Eliminating eavesdropping

The growth of shared Wi-Fi and other wireless computer networks has increased the risk of eavesdropping on internet communications.

But now, researchers at Carnegie Mellon University's School of Computer Science and College of Engineering have devised a low cost system that can thwart these so-called 'Man-in-the-Middle' (MitM) attacks.

The system, called Perspectives, can also protect against attacks related to a recently disclosed software flaw in the Domain Name System (DNS), the internet phone book used to route messages between computers.
   
The researchers - David Andersen, assistant professor of computer science, Adrian Perrig, associate professor of electrical and computer engineering and public policy, and Dan Wendlandt, a PhD student in computer science - have incorporated Perspectives into an extension for the popular Mozilla Firefox v3 browser.

It can be downloaded free of charge at www.cs.cmu.edu/~perspectives/firefox.html.
   
Perspectives employs a set of friendly sites, or 'notaries' that can aid in authenticating websites for financial services, online retailers and other transactions requiring secure communications. By independently querying the desired target site, the notaries can check whether each is receiving the same authentication information, called a digital certificate, in response. If one or more notaries report authentication information that is different than that received by the browser or other notaries, a computer user would have reason to suspect that an attacker has compromised the connection.
   
Certificate authorities, such as VeriSign, Comodo and GoDaddy, already help authenticate websites and reduce the risk of MitM attacks. The Perspectives system provides an extra layer of security in those cases but will be especially useful for the growing number of sites that do not use certificate authorities and instead use less expensive 'self-signed' certificates.
   
Andersen said: 'When Firefox users click on a website that uses a self-signed certificate, they get a security error message that leaves many people bewildered.' Once Perspectives has been installed in the browser, however, it can automatically override the security error page without disturbing the user if the site appears legitimate.
   
The system can also detect if one of the certificate authorities may have been tricked into authenticating a bogus website and warn the Firefox user that the site is suspicious. Perrig added: 'Perspectives provides an additional level of safety to browse the internet.'

Andersen said the increasing use of wireless connections to the internet has intensified the risk of MitM attacks. These occur when an attacker tricks a computer user into believing that the user has established a secure link with a target site, such as a bank. In actuality, the computer user is communicating with the attacker's computer, which can eavesdrop as it relays communications between the user and the target site.
   
Andersen said: 'It's very easy for someone to convince you to go through their computer when making connections through public Wi-Fi. A user who thinks he is linked to an airport or coffee shop 'hot spot,' for instance, might actually be linked to a laptop of someone just a few seats away. A lot of people wouldn't even know they've been attacked.'
   
Most internet communications, such as to standard hypertext transfer protocol (HTTP) sites, are unsecure, but those involving encryption over a secured socket layer (SSL) and those using secure shell (SSH) protocol, which involves the use of a login and password, require that sites authenticate themselves with a digital certificate containing a so-called public key, which is used for encryption.
   
The exchange of this security information typically occurs without the computer user being aware of it. But when something is not quite right, a dialogue box such as 'Unable to verify the identity of XYZ.com as a trusted site' is displayed by the web browser.
   
Wendlandt said: 'Most users don't have a clue about what to do in those cases. A lot of them just shrug and go ahead with the connection, potentially opening themselves up to attack.'
   
Andersen, Perrig and Wendlandt have launched their own publicly available network of notary sites. They anticipate that ISPs, universities and large companies will eventually sponsor additional notary sites.

More information is available at www.cs.cmu.edu/~perspectives/