Big Business' SSL Problem

BURLINGAME, Calif. -- Secure browsing has taken another major hit, this time from a security outfit called PhoneFactor located in Overland Park, Kan.

PhoneFactor researcher Marsh Ray and chief technologist Steve Dispensa have devised a way to inject malicious code into secure data streams using a man-in-the-middle attack that positions the assailant between a data stream's source and its target. It exploits a fundamental weakness in the Secure Sockets Layer, or SSL, protocol that puts the "s" in the "https://" that appears before secure Web URLs.

The trick allows an attacker to inject data into an encrypted traffic stream, but does not allow the attacker to see the unencrypted contents of that traffic. So, rather than opening doors for an attacker, it's more like allowing someone to follow another person into a room.

PhoneFactor says it discovered the flaw in August, but the word spread after another researcher independently discovered the issue and posted it to a public mailing list. Now industry heavyweights like VeriSign ( VRSN - news - people ) are scrambling to fix the flaw.

The good news, says VeriSign SSL expert Tim Callan, is that this is a problem for companies, not consumers. "We don't believe this is something that the public at large needs to be worried about," Callan says. "The people who need to be cognizant of this are the ones running big Web sites."

More good news: It's patchable. Companies like Microsoft ( MSFT - news - people ) are constantly working on patches to fix vulnerabilities, and this particular bug will likely be stomped out soon. Immediate solutions are available but likely need to be tested before they get deployed.

While independent security researchers like Moxie Marlinspike have called the Internet's trust systems into question, this flaw is very specific. Businesses running large Web sites have good cause to be concerned, but Callan says regular Internet users don't need to panic.

"It's not an attack that is ever directed as an end consumer. It's not an attack that steals your credit card or bank login," Callan says. "It's essentially the equivalent of another network security hole."