Evan Schuman's StorefrontBacktalk

Secure HTTP may be in trouble. The protocol that E-Commerce sites use to safely receive customers’ payment-card information can be hijacked in a matter of minutes, according to two security researchers who will demonstrate their attack at a security conference on Friday (Sept. 23). In case anyone doubts how relevant their demonstration is, their target will be a PayPal account.

The good news: The security hole can be closed by upgrading E-Commerce sites to a version of the security protocol that has been available since 2006. The bad news: Most E-Commerce Web sites and most Web browsers are still using the version with the security hole. The security-guru consensus: The sky isn’t falling yet, and browser makers may be able to implement a tweak that blocks the threat without a new security protocol.

According to Kaspersky Labs, researchers Juliano Rizzo and Thai Duong found a way to capture and decrypt HTTPS cookies on the fly. If their technique works, cyberthieves who can successfully eavesdrop on a user’s online session could hijack it, even if it’s supposed to be secure.

The security hole has been known for years, but most experts believed it was too hard to exploit for thieves to use. As a result, the OpenSSL package used by many E-Commerce sites, as well as the Firefox and Chrome browsers, still use a security protocol called Transport Layer Security (TLS) 1.0, which has the bug. Microsoft’s Internet Explorer browser and IIS Web server support a safer version of TLS, but not by default.

That means most E-Commerce sessions are using the vulnerable version of the protocol. And because of the chicken-and-egg problem of security protocols, E-Commerce sites are unwilling to raise their versions of TLS if that will block some customers whose browsers can’t handle the later version.

How serious a problem is the new attack? The demonstration on Friday (at the Ekoparty security conference in Buenos Aires, Argentina, if you’re in the neighborhood) will shed more light on the threat. But early reports are that it may be possible to close the security hole on the browser side. That means E-tailers may not have to bite the bullet and lock out customers for their own good.

Google, which has had details of the exploit since at least June, is reportedly almost ready with an update for its Chrome browser that should block the threat. There’s no word from Microsoft or Mozilla on their plans for security updates to solve the problem.