Securing SSL Certificate Verification through Dynamic Linking Adam Bates Joe Pletcher Tyler Nichols CISE Dept. CIS Dept. CIS Dept. University of Florida University of Oregon University of Oregon Gainesville, FL Eugene, OR Eugene, OR adammbates@ufl.edu [email protected] [email protected] Braden Hollembaek Dave Tian Kevin R. B. Butler iSEC Partners CISE Dept. CISE Dept. Seattle, WA University of Florida University of Florida [email protected] Gainesville, FL Gainesville, FL [email protected]fl.edu butler@ufl.edu ABSTRACT 1. INTRODUCTION Recent discoveries of widespread vulnerabilities in the SSL- Internet applications have relied for years on the SSL/TLS /TLS protocol stack, particular with regard to the verifica- libraries for secure end-to-end channels, but a growing body tion of server certificates, has left the security of the In- of literature points to systemic lapses in security procedure ternet's communications in doubt. Newly proposed SSL that renders our communications insecure. The heart of trust enhancements address many of these vulnerabilities, these problems lies with the inability for clients to accurately but are slow to be deployed and do not solve the prob- authenticate the server when presented with its public-key lem of securing existing software. In this work, we pro- certificate. Certificate validation has been shown to be in- vide new mechanisms that offer immediate solutions to ad- correct at all layers of the SSL stack, from improper certifi- dressing vulnerabilities in legacy code. We introduce Cert- cate handling in libraries [7, 29], to confusion and abuse of Shim, a lightweight retrofit to SSL implementations that SSL APIs [19, 43], to applications that are broken by design protects against SSL vulnerabilities, including those sur- so that they are easier to use [17]. Moreover, high pro- veyed by Georgiev et. al. [19], in a manner that is trans- file compromises of prominent Certificate Authorities (CAs) parent to the application. We demonstrate CertShim's ex- have eroded the very foundations of the SSL trust model tensibility by adapting it to work with Convergence, DANE, [12, 18, 32]. Any one of these lapses gives rise to the threat and Client-Based Key Pinning. CertShim imposes just 20 of a Man-in-the-Middle (MitM) attack, in which an attacker ms overhead for an SSL verification call, and hooks the SSL is able to intercept and read supposedly-secure SSL traffic dependencies of 94% of Ubuntu's most popular packages in transit to or from a target website. with no changes necessary to existing applications. This While a variety of forward-thinking solutions have been work significantly increases system-wide security of SSL com- proposed in the literature [10], less attention has been paid munications in non-browser software, while simultaneously to immediate countermeasures, and ways in which we can reducing the barriers to evaluating and adopting the myriad fix the vast amount of legacy software that is vulnerable and alternative proposals to the certificate authority system. inexorably linked to the CA model. Detecting and report- ing these vulnerabilities is an inadequate solution; studies of Categories and Subject Descriptors Android SSL usage have found that up to 76% of vulnera- bilities persist for over a year [43], even once the developers C.2.0. [Computer-Communication Networks]: Gen- have been notified of confirmed vulnerabilities [17]. In the eral | Security and protection presence of aloof and unavailable developers, we must pursue alternate means of securing our Internet communications. Keywords In this paper, we consider a system-wide approach to SSL, TLS, HTTPS, public-key certificates securing negligent SSL code in non-browser software that simultaneously facilitates the immediate use of CA alter- natives and other SSL trust enhancements. We present Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed CertShim, a lightweight retrofit to existing popular SSL im- for profit or commercial advantage and that copies bear this notice and the full cita- plementations (OpenSSL, GnuTLS, and partial support for 1 tion on the first page. Copyrights for components of this work owned by others than JSSE) that acts as a shim into the validation procedure in ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re- dynamically linked applications. CertShim provides appli- publish, to post on servers or to redistribute to lists, requires prior specific permission cation and domain specific handlers that force correct cer- and/or a fee. Request permissions from [email protected]. CCS’14, November 3–7, 2014, Scottsdale, Arizona, USA. 1 Copyright 2014 ACM ACM 978-1-4503-2957-6/14/11 ...