MD5 considered harmful today

http://www.win.tue.nl/hashclash/rogue-ca/

 

Note an update today in the article:

I and a friend discussed this article yesterday, and agreed that it afforded an opportunity to review some security procedures. So, while the crypto experts are hashing over the mathematical intricacies of all of this, here is a pertinent statement we home users can ponder:

It's evident that their attack scenario is one that has been in use for many years: redirect to the rogue site. Two basic methods for redirect have been labeled as phishing and pharming.

The common way to exploit phishing is to trick the user into clicking on a link in an email or on a website which takes them to a different site than they expected.

(We can eliminate the Google redirect here, since people don't normally use Google to get to their financial web sites.)

By hiding the rogue URL in html code, the URL that displays will appear to be legitimate, but will reveal the rogue URL when hovering the mouse over the link:

​

Paypal scams were common awhile back:

​

The obvious prevention is to never click on a link to go to a site to login where you transact business. The financial sites I deal with emphasize this in their security measures.

The other method is pharming, where hackers are able to redirect to a rogue site by assigning a different Internet Protocol (IP) address to the URL you think you are using, by hacking into the Domain Name System (DNS) server where the URL name is resolved into a number (IP address).

If your_bank.com has an IP address of 123.45.678 and the hacker is able to change that to the rogue site address of say, 213.45.32, then even if you type your_bank.com into your browser, you can be led directly to the rogue site which may use an exact replica of your site's logos, etc. You can search for examples of exploits using this method, and evidently the attack scenario described in the article would make use of this method.

How to prevent? We like to trust our DNS servers, but some people take preventative measures against pharming by using their firewall as a filter.

This is accomplished by putting the IP addresses of your sites where you transact business into a Custom Address Group, such as:

​

Since these are usually secure sites - https via port 443 - you can create a rule to permit connection only to those addresses in your custom address group:

​

Now, if you type your_bank.com into the browser and it is redirected to a different IP address, your firewall will alert:

​

One person I know has a rule as above which includes *any* port, to take care of a redirect to a port other than port 443. Before going to a financial site, she opens a fresh instance of the browser, invokes that firewall rule, then navigates to the site using a bookmark. When finished, she closes the browser, clears the cache, then reverts back to the normal firewall rule.

Overly cautious? Perhaps, but part of security is keeping one's peace of mind.

There may be other ways of dealing with pharming that someone would like to mention.

EDIT: On another forum it was brought out that Man In the Middle Attacks at WiFi hotspots presents a problem different from that of classic pharming. For one example, see:

http://en.wikipedia.org/wiki/Evil_twin_(wireless_networks)

----
rich

 

Rich,

once again, thanks for sharing your knowledge.

 

Yes, very nice.

 

Can u tell about SHA and RIPEMED regarding the securityas MD5 is insecure.

 

Thanks, HURST and aigle for your comments.

The article HURST posted has been added to the Notes in the wiki article on MD5:

http://en.wikipedia.org/wiki/MD5

The Versign response indicated that the researchers did not notify Verisign, one of the Certification Authorities, before their presentation.

Verisign's comment:

________________________________________________________________________________________________​

You can start here for some background on SHA and then search for other articles:

http://en.wikipedia.org/wiki/SHA1


----
rich