Keys left unchanged in many Heartbleed replacement certificates!

Although many secure websites reacted promptly to the Heartbleed bug by patching OpenSSL, replacing their SSL certificates, and revoking the old certificates, some have made the critical mistake of reusing the potentially-compromised private key in the new certificate. Since the Heartbleed bug was announced on 7 April, more than 30,000 affected certificates have been revoked and reissued without changing the private key.

Internet users rely on public key cryptography to verify the identity of secure websites: SSL certificates contain a public key that is generated from its associated private key. At the start of the secure connection, the server proves that it has the private key by decrypting messages encrypted with the public key, or by cryptographically signing its own messages. Keeping the private key secret is critical — if an attacker steals the private key, he can impersonate the secure website, decrypt sensitive information, or perform a man-in-the-middle attack.

Although we typically refer to "potentially-compromised" certificates when discussing the Heartbleed bug, the CA/Browser Forum adopts a much more cautious approach to its terminology. This group lays out the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, and they consider a private key to be "compromised" if there exists a practical technique by which an unauthorised person may discover its value — even if there is no evidence of such a technique having been exploited.

By reusing the same private key, a site that was affected by the Heartbleed bug still faces exactly the same risks as the those that have not yet replaced their SSL certificates — if the previous certificate had been compromised, then the stolen private key can still be used to impersonate the website's new SSL certificate, even if the old certificate has been revoked. Certificates that have been reissued with the same private key are easy to identify, as the new public key will also be identical to the old one.

Only 14% of affected websites (Zone A in the above Euler diagram) have done all three required steps after patching the Heartbleed bug – they have replaced their SSL certificates, revoked the old ones, and made sure to use a different private key. This zone also includes sites with certificates that expired shortly after the bug was disclosed.

Zone B represents the 5% of sites that have made the fundamental mistake of reissuing their certificates without changing the private key. This is the most dangerous zone, as not only could these websites still be vulnerable to impersonation attacks, but the website administrators will probably believe that they have done everything necessary to fix the problem. An additional 2% have reused the same private key and not revoked the old SSL certificate.

The white outer zone represents nearly 57% of the affected sites which have taken no action whatsoever — they have neither reissued nor revoked their certificates. A further 21% have reissued their certificates with a new private key, but failed to revoke the old ones.

The Canadian government ought to appreciate the risks posed by the Heartbleed bug more than others, particularly after the bug was exploited to steal social insurance numbers from the Canadian Revenue Agency. However, some parts of the Canadian government have made the mistake of reusing private keys while trying to mitigate the risks.

The Quebec Automobile Insurance Corporation is a crown corporation responsible for licensing drivers and providing personal injury insurance to the public. One of its websites at secure.saaq.gouv.qc.ca was issued a new SSL certificate in response to the Heartbleed bug, and the previous certificate was revoked on 29 April. The CRL revocation status listed the reason as "keyCompromise", but the issuing certificate authority nonetheless allowed the new certificate to be signed with the same private key. This means the new certificate can also be impersonated by anyone who is in possession of the compromised key.

This type of mistake could be prevented by certificate authorities: if public keys from revoked certificates were blacklisted, new requests with the same public key would be rejected. This type of automated check does not seem to be in use by most CAs; however, Netcraft's Site Reports and browser extensions can be used to determine whether a website has signed its replacement certificate with the same private key:

May 2014 Web Server Survey

In the May 2014 survey we received responses from 975,262,468 sites — 16 million more than last month.

Microsoft threatening Apache's market lead

Microsoft gained nine million additional sites this month, increasing its market share by a further 0.37 percentage points. Meanwhile, despite gaining 4.3 million sites, Apache's market share fell by 0.18 points. Although Apache still leads with 37.6% of all sites, Microsoft is now just 4.1 percentage points behind. Apache has been the most commonly used web server for more than 18 years, but this is the closest Microsoft has ever been to threatening this position.

Apache's position is much stronger when considering only Active Sites — it retains an absolute majority of 52.3%, and second place is held by nginx (14.4%), rather than Microsoft (11.3%). By excluding much of the automatically-generated content present on the internet, the Active Sites metric better reflects web server market share amongst human-maintained web sites.

