ICS Startup SafeMashups Forms MashSSL Alliance

The latest Institute for Cyber Security startup to go live, SafeMashups, Inc., has just announced the launch of the MashSSL alliance. Read the press release below:

MOUNTAIN VIEW, CA--(Marketwire - November 12, 2009) - A consortium of leading technology companies today announced the creation of the MashSSL Alliance, an organization dedicated to evangelizing the use of the MashSSL technology and specification. MashSSL is an innovative way to use the proven and trusted SSL protocol and trust infrastructure to solve the tricky and serious problem of trust establishment between web applications communicating through an end user at a browser. This is a hard problem as the web applications have to assume that the user in the middle could be a malicious hacker or a legitimate user with a malware infected browser.

The founding members of the Alliance include leading SSL certificate vendors Comodo, DigiCert, Entrust and VeriSign; leading providers of security technology and services Arcot, Cenzic, ChosenSecurity, Denim Group, OneHealthPort, QuoVadis, SafeMashups and Venafi; leading security research institutions Institute for Cyber Security, UTSA, MIT Kerberos Consortium and Secure Business Austria, and noted industry security experts.

"Having been both a vendor and security practitioner, what makes MashSSL such an innovative and elegant solution is the fact that it sits on top of SSL at the application layer and does not disrupt the existing ecosystem -- no new crypto protocols to analyze, no changes to the browser and no new types of credentials," said Lynn Terwoerds, Former Head of Security Architecture & Standards, Barclays GRCB, former Senior Security Strategist, Microsoft, and member of the Cloud Security Alliance. "The ability to significantly reduce the risk involved with online collaboration and transactions opens up a whole new realm of opportunities to both product developers and to security practitioners who need to live in a highly virtualized and cloud based world, where applications and data no longer reside in a single location."

"End users' Web experiences, be it in healthcare or any other vertical, are increasingly an aggregation of data and processing from cooperating Web applications that communicate wholly or partially through the user's browser," said Sue Merk, vice president of business development and product management at OneHealthPort, a coalition of health plans, physicians and hospitals that joined together to build a trusted community where business and clinical information could be shared securely. "Unfortunately, a malicious man-in-the-middle attack or a user infected with man-in-the-browser malware can easily subvert such communications. An open standard to solve this universal problem once, and not in a piece meal ad hoc fashion, has been a long time coming. That it is based on the trusted and familiar SSL certificate infrastructure is a bonus."

MashSSL, which was first developed by application authentication pioneer SafeMashups, has now become an open specification with an open source reference implementation, and is in the process of being standardized.

"Using different proprietary security methods and a multitude of quasi-trusted credentials to solve this fundamental problem is clearly inefficient and will lead to administrative errors which underlie many vulnerabilities," said Siddharth Bajaj, Principal in the Innovation Group at VeriSign and steering committee chair of both the MashSSL Alliance and W3C MashSSL XG. "MashSSL repurposes SSL to create a secure application layer pipe through which open protocols like OAuth, OpenID, OpenAJAX, etc., and proprietary applications like payment provider interfaces can flow in a more secure fashion while leveraging the already existing trust and credential infrastructure."

While MashSSL was originally developed for use with newer mashup technologies, it became rapidly apparent that the protocol can be used in any situation where two Web applications need to communicate through a user's browser, where the user may be malicious or the browser infected with malware. Consequently, the potential field of use for MashSSL is very broad, including potentially underlying identity federation protocols, payment button interfaces, etc.

The initial MashSSL specification and open source reference implementation have been made generally available at www.mashssl.org.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Comodo and SafeMashups Partner on MashSSL Technology

SafeMashups, Inc., the latest startup from the Institute for Cyber Security to go live, has teamed up with Comodo to further secure web 2.0 protocols. Comodo is a large SSL certificate authority and only the latest in growing number of SSL CAs to interoperate with SafeMashup's free Web Toolkit and SafeMashups Community Service.

As Ravi Ganesan, founder and CEO of SafeMashups states, "MashSSL has the potential to fill a significant hole in the fabric of the Internet with a secure and standard protocol. MashSSL will also drive the adoption of SSL certificates, including EV-SSL certificates in a significant fashion." Both companies reiterated their commitment to work with other partners to rapidly make the standard completely open.

Look for more good news from SafeMashups soon!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS Startup SafeMashups Named Top 11 Security Company to Watch

SafeMashups, Inc., the latest startup from the Institute for Cyber Security Incubator to go live, has been named one of the eleven security companies to watch by NetworkWorld.

