.com](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-6-320.jpg)
![1 and Ubuntu Linux 10.04, respectively. Mobile applications are The URL verification utility—found in srcAmazonIpnRe-
tested on a Nexus One smartphone running Android 2.3.6 and an turnUrlValidationSignatureUtilsForOutbound.
iPad 2 running iOS 4.2.1. php—is broken in a very similar way. This utility is critically im-
We use local DNS cache poisoning to divert clients’ connections portant because it is used by merchants to verify the origin of the
to a simulated attack server executing on an old Dell laptop with calls informing them that a customer’s payment has been success-
Ubuntu Linux 10.04. To simulate a man-in-the-middle attacker, we fully processed (see Section 5). Because Amazon’s PHP SDK does
built two prototypes: one in Java, using JKS keystore to manage not correctly verify the origin of the IPN call, e-commerce sites
the attacker’s certificates and keys, the other in C, using OpenSSL using it may be vulnerable to “shop-for-free” attacks [23].
for certificate and key management. We also used Fiddler, a Web
debugging proxy [9]. If Fiddler encounters a connection request 7.2 PayPal Payments Standard and
to a server it has not seen before, it creates a new certificate with PayPal Invoicing (PHP)
the common name matching the requested name and stores it in
PayPal Payments Standard SDK implemented in PHP uses cURL.
its repository; otherwise, it retrieves an existing certificate from
The previous version disabled all certificate validation checks:
its repository. Fiddler then presents the certificate to the client,
allowing us to simulate a man-in-the-middle attacker who presents curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
self-signed certificates with correct common names. In addition, curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
we enabled Fiddler to capture and decrypt HTTPS connections.
The version released on April 27, 2012, “fixes” the problem:
Our simulated “man-in-the-middle” server presents the client with
several certificates: (1) a self-signed certificate with the same com- curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, TRUE);
mon name as the host the client is attempting to connect to, (2) a curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, TRUE);
self-signed certificate with an incorrect common name, and (3) a
As in Section 7.1, this code overrides the correct default value of
valid certificate issued by a trusted certificate authority to a domain
CURLOPT_SSL_VERIFYHOST and breaks hostname verification.
called AllYourSSLAreBelongTo.us. If the client establishes
PayPal Invoicing contains similarly broken code:
an SSL connection, the attack server decrypts traffic sent by the
client. It can then establish its own SSL connection to any legiti- public function setHttpTrustAllConnection(
mate server specified by the attacker and forward the client’s traffic. $trustAllConnection)
{
The attack server also listens for the legitimate server’s response, $this->curlOpt[CURLOPT_SSL_VERIFYPEER] =
decrypts and logs it, re-encrypts it with the symmetric key the at- !$trustAllConnection;
tacker shares with the client and forwards it to the client. $this->curlOpt[CURLOPT_SSL_VERIFYHOST] =
!$trustAllConnection;
If we observed a particular client successfully establishing an }
SSL connection when presented with any of the attack certificates,
we analyzed the source code of the client or, in the case of closed- Any PHP code using these PayPal-provided SDKs to establish
source applications, the results of reverse-engineering, decompi- an SSL connection to PayPal’s payment processing gateway is in-
lation, and runtime traces (focusing in particular on calls to SSL secure against a man-in-the-middle attack.
libraries) in order to find the root cause of the vulnerability.
In Sections 7 through 10, we describe the vulnerabilities in spe- 7.3 PayPal IPN in ZenCart
cific programs, arranged by error type. ZenCart’s functionality for PayPal IPN shows a profound misun-
derstanding of cURL’s parameters. It disables certificate validation
entirely, yet attempts to enable hostname verification—even though
7. MISUNDERSTANDING THE SSL API the latter has no effect if certificate validation is disabled.
$curlOpts=array( ...
7.1 Amazon Flexible Payments Service (PHP) CURLOPT_SSL_VERIFYPEER => FALSE,
CURLOPT_SSL_VERIFYHOST => 2
Amazon Flexible Payments Service (FPS) provides SDKs that ... );
merchants use to transmit customers’ payment details to the FPS
gateway. The PHP version of the FPS SDK uses a wrapper around 7.4 Lynx
the libcurl library (see Section 4.2) to establish an SSL connection
to the gateway. cURL’s options for certificate validation are set in Lynx is a text-based browser, included in our study because it is
srcAmazonFOPSClient.php as follows: often used programmatically by other software. It relies on GnuTLS
to validate SSL certificates:
curl_setopt($curlHandle, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($curlHandle, CURLOPT_SSL_VERIFYHOST, true); ret = gnutls_certificate_verify_peers2(handle->gnutls_
... state, &tls_status);
/ / Execute the request if (ret < 0) {
$response = curl_exec($curlHandle); int flag_continue = 1;
char *msg2;
This well-intentioned code contains a fatal mistake. cURL’s de- if (tls_status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
fault value of CURLOPT_SSL_VERIFYHOST is correctly set to 2. In the msg2 = gettext("no issuer was found");
curl_setopt($curlHandle,CURLOPT_SSL_VERIFYHOST, true) call, } else if (tls_status & GNUTLS_CERT_SIGNER_NOT_CA) {
true silently turns into 1, overriding the default and instructing msg2 = gettext("issuer is not a CA");
} else if (tls_status & GNUTLS_CERT_SIGNER_NOT_FOUND)
cURL to check the existence of any common name in the certificate {
(Section 4.2), which may or may not match the name requested. msg2 = gettext("the certificate has no known issuer"
Any PHP code using this Amazon-provided SDK to establish an );
} else if (tls_status & GNUTLS_CERT_REVOKED) {
SSL connection to the Amazon Flexible Payments Service gateway msg2 = gettext("the certificate has been revoked");
is insecure against a man-in-the-middle attack. } else {](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-7-320.jpg)
![msg2 = gettext("the certificate is not trusted"); } example, it will reject mail.<a>.<b>.com if the name in the
... } certificate is m*.<a>.<b>.com.
Furthermore, the original patch, as well as its derivatives, has
This code misinterprets the semantics of gnutls_certificate_
a minor bug in the regular expression for parsing IPv4 addresses,
verify_peers2. As explained in Section 4.1, this function indeed
causing it to accept IP addresses starting with zero (this does not
sets the tls_status code if certificate validation fails, but for cer-
immediately result in a security vulnerability):
tain errors—including self-signed certificates!—it returns 0. Even
though the above code includes two identical checks for GNUTLS_ private static final Pattern IPV4_PATTERN =
CERT_SIGNER_NOT_FOUND, neither check is ever executed when GNU- Pattern.compile("^(25[0-5]|2[0-4]d|[0-1]?d
?d)(.(25[0-5]|2[0-4]d|[0-1]?d?d))
TLS_CERT_SIGNER_NOT_FOUND is actually true! In this case hostname {3}$");
verification is correct, but chain-of-trust verification is broken.
7.5 Apache HttpClient 7.6 Trillian
The most widely used version of Apache HttpClient is 3.1, re- Trillian, a popular instant messenger client, relies on OpenSSL
leased in 2007. This library, as well as its earlier versions, sets for SSL connection establishment. By default, OpenSSL does not
up SSL connections using JSSE’s SSLSocketFactory without per- throw a run-time exception if the certificate is self-signed or has an
forming its own hostname verification (see Sections 4.1 and 4.2). invalid chain of trust. Instead, it sets flags. Furthermore, OpenSSL
As a consequence, Apache HttpClient 3.* accepts any certificate does not provide any hostname verification.
with a valid chain of trust, regardless of the name. As mentioned in If the application has called SSL_CTX_set to set the SSL_VERIFY
Section 4.2, the same bug occurs in Weberknecht. _PEER flag (see Section 4.1), then SSL_connect exits and prints an
The hostname verification bug in HttpClient was fixed in version error message when certificate validation fails. Trillian does not set
4.0-alpha1 [1]. The current version, 4.2.1, has its own hostname the SSL_VERIFY_PEER flag. When this flag is not set, SSL_connect
verifier and delegates chain-of-trust verification to JSSE. Unfortu- returns 1. The application is then expected to check the status of
nately, as we show in Section 8, the existence of a correct imple- certificate validation by calling SSL_get_verify_result. Trillian
mentation of HttpClient has had little effect on the security of appli- does not call this function.
cations that rely on HttpClient for SSL connection establishment. Trillian thus accepts any SSL certificate and is insecure against a
Apache HttpClient 4.* involved a major architectural re-design, man-in-the-middle attack. Depending on the specific module cho-
thus much of legacy and even new software still relies on version sen by the Trillian user, this reveals usernames, passwords, secu-
3.*. The use of HttpClient is often hidden inside Web-services mid- rity tokens, etc. for Google Talk (typically compromising all of the
dleware such as Axis 2 and XFire, which—several years after ver- user’s Google services), AIM, ICQ, Windows Live (including Sky-
sion 4.* became available—still ship with HttpClient 3.* and thus Drive), and Yahoo! Messenger (and thus all Yahoo! services).
skip hostname verification for SSL certificates. Interestingly, it was reported back in 2009 that older versions of
It is worth noting that the custom hostname verification code Trillian do not correctly validate MSN certificates [20]. This bug
added to HttpClient 4.* is incorrect and will reject valid certificates. was ostensibly fixed in Trillian 4.2. Our analysis shows, however,
The following code is from HttpClient 4.2.1: that SSL certificate validation is still completely broken for all ser-
vices, not just for MSN (Windows Live), in Trillian 5.1.0.19.
/ / The CN b e t t e r h a v e a t l e a s t two d o t s i f i t w a n t s
wildcard
/ / action . I t a l s o can ’ t be [ ∗ . co . uk ] o r [ ∗ . co . j p ] o r
7.7 Rackspace
/ / [ ∗ . o r g . uk ] , e t c . . . The Rackspace app for iOS (version 2.1.5) is an open-source
String parts[] = cn.split("."); application for administering Rackspace cloud services. It uses the
boolean doWildcard = parts.length >= 3 &&
parts[0].endsWith("*") &&
OpenStack iOS cloud client framework, which in turn relies on the
acceptableCountryWildcard(cn) && ASIHTTPRequest library to set up HTTPS connections.
!isIPAddress(host); ASIHTTPRequest provides a configuration variable Validates
if(doWildcard) {
SecureCertificate, set to 1 by default. If reset to 0, it turns
if (parts[0].length() > 1) { / / e . g . s e r v e r ∗
String prefix = parts[0].substring(0, parts.length off both chain-of-trust and hostname verification. OpenStack sup-
-2); / / e . g . s e r v e r ports multiple accounts on remote servers and lets users customize
String suffix = cn.substring(parts[0].length()); SSL certificate validation on per-account basis using the ignoreSSL
/ / s k i p w i l d c a r d p a r t f r o m cn
String hostSuffix = hostName.substring(prefix.length Validation variable. The value of this variable depends on the GUI
()); / / s k i p w i l d c a r d p a r t f r o m h o s t switch validateSSLSwitch, which should be shown to the user.
match = hostName.startsWith(prefix) && hostSuffix. The Rackspace app (version 2.1.5) does not present the user with
endsWith(suffix);
} else { this option.9 The GUI switch validateSSLSwitch is thus never dis-
match = hostName.endsWith(cn.substring(1)); played or explicitly assigned. Instead, it is simply initialized to 0 by
} the Objective-C allocator. This turns on ignoreSSLValidation in
if(match && strictWithSubDomains) {
/ / I f we ’ r e i n s t r i c t mode , t h e n [ ∗ . f o o . com ] i s n o t ASIHTTPRequest, which in turn sets ValidatesSecureCertificate
/ / a l l o w e d t o match [ a . b . f o o . com ] to 0 and disables certificate validation.
match = countDots(hostName) == countDots(cn); As a consequence, SSL connections established by the Rackspace
}
} else {
app on iOS are insecure against a man-in-the-middle attack.
match = hostName.equals(cn);
} 7.8 TextSecure
TextSecure is an Android application for encrypting SMS and
This code computes the length of the prefix by subtracting 2
MMS messages. It was written by Moxie Marlinspike who had
from the number of parts (determined by the number of dots in the
name). This logic is incorrect: validity of the first part of a domain 9
We are informed by Mike Mayo that this was an accidental over-
name should have nothing to do with the total number of parts. For sight and will be fixed in subsequent releases of the app.](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-8-320.jpg)
![previously discovered several SSL certificate validation vulnerabil- In summary, any software using any of the above Web-services
ities [11, 12]. This following code can be found in the application frameworks is insecure against a man-in-the-middle attack.
(however, it does not appear to be reachable from the user interface Apache CXF. Apache CXF is a continuation of XFire. It supports
and may not currently lead to an exploitable vulnerability): SOAP, along with REST and CORBA; the latest release is 2.6.1.
schemeRegistry.register(new Scheme("http", It does not rely on Apache HttpClient. Instead, SSL connections
PlainSocketFactory.getSocketFactory(), 80)); are established using OpenJDK’s HttpsClient. Therefore, prop-
schemeRegistry.register(new Scheme("https", erly configured instances of CXF do verify hostnames.
