The details are here: http://hackaday.com/2009/07/29/black-hat-2009-breaking-ssl-with-null-characters/

One recommendation per post please.

  • Maybe this should be a wiki? – sybreon Jul 30 '09 at 12:08

Use FireFox 3.5 which is apparently1 not vulnerable.

(In the end, all SSL clients will need to update to ignore null for null characters when checking the host name of the certificate matches.)

1 According to this article on The Register (final paragraph).

  • null-terminated strings are a fixture of C, and possibly other languages. – sybreon Jul 30 '09 at 16:07

This is not really a solution and more of a discussion kick-off.

It can be mitigated by reducing the reliance on SSL. What I means is that we should not rely on SSL only and assuming that all SSL connections are secure. The hack essentially allows MITM attacks from being detected by the user.

Maybe, the way to work around it is by avoiding any transmission of sensitive information through the connection.


Instead of transmitting login passwords through SSL, have the password hashed at the client and with some sort of salt issued by a challenge and then transmit that through SSL. Also, using some sort of OTP generator like some banks use, is a good idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.