According to the article, SafeMashups is worth watching because its free Web Toolkit and SafeMashups Community Service can change today's mashups' lack of security controls. MashSSL is a protocol to allow one web app to talk to another through a browser in "mashups. There is a neat accompanying slideshow as well.

Look for more from SafeMashups in the coming months!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Firefox 3.5 Released

The good folks behind Mozilla's Firefox made its highly anticipated Firefox 3.5 available today.

As we've discussed before, One of the most interesting advancements to come out of Firefox 3.5 (and IE8) is mainstream cross-domain XHR. Due to the same origin policy concept that all major browsers adhere to, web applications are only allowed to make AJAX-style requests from the browser to their own server Cross-domain XHR provides mainstream support for mashups, but without security underlying it, most enterprises will not adopt them.

The latest startup from the Institute for Cyber Security to go live, SafeMashups, Inc., provides such a authentication and authorization framework in its free web toolkit and SafeMashups Community Service.

Along with enhanced JavaScript enhancements in both mainstream browsers (and Safari 4's recent release), the language's prominence and status has grown. It'll be worthwhile to see what improvements come down the pipes in the next few years.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Entrust and SafeMashups Team Up to Protect Mashups

SafeMashups, Inc., the latest startup from the Institute for Cyber Security to go live, has teamed up with Entrust to further secure web 2.0 protocols. Entrust is a large SSL certificate authority and only the latest in growing number of SSL CAs to interoperate with SafeMashup's free Web Toolkit and SafeMashups Community Service.

As Ravi Ganesan, founder and CEO of SafeMashups states, "Emerging mashup innovations such as cross domain XHR and OAuth offer many benefits to online users, but also introduce new threats. Customers of Entrust SSL certificates can use MashSSL to strongly authenticate the business partners participating in these productive mashups for their employees or customers, helping to reduce unnecessary risks."

For more about the recent OAuth security hole that exposed a man-in-the-middle vulnerability in Twitter and how MashSSL can be used as a workaround to it, visit our post on the subject here.

Look for more good news from SafeMashups soon!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

UK Web Host Unveils an Innovative Mashup Contest

As is well-documented, we at the Institute for Cyber Security enjoy both mashups and contests. So imagine our delight when 34SP, a web host located in the United Kingdom, announced its mashup contest yesterday.

In fine British fashion, their only requirement is that the mashup have to do with pubs in some way. More information on the contest, as well as a link to their rules, can be found at their contest site. We might humbly suggest securing that wonderful new mashup with MashSSL, invented by SafeMashups, the latest company to emerge from the ICS Incubator!

Image is of Kyrie's, a famous pub in Edinburgh, Scotland.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Cloud Computing and Semi-Private Clouds

If anyone had the opportunity to attend the RSA conference in April (of which SafeMashups, an Institute for Cyber Security incubator company, was named an RSA "Most Innovative Company" finalist), nearly half the talks covered cloud computing in some respect, even if it was only tangeltially related to their business. If it wasn't obvious to the conference's audience that cloud computing was the "next big thing", it certainly became so, especially as it relates to securing the cloud.

RedHat has a new study out that finds many companies are building "private clouds" within large enterprises, but that a few are building "semi-private clouds", in which they plan to share IT resources with trusted partners. This opens a huge door for access control and trust computing experts to leep the network secure, but it also opens an interesting door in enterprise mashups.

Nemertes Research also highlighted the need for enterprise mashups security in a brief on SafeMashups. In their study, they found 42% of participants are already using mashups, but that for the enterprise, they must implement strong security controls to protect internal mashup applications from insider threats. It's worth mentioning that SafeMashups's MashSSL protocol is identified by Nemertes as having the opportunity to boost enterprise mashup platforms.

(Image is an aerial shot of flat-base cumulus clouds, often colloquially referred to as "mashed potato" or just "mashed" clouds)

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

SafeMashups and Kerberos Interoperability Mention on Microsoft's Interoperability Site

The MIT Kerberos Consortium held its first Interoperability Testing Workshop a few weeks ago, hosted by Microsoft Corporation on their Redmond, Washington campus. Representatives from MIT, Microsoft, Sun, Cornell, and the Institute for Cyber Security were in attendance, with a lot of folks interested in Kerberos and trust security participating. The slide deck from our talk at the is now up online.

