Protecting Free and Open Communications on the Internet Against Man-in-the-Middle Attacks on Third-Party Software: We're FOCI'd

In this position paper, we argue that the potential for man-in-the-middle attacks on third-party software is a significant threat to free and open communications on the Internet (FOCI). The FOCI community has many challenges ahead, from the failure of the SSL system to protect Internet users from states that control the Internet to the challenges inherent in measuring and cataloging Internet censorship. It is already well-known in the community that man-in-the-middle attacks are a threat, and such attacks are already being used by nation states. In this paper we discuss our experiences discovering two vulnerabilities in software update mechanisms (in Impulse SafeConnect and Sun Java). What surprised us was the relative ease of finding such vulnerabilities and exploiting them. Our argument is that automated tools are needed to help users manage this threat more effectively because the threat involves many third-party applications from many small vendors.