Featured Research

from universities, journals, and other organizations

Low-cost System System Thwarts Internet Eavesdropping

Date:
August 26, 2008
Source:
Carnegie Mellon University
Summary:
The growth of shared Wi-Fi and other wireless computer networks has increased the risk of eavesdropping on Internet communications, but researchers at Carnegie Mellon University's School of Computer Science and College of Engineering have devised a low-cost system that can thwart these "Man-in-the-Middle" attacks.

The growth of shared Wi-Fi and other wireless computer networks has increased the risk of eavesdropping on Internet communications, but researchers at Carnegie Mellon University's School of Computer Science and College of Engineering have devised a low-cost system that can thwart these "Man-in-the-Middle" (MitM) attacks.

Related Articles


The system, called Perspectives, also can protect against attacks related to a recently disclosed software flaw in the Domain Name System (DNS), the Internet phone book used to route messages between computers.

The researchers — David Andersen, assistant professor of computer science, Adrian Perrig, associate professor of electrical and computer engineering and public policy, and Dan Wendlandt, a Ph.D. student in computer science — have incorporated Perspectives into an extension for the popular Mozilla Firefox v3 browser than can be downloaded free of charge at http://www.cs.cmu.edu/~perspectives/firefox.html.

Perspectives employs a set of friendly sites, or "notaries," that can aid in authenticating Web sites for financial services, online retailers and other transactions requiring secure communications. By independently querying the desired target site, the notaries can check whether each is receiving the same authentication information, called a digital certificate, in response. If one or more notaries report authentication information that is different than that received by the browser or other notaries, a computer user would have reason to suspect that an attacker has compromised the connection.

Certificate authorities, such as VeriSign, Comodo and GoDaddy, already help authenticate Web sites and reduce the risk of MitM attacks. The Perspectives system provides an extra measure of security in those cases but will be especially useful for the growing number of sites that do not use certificate authorities and instead use less expensive "self-signed" certificates.

"When Firefox users click on a Web site that uses a self-signed certificate, they get a security error message that leaves many people bewildered," Andersen said. Once Perspectives has been installed in the browser, however, it can automatically override the security error page without disturbing the user if the site appears legitimate.

The system also can detect if one of the certificate authorities may have been tricked into authenticating a bogus Web site and warn the Firefox user that the site is suspicious. "Perspectives provides an additional level of safety to browse the Internet," Perrig said. "To the security conscious user, that is a significant comfort."

Andersen said the increased use of wireless connections to the Internet has increased the risk of MitM attacks. These occur when an attacker tricks a computer user into believing that the user has established a secure link with a target site, such as a bank. In actuality, the computer user is communicating with the attacker's computer, which can eavesdrop as it relays communications between the user and the target site.

"It's very, very, very easy for someone to convince you to go through their computer" when making connections through public Wi-Fi, Andersen said. A user who thinks he is linked to an airport or coffee shop "hot spot," for instance, might actually be linked to a laptop of someone just a few seats away. "A lot of people wouldn't even know they've been attacked," he added.

Most Internet communications, such as to standard hypertext transfer protocol (HTTP) sites, are unsecured, but those involving encryption over a secured socket layer (SSL) and those using secure shell (SSH) protocol, which involves the use of a login and password, require that sites authenticate themselves with a digital certificate containing a so-called public key, which is used for encryption.

The exchange of this security information typically occurs without the computer user being aware of it. But when something isn't quite right, a dialogue box such as "Unable to verify the identity of XYZ.com as a trusted site" is displayed by the Web browser.

"Most users don't have a clue about what to do in those cases," Wendlandt said. "A lot of them just shrug and go ahead with the connection, potentially opening themselves up to attack."

A vulnerability disclosed in July in the DNS software poses a different problem for computer users, but one that also is addressed by Perspectives. The software flaw could enable an attack against an Internet Service Provider (ISP) that would cause the ISP to connect users with a malicious site instead of the legitimate site they were seeking. "With Perspectives, even if a client's ISP has fallen victim to the attack, the client will be able to detect that the public key received from the fake site is inconsistent with the results returned from the notaries," Wendlandt said.

Andersen, Perrig and Wendlandt have launched their own publicly available network of notary sites. They anticipate that ISPs, universities and large companies will eventually sponsor additional notary sites, in the same way that they voluntarily provide time servers and network diagnosis sites. More information is available at http://www.cs.cmu.edu/~perspectives/

This work was supported in part by Carnegie Mellon's CyLab under grants from the Army Research Office and the National Science Foundation, as well as by the Department of Homeland Security.


Story Source:

The above story is based on materials provided by Carnegie Mellon University. Note: Materials may be edited for content and length.


Cite This Page:

Carnegie Mellon University. "Low-cost System System Thwarts Internet Eavesdropping." ScienceDaily. ScienceDaily, 26 August 2008. <www.sciencedaily.com/releases/2008/08/080825103525.htm>.
Carnegie Mellon University. (2008, August 26). Low-cost System System Thwarts Internet Eavesdropping. ScienceDaily. Retrieved December 19, 2014 from www.sciencedaily.com/releases/2008/08/080825103525.htm
Carnegie Mellon University. "Low-cost System System Thwarts Internet Eavesdropping." ScienceDaily. www.sciencedaily.com/releases/2008/08/080825103525.htm (accessed December 19, 2014).

Share This


More From ScienceDaily



More Computers & Math News

Friday, December 19, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

Navy Unveils Robot Fish

Navy Unveils Robot Fish

Reuters - Light News Video Online (Dec. 18, 2014) The U.S. Navy unveils an underwater device that mimics the movement of a fish. Tara Cleary reports. Video provided by Reuters
Powered by NewsLook.com
How 2014 Shaped The Future Of The Internet

How 2014 Shaped The Future Of The Internet

Newsy (Dec. 18, 2014) It has been a long, busy year for Net Neutrality. The stage is set for an expected landmark FCC decision sometime in 2015. Video provided by Newsy
Powered by NewsLook.com
White House: Sony Hack a 'serious National Security Matter'

White House: Sony Hack a 'serious National Security Matter'

AFP (Dec. 18, 2014) White House spokesperson Josh Earnest says cyber attacks that ultimately prompted Sony Pictures to scrap the release of a madcap comedy about North Korea are a "serious national security matter." Duration: 00:35 Video provided by AFP
Powered by NewsLook.com
Google Maps Lets You Tour Street View in Virtual Reality

Google Maps Lets You Tour Street View in Virtual Reality

Buzz60 (Dec. 18, 2014) Google Maps now lets Android users see cities on Street View in virtual reality with the special Cardboard feature. Sean Dowling (@Seandowlingtv) has the details. Video provided by Buzz60
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:

Strange & Offbeat Stories


Space & Time

Matter & Energy

Computers & Math

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins