Research teams at Ca\u2019 Foscari University of Venice and Tu Wien in Austria have discovered security vulnerabilities in the TLS browser encryption defence system of 5.5% of 10,000 HTTPS sites which could leave website visitors vulnerable to attack.<\/p>\n\n\n\n
What Is TLS?<\/strong><\/p>\n\n\n\n Transport Layer Security (TLS) is one of the two security protocols (the other is SSL) used in HTTPS to encrypt the data between your browser and the web servers it communicates with. The visual symbol on a browser that this secure connection is place is a green padlock symbol.<\/p>\n\n\n\n HTTPS should secure communication over the Web by providing a cryptographic protection layer that protects the confidentiality and integrity of communication and enables client\/server authentication. <\/p>\n\n\n\n The Research<\/strong><\/p>\n\n\n\n The recent research carried out on top ranking HTTPs sites (ranked by Amazon\u2019s Alexa analytics company) uncovered a number of potentially exploitable TLS vulnerabilities in 5,574 hosts that could be broadly grouped into 3 risk categories:<\/p>\n\n\n\n More detail of the vulnerabilities identified include:<\/p>\n\n\n\n Green Padlock Still Showing<\/strong><\/p>\n\n\n\n The vulnerabilities identified by the researchers were present even though the green padlock symbol was still showing on the browser. This indicates that the vulnerabilities are not fixed, not even noticed by the browser\u2019s defence layer, and are not pointed out on the user side<\/p>\n\n\n\n The Causes<\/strong><\/p>\n\n\n\n The vulnerabilities are thought to be caused by a combination of issues in how each site\u2019s TLS encryption schemes have been implemented and a failure to patch any known bugs. Most of the issues are, therefore, due to external or related-domain hosts.<\/p>\n\n\n\n What Does This Mean For Your Business?<\/strong><\/p>\n\n\n\n For many businesses, buying a HTTPS certificate for their website was a trusted way to help ensure security, particularly with the introduction of GDPR. This research, however, shows that even this system has holes in it, and it is particularly worrying for businesses (and as general web users) that, for example, 898 HTTPS websites were found to be fully compromisable. <\/p>\n\n\n\n The researchers have demonstrated how a relatively limited number of exploitable HTTPS vulnerabilities can be amplified by the complexity of the web ecosystem, and how the security of many so-called secure websites with encrypted connections can be severely harmed by cryptographic weaknesses, many of which are due to external or related-domain hosts.<\/p>\n\n\n\n This story also highlights the importance of keeping up to date with software patches and fixes.<\/p>\n","protected":false},"excerpt":{"rendered":" Research teams at Ca\u2019 Foscari University of Venice and Tu Wien in Austria have discovered security vulnerabilities in the TLS browser encryption defence system of 5.5% of 10,000 HTTPS sites which could leave website visitors vulnerable to attack. What Is TLS? Transport Layer Security (TLS) is one of the two security protocols (the other is SSL) […]<\/p>\n","protected":false},"author":1,"featured_media":1101,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1583","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general"],"yoast_head":"\n