New releases of nginx

The total number of websites using nginx fell by 3.7 million this month; however, the losses were mostly isolated to just a few hosting companies. Nearly two million nginx sites disappeared at cloud hosting company Enzu, followed by 1.2 million at BurstNet. Within the top million sites, however, nginx was the only web server to grow — Microsoft, Apache, and Google all lost market share.

A new stable version of nginx was released on April 24. nginx 1.6.0 features SPDY 3.1 support and various SSL improvements that were originally implemented in the 1.5.x mainline branch of releases. The previous mainline branch has also been superseded by nginx 1.7.0, which added support for backend SSL certificate verification and support for SNI while working with SSL backends.

Seven million new sites using Microsoft IIS

Nearly seven million of this month's new websites are using Microsoft IIS. Around 11 thousand of these new sites are hosted on the Microsoft Azure platform (including a few phishing sites), helping to maintain Microsoft's position as the largest Windows hosting company in terms on web-facing computers. Most of the new IIS sites at Azure are hosted in the US, with more than a third of the total being hosted in the North Central US Azure region alone.

Notably, www.apachelounge.com is one of this month's websites which appears to have switched to Microsoft IIS. The Apache Lounge is a web forum primarily focused on running Apache in Windows environments, and has provided Windows Apache binaries for more than 10 years. The site understandably has a long history of being hosted from an Apache web server, most recently on a Windows Server 2008 platform, but is now using Microsoft IIS 8.5 on Windows Server 2012.

All may not be as it seems, however, as the web server is still sending an X-Powered-By: Apache/2.4.9 (Win64) header. The web server is also reporting X-Powered-By: ARR/2.5, indicating the use of IIS's load-balancing features. It is likely that Apache Lounge is powered by multiple Apache instances which are hidden behind a Microsoft IIS load balancer.

New gTLDs showing promising growth

Several more new generic top-level domains have shown rapid growth in this month's survey. The .berlin gTLD, which was used by only two websites in last month's survey, is now used by 40,000 websites. The domain started its sunrise registration period on February 14, when trademark owners were able to register .berlin domains ahead of the March 16 deadline.

German news magazine Der Spiegel – one of Europe's largest publications of its kind – criticised the availability of .berlin and other new top-level domains, likening them to a housing bubble and suggesting that such domain names are a waste of money. The company behind the .berlin domain, dotBERLIN GmbH & Co. KG, was quick to reply pointing out that not only had Der Spiegel applied for its own gTLD (.spiegel) two years ago, but it had also already registered the domain name spiegel.berlin before its own article was published.

The .email gTLD is another one that has been thriving since the closure of its sunrise period: More than 12 thousand websites are now using .email, compared with only two last month. This gTLD is one of many operated by Donuts Inc, and became generally available on March 19.  Donuts applied to ICANN for more than 300 TLDs in 2012, 65 of which are already generally available for registration, including .support, .domains, .photos, .estate, .guru and .plumbing. A further 66 TLDs are scheduled for general availability between now and September, including .expert, .parts, .media, .toys, .wtf and .fail.





DeveloperApril 2014PercentMay 2014PercentChange
Apache361,853,00337.74%366,262,34637.56%-0.18
Microsoft316,843,69533.04%325,854,05433.41%0.37
nginx146,204,06715.25%142,426,53814.60%-0.64
Google20,983,3102.19%20,685,1652.12%-0.07
Continue reading

Thai Government websites infested with malware

Nearly 100 Thai Government websites were hacked and used to serve malware last month. More than 500 distinct attacks were launched from these websites, representing about 85% of all government-hosted malware in the world.

Seven of the hacked sites belong to Thai police forces, such as the Narathiwat Provincial Police website at narathiwat.police.go.th, where hackers have appended a large chunk of malicious VBScript to the page shown below. This script attempts to write malware from a hexadecimal string to a file named svchost.exe on the local file system, and then tries to automatically run the malware contained within the freshly planted executable file.

This page on the Narathiwat Provincial Police website exposes visitors to drive-by malware.

The filename used in this attack has been deliberately chosen to make it look as though the malware is a legitimate Windows component when it appears in a list of running processes. The genuine svchost.exe file, which normally resides in the Windows\System32 folder, is used as a generic host process name for services that run from DLL files.

