The Mozilla Foundation has released an emergency patch to its Firefox browser which disables a new security feature, following the discovery that it can actually enable man-in-the-middle (MITM) attacks on encrypted connections.
Introduced late last month with the release of Firefox 37, opportunistic encryption is a new feature of the HTTP standard which allows for connections to be encrypted even when HTTPS would not normally be supported. Although not as secure as a true HTTPS connection, as there is no indication of the encryption visible to the user and no authentication that would normally take place on the certificate of a real HTTPS connection, Mozilla positioned the feature as offering improved protection against data loss and a boost in privacy against passive eavesdropping.
Unfortunately, Mozilla's implementation of opportunistic encryption has been found to have the opposite effect, weakening privacy by enabling an attacker to easily perform a man-in-the-middle (MITM) attack against supposedly-secure HTTPS connections. The problem lies with the Alternative Services (Alt-Svc) header introduced in Firefox's new HTTP/2 protocol support: if the header is included in the response from an HTTP/2 compatible server, it's possible to force the connection on to an alternative server for which certificate validation doesn't take place. The result: invalid certificates are accepted without warning, leaving the user none the wiser that their communications have been nobbled.
In a security advisory rating the flaw as critical and citing Muneaki Nishimura as the discoverer of the issue, Mozilla responded by releasing Firefox 37.0.1. Coming just over a week after the opportunistic encryption feature was enabled, it switches it off again until work on the Alt-Svc header can be done to guarantee that certificate validation bypass will no longer be possible.
The new release replaces Firefox 37.0.1 on all platforms, and is being rolled out to users automatically.
Introduced late last month with the release of Firefox 37, opportunistic encryption is a new feature of the HTTP standard which allows for connections to be encrypted even when HTTPS would not normally be supported. Although not as secure as a true HTTPS connection, as there is no indication of the encryption visible to the user and no authentication that would normally take place on the certificate of a real HTTPS connection, Mozilla positioned the feature as offering improved protection against data loss and a boost in privacy against passive eavesdropping.
Unfortunately, Mozilla's implementation of opportunistic encryption has been found to have the opposite effect, weakening privacy by enabling an attacker to easily perform a man-in-the-middle (MITM) attack against supposedly-secure HTTPS connections. The problem lies with the Alternative Services (Alt-Svc) header introduced in Firefox's new HTTP/2 protocol support: if the header is included in the response from an HTTP/2 compatible server, it's possible to force the connection on to an alternative server for which certificate validation doesn't take place. The result: invalid certificates are accepted without warning, leaving the user none the wiser that their communications have been nobbled.
In a security advisory rating the flaw as critical and citing Muneaki Nishimura as the discoverer of the issue, Mozilla responded by releasing Firefox 37.0.1. Coming just over a week after the opportunistic encryption feature was enabled, it switches it off again until work on the Alt-Svc header can be done to guarantee that certificate validation bypass will no longer be possible.
The new release replaces Firefox 37.0.1 on all platforms, and is being rolled out to users automatically.
MSI MPG Velox 100R Chassis Review
October 14 2021 | 15:04
Want to comment? Please log in.