Microsoft has added a security feature to Internet Explorer 11 to prevent so-called SSL-stripping attacks but it’s taking a lighter touch approach to enforcement than in Edge for Windows 10.
The feature comes as part of Microsoft’s June Patch Tuesday update for Internet Explorer (IE) 11 and prevents attacks that attempt to downgrade an encrypted HTTPS connection to an unencrypted HTTP one, which could be intercepted and read by an attacker.
Microsoft has done this by implementing HTTP Strict Transport Security (HSTS), an IETF standard supported by Chrome and Firefox for several years. It’s designed to prevent “SSL stripping” attacks, where a man-in-the-middle attacker could remove encryption protecting communications between a server and client.
HSTS support in IE 11 follows a directive issued by White House Office of Management and Budget yesterday for all public-facing federal government websites to enable HTTPS before 2017.
Microsoft has been working on introducing HSTS to its browsers for sometime. Last April it confirmed its new Edge browser (then known as IE 12) would support HSTS. In February this year it released its first HSTS-compliant browser under a Windows 10 preview.
The IE 11 security update on Tuesday broadens Microsoft’s support for built-in defences against SSL-stripping attacks since IE 11 supports Windows 10 and earlier versions of Windows, whereas Edge only runs on Windows 10.
“With today’s monthly security updates (KB 3058515), we’re bringing the protections offered by HSTS to Internet Explorer 11 on Windows 8.1 and Windows 7. HSTS is also available in both Internet Explorer 11 and Microsoft Edge on Windows 10,” Kyle Pflug, a program manager on Microsoft’s Edge team said.
Microsoft is however taking a lighter touch approach to enforcing HSTS in IE 11 than in Edge when it comes to mixed content, such as insecure HTTP elements within an otherwise secured HTTPS site.
Edge on Windows 10 doesn't support mixed content on servers that support HSTS, however for IE 11 on Windows 10, Windows 8.1 and Windows 7 will flag mixed content in the Information bar but will also urge the user to proceed.
Read more: Data retention laws and media - AusCERT 2015
Site developers have a few ways of implementing HSTS for IE 11 and Edge. They can register websites to be hardcoded by Edge, IE and other browsers to redirect HTTP traffic to HTTPS. Site developers can register their websites on the Chromium HSTS preload list to ensure that communications with these websites from the initial connection are automatically secured.
The other way to implement the policy without registering on that list is to enable HSTS via the Strict-Transport-Security HTTP header.
“After an initial HTTPS connection from the client containing the HSTS header, any subsequent HTTP connections are redirected by the browser to be secured via HTTPS,” Pflug explained of the alternative method.
The security feature came alongside 24 fixes for IE in this month’s security update, which includes 20 critical flaws, meaning they should be applied as quickly as possible.
Developers may find elements of their sites broken in IE 11 and Edge if the site contains “mixed content” or elements of a page that are not encrypted.
This article is brought to you by Enex TestLab, content directors for CSO Australia.
Feeling social? Follow us on Twitter and LinkedIn Now!