SSLSocketFactory.getSocketFactory(), 443));
... Apache CXF provides an application-controlled option to turn
HttpHost target = new HttpHost(hostUrl.getHost(), off certificate validation. Certificate validation is enabled by de-
hostUrl.getPort(), HttpHost.DEFAULT_SCHEME_NAME); fault, but was disabled in the sample wsdl_first_https code sup-
...
HttpResponse response = client.execute(target, request); plied with CXF until we notified the developers.
Even if the port number is 443, DEFAULT_SCHEME_NAME is “http”
and the connection is over HTTP, not HTTPS.
9. USING INSECURE SSL LIBRARIES
As described in Section 4.2, PHP’s fsockopen does not validate
SSL certificates. Nevertheless, it is often used even by applications
8. USING INSECURE MIDDLEWARE that must be secure against a man-in-the-middle attack. For exam-
As explained in Section 5, software based on Web services usu- ple, PayPal’s IPN utility contains this code:
ally relies on middleware libraries to manage network connections. / / p o s t b a c k t o PayPal u t i l i t y t o v a l i d a t e
SSL functionality inside these libraries is opaque to the applica- ...
tions. If the middleware employs a broken HTTPS implementation $fp = fsockopen (’ssl://www.paypal.com’, 443, $errno,
that does not correctly validate SSL certificates, all applications $errstr, 30);
based on it typically “inherit” the vulnerability.
This code is replicated in PayPal payment modules for ZenCart
and PrestaShop shopping carts. PrestaShop uses fsockopen in its
8.1 Apache Axis, Axis 2, Codehaus XFire CanadaPost payment module, too. Other similarly vulnerable soft-
Apache Axis is an open-source Java implementation of SOAP. ware includes Open Source Classifieds,
The latest release is 1.4, discontinued in 2007 in favor of Axis 2, Python’s URL libraries do not validate certificates (Section 4.2),
but the library is still used, for example, in PayPal’s Java SDKs. yet developers still use them for SSL connections. Examples in-
Apache Axis 2 is a complete redesign of Apache Axis. The lat- clude Tweepy, a library for accessing Twitter API that uses httplib,
est release is 1.6.2. Codehaus XFire is another open-source Java and Mozilla’s Zamboni project, which accepts contributions for
implementation of SOAP. It was discontinued in 2007 in favor of extension developers and uses urllib2 to connect to PayPal.
Apache CXF, but is still used, for example, in Amazon’s EC2 Java
SDK. The latest release of XFire is 1.2.6.
Apache Axis uses its own version of HttpClient, while Axis 2 10. BREAKING OR DISABLING
and XFire use Apache HttpClient version 3.1. Both versions of CERTIFICATE VALIDATION
HttpClient rely on SSLSocketFactory for SSL connection estab- In general, disabling proper certificate validation appears to be
lishment but mistakenly omit hostname verification (Section 4.2). the developers’ preferred solution to any problem with SSL libraries.
SSL vulnerabilities caused by bugs in Web-services middleware Here are a few typical quotes from developers’ forums:
are pervasive in Amazon libraries. Affected software includes Ama-
zon EC2 API Tools Java library, which uses XFire to set up SSL • “I want my client to accept any certificate (because I’m only
connections to EC2 servers, and Amazon Flexible Payments Ser- ever pointing to one server) but I keep getting a javax.net.
vice (Java) merchant SDK, which relies on an old Apache Http- ssl.SSLException: Not trusted server certificate ex-
Client. The latter library is used by merchants to transmit cus- 11
ception” —[note the fallacious reasoning!]
tomers’ payment details to the FPS gateway. The PHP version of
the library is broken, too, but in a very different way (Section 7.1). • “Tutorial: Disabling Certificate Validation in an HTTPS Con-
In contrast to the PHP version, however, the Java utility for verify- nection. . . Reply: Thank you very much. You solved my
ing instant payment notifications uses JSSE’s HttpsClient instead biggest problem in the project.” 12
of Apache HttpClient and thus checks SSL certificates correctly.
Other software that relies on Axis includes Java SOAP SDKs • “I have always turned off CURLOPT_SSL_VERIFYPEER
for PayPal Payments Pro (Direct Payment), PayPal Transac- in curl.”13
tional Information, and PayPal Mass Pay, as well as Apache
ActiveMQ implementation of JMS (Java Message Service). • “I am using axis on java to consume a webservice. The web
service is in https, and I want to avoid the the check for cer-
8.2 Pusher tificate.”14
Pusher is a WebSocket-based API that provides real-time mes- 11
http://stackoverflow.com/questions/2642777/
saging functionality to mobile and Web applications. Pusher’s An- trusting-all-certificates-using-httpclient-
droid libraries10 are based on Weberknecht (see Section 4.2). Any over-https
application using these libraries (e.g., GitHub’s Gaug.es) is thus 12
http://www.exampledepot.com/egs/javax.net.
insecure. It is also worth noting that Gaug.es is using an updated ssl/trustall.html
version of Weberknecht, which, in addition to incorrectly using raw 13
http://stackoverflow.com/questions/
SSLSocketFactory (see Section 4.1), disables the trust manager. 10102225/curl-ssl-certificates
14
http://stackoverflow.com/questions/9079298/
10
https://github.com/EmoryM/Android_Pusher axis-fake-certificate](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-9-320.jpg)
![• “However, by default, SSL support in NSStream is a little def _verify_hostname(self, hostname, cert):
paranoid. It won’t, for example, use a self-signed certifi- # V e r i f y hostname a g a i n s t peer c e r t
# Check b o t h commonName and e n t r i e s i n s u b j e c t A l t N a m e ,
cate or an expired certificate to establish a secure connec- # u s i n g a r u d i m e n t a r y glob t o dns r e g e x check
tion. NSStream does a number of validity checks when es- # to f i n d matches
tablishing the secure connection, and if they don’t all pass,
common_name = self._get_common_name(cert)
the streams appear to be valid, but no data gets sent or re- alt_names = self._get_subject_alt_names(cert)
ceived. This is somewhat frustrating, and it could be there’s
a way to find out when the secure connection failed, but I # r e p l a c e ∗ w i t h a l p h a n u m e r i c and d a s h
# replace . with l i t e r a l .
haven’t been able to find it in the documentation, or using valid_patterns = [re.compile(pattern.replace(r".", r"
Google. There is an error domain declared for these errors .").replace(r"*", r"[0-9A-Za-z]+"))
(NSStreamSocketSSLErrorDomain), but in my experimenta- for pattern
tion, no errors gets generated, the streams even accept bytes in (set(common_name) | set(alt_names))
]
for transfer, but nothing happens.” 15
return any(
pattern.search(hostname)
Unfortunately, these bad development practices find their way for pattern in valid_patterns
even into critical software responsible for transmitting financial in- )
formation and sensitive data, where security against man-in-the-
middle attacks is absolutely essential and SSL certificate valida- This bug has been fixed in Libcloud version 0.11.1 after we no-
tion should be mandatory. For example, a comment in the Autho- tified the developers.
rize.Net eCheck module of ZenCart says that certificate validation
is disabled for “compatibility for SSL communications on some 10.3 Amazon Elastic Load Balancing API Tools
Windows servers (IIS 5.0+)”—note the fallacious reasoning! This library overrides JDK’s default X509TrustManager to dis-
able hostname verification. Even if X509TrustManager had not been
10.1 Chase mobile banking overriden, this library employs Codehaus XFire which does not
Chase is a major US bank. SSL connections established by its perform hostname verification (see Section 8.1).
mobile banking application on Android are insecure against a man-
in-the-middle attack. This allows a network attacker to capture cre- 10.4 Shopping carts
dentials, such as username and password, of any Chase customer osCommerce, ZenCart, Ubercart, and PrestaShop are open-
using this app, along with the rest of their session. source shopping carts implemented in PHP. They use cURL for
Decompilation and analysis of this app’s code show that it over- SSL connections to payment gateways. If cURL is not available,
rides the default X509TrustManager. The replacement code simply they typically fall back on (insecure) fsockopen.
returns without checking the server’s certificate. The code below All carts are bundled with plugin modules for specific payment
is the result of reverse-engineering, thus variable names and other processors. Almost without exception, these modules turn off cer-
details may differ from the actual code: tificate validation. In ZenCart, vulnerable modules include Link-
Point, Authorize.Net, and PayPal Payments Pro, as well as PayPal
public final void checkServerTrusted(X509Certificate[]
paramArrayOfX509Certificate, String paramString) IPN functionality (see Section 7.3). The insecure LinkPoint mod-
{ ule contains an amusing comment at the beginning of the file: “###
if ((paramArrayOfX509Certificate != null) && ( YOU REALLY DO NOT NEED TO EDIT THIS FILE! ###”
paramArrayOfX509Certificate.length == 1))
paramArrayOfX509Certificate[0].checkValidity(); Vulnerable modules include eBay, PayPal, and Canada Post in
while (true) PrestaShop, PayPal, Authorize.Net, and CyberSource in Ubercart,
{ Sage Pay Direct, Authorize.Net, MoneyBookers, and PayPal Ex-
return;
this.a.checkServerTrusted(
press, Pro, Pro PayFlow, and Pro PayFlow EC in osCommerce.
paramArrayOfX509Certificate, paramString); SSL connections to payment gateways from merchants using any
} of these carts are insecure against a man-in-the-middle attack.
}
The only exceptions are Google modules for PrestaShop and os-
Note the unreachable invocation of checkServerTrusted. We Commerce. The Google Checkout module for osCommerce comes
conjecture that this was a temporary plug during development that from code.google.com and is not bundled with osCommerce.
somehow found its way into the production version of the app. It sets CURLOPT_SSL_VERIFYPEER to true and leaves CURLOPT_SSL_
VERIFYHOST to its correct default value, 2. By contrast, the official,
10.2 Apache Libcloud PayPal-provided PayFlow module disables certificate validation.
Apache Libcloud16 is a Python library extension providing sup- 10.5 AdMob
port for 26 different cloud service providers. Libcloud relies on
Google’s AdMob provides sample code to mobile site owners
the underlying Python library to verify the chain of trust in SSL
that they can use on their servers to associate instances of their
certificates; internally, Python uses OpenSSL. Once the chain of
mobile apps with their developer accounts (see Section 5). This
trust is verified, Libcloud verifies the hostname using the _verify
code uses cURL to establish an SSL connection to AdMob’s server,
_hostname method in httplib_ssl.py. This code uses an in-
but turns off certificate validation. A man-in-the-middle attacker
correct regular expression for hostname verification. For example,
can thus gain access to all of the developers’ Google services.
it accepts oogle.com as a match for google.com, exposing all
Libcloud clients to a man-in-the-middle attack:
10.6 Android apps
15 Groupon Redemptions, an Android app for merchants, disables
http://iphonedevelopment.blogspot.com/2010/
05/nsstream-tcp-and-ssl.html certificate validation twice: by allowing any hostname via the “al-
16
http://libcloud.apache.org/ low all” hostname verifier and by binding to an empty trust man-](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-10-320.jpg)
![ager. Similarly, Breezy, an app for secure document printing, dis- example, the PHP libraries for Amazon Flexible Payments Services
ables hostname verification and overrides the default trust manager. and PayPal Payments Standard attempt to enable hostname verifi-
ACRA, an Android library for posting application crash reports cation in cURL, but instead accidentally override the correct default
to a Google Doc, overrides the default trust manager. Any app value and end up disabling it (Sections 7.1 and 7.2). This shows
using this library is insecure against a man-in-the-middle attack. that even safe defaults may be insufficient. Lynx attempts to check
for self-signed certificates, but misinterprets the meaning of return
10.7 AIM values of GnuTLS’s certificate validation function and the check is
AIM client version 1.0.1.2 on Windows uses Microsoft’s Cryp- never executed (Section 7.4). Formalizing the precise semantics of
toAPI. Runtime analysis shows that it calls CryptoAPI’s certifi- SSL library API and rigorously verifying the “contracts” between
cate validation function CertVerifyCertificateChainPolicy. To the application and the library is an interesting topic for future re-
disable certificate validation, it passes a CERT_CHAIN_POLICY_PARA search and may call for programming language support.
variable with CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAG set, in- DON’T delegate the responsibility for managing SSL connec-
structing CryptoAPI to accept certificates signed by untrusted au- tions to the applications. Existing SSL libraries expose many op-
thorities. AIM does not perform any hostname verification, either. tions to higher-level software. This is fraught with peril. Appli-
cation developers may not realize that they must explicitly choose
10.8 FilesAnywhere certain options in order to enable certificate validation. Therefore,
FilesAnywhere is an application for managing cloud storage. It libraries should use safe defaults as much as possible. Furthermore,
uses CryptoAPI for SSL connections and accepts both self-signed they should not silently skip important functionality such as host-
and third-party certificates. name verification as JSSE does when the algorithm field is NULL
FilesAnywhere has an interesting peculiarity. If presented with or an empty string (see Section 4.1). Instead, they should raise a
a Google certificate when it attempts to connect to a non-Google runtime exception or inform the application in some other way.
