Moxie Marlinspike

Moxie Marlinspike

Moxie Marlinspike
Other names Matthew Rosenfeld,[1][2]
Mike Benham[3][4]
Citizenship US
Fields Computer security,
Software architecture
Known for Open Whisper Systems,
Whisper Systems,
Convergence (SSL)
Website
thoughtcrime.org

Moxie Marlinspike is the pseudonym of a computer security researcher. He is a member of the Institute For Disruptive Studies,[5] former head of security at Twitter,[6] founder of Open Whisper Systems,[7] and a fellow at the Shuttleworth Foundation.[8] He runs a cloud-based WPA cracking service,[9] manages the GoogleSharing targeted anonymity service,[10] and is the author of the Convergence SSL authentication system.[11]

Biography

Marlinspike was the chief technology officer and co-founder of Whisper Systems,[12] an enterprise mobile security company that was acquired by Twitter for an undisclosed amount in late 2011.[13] During his time as Twitter's head of security, Twitter open-sourced Whisper Systems' apps.[14][15] Marlinspike later left Twitter and founded Open Whisper Systems.[16]

Notable research

SSL stripping

In a 2009 paper, Marlinspike introduced the concept of SSL stripping, a man-in-the-middle attack in which a network attacker could prevent a web browser from upgrading to an SSL connection in a subtle way that would likely go unnoticed by a user. He also announced the release of a tool, sslstrip,[17] which would automatically perform these types of man in the middle attacks. The HTTP Strict Transport Security (HSTS) specification was subsequently developed to combat these attacks. However, deployment of HSTS has been slow, and SSL stripping attacks are still widely used today.[18][19]

SSL implementation attacks

Marlinspike has discovered a number of different vulnerabilities in popular SSL implementations. Notably, Marlinspike published a 2002 paper [20] on exploiting SSL/TLS implementations that did not correctly verify the X.509 v3 "BasicConstraints" extension in public key certificate chains. This allowed anyone with a valid CA-signed certificate for any domain name to create what appeared to be valid CA-signed certificates for any other domain. The vulnerable SSL/TLS implementations included the Microsoft CryptoAPI, making Internet Explorer and all other Windows software that relied on SSL/TLS connections vulnerable to a man-in-the-middle attack. In 2011, the same vulnerability was discovered to have remained present in the SSL/TLS implementation on Apple Inc.'s iOS.[21][22] Also notably, Marlinspike presented a 2009 paper,[23] where he introduced the concept of a null-prefix attack on SSL certificates. He revealed that all major SSL implementations failed to properly verify the Common Name value of a certificate, such that they could be tricked into accepting forged certificates by embedding null characters into the CN field.[24][25]

Solutions to the CA problem

In 2011, Marlinspike presented a talk titled SSL And The Future Of Authenticity[26] at the Black Hat security conference in Las Vegas. He outlined many of the current problems with certificate authorities, and announced the release of a software project called Convergence to replace Certificate Authorities.[27][28] In 2012, Marlinspike and Trevor Perrin submitted an Internet Draft for TACK,[29] which is designed to provide SSL certificate pinning and help solve the CA problem, to the IETF.[30]

Cracking MS-CHAPv2

In 2012, Marlinspike and David Hulton presented research that makes it possible to reduce the security of MS-CHAPv2 handshakes to a single DES encryption. Hulton built hardware capable of cracking the remaining DES encryption in less than 24 hours, and the two made the hardware available for anyone to use as an Internet service.[31]

Traveling

Secondary Security Screening Selection (SSSS)

Marlinspike says that when flying within the USA he is unable to print his own boarding pass, is required to have airline ticketing agents make a phone call in order to issue one, and is subjected to secondary screening at TSA security checkpoints.[32]

Detainment

While entering the United States via a flight from the Dominican Republic in 2010, Marlinspike was detained for five hours; federal agents requested his passwords, and all his electronic devices were confiscated and then returned.[33]

