Securing Your Communications

Why (Android) SSL isn't always secure...
and how to make it secure

By Dennis M. Sosnoski, Sosnoski Software Associates Ltd

Security background

There are many threats to your data security: Unaffiliated hackers Criminal organizations National governments If your data is "valuable", any or all of these may target you All you can do is make it as difficult as possible This talk looks at securing communications

Certificates

Bandits on the road

Internet connections routed through intermediaries Local network routers ISP routers Backbone routers Routers can be hacked Illegal hacks common Router software often has poor security Need firmware updates to fix known problems Criminal organizations (and NSA) track hacks "Legal" hacks also common NSA monitors/subverts internet backbones GCHQ monitors/subverts international cables Likely NSA and others insert backdoors in routers

Java per-connection certificate control

At a per-connection level:

        // open the keystore
        KeyStore keyStore = KeyStore.getInstance("JKS");
        FileInputStream fis = new FileInputStream(Constants.TRUSTSTORE_NAME);
        keyStore.load(fis, Constants.TRUSTSTORE_PASS.toCharArray());
        
        // create trust manager that trusts only the server certificate
        String alg = TrustManagerFactory.getDefaultAlgorithm();
        TrustManagerFactory tmfact = TrustManagerFactory.getInstance(alg);
        tmfact.init(keyStore);
        X509TrustManager tm = (X509TrustManager)tmfact.getTrustManagers()[0];
        
        // create the connection configured to use trust manager
        HttpURLConnection conn = (HttpURLConnection)url.openConnection();
        SSLContext context = SSLContext.getInstance("TLS");
        context.init(null, new TrustManager[] { tm }, null);
        SSLSocketFactory sockfactory = context.getSocketFactory();
        ((HttpsURLConnection)conn).setSSLSocketFactory(sockfactory);
        conn.connect();
        conn.getInputStream();

Negotiating a connection

Initial steps in establishing a secure connection: Client sends ClientHello message: Highest protocol version supported Suggested ciphersuites Random number Server sends ServerHello message Chosen protocol version Chosen ciphersuite Random number Server sends Certificate message with actual cert Server sends ServerHelloDone message Remaining steps use server cert to secure exchange

Anything you've ever said or done online...

NSA already able to break much encryption Massive hardware — for RC4? or RSA 1024-bit keys? Deliberate weaknesses in algorithms — elliptic curves? Clandestine access to private keys for major companies? Looks like NSA is starting(?) to store encrypted intercepts Majority of internet traffic is media Most of what remains is published pages Very little internet traffic is actually personal Decryption can be done later (technology, or stolen keys)