Microsoft's Interoperability Site has a great article covering some of the background and collaboration of the event. ICS was there with its first startup, SafeMashups, Inc., to introduce MashSSL and how the protocol can seamlessly work with Kerberos. As a supplement to Jean-Christophe Cimetiere's interesting coverage, SafeMashups also discussed MashSSL as a new standard for establishing trust in mashups and how it can provide application-level trust for Kerberized web applications, and non-Kerberized applications that want to make use of a KDC.

For those interested in the Safemashups solution to Kerberize web applications, a new tutorial on mashing MashSSL with Kerberos on its YouTube channel. Other demos on mashing MashSSL with OpenAJAX, Flash, OAuth, and Cross-Domain XHR, and more can be found there, too.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

DigiCert and SafeMashups Partner to Secure Web 2.0 Protocols

SafeMashups, Inc., the latest startup from the Institute for Cyber Security to go live, has teamed up with DigiCert to further secure web 2.0 protocols. DigiCert is a large provider of SSL certificates and now interoperates with SafeMashup's free Web Toolkit and SafeMashups Community Service.

As Ravi Ganesan, founder and CEO of SafeMashups states, "The recent session fixation vulnerability discovered in OAuth is a perfect example of the sort of vulnerabilities that arise when two web services have to communicate via a potentially untrusted user. " Luckily, both companies reiterated their commitment to work through the standards process with other partners to make the MashSSL specification an open standard.

For more about the recent OAuth security hole that exposed a man-in-the-middle vulnerability in Twitter and how MashSSL can be used as a workaround to it, visit our post on the subject here.

Look for more good news from SafeMashups soon!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Ruminations on the Recent OAuth Security Issue

You may have heard about the recent OAuth security hole that left Twitter vulnerable to cross-site scripting attacks. The first response someone looking at the details of the attack and its high media coverage might be to throw up their hands and give up on OAuth altogether.

This is to the wrong way to look at these recent events. The OAuth specification is a great one. Like all great standards, it is easy to read and simple to implement. For example, one of the developers here at the Institute for Cyber Security wrote a robust Java implementation of it in three days from his first look at the specification; there just are not many specs that do something so useful but can be put into practice so easily.

What needs to be understood is that this is exactly how the crypto protocols process works. Any standard worth its salt takes years and years to mature. As an example, SSL was first developed in 1993; people far smarter than I are still improving it a decade and a half later! Yet no one would argue that SSL is not a secure or well-thought-out spec. The fact that this attack even detected shows OAuth is under scrutiny and is gaining traction, which is really a good thing for OAuth. Would you rather use a spec which smart people are trying to break, or a no name spec that only the "wrong smart people" know how to break.

In the end, we do not know what OAuth's fix to this vulnerability will be, but if developers want a quick solution, they may want to consider using the MashSSL protocol that ICS developed with SafeMashups. SafeMashups is our most mature company in incubation, and integrates with OAuth. as well as other popular Web 2.0 standards.

MashSSL a multi-party version of SSL running in the application layer, and from an OAuth-centric standpoint, MashSSL first runs between the Consumer and the Service Provider through the user's browser (using standard SSL certificates for each server; no certificate on the browser is needed or expected). We then set the OAuth credential type to "PLAINTEXT", but all the OAuth messages are encrypted with the SSL "master secret" (the session key the two parties share at end of any SSL session). Except for the first go-round which involves public key operations, all subsequent sessions use the SSL abbreviated handshake, which is very efficient and only uses symmetric key crypto. The session fixation attack will not work as the Service Provider won't operate with a site with which it cannot establish or share an SSL session. So when the "good" URL is moved to "bad" site (as in this OAuth vulnerability), the attack is detected and stopped.

More info on how OAuth can interoperate with MashSSL can be found here. Additionally, a video on MashSSL/OAuth interoperation can be found on the SafeMashups YouTube channel. and in the the education center on the SafeMashups site.

Disclaimers:

1. MashSSL is moving towards becoming an open standard, but is not there yet (and I suppose that there is an infinitely small but non-zero probability that it may not, although the more people that cloamor for it, the sooner that will occur).
2. The software though is available under a perpetual royalty free license so you do not have to pay anything to use it.
3. At the moment it only works with certs from VeriSign (and our own free CA which we absolutely do NOT recommend you use except for testing).

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Image is a graph of SSL's growth over time. Just as SSL was improved via a battery of tests over time, new cryptographic protocols like OAuth can certainly persevere to become ubiquitous standards.