|
MD5 hash vulnerability is expert's top Web security flaw |
|
|
|
Source: Search Security - Posted by Alex
|
One of the infosec industry's top Web security gurus said a hash algorithm flaw, discovered more than a year ago, may well be the most dangerous security flaw on the Web.
During a session at the 2010 RSA Conference, WhiteHat Security chief technology officer Jeremiah Grossman formally presented his list of the top 10 Web hacking techniques of the past year. First revealed on his blog in January, Grossman's fourth-annual list is intended to shed light on obscure but significant exploit research that would otherwise go unnoticed.
At the top of the list was the ability to create a rogue certificate authority, which essentially defeats the Internet's trust infrastructure and makes it difficult for users to know which sites and certificates are trustworthy.
Originally discovered in late 2008 by a team of security researchers, including independent researcher Alex Sotirov, the flaw exploits a weakness in the MD5 hash algorithm that under special circumstances allows a collision attack in the form of a duplicate fake digital fingerprint.
Grossman said MD5 is still used by some CAs, but is being phased out in favor of the more secure SHA-1 hash function, which is not vulnerable.
Read this full article at Search Security
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
