Alarming open-source security holes found

Back in
May 2006 a few programmers working on an open-source security project made a
whopper of a mistake. Last week, the full impact of that mistake was just
beginning to dawn on security professionals around the world. Simson Garfinkel,
an associate professor
at the naval postgraduate school in Monterey, California, and a fellow at the
Center for Research and Computation and Society at Harvard University, writes in Technology Review that in technical terms, a programming error
reduced the amount of entropy used to create the cryptographic keys in a piece
of code called the OpenSSL library, which is used by programs such as the
Apache Web server, the SSH remote access program, the IPsec Virtual Private
Network (VPN), secure e-mail programs, some software used for
anonymously accessing the Internet, and so on. In simpler language: after a
week of analysis, we now know that two changed lines of code have created
profound security vulnerabilities in at least four different open-source
operating systems, twenty-five different application programs, and millions of
individual computer systems on
the Internet. Even though the vulnerability was discovered on 13 May and a
patch has been distributed, installing the patch does not repair the damage to
the compromised systems. What is even more alarming is that some computers may
be compromised even though they are not running the suspect code. The reason
that the patch does not fix the problem has to do with the specifics of the
programmers’ error. Modern computer systems employ large numbers to generate
the keys that are used to encrypt and decrypt information sent over a network.
Authorized users know the right key, so they do not have to guess it.
Malevolent hackers do not know the right key. Normally, it would simply take
too long to guess it by trying all possible keys—like, hundreds of billions of
years too long. The security of the system, however, turns upside down if the
computer can only use a limited number of a million different keys. For the
authorized user, the key looks good — the data gets encrypted. The bad guy’s
software, however, can quickly make and then try all possible keys for a
specific computer. The error introduced two years ago makes cryptographic keys
easy to guess. The error does not give every computer the same cryptographic
key — that would have been caught before now. Instead, it reduces the number
of different keys that these Linux computers can generate to 32,767 different
keys, depending on the computer’s processor architecture, the size of the key,
and the key type.

Less than
a day after