Written by: Ryan J. Rodrigue, CISA, CISSP,
The official end of support for SHA-1 has caused some waves in the information security world. It’s an issue we’re seeing in many of the vulnerability assessments we perform, and believe this is a perfect time to examine the causes and real-life implications of using SHA-1 and what you as an organization should be doing about it.
What is SHA-1?
SHA-1 is a hashing algorithm that’s often used to digitally sign documents, ensure authentic installation files, and produce website encryption certificates. A digitally signed website encryption certificate proves that the website is legitimate and not an imposter. Obviously, this only works based on the assumption that the signature cannot be reproduced, and that every digital signature is unique.
For several years, researchers have expressed concerns over the SHA-1 algorithm and its ability to create unique digital signatures. They have theorized that you could intentionally reproduce an identical signature from different source data (a situation known as a “SHA-1 collision”). Thus, newer, stronger algorithms have been developed since the introduction of SHA-1, but many websites continue to use this legacy algorithm. All the major browsers are now warning users that a website is using SHA-1, but the user can still click thru to ignore the warning.
What are the Risks?
If an attacker can reproduce a SHA-1 signature using their own source data, we can’t rely on the authenticity of the signature. A website presenting a SHA-1 signed encryption certificate could actually be an imposter, compromising the trust and security controls built into the internet.
This is no longer just a theoretical weakness. In February 2017, researchers demonstrated the first intentional SHA-1 collision. Details on this attack, dubbed “SHA-1 Shattered,” will be publicly released this spring. Any systems still vulnerable at that time could be targets for exploitation.
What Should I Do?
From a practical standpoint, you should be concerned with end user behavior. If a user goes to a website that still uses SHA-1, the browser will produce a security warning. Unfortunately, the user will still be allowed to click through to proceed to the website. We need to better train users not to click through the warnings!
In addition, you should identify and inventory all of your encryption keys and certificates and make sure you revoke any of your digital SHA-1 certificates and replace them with SHA-2 certificates. Don’t forget to include any vendors that are providing websites on your behalf. They too need to make sure they update their certificates.
Lastly, you should have a process to always monitor information security news sources for new vulnerabilities or deprecated algorithms, protocols, and ciphers. Strong monitoring along with an effective vulnerability testing and remediation process will keep you ahead of the risks.
