14 DAY TRIAL // Security failures in web content-filtering software Net Nanny expose users to attacks that allow perpetrators to intercept secure traffic originating from the victim’s computer and view it in plain text.
To be able to impose restrictions for viewing online content, the application intercepts communication entering the computer by installing a man-in-the-middle (MitM) proxy that uses a verified root certificate to prove it can be trusted.
The method is widely used with software that filters encrypted traffic and it does not pose risks as long as it is implemented correctly and the certificate does not fall into the wrong hands.
However, recent incidents, such as that caused by SuperFish, or the one involving PrivDog, have showed that secure implementation of MitM proxies is far from being a standard and sparked a violent reaction from the security industry.
Private key available in plain text in the software
Root certificates are particularly important because they can be used past the trust bestowed by the issuing authority to other certificates. As such, they should benefit from increased protection lest they are stolen and used to impersonate legitimate domains for nefarious purposes.
The problem with ContentWatch's Net Nanny is that the application uses the same root certificate and private key for generating it for all software installations. More than this, the developer included the private key in plain text in the application, said in a warning Garret Wassermann from Carnegie Mellon’s CERT division.
The risk emerging from this is that an attacker could use the key to generate new certificates that would appear trustworthy, and employ them to spoof legitimate websites. This way, the user would not receive any alerts when connecting to a malicious domain that spoofs a legitimate one.
Uninstalling the program eliminates the issue
According to CERT, version 7.2.4.2 has been confirmed to be affected, but other releases could also be vulnerable.
The organization offers two methods for mitigating the risk. One refers to uninstalling Net Nanny from the system, an action that also removes the root certificate from the operating system’s certificate store.
The other workaround is to disable SSL filtering and remove the certificate manually. CERT says that this solution mitigates the risk and does not impact other features of the program.