Speaking engagements

References

  1. ↑ Meyer, Christopher; Schwenk, Jörg (31 Jan 2013). "Lessons Learned From Previous SSL/TLS Attacks". Cryptology. Retrieved 2014-10-19.
  2. ↑ "Moxie Marlinspike Answers Your Questions - Slashdot". Interviews.slashdot.org. 2011-12-19. Retrieved 2013-10-04.
  3. ↑ "Severe Security Flaw Found in IE". PCWorld. 2002-08-13. Retrieved 2013-10-17.
  4. ↑ "Bugtraq: IE SSL Vulnerability". Seclists.org. 2002-08-05. Retrieved 2013-10-04.
  5. ↑ "With SSL, who can you really trust?". NetworkWorld. 2011-08-18. Retrieved 2013-12-09.
  6. ↑ Alex Hern (17 October 2014). "Twitter's former security head condemns Whisper's privacy flaws". The Guardian. Retrieved 22 January 2015.
  7. ↑ Franceschi-Bicchierai, Lorenzo (18 November 2014). "WhatsApp messages now have Snowden-approved encryption on Android". Mashable. Retrieved 23 January 2015.
  8. ↑ "Moxie Marlinspike". Shuttleworth Foundation. Retrieved 22 January 2015.
  9. ↑ "New Cloud-Based Service Steals Wi-fi Passwords". PC World. Retrieved 2013-12-09.
  10. ↑ "A Better Way To Hide From Google". Forbes. 2013-11-25. Archived from the original on 12 October 2013. Retrieved 2013-12-09.
  11. ↑ "Convergence". Convergence.io. Retrieved 2013-12-09.
  12. ↑ Mills, Elinor (2011-03-15). "CNet: WhisperCore App Encrypts All Data For Android". News.cnet.com. Retrieved 2013-12-09.
  13. ↑ "Twitter Acquires Moxie Marlinspike's Encryption Startup Whisper Systems". Forbes. Retrieved 2013-10-04.
  14. ↑ Chris Aniszczyk (20 December 2011). "The Whispers Are True". The Twitter Developer Blog. Twitter. Archived from the original on 24 October 2014. Retrieved 22 January 2015.
  15. ↑ "RedPhone is now Open Source!". Whisper Systems. 18 July 2012. Archived from the original on 31 July 2012. Retrieved 22 January 2015.
  16. ↑ Andy Greenberg (29 July 2014). "Your iPhone Can Finally Make Free, Encrypted Calls". Wired. Retrieved 18 January 2015.
  17. ↑ "sslstrip". Thoughtcrime.org. Retrieved 2013-12-09.
  18. ↑ "Breaking Your Browser's Padlock". Archive.is. Retrieved 2013-12-09.
  19. ↑ Kelly Jackson Higgins February 24, 2009 (2009-02-24). "SSLStrip Hacking Tool Released". Darkreading.com. Retrieved 2013-12-09.
  20. ↑ "BasicConstraints Vulnerability". Retrieved 2013-12-09.
  21. ↑ Apple iOS Bug Worse Than Advertised/
  22. ↑ "iPhone data interception tool released". Scmagazine.com.au. 2011-07-27. Retrieved 2013-12-09.
  23. ↑ "More New Tricks For Defeating SSL In Practice". Youtube.com. 2011-01-15. Retrieved 2013-12-09.
  24. ↑ Zetter, Kim (2009-07-30). "Vulnerabilities Allow Attackers To Impersonate Any Website". Wired.com. Retrieved 2013-12-09.
  25. ↑ Goodin, Dan (2009-07-30). "Wildcard certificate spoofs web authentication". Theregister.co.uk. Retrieved 2013-12-09.
  26. ↑ "SSL And The Future Of Authenticity". Youtube.com. 2011-08-18. Retrieved 2013-12-09.
  27. ↑ "New SSL Alternative". Informationweek.com. Retrieved 2013-12-09.
  28. ↑ "Future of SSL in doubt?". Infosecurity-magazine.com. 2011-08-09. Retrieved 2013-12-09.
  29. ↑ "Trust Assertions For Certificate Keys". Tack.io. Retrieved 2013-12-09.
  30. ↑ Goodin, Dan (2012-05-23). "SSL fix flags forged certificates". Arstechnica.com. Retrieved 2013-12-09.
  31. ↑ New Tool From Moxie Marlinspike Cracks Some Crypto Passwords (Archive.org-Link)
  32. ↑ Mills, Elinor (2010-11-18). "Security researcher: I keep getting detained by feds". News.cnet.com. Retrieved 2013-12-09.
  33. ↑ Zetter, Kim. "Another Hacker's Laptop, Cellphones Searched At Border". Wired.com. Retrieved 2013-12-09.
  34. ↑ "DEF CON 17 - Moxie Marlinspike - More Tricks for Defeating SSL". YouTube. DEF CON. Retrieved 22 January 2015.
  35. ↑ "DEF CON 18 - Moxie Marlinspike - Changing Threats To Privacy: From TIA to Google". YouTube. DEF CON. Retrieved 22 January 2015.
  36. ↑ "DEF CON 19 - Moxie Marlinspike - SSL And The Future Of Authenticity". YouTube. DEF CON. Retrieved 22 January 2015.
  37. ↑ "DEF CON 20 - Marlinspike Hulton and Ray - Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2". YouTube. DEF CON. Retrieved 22 January 2015.
  38. ↑ "Webstock '15: Moxie Marlinspike - Making private communication simple". Vimeo. Webstock. Retrieved 22 April 2015.

External links