One SSL flaw centres on null characters in certificates and, according to researchers, could allow access to the host computer running the web browser when accessing an infected site.
The technique, which was demonstrated by well-known IT security researcher Moxie Marlinspike, uses a certificate that contains a null character such as `\0' and allows hackers to route a user away from a legitimate web page and on to an infected site.
Two other researchers - Len Sassaman and Dan Kaminsky - meanwhile, showed audiences at the Las Vegas briefings how a number of websites still use the outdated MD-2 security algorithm and how it could be circumvented.
The MD-2-based attack is similar to an attack methodology used by researchers in the Netherlands, who created a rogue certification authority and demonstrated their methodology at the Chaos Computer Club briefings in Berlin late last December.
The efficacy of web browsing security was further undermined in April of this year when Peter Wood, chief of operations with First Base Technologies, the penetration testing specialist, and a member of the ISACA conference committee, revealed a structural security flaw in the https (secure IP) protocol.
That flaw, which centres on the security flag of session cookies on popular websites, means that, as sites move users between http and https (secure) IP sessions, the cookie can be intercepted and used by someone eavesdropping on the internet data stream.
The Black Hat revelations, however, have apparently spurred Verisign, which manages SSL security for the .com domain, as well as a web browser developers, to work together and speed up their enhancements for secure web browsing.
Verisign has said it expects to offer improved SSL-based browser sessions by the end of the year.