server, it shows a warning message “The WebDav server has a new DO design a clean and consistent error reporting interface. Li-
address. Please specify http://google.com in the profile.” If pre- braries such as OpenSSL and GnuTLS report some errors via re-
sented with any other third-party certificate, it silently accepts it turn values of functions, while other errors from the same function
and sends user’s data to a wrong, potentially malicious server. are reported through a flag passed as an argument. Inconsistent in-
terfaces confuse developers who then mistakenly omit some error
11. OUR RECOMMENDATIONS checks in their applications.
Whenever application developers must deal with SSL, the con- These recommendations provide short-term fixes. A principled
ventional advice is to use standard SSL libraries. This advice is solution to the problem must involve a complete redesign of the
correct, but insufficient. As this paper shows, even developers of SSL libraries’ API. Instead of asking application developers to man-
high-security software often use standard SSL libraries incorrectly. age incomprehensible options such as CURLOPT_SSL_VERIFYPEER or
The following recommendations are informed by our analyses of SSL_get_verify_result, they should present high-level abstrac-
broken SSL certificate validation in diverse applications. tions that explicitly express security properties of network connec-
tions in terms that are close to application semantics: for exam-
11.1 For application developers ple, a “confidential and authenticated tunnel.” The library should
DO use fuzzing (black-box, if necessary) and adversarial test- also be explicit about the security consequences of any application-
ing to see how the application behaves when presented with abnor- controlled option: for example, instead of “verify hostname?”, it
mal SSL certificates. Even when the vulnerabilities are subtle, the could ask “Anyone can impersonate the server. Ok or not?”
symptoms usually are not. In many of our case studies, it is obvious
that the software in question has never been tested with any certifi-
cates other than those of the intended server. When presented with 12. RELATED WORK
a certificate issued to AllYourSSLAreBelongTo.us instead Independently of this work, Kevin McArthur announced multi-
of the expected Amazon or PayPal or Chase certificate, these pro- ple vulnerabilities caused by improper SSL certificate validation in
grams eagerly establish SSL connections and spill out their secrets. PHP software. 17 Affected programs include, among others, os-
These vulnerabilities should have manifested during testing. Commerce, Ubercart, PrestaShop, and three PayPal SDKs.
DON’T modify application code and disable certificate valida- Moxie Marlinspike demonstrated several vulnerabilities in cer-
tion for testing with self-signed and/or untrusted certificates. We tificate validation code in browsers and SSL libraries, including the
found in our case studies that developers forget to reverse these lack of basic constraint checking (e.g., checking the CA bit) [11]
modifications even for the production version of the software. In- and incorrect parsing of NULL characters in the “CommonName”
stead, create a temporary keystore with the untrusted CA’s public field [12]. By contrast, we focus on non-browser software that uses
key in it. While testing your code with self-signed or untrusted (mostly) correct SSL libraries incorrectly.
certificates, use that keystore as your trusted keystore. Kaminsky et al. [10] showed that parsing differences between
DON’T depend on the library’s defaults to set up the SSL con- CA software and browser certificate validation code can result in a
nection securely. Default settings can and do change between dif- CA issuing a certificate that can be used for a man-in-the-middle
ferent libraries or even different versions of the same library—for attack. By contrast, we investigate certificate validation bugs in
example, cURL prior to version 7.10 did not validate certificates non-browser clients, not in CA software.
by default, but version 7.10 and later do. Always explicitly set the Stevens et al. showed how an attacker can leverage MD5 hash
options necessary for secure connection establishment. collisions to get a CA to issue a specially crafted certificate that is
valid for an ordinary host but whose hash collides with that of a
11.2 For SSL library developers certificate for a new, rogue intermediate CA [18]. By contrast, our
DO make SSL libraries more explicit about the semantics of their attacks do not involve certificate forgery.
APIs. In many cases, it is obvious that application developers do
17
not understand the meaning of various options and parameters. For http://www.unrest.ca/peerjacking](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-11-320.jpg)
![Several certificate authorities such as Comodo [5] and DigiNo- [3] S. Chen, Z. Mao, Y.-M. Wang, and M. Zhang.
tar [6] were recently compromised and used by attackers to issue Pretty-Bad-Proxy: An overlooked adversary in browsers’
fake certificates for popular websites. By contrast, our attacks do HTTPS deployments. In S&P, 2009.
not involve CA compromise. [4] S. Chen, R. Wang, X. Wang, and K. Zhang. Side-channel
To mitigate the risks of rogue certificates, Evans et al. proposed leaks in Web applications: A reality today, a challenge
certificate pinning, i.e., pre-established bindings in the browser be- tomorrow. In S&P, 2010.
tween well-known websites and their certificates [8]. Certificate [5] Comodo report of incident.
pinning is not supported by any of the software we analyzed. http://www.comodo.com/Comodo-Fraud-
Several large-scale studies analyzed HTTPS deployment [7, 22] Incident-2011-03-23.html, 2011.
and found many errors in SSL certificates. One of the most com- [6] Diginotar issues dodgy SSL certificates for Google services
mon errors is a mismatch between the server’s fully qualified do- after break-in.
main name and certificate’s identifiers. This misconfiguration alone http://www.theinquirer.net/inquirer/
does not enable a man-in-the-middle attack. news/2105321/diginotar-issues-dodgy-ssl-
Chen et al. showed how a malicious proxy can exploit browser certificates-google-services-break, 2011.
bugs for man-in-the-middle attacks on HTTPS [3]. By contrast, our [7] P. Eckersley and J. Burns. An observatory for the SSLiverse.
attacks do not depend on browser bugs. In DEFCON, 2010.
Side-channel attacks can extract information from encrypted traf- [8] C. Evans and C. Palmer. Certificate pinning extension for
fic even when SSL is correctly deployed [4, 19]. By contrast, we HSTS. http://www.ietf.org/mail-archive/
found vulnerabilities that enable a man-in-the-middle attacker to web/websec/current/pdfnSTRd9kYcY.pdf, 2011.
decrypt SSL traffic, obviating the need for side-channel analysis. [9] Fiddler - Web debugging proxy.
Other side-channel attacks include a timing attack that extracts the http://fiddler2.com/fiddler2/.
private key from OpenSSL implementations [2]. [10] D. Kaminsky, M. Patterson, and L. Sassaman. PKI layer
cake: new collision attacks against the global X.509
infrastructure. In FC, 2010.
13. CONCLUSION [11] Moxie Marlinspike. IE SSL vulnerability. http:
The main lesson of this paper is that using SSL in non-browser //www.thoughtcrime.org/ie-ssl-chain.txt,
software is a surprisingly challenging task. We demonstrated that 2002.
even applications that rely on standard SSL libraries such as JSSE, [12] Moxie Marlinspike. Null prefix attacks against SSL/TLS
OpenSSL, GnuTLS, etc. often perform SSL certificate validation certificates.
incorrectly or not at all. These vulnerabilities are pervasive in crit- http://www.thoughtcrime.org/papers/null-
ical software, such as Amazon FPS and PayPal libraries for trans- prefix-attacks.pdf, 2009.
mitting customers’ payment details from merchants to payment [13] Internet X.509 public key infrastructure certificate policy and
gateways; integrated shopping carts; Amazon EC2, Rackspace, and certification practices framework.
other clients for remote administration of cloud storage and virtual http://www.ietf.org/rfc/rfc2527.txt, 1999.
cloud infrastructure; Chase mobile banking on Android; and many [14] HTTP over TLS.
other popular programs. Their SSL connections are completely in- http://www.ietf.org/rfc/rfc2818.txt, 2000.
secure against a man-in-the-middle attack. [15] Internet X.509 public key infrastructure certificate and
We also presented our recommendations for safer use of SSL in certificate revocation list (CRL) profile.
non-browser software. Future research directions include (1) de- http://tools.ietf.org/html/rfc5280, 2008.
velopment of better black-box testing and code analysis tools for [16] The Secure Sockets Layer (SSL) protocol version 3.0.
discovering errors in SSL connection establishment logic, (2) de- http://tools.ietf.org/html/rfc6101, 2011.
sign of formal verification techniques and programming language [17] Representation and verification of domain-based application
support for automatically checking whether applications use SSL service identity within Internet public key infrastructure
libraries correctly and not misinterpret the meaning of critical op- using X.509 (PKIX) certificates in the context of Transport
tions and parameters, and (3) design of better APIs for SSL and Layer Security (TLS).
other secure networking protocols. http://tools.ietf.org/html/rfc6125, 2011.
Acknowledgments. This research was partially supported by the [18] M. Stevens, A. Sotirov, J. Appelbaum, A. Lenstra,
NSF grants CNS-0331640, CNS-0746888, and CNS-0905602, two D. Molnar, D. Osvik, and B. Weger. Short chosen-prefix
Google research awards, Samsung, and the MURI program under collisions for MD5 and the creation of a rogue CA
AFOSR Grant No. FA9550-08-1-0352. Boneh also thanks iSEC certificate. In CRYPTO, 2009.
partners for helpful conversations about this work. [19] Q. Sun, D. Simon, Y.-M. Wang, W. Russell,
We acknowledge Amazon, Apache, Chase, GitHub, Lynx, Pay- V. Padmanabhan, and L. Qiu. Statistical identification of
Pal, and Rackspace developers for recognizing and promising to encrypted Web browsing traffic. In S&P, 2002.
repair the vulnerabilities after they were brought to their attention. [20] CVE-2009-4831. http://cve.mitre.org/cgi-
We thank Colm O hEigeartaigh for explaining the intended behav- bin/cvename.cgi?name=CVE-2009-4831, 2009.
ior of certificate validation in Apache CXF. [21] J. Viega and M. Messier. Secure Programming Cookbook for
C and C++. O’Reilly Media, 2007.
[22] N. Vratonjic, J. Freudiger, V. Bindschaedler, and J.-P.
References Hubaux. The inconvenient truth about Web certificates. In
WEIS, 2011.
[1] https should check CN of x509 cert. https://issues.
[23] R. Wang, S. Chen, X. Wang, and S. Qadeer. How to shop for
apache.org/jira/browse/HTTPCLIENT-613.
free online – Security analysis of cashier-as-a-service based
[2] D. Brumley and D. Boneh. Remote timing attacks are
Web stores. In S&P, 2011.
practical. In USENIX Security, 2003.](https://image.slidesharecdn.com/shmatccs12-121113233703-phpapp02/85/Shmat-ccs12-12-320.jpg)
Shmat ccs12
- 1. The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software Martin Georgiev Subodh Iyengar Suman Jana The University of Texas Stanford University The University of Texas at Austin at Austin Rishita Anubhai Dan Boneh Vitaly Shmatikov Stanford University Stanford University The University of Texas at Austin ABSTRACT cations. The main purpose of SSL is to provide end-to-end security SSL (Secure Sockets Layer) is the de facto standard for secure In- against an active, man-in-the-middle attacker. Even if the network ternet communications. Security of SSL connections against an is completely compromised—DNS is poisoned, access points and active network attacker depends on correctly validating public-key routers are controlled by the adversary, etc.—SSL is intended to certificates presented when the connection is established. guarantee confidentiality, authenticity, and integrity for communi- We demonstrate that SSL certificate validation is completely bro- cations between the client and the server. ken in many security-critical applications and libraries. Vulnerable Authenticating the server is a critical part of SSL connection es- software includes Amazon’s EC2 Java library and all cloud clients tablishment.1 This authentication takes place during the SSL hand- based on it; Amazon’s and PayPal’s merchant SDKs responsible shake, when the server presents its public-key certificate. In order for transmitting payment details from e-commerce sites to payment for the SSL connection to be secure, the client must carefully verify gateways; integrated shopping carts such as osCommerce, ZenCart, that the certificate has been issued by a valid certificate authority, Ubercart, and PrestaShop; AdMob code used by mobile websites; has not expired (or been revoked), the name(s) listed in the certifi- Chase mobile banking and several other Android apps and libraries; cate match(es) the name of the domain that the client is connecting Java Web-services middleware—including Apache Axis, Axis 2, to, and perform several other checks [14, 15]. Codehaus XFire, and Pusher library for Android—and all applica- SSL implementations in Web browsers are constantly evolving tions employing this middleware. Any SSL connection from any of through “penetrate-and-patch” testing, and many SSL-related vul- these programs is insecure against a man-in-the-middle attack. nerabilities in browsers have been repaired over the years. SSL, The root causes of these vulnerabilities are badly designed APIs however, is also widely used in non-browser software whenever of SSL implementations (such as JSSE, OpenSSL, and GnuTLS) secure Internet connections are needed. For example, SSL is used and data-transport libraries (such as cURL) which present devel- for (1) remotely administering cloud-based virtual infrastructure opers with a confusing array of settings and options. We analyze and sending local data to cloud-based storage, (2) transmitting cus- perils and pitfalls of SSL certificate validation in software based on tomers’ payment details from e-commerce servers to payment pro- these APIs and present our recommendations. cessors such as PayPal and Amazon, (3) logging instant messenger clients into online services, and (4) authenticating servers to mobile applications on Android and iOS. Categories and Subject Descriptors These programs usually do not implement SSL themselves. In- C.2.0 [Computer-Communication Networks]: General—Secu- stead, they rely on SSL libraries such as OpenSSL, GnuTLS, JSSE, rity and protection; K.4.4 [Computers and Society]: Electronic CryptoAPI, etc., as well as higher-level data-transport libraries, Commerce—Security such as cURL, Apache HttpClient, and urllib, that act as wrappers around SSL libraries. In software based on Web services, there is Keywords an additional layer of abstraction introduced by Web-services mid- dleware such as Apache Axis, Axis 2, or Codehaus XFire. SSL, TLS, HTTPS, public-key infrastructure, public-key certifi- cates, security vulnerabilities Our contributions. We present an in-depth study of SSL connec- tion authentication in non-browser software, focusing on how di- 1. INTRODUCTION verse applications and libraries on Linux, Windows, Android, and iOS validate SSL server certificates. We use both white- and black- Originally deployed in Web browsers, SSL (Secure Sockets Lay- box techniques to discover vulnerabilities in validation logic. Our er) has become the de facto standard for secure Internet communi- main conclusion is that SSL certificate validation is completely bro- ken in many critical software applications and libraries. When presented with self-signed and third-party certificates—including Permission to make digital or hard copies of all or part of this work for a certificate issued by a legitimate authority to a domain called personal or classroom use is granted without fee provided that copies are AllYourSSLAreBelongTo.us —they establish SSL connec- not made or distributed for profit or commercial advantage and that copies tions and send their secrets to a man-in-the-middle attacker. bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. 1 CCS’12, October 16–18, 2012, Raleigh, North Carolina, USA. SSL also supports client authentication, but we do not analyze it Copyright 2012 ACM 978-1-4503-1651-4/12/10 ...$15.00. in this paper.
