Mozilla pushes out fix for Firefox opportunistic encryption flaw

Summary:The latest Firefox browser update has created a web encryption security hole for hackers to exploit.

Mozilla's Firefox has received a new update to patch a web encryption flaw which could allow malicious websites to bypass certificate verification checks.

Last week, Mozilla introduced Firefox 37.0, which included support for HTTP/2, an Internet standard which allows for web connections to be encrypted even when HTTPS is not supported. One feature is HTTP Alternative Services -- otherwise known as Alt-Svc -- which forces end-to-end encryption between pages through redirection protocols.

Alt-Svc communicates with your PC or mobile device, offering an alternative way to access a web page. Instructions then can be sent in order to perform "opportunistic encryption," which forces through basic encryption protocols when visiting a website. It is not as secure as HTTPS, but is certainly an improvement on today's HTTP, which is the most commonly used communication channel on the Internet.

Unfortunately, while the latest Firefox update was designed to improve basic security, it also introduced a new, critical bug which allowed a researcher to find a way to bypass certificate verification if a web server redirected visitors through the HTTP/2 system.

In a basic security advisory provided by the Mozilla Foundation, the security flaw was deemed "critical." The bug, exploited through the HTTP/2 Alt-Svc header -- within Mozilla's Alternative Services implementation -- allowed for SSL certification verification to be bypassed.

As a result, invalid SSL certificate warnings would not be displayed and a hacker could potentially use a man-in-the-middle (MITM) attack to impersonate legitimate websites with the overall aim of luring victims to malicious pages, which could then be used to steal data or deliver malware payloads.

Cyberattackers could, for example, hijack the connection which looks legitimate thanks to Alt-Svc and send a victim to a phishing site masquerading as their bank, and users may not find anything amiss -- as invalid certificate warnings would not be displayed.

As reported by the Sophos Naked Security team, the bug was rapidly discovered and fixed. The team also noted that HTTP/2 isn't yet finalized and is not widely used. However, it is on its way to adoption through support by web servers including Apache, Nginx and Microsoft's IIS (Internet Information Servers) in Windows 10 Preview.

Go here to see the original:
Mozilla pushes out fix for Firefox opportunistic encryption flaw