Secure Websites For Communication Computer Science Essay

Published Date: 02 Nov 2017

Homework 3

Pavan Jami

A lot of us use secure websites for communication. Let it for social networking (Facebook), sending and receiving mails (Gmail), or for e-commerce, we depend on the "secure" mode of the webpage to keep our information safe under the assumption that these sites are safe. Some of the unseen risks when using a "secure" website include:

CA Trust issues

If A digitally signs his/her message with their private key, and sends the receiver a copy of the certificate, the receiver can know for sure that the message was sent by A. This is known as authentication. In internet domain, authentication can be done using digital certificates.

A certification authority (CA) is a body that issues digital certificates. Digital certificate is a confirmation that the public key contained in the certificate belongs to the person or organization or group mentioned in the certificate issued. It could be said that CA is a third party who is trusted by the owner of the certificate and the user depending on the issued certificate. SSL works on this trust.

Now, the CA that signs the certificate needs to be trusted. One must decide by himself whether a CA could be trusted or not. Browsers generally maintain and update a list of trusted CAs (and a list of blocked CAs), which includes the certificates of those CAs that are trusted. Which CAs should make the list becomes a matter of judgement for the user. Some CAs are well known that they are included by default in many browsers. Many web browsers like IE, Chrome and Firefox usually include VeriSign and a few other ‘trusted’ CA’s certificates, because many websites use certificates issued by these companies. A user can also add other CAs to the 'trusted list'.

If the CA, who is trusted by a user, can be manipulated, then the security of the entire system for each and every user (who uses the certificate signed by the CA) is lost. Hacking or coercion of a CA would lead to a person with malicious intent producing a certificate that many devices on the Internet will trust, allowing interception and eavesdropping of otherwise secure communication. In such cases, we are forced to blindly trust a single CA's opinion regarding the validity of a website.

Some notable incidents in the past are:

In 2011, a fake Adobe Flash updater was discovered on the Internet. The software’s certificates, which verify the authenticity and integrity of Internet connections, had an authorized signature. An unknown master had access to all of their data. The keys used to sign the certificates had been stolen from a ‘certificate authority’ (Malaysian Agricultural Research and Development Institute). [1]

VeriSign issuing certificates to an individual who claimed that he/she represented Microsoft. [2]

Comodo's certificate authority business was attacked in 2010 when someone stole log-in credentials belonging to a reseller and tricked Comodo into issuing eight certificates to major Web services including Google and Skype. [3]

CDN issues

A content delivery network (CDN) is an accumulation of web servers spread across multiple locations. CDNs generally use a large number of servers distributed across the Internet. The server singled out to deliver content to a particular user is based on its closeness to that particular user.

Many websites use third-party CDNs to efficiently serve webpages to the users. By doing this, the websites serve mixed content (a combination of HTTP and HTTPS pages) and they also invite these third-party CDN into the conversation between the website and the user. When a user clicks on a link, information about the HTTP referrer is also sent along with the request. Using JavaScript libraries that are not hosted on one’s website could be dangerous since the code could be modified to collect data about the users.

As an example, let us consider a situation. A merchant sets up a website of his own for selling his goods. Users can purchase stuff and during checkout, enter their credit card number. The site is protected with SSL for all the traffic. But for building the website, the merchant uses open source JavaScript (say XYZ from ABC). ABC serves their content over CDN and uses SSL. But this amounts to deceiving the users who make transactions on the site. By doing this, the merchant is allowing ABC to execute JavaScripts on their website and now ABC can also see any information the user reads or enters on those pages.

Also, many sites use encrypted connections for authentication and sensitive information and to avoid transmitting passwords in plaintext, but they generally don’t use SSL connections for the other pages. The absence of website-wide support of SSL is usually because of the bandwidth overhead of encrypting every connection.

Third Party Content Issues

Filling up a website with third-party content is a good way for a company to make their website more interesting or maybe even to get additional revenue. But adding third-party content to a website also brings a way in which attackers can distribute malicious content to visitors. It is generally easy to compromise someone that already has traffic.

It is easy to sneak malicious content into advertisements so that they can compromise visitors to legitimate and secure sites. The malicious content can be put on a site (i.e. hosted) when CDNs are tricked into believing the criminals represent a legitimate company. Sometimes, attackers compromise a network's server and replace legitimate advertisements with versions that have malicious content. This could lead to the visitors of the site, who assume the site to be safe and secure, to be deceived and maybe some valuable information being stolen. Notable example includes London Stock Exchange [4], whose secure website has been compromised.

Sites like Gmail and Facebook, serve a lot of ads to add to their revenue. They could be a potential source of threat to users.