The Carnegie-Mellon University (CMU) made available a Firefox extension developed at its School of Computer Science and the College of Engineering, which enhances security in Firefox, by protecting against man-in-the-middle attacks. The extension, called Perspectives, is available only for Firefox 3 and works on Windows, Linux (32-bit) and OS X (Intel), with support for Linux (64-bit) and the Open Solaris is in the experimental stage of development.
A man-in-the-middle attack is carried out through the interception of traffic between a user and a resource that he is trying to access. This can be achieved by taking advantage of several vulnerabilities, as well as the latest DNS cache poisoning or Gmail accounts hacking incidents show.
Once access to a server resource using secure protocols SSL or SSH, a proper identification of the server is required. This is achieved by digitally signed certificates. Due to the certificates issued by trusted authorities like VeriSign are expensive; it became common practice for small companies and websites that use their own certificates.
When the browser encounters such a certificate for the first time, it raises a warning saying it cannot check the certificate and leave the final decision for the user. Because of this, users have developed a habit of accepting such certificates without paying too much attention. But this also makes it possible for an attacker to intercept the applications to fool users to send sensitive information by those false self-employed persons signed the certificate. Prospects for Firefox will override the default warning, which is often ignored by users, and carrying out their own additional verification methods to determine the validity of a certificate.
It achieves this by researching the "notary network servers." These are servers that automatically contact sites and record changes in their certificates keys for longer periods of times. When encountering a self-signed certificate, Perspectives extension download a list of important changes recorded certificate from notary servers, and uses this information to determine if the certificate belonging to the server, the user is trying to access. A setting allows the user to increase or decrease the level of security, by extension, which affects the way the validity of the certificates is established.
Based on the information received from notary servers, just as the last recorded key, the presence of the most important in a number of notary servers or former key changes, by extension, either automatically accepts the certificate or it gives the user more relevant information of a possible man-in-the - middle attack. The user can then make informed decisions based on this additional information gathered from notaries.
The extension protects users' privacy by allowing them to opt for lodging each time a notary server must be contacted. In addition, the notary servers do not keep any record of IP issues. The code is open source and people are encouraged to contribute their ideas, patches, bug submissions, GUI design or by offering to host notary servers. More technically oriented users can also read the newspaper published by the author that describes the development and its concepts in more detail.