- 2. This is exactly the attack that SSL is intended to protect against. In summary, SSL connections established by any of the above It does not involve compromised or malicious certificate authori- programs are insecure against a man-in-the-middle attack. All ties, nor forged certificates, nor compromised private keys of legit- vulnerabilities have been empirically confirmed. imate servers. The only class of vulnerabilities we exploit are logic Causes. For the most part, the actual SSL libraries used in these errors in client-side SSL certificate validation. programs are correct. Yet, regardless of which well-known library The root cause of most of these vulnerabilities is the terrible de- the software relies on—whether JSSE, OpenSSL, GnuTLS, or Cryp- sign of the APIs to the underlying SSL libraries. Instead of ex- toAPI, used directly or wrapped into a data-transport library such pressing high-level security properties of network tunnels such as as Apache HttpClient or cURL—it often finds a way to end up with confidentiality and authentication, these APIs expose low-level de- broken or disabled SSL certificate validation. tails of the SSL protocol to application developers. As a conse- The primary cause of these vulnerabilities is the developers’ mis- quence, developers often use SSL APIs incorrectly, misinterpreting understanding of the numerous options, parameters, and return val- and misunderstanding their manifold parameters, options, side ef- ues of SSL libraries. For example, Amazon’s Flexible Payments fects, and return values. In several cases, we observed developers Service PHP library attempts to enable hostname verification by introducing new vulnerabilities when attempting to “fix” certificate setting cURL’s CURLOPT_SSL_VERIFYHOST parameter to true. Un- validation bugs. Furthermore, deveopers often do not understand fortunately, the correct, default value of this parameter is 2; setting which security properties are or are not provided by a given SSL it to true silently changes it to 1 and disables certificate validation. implementation: for example, they use SSL libraries that do not PayPal Payments Standard PHP library introduced the same bug validate certificates even when security is essential (e.g., connect- when updating a previous, broken implementation. Another ex- ing to a payment processor). More prosaic, yet deadly causes in- ample is Lynx, a text-based browser which is often used program- clude intermediate layers of the software stack silently disabling matically and thus included in our study. It checks for self-signed certificate validation and developers turning off certificate valida- certificates—but only if GnuTLS’s certificate validation function tion accidentally (e.g., for testing) or intentionally. returns a negative value. Unfortunately, this function returns 0 for certain errors, including certificates signed by an untrusted author- 2. OVERVIEW OF OUR RESULTS ity. Chain-of-trust verification in Lynx is thus broken. Our study uncovered a wide variety of SSL certificate valida- Developers often misunderstand security guarantees provided by tion bugs. Affected programs include those responsible for manag- SSL libraries. For example, JSSE (Java Secure Socket Extension) ing cloud-based storage and computation, such as Amazon’s EC2 has multiple interfaces for managing SSL connections. The “ad- Java client library and Elastic Load Balancing API Tools, Apache vanced” SSLSocketFactory API silently skips hostname verifica- Libcloud, Rackspace iOS client, and Windows-based cloud storage tion if the algorithm field in the SSL client is NULL or an empty clients such as ElephantDrive and FilesAnywhere. string rather than HTTPS. This is mentioned in passing in the JSSE Java-based Web-services middleware, such as Apache Axis, Axis reference guide, yet many Java implementations of SSL-based pro- 2, and Codehaus XFire, is broken, too. So is the Android library tocols use SSLSocketFactory without performing their own host- for Pusher notification API and Apache ActiveMQ implementation name verification. Vulnerable libraries include Apache HttpClient of Java Message Service. All programs employing this middleware version 3.* and the Weberknecht implementation of WebSockets. are generically insecure. Any Java program based on these libraries is generically insecure Certificate validation bugs are pervasive in “merchant SDKs,” against a man-in-the-middle attack. Vulnerable programs include which typically run on e-commerce servers (e.g., online stores) and SOAP Web-services middleware such as Apache Axis and Code- are responsible for transmitting customers’ financial details to pay- haus XFire, as well as any software built on top of it (for ex- ment processing gateways. Broken libraries include Amazon Flex- ample, Amazon’s EC2 client library), any Android app that uses ible Payments Service (both Java and PHP), as well as PayPal Pay- Pusher API to manage real-time messaging (for example, GitHub’s ments Standard and PayPal Invoicing (both in PHP), PayPal Pay- Gaug.es), clients of Apache ActiveMQ servers, etc. ments Pro, Mass Pay, and Transactional Information SOAP (all in Other bugs include using incorrect regular expressions for host- Java). Most payment modules for integrated shopping carts, such name matching, not checking the results of certificate validation as ZenCart, Ubercart, PrestaShop, and osCommerce, do not val- correctly, accidentally or deliberately disabling validation, etc. idate certificates, either. A man-in-the-middle attack enables the Lessons. First, the state of adversarial testing appears to be excep- attacker to harvest credit card numbers, names, addresses, etc. of tionally poor even for critical software such as mobile banking apps the customers of any merchant who uses one of these programs for and merchant SDKs responsible for managing secure connections payment processing. Mobile app providers who use AdMob’s sam- to payment processors. Most of the vulnerabilities we found should ple code to link app instances to their AdMob accounts are vulner- have been discovered during development with proper unit testing. able, too, enabling the attacker to capture the developer’s account Second, many SSL libraries are unsafe by default, requiring high- credentials and gain access to all of her Google services. er-level software to correctly set their options, provide hostname Instant messenger clients such as Trillian and AIM do not val- verification functions, and interpret return values. As we show, idate certificates correctly, either. A man-in-the-middle attack on software that relies on these libraries is often not up to the task. Trillian yields login credentials for all Google (including Gmail), Third, even safe-by-default libraries, such as cURL’s wrapper Yahoo!, and Windows Live services (including SkyDrive). around OpenSSL, are misused by developers that misinterpret the Not the most interesting technically, but perhaps the most devas- meaning of various options. This calls for better documentation and tating (because of the ease of exploitation) bug is the broken certifi- more rigorous formalization of API semantics. In particular, APIs cate validation in the Chase mobile banking app on Android. Even should present high-level abstractions to developers, such as “con- a primitive network attacker—for example, someone in control of fidential and authenticated tunnel,” as opposed to requiring them to a malicious Wi-Fi access point—can exploit this vulnerability to explicitly deal with low-level details such as hostname verification. harvest the login credentials of Chase mobile banking customers. Fourth, SSL bugs are often hidden deep inside layers of middle- Other insecure Android software includes Breezy, a “secure” print- ware, above the actual SSL implementation but below the applica- ing app, and the ACRA library for application crash reporting.
- 3. tion, making the problem hard to locate and repair, and effectively cates have not expired and that the certificates of the intermediate taking it out of application developers’ hands. CAs have the CA bit set in the “Basic Constraints” field. Fifth, least interesting technically but still critically important, Hostname verification. After the chain of trust is established, the we observed many cases of developers deliberately disabling cer- client must verify the server’s identity. RFC 2818 advises the im- tificate validation, while assuring both users and higher-level pro- plementors to use “SubjectAltNames” as the main source of server grams that SSL is being supported but not informing them that pro- identifiers and support “Common Name” for backward compatibil- tection against active attacks has been turned off. ity only, but most of the software we tested does it the other way around and checks “Common Name” first. After building the list 3. OVERVIEW OF SSL of server identifiers, the client attempts to match the fully qualified DNS name of the requested server to one of the identifiers. 3.1 Threat model If the client finds an exact match in the list of server identi- fiers, verification is done by straightforward string comparison. The We assume an active, man-in-the-middle network attacker who client may also find a wildcard name in the list of identifiers. The may control network routers or switches, Wi-Fi access points, and/or rules for wildcard matching are fairly complex [14, 17], especially DNS. She may also control one or more servers and possess valid concerning international character sets. SSL certificates for these servers. When an SSL client attempts to connect to a legitimate server, the attacker can mislead it about the Certificate revocation and X.509 extensions. This paper focuses server’s network address (e.g., through DNS poisoning) and trick it on verifying the server’s identity, but full certificate validation in- into connecting to an attacker-controlled server instead. volves many more checks. These checks are essential for security, Our attacker (1) does not have access to the private keys of le- yet are handled poorly or not at all by non-browser software. gitimate servers, (2) does not control any certificate authorities, (3) For example, some SSL libraries such as OpenSSL implement cannot forge certificates. Even if she succeeds in spoofing the ad- certificate revocation, but require the application to provide the dress of a legitimate server, a correctly implemented SSL client certificate revocation list (CRL). The applications we analyzed do should refuse to accept the malicious server’s certificate because of not avail themselves of this facility. Furthermore, libraries such as a mismatch between the name(s) on the certificate and the domain JSSE require the application to check validity of the CRL on its to which the client is connecting. own. Most applications don’t bother. Other SSL libraries, such as Python’s ssl, do not expose a method for CRL checking. target of our attacks Some X.509 certificate extensions contain security-critical infor- SSL Client SSL Server mation such as key usage (e.g., is the CA allowed to use this key for client hello signing certificates?), name constraints (restricting the names that a sub-CA can certify), and certificate policies, described in RFC server hello 2527 [13]. For instance, a CA may assign different levels of trust validate server cert. server cert. client cert. request to different sub-CAs, but the application must provide a policy that (optional) takes advantage of this information. In practice, these extensions client key exchange validate are largely neglected. For example, until recently OpenSSL did not client cert. (optional) client cert. validate name constraints correctly, while cURL does not even have change cipher spec (optional) an interface for specifying the application’s certificate policy. encrypted data Attacks exploiting improper treatment of certificate revocation and X.509 extensions are somewhat different from the “pure” man- Figure 1: Simplified overview of SSL handshake. in-the-middle model considered in this paper. We leave their de- tailed analysis to future work. 4. SSL ABSTRACTIONS 3.2 SSL certificate validation Depending on its needs, an application can “plug” into SSL at An SSL connection starts with a handshake between the client different levels of abstraction. At the lowest level, there are many and the server. The handshake protocol is summarized in Figure 1; popular SSL implementations with different features, licenses, and see RFC 6101 [16] for a complete description. hardware requirements: OpenSSL, JSSE, CryptoAPI, NSS, yaSSL, We focus on the client’s validation of the server certificate. All GnuTLS, BouncyCastle, and others. These libraries are mostly SSL implementations we tested use X.509 certificates. The com- oblivious to protocols transported over SSL. Therefore, to avoid plete algorithm for validating X.509 certificates can be found in having to parse HTTP messages on their own, applications that in- RFC 5280 [15] and RFC 2818 [14]. In this paper, we consider two volve HTTP over SSL (HTTPS) typically do not use them directly. of the checks; both are critical for security against active attacks. Instead, they employ one of the many HTTPS libraries (see Sec- Chain-of-trust verification. Each X.509 certificate has an “issuer” tion 4.2), which in turn use SSL libraries internally. Applications field that contains the name of the certificate authority (CA) that that use SOAP- or REST-based Web services require additional issued the certificate. Every SSL client is configured with a list of middleware on top of HTTPS or WebSockets (see Figure 2). certificates for trusted root CAs. 4.1 SSL libraries In addition to its own certificate, the server sends the certificate of the issuing CA. If the issuing CA is not a root CA, the server OpenSSL. OpenSSL only provides chain-of-trust verification; ap- also sends a list of certificates of higher-level CAs all the way to plications must supply their own hostname verification code. This a root CA. The client attempts to build a chain starting from the is typical for low-level SSL libraries. Different application-layer server’s certificate at the bottom. Each certificate in the chain must protocols such as HTTPS, LDAP, etc. have different notions of be signed by the CA immediately above it; the root CA must be one what constitutes a valid hostname and what it means for a hostname of the client’s trusted CAs. The client also verifies that the certifi- to match the name(s) listed in the certificate. Therefore, hostname