$15.00. A shim is a library that transparently intercepts an API http://dx.doi.org/10.1145/2660267.2660338. and changes its parameters or operations. tificate validation on previously insecure applications. We present the design and implementation of CertShim, ana- demonstrate its practicality by incorporating a variety of lyze its features in Section 4, and evaluate its performance verification techniques including traditional CA validation, as well as coverage of real world SSL usage in Section 5. Convergence [30], DANE [23], and client-side key pinning Limitations of our approach and future work are discussed [14, 31, 37, 42], some of which were previously only avail- in Section 6, and related work is summarized in Section 7. able as experimental browser plug-ins. CertShim reduces In Section 8 we conclude. the barrier to adopting these systems by making them im- mediate candidates for system-wide deployment. 2. BACKGROUND While recent studies have made recommendations for the The SSL/TLS protocol families are largely responsible for general improvement of the SSL ecosystem, few have intro- securing the Internet's web traffic. The original SSL (Secure duced system-wide defenses to SSL vulnerabilities in legacy Socket Layers) protocols were introduced by Netscape in software. Fahl et al. modify the Android API to restrict 1995 to provide confidentiality, integrity, and identity to net- SSL misuse [17], while Conti et al. introduce MYTHIS, work communications [22]. While the foundations of SSL's a benign MitM proxy for Android that is able to defend solutions to confidentiality and integrity have withstood the against rogue access point attacks [11]. In contrast to these test of time, reliably establishing destination identity in SSL works, our platform-wide defense does not require a manu- connections has proven to be a surprisingly difficult prob- facturer update, or even administrator privileges, to be put lem. Without identity assurances, users are vulnerable to to use. We also deliver on the promise of pluggable certifi- the threat of impersonation or Man-in-the-Middle (MitM) cate verification that is left to future work by Fahl et al., attacks, in which an attacker is able to intercept and read and go a step further by showing that additional security supposedly-secure SSL traffic bound to or from a target assurances can be attained by layering multiple verification website. We still rely on Netscape's original solution, the modules. works in desktop and server environ- CertShim Certificate Authority (CA) public key infrastructure, which ments, which are considerably more complex than Android, requires that domains register with one or more CAs in ex- as various SSL implementations need be considered. Fur- change for a signed X.509 certificate. A client can then thermore, the solutions for Android experience compatibil- authenticate the server validating its certificate by using the ity issues with some programs; in contrast, we present a issuing CA's public key; obtaining this public key is a trans- policy engine that provides application- and domain-specific parent process to the client, as it is likely pre-installed into certificate handling. their operating system or web browser. We make the following contributions: Development Vulnerabilities. Good SSL code, par- • Enforce Safe Defaults on SSL: CertShim hooks ticularly with regards to certificate verification, is very dif- calls to SSL APIs in order to enforce hostname valida- ficult to correctly implement. Numerous MitM vulnerabili- tion and certificate validation. As this behavior would ties have been discovered in certificate chain validation rou- otherwise break applications that pin certificates or tines, such as null prefix attacks on Pascal strings [28, 29]. connect to domains that use self-signed certificates, we Georgiev et al's survey of SSL connection authentication ex- present a policy engine that enforces safe defaults but posed pervasive misunderstanding of certificate verification provides unique handlers based on the application and in SSL API's in non-browser software, and also drew at- destination domain. tention to many popular SSL libraries that are broken by design [19]. Fahl et al. interviewed developers to find that • Enable CA Alternatives: Existing open source ini- apps were often intentionally broken so as to allow for eas- tiatives may be slow to adopt alternative SSL trust ier development, or to support self-signed certificates [17]. models, may intentionally choose to stay with the sta- Even worse, the tomes of vulnerable SSL code that exist tus quo of certificate authorities, or may simply have today that are unlikely to ever be patched. Studies of SSL gone defunct. CertShim provides modular retrofits vulnerabilities in Android apps have found that up to 76% of that allow existing applications to use modern CA al- vulnerabilities persist for over a year [43], even once the de- ternatives. CertShim provides a means of taking the velopers have been notified of confirmed vulnerabilities [17]. consensus of multiple forms of certificate validation, Even more surprisingly, Brubaker et al. perform automated which to our knowledge is the first of its kind in the testing to uncover dramatic inconsistencies in the validation literature, allowing even stronger guarantees through routines of the major SSL libraries, some of which gave rise ensemble validation.