Part of the malign VBScript appended to the bottom of the HTML document.

Thai military websites were also compromised during April. For example, the Thai Navy website at www.navy.mi.th was involved in a phishing attack which targeted VISA cardholders last week. A page surreptitiously planted on the Navy's server was used to redirect victims to a different website hosted in Malaysia, which attempted to steal card details. The Malaysian website has since been taken down, but the redirection page on the Thai Navy website is still present today:

$ curl -D - http://www.navy.mi.th/namo/libraries/fr/
HTTP/1.1 302 Found
Date: Tue, 06 May 2014 08:58:06 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Location: http://eproductdesign.com/plugins/ok.php?[...]
Content-Length: 0
Connection: close
Content-Type: text/html; charset=TIS-620

All of the hacked Thai Government websites use the .go.th second-level domain, which is eligible to be registered only by government entities in Thailand. The .th top-level domain is administered by T.H.NIC Co.,Ltd. (THNIC), which provides its domain registration services under a policy managed by the Thai Network Information Center Foundation, and allows domain names to be purchased through THNIC Authorized Resellers.

.th is also the fourth phishiest top-level domain. Netcraft currently blocks 310 phishing sites under this TLD, which is rather significant given that there are fewer than 100,000 .th sites in total.

Government sites typically confer a greater level of trust than other types of websites can, but in Thailand, many are evidently used to host phishing sites and conduct drive-by malware attacks. Cleaning up these attacks is unlikely to be Thailand's number one priority at the moment — the country has been in a state of paralysis since government elections were obstructed by protesters, and last month, there were concerns that the situation could escalate into civil war.

Chinese government websites (.gov.cn) hosted the second largest number of instances of malware last month, accounting for more than a tenth of all government-hosted malware. Between them, Thailand and China alone hosted 95% of all government-hosted malware during April. For comparison, during the same month, no malware attacks were reported on US or UK government websites (.gov and .gov.uk).

SHA-2: Very cryptographic. So secure. Such growth. Wow.

Use of the SHA-2 cryptographic signature algorithm has received a significant boost in the wake of the Heartbleed Bug.

More than half a million SSL certificates were potentially compromised as a result of the Heartbleed vulnerability — affected certificates require urgent re-issuance and revocation. The good news is that many of the new certificates have been signed with the SHA-2 algorithm instead of the less secure SHA-1 algorithm, which has helped the total number of certificates signed with SHA-2 increase by more than 50% over the past month.

Practical attacks against the SHA-1 algorithm are now within reach of government agencies, giving them the opportunity to construct a pair of different SSL certificates with the same SHA-1 digest. Ultimately, this could enable an attacker to impersonate secure websites using a variant of the attack that worked against MD5 in 2008. This attack is, however, made more difficult by path constraints and the inclusion of unpredictable data into the certificate before signing it.

Even before the Heartbleed bug was announced, the migration to SHA-2 was inevitable, if not rapid. The long-term shift to SHA-2 is being fuelled by Microsoft's SHA-1 deprecation policy: Windows will stop accepting certificates signed using SHA-1 from 2017. It is in the interest of certificate authorities to begin the migration as soon as possible, otherwise long-term certificates could become useless partway through their lifetime.

In response to the potential dangers, the National Institute of Standards and Technology (NIST) issued a special publication which disallowed the use of SHA-1 after December 2013. Embarrassingly, NIST ignored its own recommendation and deployed a SHA-1 certificate on its own secure website at www.nist.gov in January 2014.

NIST was not alone in being slow to heed its recommendations: more than 92% of all SSL certificates issued in January were signed with SHA-1. However, the number of certificates using SHA-1 has noticeably declined in the past couple of months. This shift has undoubtedly been assisted by the publication of the Heartbleed Bug, prompting website administrators to deploy new SSL certificates long before their existing certificates were due to expire.

Nearly 200,000 valid third-party certificates are now signed with SHA-2. Despite showing impressive growth, certificates signed with SHA-2 account for 6.6% of all valid third-party certificates currently in use on the web; but this is still a significant jump from last month's share of 4.3%, and is likely to continue at a strong rate.

SHA-1 vs. SHA-2 (May 2014)

The latest version of the CA/Browser Forum's Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates [PDF] states that SHA-1 may still be used in subscriber certificates until SHA-256 (part of the SHA-2 family) is supported by a substantial portion of relying-parties worldwide. Arguably, this time has long passed — even Windows XP, which is no longer supported by Microsoft, has been able to accept certificates signed with SHA-256, SHA-384 and SHA-512 since the release of Service Pack 3 in 2008.

Most Reliable Hosting Company Sites in April 2014

Rank Performance Graph OS Outage
hh:mm:ss
Failed
Req%
DNS Connect First
byte
Total
1 Qube Managed Services Linux 0:00:00 0.004 0.105 0.036 0.074 0.074
2 Host Europe Linux 0:00:00 0.012 0.110 0.072 0.149 0.150
3 XILO Communications Ltd. Linux 0:00:00 0.015 0.202 0.066 0.131 0.226
4 Netcetera Windows Server 2012 0:00:00 0.015 0.065 0.071 0.157 0.295
5 New York Internet FreeBSD 0:00:00 0.015 0.145 0.071 0.148 0.555
6 ServerStack Linux 0:00:00 0.015 0.079 0.074 0.146 0.146
7 Datapipe FreeBSD 0:00:00 0.019 0.102 0.018 0.037 0.054
8 Swishmail FreeBSD 0:00:00 0.019 0.127 0.070 0.141 0.186
9 Logicworks Linux 0:00:00 0.019 0.149 0.071 0.148 0.299
10 Webzilla FreeBSD 0:00:00 0.023 0.127 0.071 0.140 0.355

See full table

Qube had the most reliable hosting company site in April, with only one failed request. The London-based managed hosting provider uses data centres in the UK, USA and Switzerland, all of which are ISO 27001 certified. This information security management system standard uses a three-stage external audit process to ensure the company has suitable security policies and risk treatment plans.

Qube (which stands for "Qualified By Experience") has performed rather well so far this year — it also had the most reliable hosting company site in February (with no failed requests), narrowly missed out on first place in January, and made 4th place in March. Qube provides a Virtual Data Centre cloud computing service powered by VMware vCloud, managed dedicated servers, and managed colocation in its Tier 3 central London data centre.

Host Europe had the second most reliable hosting company site in April, with three isolated failed requests from Netcraft's globally distributed performance collectors. The company has attained 100% uptime over the past six months, and 99.98% uptime over 12 months. The Host Europe Group also owns the largest domain name provider in the UK, 123-reg, which recently teamed up with Knowhow to offer domain and website building packages from Currys and PC World stores.

XILO Communications came third in April, with four failed requests. Its uptime over the past 12 months is an impressive 99.993%. Netcetera, New York Internet, and ServerStack also had only four failed requests, but with longer average connection times than XILO.

Half of April's top ten hosting company websites were served from Linux machines, including all of the top three. Four of the other sites used FreeBSD, and one used Windows Server 2012.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

Phishers find Microsoft Azure 30-day trial irresistible!

Fraudsters have taken to Microsoft Azure to deploy phishing sites, taking advantage of Microsoft's free 30-day trial.

Free hosting!

In order to get a phishing site hosted at Azure, the fraudster has several options: steal the credentials for a Microsoft account, compromise a virtual machine running at Azure, or use Microsoft’s free trial which provides $200 of credit. Given the number of subdomains registered explicitly for phishing, it is unlikely that many fraudsters are exploiting legitimate customers’ virtual machines.

Free subdomains!

Microsoft Azure offers free subdomains to users: azurewebsites.net for its Azure Web Sites service and cloudapp.net for Cloud Apps and virtual machines. Almost twice as many phishing sites used azurewebsites.net rather than cloudapp.net, perhaps reflecting the ease-of-use of Azure Web Sites. The remainder of the phishing sites are accessed using their IP addresses or custom domains.

An Apple phishing site on itune-billing2update-ssl-apple.azurewebsites.net (Site Report).

Many of the subdomains are clearly registered with the intention of phishing; the table below includes some of the most egregious examples targeting well-known institutions.