- 4. SSL_CTX_set_verify_depth SSL_set_verify_depth Applications Applications SSL_CTX_set_verify SSL_set_verify SSL_set_fd SSL_new SOAP REST Applications Axis ... CXF Pusher ... verify verify verify HTTP Web Socket mode callback depth fd ... IM default: default: default: HttpsClient ... cURL Weberknecht ... 0 None 9 SSL JSSE ... ... OpenSSL user−land SSL_CTX SSL GnuTLS libraries kernel OpenSSL’s verify_result TCP OS NetworkingStack internal data structures Figure 2: Protocol stack. SSL_get_verify_result SSL_connect (see Algorithm 1) verification must be managed either by the application itself, or by Figure 3: OpenSSL API for setting up SSL connections with a data-transport wrapper such as cURL. the default chain-of-trust verification. Proper hostname verification for OpenSSL and CryptoAPI is dis- cussed in [21, Chap. 10.8], assuming the chain of trust has been verified correctly. As discussed in [21, Chap. 10.5], the latter is error-prone due to the complexity of the underlying API. OpenSSL The certificate validation function in GnuTLS, gnutls_certif- allows applications to customize chain-of-trust verification by pro- icate_verify_peers2, has similarly atrocious error reporting. It viding a callback function or modifying configuration variables such takes a reference to tls_status as an argument and sets it to an as “verify depth” and “verify mode” as shown in Figure 3. appropriate error code if validation fails. For some errors (e.g., A program using OpenSSL can perform the SSL handshake by insufficient credentials or no certificate found), it returns a negative invoking the SSL_connect function. A high-level overview of the value; for others (e.g., self-signed certificate), it sets the error code handling of different configurations and callbacks is shown in Al- but returns zero. In Section 7.4 we show that application developers gorithm 1. They can have complex interactions. misunderstand this complex relationship between the error status Some certificate validation errors are signaled through the return and the return value, resulting in broken certificate validation. values of SSL_connect, while for other errors SSL_connect returns OK but sets internal “verify result” flags. Applications must call JSSE. Java Secure Socket Extension (JSSE) provides numerous in- SSL_get_ verify_result function to check if any such errors oc- terfaces through which Java applications—including Android mo- curred. This approach is error-prone (see Section 7.6). bile apps—can establish SSL connections. The low-level API is SSLSocketFactory. Depending on how the Algorithm 1 Outline of SSL_connect control flow. SSL client is created, this API may or may not perform hostname while chain of trust contains no trusted CA do verification. The following code sample is taken from X509Trust if chain length <verify_depth then ManagerImpl.checkIdentity in Java 6 update 31: Try to extend chain of trust by 1 level private void checkIdentity(String hostname, Set ERROR appropriately if any error X509Certificate cert, String algorithm) else throws CertificateException { Set ERROR to ‘incomplete chain’ if (algorithm != null && algorithm.length() != 0) { end if .... if ERROR then if (algorithm.equalsIgnoreCase("HTTPS")) { verify_result = error HostnameChecker.getInstance(HostnameChecker.TYPE if verify_callback == NULL then _TLS).match(hostname, cert); if verify_mode != 0 then } else if (algorithm.equalsIgnoreCase("LDAP")) { HostnameChecker.getInstance(HostnameChecker.TYPE Print error and terminate connection. _LDAP).match(hostname, cert); end if } else { else throw new CertificateException( ret = verify_callback(preverify_ok = 0, . . . ) "Unknown identification algorithm: " + algorithm); if (verify_mode != 0) and (ret == 0) then } Print error and terminate connection. } end if } end if if ERROR is not related to incorrect parsing then The checkIdentity method throws an exception if the algorithm return 1 field is set to anything other than HTTPS or LDAP. This is different else from, for example, OpenSSL, which returns a value even if verifi- return ERROR cation fails and expects the application to check this value. end if JSSE APIs such as HttpsClient and HttpsURLConnection call else ret = verify_callback(preverify_ok = 1, . . . ) try SetHostnameVerification when creating SSL clients. This if (verify_mode != 0) and (ret == 0) then method sets the algorithm field to HTTPS. The above code thus Print error and terminate connection. invokes HostnameChecker and verifies the name in the certificate. end if If the algorithm field in the client data structure is NULL or an end if empty string, checkIdentity silently skips hostname verification end while without throwing an exception. We conjecture that this behav- return 1 ior is designed to accommodate implementors of certificate-based protocols other than HTTPS or LDAP who may want to re-use
- 5. JSSE’s default trust manager for chain-of-trust verification but pro- nal consistency checks: for example, it allows connections to port vide their own, protocol-specific hostname verification. 443 to have HTTP as the scheme. In Section 7.8, we show how this On February 14, 2012, Java 7 update 3 was released. The code leads to errors even in code implemented by SSL experts. for certificate validation is different from Java 6, but its behav- Weberknecht. Weberknecht4 is a Java implementation of the Web- ior is similar: if the algorithm field is NULL or an empty string, Sockets protocol. It uses SSLSocketFactory but does not perform checkIdentity is never invoked. its own hostname verification. Any Java program that employs We- private void checkTrusted(X509Certificate[] chain, berknecht is vulnerable to a man-in-the-middle attack. String authType, Socket socket, boolean isClient) throws CertificateException { cURL. cURL5 is a popular tool and library (libcurl) for fetching ... data from remote servers. Since version 7.10, cURL validates SSL / / check endpoint i d e n t i t y certificates by default. Internally, it uses OpenSSL to verify the String identityAlg = sslSocket.getSSLParameters(). getEndpointIdentificationAlgorithm(); chain of trust and verifies the hostname itself. This functionality is if (identityAlg != null && identityAlg.length != 0) controlled by parameters CURLOPT_SSL_VERIFYPEER (default value: { true) and CURLOPT_SSL_VERIFYHOST (default value: 2). String hostname = session.getPeerHost(); checkIdentity(hostname, chain[0], identityAlg); This interface is almost perversely bad. The VERIFYPEER param- } eter is a boolean, while a similar-looking VERIFYHOST parameter is } an integer. The following quote from the cURL manual explains the meaning of CURLOPT_SSL_VERIFYHOST: In SSL clients created using “raw” SSLSocketFactory (as op- posed to HttpsClient or HttpsURLConnection wrappers), the algo- 1 to check the existence of a common name in the SSL rithm field is NULL, thus JSSE does not perform hostname verifi- peer certificate. 2 to check the existence of a common cation. The responsibility for hostname verification is delegated to name and also verify that it matches the hostname pro- the software running on top of JSSE. This feature is not explained vided. In production environments the value of this in the API documentation. Instead, the following warning can be option should be kept at 2 (default value). found deep inside the JSSE reference guide:2 Well-intentioned developers not only routinely misunderstand When using raw SSLSockets/SSLEngines you should these parameters, but often set CURLOPT_SSL_VERIFY HOST to TRUE, always check the peer’s credentials before sending any thereby changing it to 1 and thus accidentally disabling hostname data. The SSLSocket and SSLEngine classes do not verification with disastrous consequences (see Section 7.1). automatically verify that the hostname in a URL matches the hostname in the peer’s credentials. An application PHP. PHP provides several methods for establishing SSL connec- could be exploited with URL spoofing if the hostname tions. For example, fsockopen, which opens a raw socket to the is not verified. remote server, can be used to connect to SSL servers by putting “ssl://” in the URL. Even though fsockopen does not perform any The prevalence of Java software that uses SSLSocketFactory to certificate checks whatsoever, PHP application developers routinely create SSL clients yet does not perform hostname verification (see use it for SSL connection establishment (see Section 9). Section 4.2) suggests that developers are not aware of this feature. PHP also provides a cURL binding, which uses cURL’s default The existence of alternative JSSE interfaces that do perform host- settings to establish SSL connections with proper certificate valida- name verification only increases the confusion. tion. As we show in Sections 7.1, 7.2, and 7.3, application develop- ers often set cURL options incorrectly, overriding the defaults and 4.2 Data-transport libraries breaking certificate validation. In practice, most applications rely on data-transport frameworks Python. Several Python modules can be used for SSL connection to establish HTTPS connections. These frameworks use SSL li- establishment. urllib, urllib2, and httplib connect to SSL servers braries internally in a way that is usually opaque to applications. but do not check certificates. This is clearly documented in a bright Apache HttpClient. Apache HttpClient3 is a client-side HTTP(S) pink box on the urllib front page:6 Java library based on JDK. The latest version is 4.2.1, published on June 29, 2012, but most existing software employs older, 3.* Warning: When opening HTTPS URLs, it does not versions. Apache HttpClient is used extensively in Web-services attempt to validate the server certificate. Use at your middleware such as Apache Axis 2 (see Section 8) because native own risk! JDK does not support SOAP Web services. Furthermore, Apache HttpClient provides better performance than JDK for functionali- Nevertheless, even high-security applications routinely use these ties such as sending HTTP POST requests. modules for SSL connection establishment (see Section 9). Apache HttpClient uses JSSE’s SSLSocketFactory to establish Python also has an ssl module. This module verifies the certifi- SSL connections. As explained in Section 4.1, this means that cate’s chain of trust, but not the hostname. The application must do Apache HttpClient must perform its own hostname verification. its own hostname verification. In Python version 3, the ssl module This leads to numerous vulnerabilities in software based on older introduced the match_hostname method for hostname verification, versions on HttpClient that do not verify hostnames (Section 7.5). but it must be explicitly called by the application. Furthermore, Apache HttpClient uses HttpHost data structure to describe HTTP(S) connections. HttpHost does not have any inter- 2 http://docs.oracle.com/javase/6/docs/ technotes/guides/security/jsse/JSSERefGuide. 4 html http://code.google.com/p/weberknecht/ 3 5 http://hc.apache.org/httpcomponents-client- http://curl.haxx.se/ 6 ga/ http://docs.python.org/library/urllib.html
- 6. Merchant’s 5. SSL IN NON-BROWSER SOFTWARE Website Payment Gateway We analyze a representative sample of non-browser software ap- plications and libraries that use SSL for secure Internet connec- tions. Some programs, such as instant messenger clients and sim- ple mobile banking apps, are fairly straightforward in their use of SSL. Others, especially middleware libraries, use SSL as part of a 1 2 Customer SSL tunnel multi-layer software stack. Many of the programs we analyze trans- 3 SDK mit extremely sensitive data—private files of individual users in the Internet case of cloud clients, financial information of customers in the case of merchant SDKs, developer account credentials in the case of 1 Credit Card 2 Charge Request 3 Payment Information Confirmation mobile advertising software—over potentially insecure public net- works, thus it is absolutely critical that they use SSL correctly. Figure 4: Merchant SDK interacting with payment processor. Cloud client APIs. As cloud-computing platforms such as Ama- zon EC2 grow in popularity, their operators supply client SDKs through which third-party software can transmit user data to cloud- based storage, manage cloud-based computation (e.g., start and ter- carts are an important component of e-commerce websites. They minate virtual instances), and access other cloud services. For ex- keep track of customers’ shipping and billing information and al- ample, Amazon provides EC2 API tools in Java, PHP, Python, and low them to purchase multiple items in one transaction. When the Perl. Apache Libcloud is an example of an independent library for customer checks out, the shopping cart generates a summary of the accessing multiple cloud providers. purchases and the total price and sends it to the payment gateway. Shopping carts include modules for many payment processors. Merchant payment SDKs. Operators of e-commerce websites of- ten rely on third parties such as PayPal and Amazon Flexible Pay- Web-services middleware. Many modern programs rely on Web ments Service (FPS) to process their customers’ payments. Pay- services. A Web service is “a software system designed to support ment processors provide merchant SDKs (software development interoperable machine-to-machine interaction over a network.”7 A kits) in a variety of languages. These libraries are designed to be service has an interface described in a machine-readable XML for- integrated into the back end of e-commerce websites. Merchant mat. Different providers may provide different concrete implemen- software uses them to transmit customers’ payment details and/or tations of this interface. Other systems interact with the service by receive notifications when payments are made by customers. sending and receiving messages. An online store typically has two options for payment process- Messages to and from Web services are sent using XML-based ing. The first option is to have the customer enter payment details Simple Object Access Protocol (SOAP) or REpresentational State directly into the payment processor’s website. When the customer Transfer (REST). From the viewpoint of the client software, a Web checks out, the merchant’s website redirects her browser to PayPal service can be thought of as providing a remote procedure call or Amazon, where the customer enters her name, credit or debit (RPC) interface, while SOAP or REST middleware marshals and card number, etc. The merchant never sees these details. Once the unmarshals arguments of RPC calls. payment is complete, the payment processor redirects the customer To interact with such a Web service—for example, if a cloud back to the merchant’s website and notifies the merchant. client implemented in Java wants to interact with Amazon EC2 — The merchant’s site runs a daemon listening for IPN (Instant Pay- existing Java software often uses SOAP middleware such as Apache ment Notification) calls from the payment processor. Upon receiv- Axis, Axis 2, or Codehaus XFire (see Section 8). Similarly, if ing a notification, the merchant is advised to verify that the call in- an Android app needs real-time “push” notifications, it may use deed originated from the processor (some merchants skip this step, a client-side library to connect to the REST-based Pusher service.8 opening the door to “shop-for-free” attacks [23]). The merchant These middleware frameworks are responsible for transmitting then completes the transaction with the customer. Web-service messages over the network. If the connection must be The second option is preferred by larger, more established stores. secure, the middleware typically uses SSL but delegates actual SSL It does not require the customer to leave the merchant’s website and connection management to a data-transport library such as Apache allows the merchant to collect payment details directly from the HttpClient or Weberknecht (see Section 4.2). customer. The back-end software on the merchant’s website then Mobile advertising. Mobile advertising services such as AdMob transmits these details to the payment processor’s gateway over an supply software that providers of mobile apps install on their sites. SSL connection and receives the confirmation that the payment suc- When a new app instance is initialized on a customer’s phone, it ceeded (often over the same SSL connection). connects to the provider’s site, which in turn notifies the AdMob Fig. 4 shows schematically the interaction between the merchant’s server so that all ads shown to this app instance will be associated server and the payment gateway. The SSL client is the merchant’s with the provider’s account (to enable ad revenue sharing, etc.). back-end software (running on the merchant’s server), while the The connection from the app provider’s site to the AdMob server payment gateway acts as the SSL server. contains the provider’s credentials and must be protected by SSL. We analyzed SSL connection establishment in popular merchant SDKs, including Java and PHP SDKs for Amazon Flexible Pay- ments Service and multiple interfaces to PayPal: Payments Pro, 6. EXPERIMENTAL TESTBED Transactional Information, and Mass Pay (all in Java), as well as Our primary methodology for the initial discovery of SSL cer- Payments Standard and Invoicing (PHP). We also analyzed both tificate validation bugs is black-box fuzzing. We test applications Amazon’s and PayPal’s utilities that merchants can use to verify and libraries implementing SSL client functionality on two Dell the origin of IPN (Instant Payment Notification) calls. laptops running Microsoft Windows 7 Professional Service Pack We also analyzed several open-source shopping carts written in 7 http://www.w3.org/TR/ws-arch/ PHP: osCommerce, ZenCart, Ubercart, and PrestaShop. Shopping 8 http://pusher.com
