Microsoft is urging customers to update vulnerable versions of SSL to a newer one that is not susceptible to a recently published exploit called BEAST, but in the meantime it recommends steps that lessen the risk of being victimized.
The ultimate fix for the problem, known as Browser Exploit Against SSL/TLS (BEAST), upgrading to TLS 1.1, the latest version of the protocol. TLS is the official name for what is still frequently referred to as SSL. The problem is with TLS 1.0 and earlier SSL/TLS versions.
But because that upgrade is time consuming and not all browsers - Firefox for instance - support TLS 1.1, Microsoft recommends instead reconfiguring the order in which older versions of SSL/TLS rank the cipher suites that the protocol negotiates between servers and clients.
BEAST decrypts secure-HTTP requests, communication between browsers and servers to set up HTTPS sessions such as those between banks and their online customers. BEAST is a Java script that exploits a weakness found when SSL uses block ciphers rather than stream ciphers.
The fix Microsoft recommends changing the order in which SSL/TLS negotiates cipher suites so that stream ciphers are considered first. It's not failsafe because there is no guarantee that the device at the other end will accept the stream cipher proposal.
BEAST was demonstrated by researchers Juliano Rizzo and Thai Duong who showed that it can decrypt authentication tokens and cookies from HTTPS requests. The bottom line is that attackers can hijack users' sessions. If the session is with a bank, for example, the attacker could steal the victim's funds.
The vulnerability has been known since 2004, but the consensus was that it couldn't be exploited. TLS 1.1, which addresses the vulnerability, was defined by the IETF in 2006, but has not been widely implemented because the risk was deemed low and changes it includes will break some Web sites.
The vulnerability BEAST exploits is unrelated to threats to SSL posed by recent attacks on SSL certificate authorities. In those cases, attackers issued false SSL certificates, enabling them to falsely authenticate servers and duping victims into thinking they were at genuine sites.
BEAST actually decrypts SSL traffic.
Read more about wide area network in Network World's Wide Area Network section.