ID: IRCNE2011091267
Date: 2011-09-28
According to “ComputerWorld”, Microsoft yesterday said it will issue a Windows security update to plug a long-known hole in the protocol that secures websites.
Although the flaw in SSL 3.0 and TLS 1.0, has been known for about a decade, a practical exploit only surfaced last week when a pair of researchers demonstrated what they called BEAST, for "Browser Exploit Against SSL/TLS," a hacking tool that attacks browsers and decrypts cookies, potentially giving attackers access to encrypted website log-on credentials.
Opera Software's flagship desktop browser relies on TLS 1.1, which is not vulnerable to such attacks, but others have either not made that move or as in Microsoft's case, have left TLS 1.1 support disabled by default.
In a security advisory issued Monday, Microsoft said it is working on an update for Windows, but did not say what it would patch or modify, or when it would deliver the fix. All versions of Windows, from the 10-year-old Windows XP to 2009's Windows 7, are vulnerable to BEAST attacks, Microsoft said. Internet Explorer relies on Windows' implementation of SSL and TLS, the reason why Microsoft will patch the operating system and not its browser.
Windows 7 and Windows Server 2008 R2 support TLS 1.1, but the newer protocol is not enabled by default because of website compatibility issues: Relatively few of the servers that power sites use TLS 1.1.
Microsoft advised server and desktop users running those editions of Windows to switch on TLS 1.1, but warned them of possible problems if they did. It also published a pair of "Fix-it" tools that automate the process of turning on TLS 1.1.
Some browsers -- including Google's Chrome, Mozilla's Firefox and Apple's Safari -- are vulnerable to attack because they don't support the more secure encryption protocols.
However, Mozilla on Tuesday said that while Firefox relies on TLS 1.0, the browser itself is not at risk.
- 3