- 7. 1 and Ubuntu Linux 10.04, respectively. Mobile applications are The URL verification utility—found in srcAmazonIpnRe- tested on a Nexus One smartphone running Android 2.3.6 and an turnUrlValidationSignatureUtilsForOutbound. iPad 2 running iOS 4.2.1. php—is broken in a very similar way. This utility is critically im- We use local DNS cache poisoning to divert clients’ connections portant because it is used by merchants to verify the origin of the to a simulated attack server executing on an old Dell laptop with calls informing them that a customer’s payment has been success- Ubuntu Linux 10.04. To simulate a man-in-the-middle attacker, we fully processed (see Section 5). Because Amazon’s PHP SDK does built two prototypes: one in Java, using JKS keystore to manage not correctly verify the origin of the IPN call, e-commerce sites the attacker’s certificates and keys, the other in C, using OpenSSL using it may be vulnerable to “shop-for-free” attacks [23]. for certificate and key management. We also used Fiddler, a Web debugging proxy [9]. If Fiddler encounters a connection request 7.2 PayPal Payments Standard and to a server it has not seen before, it creates a new certificate with PayPal Invoicing (PHP) the common name matching the requested name and stores it in PayPal Payments Standard SDK implemented in PHP uses cURL. its repository; otherwise, it retrieves an existing certificate from The previous version disabled all certificate validation checks: its repository. Fiddler then presents the certificate to the client, allowing us to simulate a man-in-the-middle attacker who presents curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); self-signed certificates with correct common names. In addition, curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE); we enabled Fiddler to capture and decrypt HTTPS connections. The version released on April 27, 2012, “fixes” the problem: Our simulated “man-in-the-middle” server presents the client with several certificates: (1) a self-signed certificate with the same com- curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, TRUE); mon name as the host the client is attempting to connect to, (2) a curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, TRUE); self-signed certificate with an incorrect common name, and (3) a As in Section 7.1, this code overrides the correct default value of valid certificate issued by a trusted certificate authority to a domain CURLOPT_SSL_VERIFYHOST and breaks hostname verification. called AllYourSSLAreBelongTo.us. If the client establishes PayPal Invoicing contains similarly broken code: an SSL connection, the attack server decrypts traffic sent by the client. It can then establish its own SSL connection to any legiti- public function setHttpTrustAllConnection( mate server specified by the attacker and forward the client’s traffic. $trustAllConnection) { The attack server also listens for the legitimate server’s response, $this->curlOpt[CURLOPT_SSL_VERIFYPEER] = decrypts and logs it, re-encrypts it with the symmetric key the at- !$trustAllConnection; tacker shares with the client and forwards it to the client. $this->curlOpt[CURLOPT_SSL_VERIFYHOST] = !$trustAllConnection; If we observed a particular client successfully establishing an } SSL connection when presented with any of the attack certificates, we analyzed the source code of the client or, in the case of closed- Any PHP code using these PayPal-provided SDKs to establish source applications, the results of reverse-engineering, decompi- an SSL connection to PayPal’s payment processing gateway is in- lation, and runtime traces (focusing in particular on calls to SSL secure against a man-in-the-middle attack. libraries) in order to find the root cause of the vulnerability. In Sections 7 through 10, we describe the vulnerabilities in spe- 7.3 PayPal IPN in ZenCart cific programs, arranged by error type. ZenCart’s functionality for PayPal IPN shows a profound misun- derstanding of cURL’s parameters. It disables certificate validation entirely, yet attempts to enable hostname verification—even though 7. MISUNDERSTANDING THE SSL API the latter has no effect if certificate validation is disabled. $curlOpts=array( ... 7.1 Amazon Flexible Payments Service (PHP) CURLOPT_SSL_VERIFYPEER => FALSE, CURLOPT_SSL_VERIFYHOST => 2 Amazon Flexible Payments Service (FPS) provides SDKs that ... ); merchants use to transmit customers’ payment details to the FPS gateway. The PHP version of the FPS SDK uses a wrapper around 7.4 Lynx the libcurl library (see Section 4.2) to establish an SSL connection to the gateway. cURL’s options for certificate validation are set in Lynx is a text-based browser, included in our study because it is srcAmazonFOPSClient.php as follows: often used programmatically by other software. It relies on GnuTLS to validate SSL certificates: curl_setopt($curlHandle, CURLOPT_SSL_VERIFYPEER, true); curl_setopt($curlHandle, CURLOPT_SSL_VERIFYHOST, true); ret = gnutls_certificate_verify_peers2(handle->gnutls_ ... state, &tls_status); / / Execute the request if (ret < 0) { $response = curl_exec($curlHandle); int flag_continue = 1; char *msg2; This well-intentioned code contains a fatal mistake. cURL’s de- if (tls_status & GNUTLS_CERT_SIGNER_NOT_FOUND) { fault value of CURLOPT_SSL_VERIFYHOST is correctly set to 2. In the msg2 = gettext("no issuer was found"); curl_setopt($curlHandle,CURLOPT_SSL_VERIFYHOST, true) call, } else if (tls_status & GNUTLS_CERT_SIGNER_NOT_CA) { true silently turns into 1, overriding the default and instructing msg2 = gettext("issuer is not a CA"); } else if (tls_status & GNUTLS_CERT_SIGNER_NOT_FOUND) cURL to check the existence of any common name in the certificate { (Section 4.2), which may or may not match the name requested. msg2 = gettext("the certificate has no known issuer" Any PHP code using this Amazon-provided SDK to establish an ); } else if (tls_status & GNUTLS_CERT_REVOKED) { SSL connection to the Amazon Flexible Payments Service gateway msg2 = gettext("the certificate has been revoked"); is insecure against a man-in-the-middle attack. } else {
- 8. msg2 = gettext("the certificate is not trusted"); } example, it will reject mail.<a>.<b>.com if the name in the ... } certificate is m*.<a>.<b>.com. Furthermore, the original patch, as well as its derivatives, has This code misinterprets the semantics of gnutls_certificate_ a minor bug in the regular expression for parsing IPv4 addresses, verify_peers2. As explained in Section 4.1, this function indeed causing it to accept IP addresses starting with zero (this does not sets the tls_status code if certificate validation fails, but for cer- immediately result in a security vulnerability): tain errors—including self-signed certificates!—it returns 0. Even though the above code includes two identical checks for GNUTLS_ private static final Pattern IPV4_PATTERN = CERT_SIGNER_NOT_FOUND, neither check is ever executed when GNU- Pattern.compile("^(25[0-5]|2[0-4]d|[0-1]?d ?d)(.(25[0-5]|2[0-4]d|[0-1]?d?d)) TLS_CERT_SIGNER_NOT_FOUND is actually true! In this case hostname {3}$"); verification is correct, but chain-of-trust verification is broken. 7.5 Apache HttpClient 7.6 Trillian The most widely used version of Apache HttpClient is 3.1, re- Trillian, a popular instant messenger client, relies on OpenSSL leased in 2007. This library, as well as its earlier versions, sets for SSL connection establishment. By default, OpenSSL does not up SSL connections using JSSE’s SSLSocketFactory without per- throw a run-time exception if the certificate is self-signed or has an forming its own hostname verification (see Sections 4.1 and 4.2). invalid chain of trust. Instead, it sets flags. Furthermore, OpenSSL As a consequence, Apache HttpClient 3.* accepts any certificate does not provide any hostname verification. with a valid chain of trust, regardless of the name. As mentioned in If the application has called SSL_CTX_set to set the SSL_VERIFY Section 4.2, the same bug occurs in Weberknecht. _PEER flag (see Section 4.1), then SSL_connect exits and prints an The hostname verification bug in HttpClient was fixed in version error message when certificate validation fails. Trillian does not set 4.0-alpha1 [1]. The current version, 4.2.1, has its own hostname the SSL_VERIFY_PEER flag. When this flag is not set, SSL_connect verifier and delegates chain-of-trust verification to JSSE. Unfortu- returns 1. The application is then expected to check the status of nately, as we show in Section 8, the existence of a correct imple- certificate validation by calling SSL_get_verify_result. Trillian mentation of HttpClient has had little effect on the security of appli- does not call this function. cations that rely on HttpClient for SSL connection establishment. Trillian thus accepts any SSL certificate and is insecure against a Apache HttpClient 4.* involved a major architectural re-design, man-in-the-middle attack. Depending on the specific module cho- thus much of legacy and even new software still relies on version sen by the Trillian user, this reveals usernames, passwords, secu- 3.*. The use of HttpClient is often hidden inside Web-services mid- rity tokens, etc. for Google Talk (typically compromising all of the dleware such as Axis 2 and XFire, which—several years after ver- user’s Google services), AIM, ICQ, Windows Live (including Sky- sion 4.* became available—still ship with HttpClient 3.* and thus Drive), and Yahoo! Messenger (and thus all Yahoo! services). skip hostname verification for SSL certificates. Interestingly, it was reported back in 2009 that older versions of It is worth noting that the custom hostname verification code Trillian do not correctly validate MSN certificates [20]. This bug added to HttpClient 4.* is incorrect and will reject valid certificates. was ostensibly fixed in Trillian 4.2. Our analysis shows, however, The following code is from HttpClient 4.2.1: that SSL certificate validation is still completely broken for all ser- vices, not just for MSN (Windows Live), in Trillian 5.1.0.19. / / The CN b e t t e r h a v e a t l e a s t two d o t s i f i t w a n t s wildcard / / action . I t a l s o can ’ t be [ ∗ . co . uk ] o r [ ∗ . co . j p ] o r 7.7 Rackspace / / [ ∗ . o r g . uk ] , e t c . . . The Rackspace app for iOS (version 2.1.5) is an open-source String parts[] = cn.split("."); application for administering Rackspace cloud services. It uses the boolean doWildcard = parts.length >= 3 && parts[0].endsWith("*") && OpenStack iOS cloud client framework, which in turn relies on the acceptableCountryWildcard(cn) && ASIHTTPRequest library to set up HTTPS connections. !isIPAddress(host); ASIHTTPRequest provides a configuration variable Validates if(doWildcard) { SecureCertificate, set to 1 by default. If reset to 0, it turns if (parts[0].length() > 1) { / / e . g . s e r v e r ∗ String prefix = parts[0].substring(0, parts.length off both chain-of-trust and hostname verification. OpenStack sup- -2); / / e . g . s e r v e r ports multiple accounts on remote servers and lets users customize String suffix = cn.substring(parts[0].length()); SSL certificate validation on per-account basis using the ignoreSSL / / s k i p w i l d c a r d p a r t f r o m cn String hostSuffix = hostName.substring(prefix.length Validation variable. The value of this variable depends on the GUI ()); / / s k i p w i l d c a r d p a r t f r o m h o s t switch validateSSLSwitch, which should be shown to the user. match = hostName.startsWith(prefix) && hostSuffix. The Rackspace app (version 2.1.5) does not present the user with endsWith(suffix); } else { this option.9 The GUI switch validateSSLSwitch is thus never dis- match = hostName.endsWith(cn.substring(1)); played or explicitly assigned. Instead, it is simply initialized to 0 by } the Objective-C allocator. This turns on ignoreSSLValidation in if(match && strictWithSubDomains) { / / I f we ’ r e i n s t r i c t mode , t h e n [ ∗ . f o o . com ] i s n o t ASIHTTPRequest, which in turn sets ValidatesSecureCertificate / / a l l o w e d t o match [ a . b . f o o . com ] to 0 and disables certificate validation. match = countDots(hostName) == countDots(cn); As a consequence, SSL connections established by the Rackspace } } else { app on iOS are insecure against a man-in-the-middle attack. match = hostName.equals(cn); } 7.8 TextSecure TextSecure is an Android application for encrypting SMS and This code computes the length of the prefix by subtracting 2 MMS messages. It was written by Moxie Marlinspike who had from the number of parts (determined by the number of dots in the name). This logic is incorrect: validity of the first part of a domain 9 We are informed by Mike Mayo that this was an accidental over- name should have nothing to do with the total number of parts. For sight and will be fixed in subsequent releases of the app.
