Major SSL Security Hole?

By David Fiedler

What the Heck?

"Everyone knows" that SSL (Secure Sockets Layer) guarantees total security for electronic commerce on the Web. It provides foolproof encryption, a detailed "audit trail" between a user's browser and any applications running on either the browser or the server, and default notification to the user if there's any insecure "holes" in a page.

But Brian Clark, President of GMD Studios in Orlando, FL, seems to have found evidence to the contrary. During the process of developing software for a client, he came up with a page which is served via SSL and includes a JavaScript program which calls a remote, unsecure CGI URL, passing environment variables. This JavaScript call is loading the .src attribute of an image object:

<SCRIPT LANGUAGE="JavaScript">
<!--

   var imgObj = new Image;
   var ltUrl = "http://www.rankthis.com/cgi-bin/trakker/js_trakker.cgi";
   imgObj.src = /old?u=http%3A%2F%2Fwww.webdeveloper.com%2Fhotstuff%2FltUrl&y=1999 + "?ref=" + document.referrer;

//-->
</SCRIPT>

When he tested the page using Netscape Communicator 4 on Windows 95 and MacOS and Linux, neither provided any warning that an insecure CGI was called from the secure page, though Microsoft Internet Explorer 4.0 for Win95 properly displayed a "secure/insecure mix" warning dialog.

However, see the pages at the following URLs to see examples of how even Internet Explorer fails to always notice the potential security problem with Java applets:

According to Clark, a similar technique (passing information to a CGI program via GET-style encoding in the URL) could be used to lift data (including credit card numbers) from a secure form and deliver it to an outside, insecure server, along with environment variables. He says: "Amazing how fragile the whole SSL thing is, eh? Outside of the <applet> tag, it generates a warning...inside the <applet> tag, it doesn't...despite the fact in both cases there is communication with an insecure server."

We've tested this with Netscape 4.06 and IE 4.0 SP1 on Windows NT 4.0. We'd like to hear from Netscape and Microsoft as to whether they think this is of genuine concern or not. Personally, I may go back to sending checks via carrier pigeon.
-- David Fiedler

Refresh Daily
Join Editor-in-Chief David Fiedler The Editor With No Time and find truth, justice, and a clue or two.

[ Site Map ]

ActiveX / VBscript

Animated GIF Archive

Browsers

CGI / Perl

Database Connectivity

Design / Graphics

E-Commerce

HTML-Advanced: DHTML, CSS

HTML / Site Authoring Tools

Intranet/Groupware

Java

JavaScript

Multimedia: Audio / Video / Streaming Technologies

Opinions

Refresh Daily: Editorial Column

Security

Servers & Server Tools

Site Design / Graphics

Site Management / Marketing / Log File Analysis

Tutorials

VRML / 3D

XML