Hi malware fighters,
SSL has holes bigger than Swiss cheese...
Every SSL-implementation ever is vulnerable now’
“This vulnerability can attack any SSL-implementation that was ever implemented”, according to researcher Moxie Marlinspike. “Everybody made a similar mistake.” In SSL-connections through https a secure connection from server to user is being set up.
The misleading trick comes by getting a SSL-certificate through Certificate Authorities (CA’s), like there are VeriSign, GeoTrust and Thawte. When the owner of a particular site like illegal.com asks for a certificate with a CA, they are asked through mail to affirm they own that site. One could also get a certificate for a subdomain like for instance, let's sayl paypal.com\0.illegal.com. A CA will make out a certificate for this, because they will only check the owner of the main domain and not the one of the subdomain is verified (here that is paypal.com).
Browsers stop whenever they read ‘\0’
The root of the problem is SSL-implementation inside browsers for the first part of the domain. Firefox and Internet Explorer treat paypal.com\0.illegal.com as an official Paypal site (and also the certificate that goes with it) because they stop reading an url whenever they stumble upon a ‘\0’ in the url-code. A hacker now can easily circumvent SSL validation with whatever domain that he could dream up. The only browser that is secure in this respect is FireFox 3.5,
polonus