- 9. previously discovered several SSL certificate validation vulnerabil- In summary, any software using any of the above Web-services ities [11, 12]. This following code can be found in the application frameworks is insecure against a man-in-the-middle attack. (however, it does not appear to be reachable from the user interface Apache CXF. Apache CXF is a continuation of XFire. It supports and may not currently lead to an exploitable vulnerability): SOAP, along with REST and CORBA; the latest release is 2.6.1. schemeRegistry.register(new Scheme("http", It does not rely on Apache HttpClient. Instead, SSL connections PlainSocketFactory.getSocketFactory(), 80)); are established using OpenJDK’s HttpsClient. Therefore, prop- schemeRegistry.register(new Scheme("https", erly configured instances of CXF do verify hostnames. SSLSocketFactory.getSocketFactory(), 443)); ... Apache CXF provides an application-controlled option to turn HttpHost target = new HttpHost(hostUrl.getHost(), off certificate validation. Certificate validation is enabled by de- hostUrl.getPort(), HttpHost.DEFAULT_SCHEME_NAME); fault, but was disabled in the sample wsdl_first_https code sup- ... HttpResponse response = client.execute(target, request); plied with CXF until we notified the developers. Even if the port number is 443, DEFAULT_SCHEME_NAME is “http” and the connection is over HTTP, not HTTPS. 9. USING INSECURE SSL LIBRARIES As described in Section 4.2, PHP’s fsockopen does not validate SSL certificates. Nevertheless, it is often used even by applications 8. USING INSECURE MIDDLEWARE that must be secure against a man-in-the-middle attack. For exam- As explained in Section 5, software based on Web services usu- ple, PayPal’s IPN utility contains this code: ally relies on middleware libraries to manage network connections. / / p o s t b a c k t o PayPal u t i l i t y t o v a l i d a t e SSL functionality inside these libraries is opaque to the applica- ... tions. If the middleware employs a broken HTTPS implementation $fp = fsockopen (’ssl://www.paypal.com’, 443, $errno, that does not correctly validate SSL certificates, all applications $errstr, 30); based on it typically “inherit” the vulnerability. This code is replicated in PayPal payment modules for ZenCart and PrestaShop shopping carts. PrestaShop uses fsockopen in its 8.1 Apache Axis, Axis 2, Codehaus XFire CanadaPost payment module, too. Other similarly vulnerable soft- Apache Axis is an open-source Java implementation of SOAP. ware includes Open Source Classifieds, The latest release is 1.4, discontinued in 2007 in favor of Axis 2, Python’s URL libraries do not validate certificates (Section 4.2), but the library is still used, for example, in PayPal’s Java SDKs. yet developers still use them for SSL connections. Examples in- Apache Axis 2 is a complete redesign of Apache Axis. The lat- clude Tweepy, a library for accessing Twitter API that uses httplib, est release is 1.6.2. Codehaus XFire is another open-source Java and Mozilla’s Zamboni project, which accepts contributions for implementation of SOAP. It was discontinued in 2007 in favor of extension developers and uses urllib2 to connect to PayPal. Apache CXF, but is still used, for example, in Amazon’s EC2 Java SDK. The latest release of XFire is 1.2.6. Apache Axis uses its own version of HttpClient, while Axis 2 10. BREAKING OR DISABLING and XFire use Apache HttpClient version 3.1. Both versions of CERTIFICATE VALIDATION HttpClient rely on SSLSocketFactory for SSL connection estab- In general, disabling proper certificate validation appears to be lishment but mistakenly omit hostname verification (Section 4.2). the developers’ preferred solution to any problem with SSL libraries. SSL vulnerabilities caused by bugs in Web-services middleware Here are a few typical quotes from developers’ forums: are pervasive in Amazon libraries. Affected software includes Ama- zon EC2 API Tools Java library, which uses XFire to set up SSL • “I want my client to accept any certificate (because I’m only connections to EC2 servers, and Amazon Flexible Payments Ser- ever pointing to one server) but I keep getting a javax.net. vice (Java) merchant SDK, which relies on an old Apache Http- ssl.SSLException: Not trusted server certificate ex- Client. The latter library is used by merchants to transmit cus- 11 ception” —[note the fallacious reasoning!] tomers’ payment details to the FPS gateway. The PHP version of the library is broken, too, but in a very different way (Section 7.1). • “Tutorial: Disabling Certificate Validation in an HTTPS Con- In contrast to the PHP version, however, the Java utility for verify- nection. . . Reply: Thank you very much. You solved my ing instant payment notifications uses JSSE’s HttpsClient instead biggest problem in the project.” 12 of Apache HttpClient and thus checks SSL certificates correctly. Other software that relies on Axis includes Java SOAP SDKs • “I have always turned off CURLOPT_SSL_VERIFYPEER for PayPal Payments Pro (Direct Payment), PayPal Transac- in curl.”13 tional Information, and PayPal Mass Pay, as well as Apache ActiveMQ implementation of JMS (Java Message Service). • “I am using axis on java to consume a webservice. The web service is in https, and I want to avoid the the check for cer- 8.2 Pusher tificate.”14 Pusher is a WebSocket-based API that provides real-time mes- 11 http://stackoverflow.com/questions/2642777/ saging functionality to mobile and Web applications. Pusher’s An- trusting-all-certificates-using-httpclient- droid libraries10 are based on Weberknecht (see Section 4.2). Any over-https application using these libraries (e.g., GitHub’s Gaug.es) is thus 12 http://www.exampledepot.com/egs/javax.net. insecure. It is also worth noting that Gaug.es is using an updated ssl/trustall.html version of Weberknecht, which, in addition to incorrectly using raw 13 http://stackoverflow.com/questions/ SSLSocketFactory (see Section 4.1), disables the trust manager. 10102225/curl-ssl-certificates 14 http://stackoverflow.com/questions/9079298/ 10 https://github.com/EmoryM/Android_Pusher axis-fake-certificate
- 10. • “However, by default, SSL support in NSStream is a little def _verify_hostname(self, hostname, cert): paranoid. It won’t, for example, use a self-signed certifi- # V e r i f y hostname a g a i n s t peer c e r t # Check b o t h commonName and e n t r i e s i n s u b j e c t A l t N a m e , cate or an expired certificate to establish a secure connec- # u s i n g a r u d i m e n t a r y glob t o dns r e g e x check tion. NSStream does a number of validity checks when es- # to f i n d matches tablishing the secure connection, and if they don’t all pass, common_name = self._get_common_name(cert) the streams appear to be valid, but no data gets sent or re- alt_names = self._get_subject_alt_names(cert) ceived. This is somewhat frustrating, and it could be there’s a way to find out when the secure connection failed, but I # r e p l a c e ∗ w i t h a l p h a n u m e r i c and d a s h # replace . with l i t e r a l . haven’t been able to find it in the documentation, or using valid_patterns = [re.compile(pattern.replace(r".", r" Google. There is an error domain declared for these errors .").replace(r"*", r"[0-9A-Za-z]+")) (NSStreamSocketSSLErrorDomain), but in my experimenta- for pattern tion, no errors gets generated, the streams even accept bytes in (set(common_name) | set(alt_names)) ] for transfer, but nothing happens.” 15 return any( pattern.search(hostname) Unfortunately, these bad development practices find their way for pattern in valid_patterns even into critical software responsible for transmitting financial in- ) formation and sensitive data, where security against man-in-the- middle attacks is absolutely essential and SSL certificate valida- This bug has been fixed in Libcloud version 0.11.1 after we no- tion should be mandatory. For example, a comment in the Autho- tified the developers. rize.Net eCheck module of ZenCart says that certificate validation is disabled for “compatibility for SSL communications on some 10.3 Amazon Elastic Load Balancing API Tools Windows servers (IIS 5.0+)”—note the fallacious reasoning! This library overrides JDK’s default X509TrustManager to dis- able hostname verification. Even if X509TrustManager had not been 10.1 Chase mobile banking overriden, this library employs Codehaus XFire which does not Chase is a major US bank. SSL connections established by its perform hostname verification (see Section 8.1). mobile banking application on Android are insecure against a man- in-the-middle attack. This allows a network attacker to capture cre- 10.4 Shopping carts dentials, such as username and password, of any Chase customer osCommerce, ZenCart, Ubercart, and PrestaShop are open- using this app, along with the rest of their session. source shopping carts implemented in PHP. They use cURL for Decompilation and analysis of this app’s code show that it over- SSL connections to payment gateways. If cURL is not available, rides the default X509TrustManager. The replacement code simply they typically fall back on (insecure) fsockopen. returns without checking the server’s certificate. The code below All carts are bundled with plugin modules for specific payment is the result of reverse-engineering, thus variable names and other processors. Almost without exception, these modules turn off cer- details may differ from the actual code: tificate validation. In ZenCart, vulnerable modules include Link- Point, Authorize.Net, and PayPal Payments Pro, as well as PayPal public final void checkServerTrusted(X509Certificate[] paramArrayOfX509Certificate, String paramString) IPN functionality (see Section 7.3). The insecure LinkPoint mod- { ule contains an amusing comment at the beginning of the file: “### if ((paramArrayOfX509Certificate != null) && ( YOU REALLY DO NOT NEED TO EDIT THIS FILE! ###” paramArrayOfX509Certificate.length == 1)) paramArrayOfX509Certificate[0].checkValidity(); Vulnerable modules include eBay, PayPal, and Canada Post in while (true) PrestaShop, PayPal, Authorize.Net, and CyberSource in Ubercart, { Sage Pay Direct, Authorize.Net, MoneyBookers, and PayPal Ex- return; this.a.checkServerTrusted( press, Pro, Pro PayFlow, and Pro PayFlow EC in osCommerce. paramArrayOfX509Certificate, paramString); SSL connections to payment gateways from merchants using any } of these carts are insecure against a man-in-the-middle attack. } The only exceptions are Google modules for PrestaShop and os- Note the unreachable invocation of checkServerTrusted. We Commerce. The Google Checkout module for osCommerce comes conjecture that this was a temporary plug during development that from code.google.com and is not bundled with osCommerce. somehow found its way into the production version of the app. It sets CURLOPT_SSL_VERIFYPEER to true and leaves CURLOPT_SSL_ VERIFYHOST to its correct default value, 2. By contrast, the official, 10.2 Apache Libcloud PayPal-provided PayFlow module disables certificate validation. Apache Libcloud16 is a Python library extension providing sup- 10.5 AdMob port for 26 different cloud service providers. Libcloud relies on Google’s AdMob provides sample code to mobile site owners the underlying Python library to verify the chain of trust in SSL that they can use on their servers to associate instances of their certificates; internally, Python uses OpenSSL. Once the chain of mobile apps with their developer accounts (see Section 5). This trust is verified, Libcloud verifies the hostname using the _verify code uses cURL to establish an SSL connection to AdMob’s server, _hostname method in httplib_ssl.py. This code uses an in- but turns off certificate validation. A man-in-the-middle attacker correct regular expression for hostname verification. For example, can thus gain access to all of the developers’ Google services. it accepts oogle.com as a match for google.com, exposing all Libcloud clients to a man-in-the-middle attack: 10.6 Android apps 15 Groupon Redemptions, an Android app for merchants, disables http://iphonedevelopment.blogspot.com/2010/ 05/nsstream-tcp-and-ssl.html certificate validation twice: by allowing any hostname via the “al- 16 http://libcloud.apache.org/ low all” hostname verifier and by binding to an empty trust man-