SubdomainTarget
itune-billing2update-ssl-apple.azurewebsites.netApple
paypalscurity.azurewebsites.netPayPal
www22online-americanexpress.azurewebsites.netAmerican Express
3seb-verifiedbyvisa.azurewebsites.netVisa
login-comcastforceauthn.azurewebsites.netComcast
cielo-2014.cloudapp.netCielo

Free SSL certificate!

Microsoft Azure Web Sites also offers fraudsters the ability to use an SSL certificate. All subdomains of azurewebsites.net are automatically accessible via HTTPS using a *.azurewebsites.net SSL certificate. The Apple phishing site featured below includes mixed content, indicating it was probably not designed with SSL in mind despite its subdomain: itune-billing2update-ssl-apple. Phishing sites that make proper use of the wildcard SSL certificate may be able to instil more trust than those that do not.

An SSL certificate on itune-billing2update-ssl-apple.azurewebsites.net (Site Report).

SSL certificate is irrevocable!

The Baseline Requirements that forms part of Mozilla's CA policy suggests that the SSL certificate must be revoked within 24 hours: "The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs: [..] [t]he CA is made aware that a Wildcard Certificate has been used to authenticate a fraudulently misleading subordinate Fully-Qualified Domain Name". However, Microsoft itself issued the SSL certificate from its sub-CA of Verizon Business and has chosen not to revoke it. Moreover, the SSL certificate does not include an OCSP responder URL and is not served with a stapled response (which is also in violation of the Baseline Requirements) and consequently the SSL certificate is irrevocable in some major browsers, particularly Firefox.

Free email addresses!

Fraudsters are also using Microsoft-provided free email addresses (at live.com, hotmail.com, and outlook.com) to receive and store stolen phishing credentials. Fraudsters commonly use phishing kits to quickly deploy phishing sites — before deployment, the fraudster configures the phishing kit with his email address. If a victim is tricked by the phishing site into providing his credentials, they are sent back to the fraudster's email address.

Free anonymising proxy!

One fraudster used Azure to proxy his internet traffic when accessing the phishing site, but was exposed when he used the same email address in the phishing kit as he used on his Facebook profile. The fraudster left the log file that records visits to the phishing site accessible to the public. The first two entries in the log, which preceded all other accesses by several hours, were from Microsoft Azure IP addresses. It is likely these correspond to the fraudster checking his phishing site was ready to be sent out to would-be victims.

1  137.117.104.222  -  2014-3-27 @ 02:56:03
2  137.117.104.222  -  2014-3-27 @ 02:57:16
3  109.XXXXXXXXX  -  2014-3-27 @ 11:22:26
4  212.XXXXXXXXX  -  2014-3-27 @ 11:39:47
5  62.XXXXXXXXXXX  -  2014-3-27 @ 11:39:57
6  72.XXXXXXXX  -  2014-3-27 @ 11:40:02
7  64.XXXXXXXXXX  -  2014-3-27 @ 11:40:04
8  37.XXXXXXXXXX  -  2014-3-27 @ 11:40:20
9  194.XXXXXXXXXX  -  2014-3-27 @ 11:47:18
10 194.XXXXXXXXXX  -  2014-3-27 @ 11:47:20
11 89.XXXXXXXXX  -  2014-3-27 @ 11:49:50
12 65.XXXXXXXXXX  -  2014-3-27 @ 11:49:54
13 92.XXXXXXXXX  -  2014-3-27 @ 11:49:56
14 37.XXXXXXXXXX  -  2014-3-27 @ 11:51:20
15 94.XXXXXXXXXX  -  2014-3-27 @ 11:51:24
16 62.XXXXXXXXXXX  -  2014-3-27 @ 11:51:26

The sting

However, Microsoft may yet have a trick up its sleeve: customers must provide a phone number and credit card details in order to register for the trial. Whilst the credit card details could have been stolen in a previous phishing attack, physical access to a phone is required in order to register an account. This may prove to be the fraudsters' downfall — in serious cases, information gathered from the fraudsters mobile phone could be used as evidence subject to the phone company's cooperation and local police involvement.

Netcraft's Domain Registration Risk service can be used to pre-empt fraud by highlighting domains or subdomains that are deceptively similar to legitimate websites run by banks and other institutions that are commonly targeted by fraudsters.