Broadband Tech > Security > Security > Google disables SSL compression in Chrome against new attack

Google disables SSL compression in Chrome against new attack

The Chromium bug entry for this is at »code.google.com/p/chromium/issue···d=139744 -- however, you will get a 403 forbidden when trying to view this, so this is a sure sign that it's pertaining to a security vulnerability. Normally Chromium bug entries are viewable by anyone.

I tried looking into the Firefox source code. As best I can tell, SSL compression is off in Firefox by default. Specifically, the file sslsock.c contains an array called sslOptions with this setting:


static sslOptions ssl_defaults = {
...
PR_FALSE, /* noLocks */
PR_FALSE, /* enableSessionTickets */
PR_FALSE, /* enableDeflate */


This should mean that SSL compression is not enabled by default in Firefox. I couldn't find any recent changes to this file either when checking the diffs.

--
Mischel Internet Security - Developer of TrojanHunter

reply to MagnusM

reply to MagnusM
On the Beast last year....

"That decryption happens slowly, however; BEAST currently needs sessions of at least a half-hour to break cookies using keys over 1,000 characters long."

SSL Server Test

This free online service performs a deep analysis of the configuration of any SSL web server on the public Internet. Please note that the information you submit here is used only to provide you the service. We don't use the domain names or the test results, and we never will.
»www.ssllabs.com/ssltest/index.html
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

reply to MagnusM
Crack in Internet's foundation of trust allows HTTPS session hijacking:

reply to MagnusM
As a Pale Moon user (a Firefox variant), how can I tell if it is using the SSL compression or not? What do I query?

When I was looking at this I searched for an about:config setting, but as best I can tell there is no pre-entered setting for this. I'm sure there is a string you can enter to control it manually. There shouldn't be any need to, though, if they're using a recent branch off the Firefox source tree.
--
Mischel Internet Security - Developer of TrojanHunter

In about:config search for SPDY settings. Disable (set to false) all SPDY support.

quote:

---

network.http.spdy.enabled = false
network.http.spdy.enabledv2 = false (present in FF 15)

---

Found the entries in Pale Moon (v.15.0):

From SPDY

quote:

---

SPDY is similar to HTTP, with particular goals to reduce web page load latency and improve web security.

...

An independent study shows that, in testing, the page load time with SPDY is not significantly different on most websites from HTTP or HTTPS, because old optimization techniques such as splitting the content between many hosts prevent pipelining from taking place.

---

reply to DownTheShore

reply to MagnusM
So basically this issue is a problem for all browsers?

quote:

---

Both the Firefox and Chrome browsers [and their variants] also support this protocol. Internet Explorer and Safari does not support SPDY and are not vulnerable.

---

reply to MagnusM

reply to StuartMW
No, Fx 4.0.1 and Fx 10.0.7 Enterprise do NOT support this protocol.

Sea Monkey, older version 2.6.1, does NOT support this protocol. However, SM current version 2.12.1 does and has a bunch of entries in about:config.

So this protocol was added to Mozilla browsers within the last six months thereabouts. Just another reason to avoid the insanity of the current "race to death" frantic, constant updating of browsers. I don't see limitations in Fx 4, or 10, or the earlier SM, because they don't have this "feature". At least, I only have to disable in SM 2.12.1.

I haven't checked Opera 12 yet.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

reply to MagnusM
I did find this link at dev.opera though.

»dev.opera.com/articles/view/oper···y-build/

quote:

---

SPDY would come in Opera 12.50 (if it's not hit by any major problems)

---

reply to Mele20

reply to MagnusM

reply to norwegian
Thanks for the link. That was an interesting article. I knew very little about SPDY and any browser until this thread and that article was informative not just for Opera but in a more general way also.

I don't use secure web browsing except for banking or logging in somewhere. It puzzles me why there is a push for secure browsing when it is just ordinary browsing. I saw the Opera article refer to a Fx extension that shows you when SPDY is being used. I hope it will install on SM since I don't have a Fx version that has SPDY.

I wonder if this is the beginning of the eventual end of Proxo? I don't use Proxo SSL because the only SSL I need is for banking, and logging in sites that require that, and the rare times when I purchase something on the internet (and I am extremely reluctant to do that so only if I absolutely have to as I can't find the item here or a reasonable substitute).

I obviously don't care how fast a browser is since my favorite browser is Fx 4 and it is much slower than Opera 12 but Opera 12 is an awful browser. Why sacrifice a good browser on the speed altar? So, I am not in need of SPDY and will disable it on any browser I see it on.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

reply to MagnusM
Looks to me one would still have to do a MITM for this one.

»blog.whitehatsec.com/crime-mitm-and-xss/