- 11. ager. Similarly, Breezy, an app for secure document printing, dis- example, the PHP libraries for Amazon Flexible Payments Services ables hostname verification and overrides the default trust manager. and PayPal Payments Standard attempt to enable hostname verifi- ACRA, an Android library for posting application crash reports cation in cURL, but instead accidentally override the correct default to a Google Doc, overrides the default trust manager. Any app value and end up disabling it (Sections 7.1 and 7.2). This shows using this library is insecure against a man-in-the-middle attack. that even safe defaults may be insufficient. Lynx attempts to check for self-signed certificates, but misinterprets the meaning of return 10.7 AIM values of GnuTLS’s certificate validation function and the check is AIM client version 1.0.1.2 on Windows uses Microsoft’s Cryp- never executed (Section 7.4). Formalizing the precise semantics of toAPI. Runtime analysis shows that it calls CryptoAPI’s certifi- SSL library API and rigorously verifying the “contracts” between cate validation function CertVerifyCertificateChainPolicy. To the application and the library is an interesting topic for future re- disable certificate validation, it passes a CERT_CHAIN_POLICY_PARA search and may call for programming language support. variable with CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAG set, in- DON’T delegate the responsibility for managing SSL connec- structing CryptoAPI to accept certificates signed by untrusted au- tions to the applications. Existing SSL libraries expose many op- thorities. AIM does not perform any hostname verification, either. tions to higher-level software. This is fraught with peril. Appli- cation developers may not realize that they must explicitly choose 10.8 FilesAnywhere certain options in order to enable certificate validation. Therefore, FilesAnywhere is an application for managing cloud storage. It libraries should use safe defaults as much as possible. Furthermore, uses CryptoAPI for SSL connections and accepts both self-signed they should not silently skip important functionality such as host- and third-party certificates. name verification as JSSE does when the algorithm field is NULL FilesAnywhere has an interesting peculiarity. If presented with or an empty string (see Section 4.1). Instead, they should raise a a Google certificate when it attempts to connect to a non-Google runtime exception or inform the application in some other way. server, it shows a warning message “The WebDav server has a new DO design a clean and consistent error reporting interface. Li- address. Please specify http://google.com in the profile.” If pre- braries such as OpenSSL and GnuTLS report some errors via re- sented with any other third-party certificate, it silently accepts it turn values of functions, while other errors from the same function and sends user’s data to a wrong, potentially malicious server. are reported through a flag passed as an argument. Inconsistent in- terfaces confuse developers who then mistakenly omit some error 11. OUR RECOMMENDATIONS checks in their applications. Whenever application developers must deal with SSL, the con- These recommendations provide short-term fixes. A principled ventional advice is to use standard SSL libraries. This advice is solution to the problem must involve a complete redesign of the correct, but insufficient. As this paper shows, even developers of SSL libraries’ API. Instead of asking application developers to man- high-security software often use standard SSL libraries incorrectly. age incomprehensible options such as CURLOPT_SSL_VERIFYPEER or The following recommendations are informed by our analyses of SSL_get_verify_result, they should present high-level abstrac- broken SSL certificate validation in diverse applications. tions that explicitly express security properties of network connec- tions in terms that are close to application semantics: for exam- 11.1 For application developers ple, a “confidential and authenticated tunnel.” The library should DO use fuzzing (black-box, if necessary) and adversarial test- also be explicit about the security consequences of any application- ing to see how the application behaves when presented with abnor- controlled option: for example, instead of “verify hostname?”, it mal SSL certificates. Even when the vulnerabilities are subtle, the could ask “Anyone can impersonate the server. Ok or not?” symptoms usually are not. In many of our case studies, it is obvious that the software in question has never been tested with any certifi- cates other than those of the intended server. When presented with 12. RELATED WORK a certificate issued to AllYourSSLAreBelongTo.us instead Independently of this work, Kevin McArthur announced multi- of the expected Amazon or PayPal or Chase certificate, these pro- ple vulnerabilities caused by improper SSL certificate validation in grams eagerly establish SSL connections and spill out their secrets. PHP software. 17 Affected programs include, among others, os- These vulnerabilities should have manifested during testing. Commerce, Ubercart, PrestaShop, and three PayPal SDKs. DON’T modify application code and disable certificate valida- Moxie Marlinspike demonstrated several vulnerabilities in cer- tion for testing with self-signed and/or untrusted certificates. We tificate validation code in browsers and SSL libraries, including the found in our case studies that developers forget to reverse these lack of basic constraint checking (e.g., checking the CA bit) [11] modifications even for the production version of the software. In- and incorrect parsing of NULL characters in the “CommonName” stead, create a temporary keystore with the untrusted CA’s public field [12]. By contrast, we focus on non-browser software that uses key in it. While testing your code with self-signed or untrusted (mostly) correct SSL libraries incorrectly. certificates, use that keystore as your trusted keystore. Kaminsky et al. [10] showed that parsing differences between DON’T depend on the library’s defaults to set up the SSL con- CA software and browser certificate validation code can result in a nection securely. Default settings can and do change between dif- CA issuing a certificate that can be used for a man-in-the-middle ferent libraries or even different versions of the same library—for attack. By contrast, we investigate certificate validation bugs in example, cURL prior to version 7.10 did not validate certificates non-browser clients, not in CA software. by default, but version 7.10 and later do. Always explicitly set the Stevens et al. showed how an attacker can leverage MD5 hash options necessary for secure connection establishment. collisions to get a CA to issue a specially crafted certificate that is valid for an ordinary host but whose hash collides with that of a 11.2 For SSL library developers certificate for a new, rogue intermediate CA [18]. By contrast, our DO make SSL libraries more explicit about the semantics of their attacks do not involve certificate forgery. APIs. In many cases, it is obvious that application developers do 17 not understand the meaning of various options and parameters. For http://www.unrest.ca/peerjacking
- 12. Several certificate authorities such as Comodo [5] and DigiNo- [3] S. Chen, Z. Mao, Y.-M. Wang, and M. Zhang. tar [6] were recently compromised and used by attackers to issue Pretty-Bad-Proxy: An overlooked adversary in browsers’ fake certificates for popular websites. By contrast, our attacks do HTTPS deployments. In S&P, 2009. not involve CA compromise. [4] S. Chen, R. Wang, X. Wang, and K. Zhang. Side-channel To mitigate the risks of rogue certificates, Evans et al. proposed leaks in Web applications: A reality today, a challenge certificate pinning, i.e., pre-established bindings in the browser be- tomorrow. In S&P, 2010. tween well-known websites and their certificates [8]. Certificate [5] Comodo report of incident. pinning is not supported by any of the software we analyzed. http://www.comodo.com/Comodo-Fraud- Several large-scale studies analyzed HTTPS deployment [7, 22] Incident-2011-03-23.html, 2011. and found many errors in SSL certificates. One of the most com- [6] Diginotar issues dodgy SSL certificates for Google services mon errors is a mismatch between the server’s fully qualified do- after break-in. main name and certificate’s identifiers. This misconfiguration alone http://www.theinquirer.net/inquirer/ does not enable a man-in-the-middle attack. news/2105321/diginotar-issues-dodgy-ssl- Chen et al. showed how a malicious proxy can exploit browser certificates-google-services-break, 2011. bugs for man-in-the-middle attacks on HTTPS [3]. By contrast, our [7] P. Eckersley and J. Burns. An observatory for the SSLiverse. attacks do not depend on browser bugs. In DEFCON, 2010. Side-channel attacks can extract information from encrypted traf- [8] C. Evans and C. Palmer. Certificate pinning extension for fic even when SSL is correctly deployed [4, 19]. By contrast, we HSTS. http://www.ietf.org/mail-archive/ found vulnerabilities that enable a man-in-the-middle attacker to web/websec/current/pdfnSTRd9kYcY.pdf, 2011. decrypt SSL traffic, obviating the need for side-channel analysis. [9] Fiddler - Web debugging proxy. Other side-channel attacks include a timing attack that extracts the http://fiddler2.com/fiddler2/. private key from OpenSSL implementations [2]. [10] D. Kaminsky, M. Patterson, and L. Sassaman. PKI layer cake: new collision attacks against the global X.509 infrastructure. In FC, 2010. 13. CONCLUSION [11] Moxie Marlinspike. IE SSL vulnerability. http: The main lesson of this paper is that using SSL in non-browser //www.thoughtcrime.org/ie-ssl-chain.txt, software is a surprisingly challenging task. We demonstrated that 2002. even applications that rely on standard SSL libraries such as JSSE, [12] Moxie Marlinspike. Null prefix attacks against SSL/TLS OpenSSL, GnuTLS, etc. often perform SSL certificate validation certificates. incorrectly or not at all. These vulnerabilities are pervasive in crit- http://www.thoughtcrime.org/papers/null- ical software, such as Amazon FPS and PayPal libraries for trans- prefix-attacks.pdf, 2009. mitting customers’ payment details from merchants to payment [13] Internet X.509 public key infrastructure certificate policy and gateways; integrated shopping carts; Amazon EC2, Rackspace, and certification practices framework. other clients for remote administration of cloud storage and virtual http://www.ietf.org/rfc/rfc2527.txt, 1999. cloud infrastructure; Chase mobile banking on Android; and many [14] HTTP over TLS. other popular programs. Their SSL connections are completely in- http://www.ietf.org/rfc/rfc2818.txt, 2000. secure against a man-in-the-middle attack. [15] Internet X.509 public key infrastructure certificate and We also presented our recommendations for safer use of SSL in certificate revocation list (CRL) profile. non-browser software. Future research directions include (1) de- http://tools.ietf.org/html/rfc5280, 2008. velopment of better black-box testing and code analysis tools for [16] The Secure Sockets Layer (SSL) protocol version 3.0. discovering errors in SSL connection establishment logic, (2) de- http://tools.ietf.org/html/rfc6101, 2011. sign of formal verification techniques and programming language [17] Representation and verification of domain-based application support for automatically checking whether applications use SSL service identity within Internet public key infrastructure libraries correctly and not misinterpret the meaning of critical op- using X.509 (PKIX) certificates in the context of Transport tions and parameters, and (3) design of better APIs for SSL and Layer Security (TLS). other secure networking protocols. http://tools.ietf.org/html/rfc6125, 2011. Acknowledgments. This research was partially supported by the [18] M. Stevens, A. Sotirov, J. Appelbaum, A. Lenstra, NSF grants CNS-0331640, CNS-0746888, and CNS-0905602, two D. Molnar, D. Osvik, and B. Weger. Short chosen-prefix Google research awards, Samsung, and the MURI program under collisions for MD5 and the creation of a rogue CA AFOSR Grant No. FA9550-08-1-0352. Boneh also thanks iSEC certificate. In CRYPTO, 2009. partners for helpful conversations about this work. [19] Q. Sun, D. Simon, Y.-M. Wang, W. Russell, We acknowledge Amazon, Apache, Chase, GitHub, Lynx, Pay- V. Padmanabhan, and L. Qiu. Statistical identification of Pal, and Rackspace developers for recognizing and promising to encrypted Web browsing traffic. In S&P, 2002. repair the vulnerabilities after they were brought to their attention. [20] CVE-2009-4831. http://cve.mitre.org/cgi- We thank Colm O hEigeartaigh for explaining the intended behav- bin/cvename.cgi?name=CVE-2009-4831, 2009. ior of certificate validation in Apache CXF. [21] J. Viega and M. Messier. Secure Programming Cookbook for C and C++. O’Reilly Media, 2007. [22] N. Vratonjic, J. Freudiger, V. Bindschaedler, and J.-P. References Hubaux. The inconvenient truth about Web certificates. In WEIS, 2011. [1] https should check CN of x509 cert. https://issues. [23] R. Wang, S. Chen, X. Wang, and S. Qadeer. How to shop for apache.org/jira/browse/HTTPCLIENT-613. free online – Security analysis of cashier-as-a-service based [2] D. Brumley and D. Boneh. Remote timing attacks are Web stores. In S&P, 2011. practical. In USENIX Security, 2003.