1724 Members
18 Forums
7651 Topics
125752 Posts
Max Online: 107 @ 05/03/07 08:31 PM
|
|
|
#122258 - 03/24/11 08:06 PM
SSL meltdown forces browser developers to update
|
Prime Rib
Registered: 09/14/00
Posts: 6982
Loc: www.infowars.com
|
http://www.h-online.com/security/news/it...te-1213358.html
23 March 2011, 13:54
SSL meltdown forces browser developers to update
According to Tor developer Jacob Appelbaum and a blog posting by the Mozilla Foundation, the Comodo SSL Certification Authority may have been compromised. As a consequence, criminals apparently obtained nine certificates for web sites that already existed, including addons.mozilla.org. There is no official statement on whether the situation was caused by insufficient checks during the certification process or by a breach of Comodo's infrastructure.
However, what initially appeared to be a problem for Comodo is now forcing browser developers to take counter measures and release updates. Otherwise, criminals could, for example, redirect users to a bogus Firefox plug-in page and offer them infected add-ons to install – as the page would possess a valid server certificate for addons.mozilla.org, users would be unaware, and Firefox wouldn't issue an alert. Similar attacks on online banking sites are also conceivable.
PKI infrastructures allow compromised certificates to be withdrawn, and providers can offer either Certificate Revocation Lists (CRLs) to download or an online checking service, via Online Certificate Status Protocol (OCSP). This is supposed to allow browsers to check whether a certificate that is being offered by a server is not compromised. Consequently, Certificate Authorities (CAs) have said for years that cases such as the current one are "not a problem".
So much for the theory. In practice, however, it has now emerged that CRL and OCSP queries can be blocked without triggering an alert in the browsers' default configurations. This will cause verification to fail, and users to remain unaware. Probably for this reason, Comodo has contacted all major browser developers and notified them of the serial numbers of the affected certificates. These serial numbers are now to be hard-coded into browsers as a blacklist so they trigger an alert even without CRL and OCSP.
Google had already responded last week by releasing Chrome 10.0.648.151, while the Mozilla Foundation narrowly managed to include the blacklist in Firefox 4, and the newly released Firefox versions 3.6.16 and 3.5.18 also include the list. Tor developer Jacob Appelbaum, who has been in contact with Comodo since last week, says that a mitigation pack for Internet Explorer is being put together. The update policies of Opera and Apple currently remain unknown.
The incident is further proof that the entire concept of SSL and of users' trust in the Certificate Authorities are standing on feet of clay. After all, a certificate is also considered trustworthy even if it is issued by a CA reseller based in a country to which users probably wouldn't even go on holiday for security reasons. And the promised technologies don't even work when a compromised certificate is made public. It is time to come up with a new concept – and "EV-SSL" certificates, at least, should not be a part of it .
_________________________
|
|
Top
|
|
|
|
Sponsored Links
Member
Registered: 27/08/04
Posts: 10136
Loc: Vernon, B.C.
|
Remove these ads, you don't have to see them here! Just CLICK HERE to become a supporting website member, and you won't see these ads in the threads!
|
|
Top
|
|
|
|
|
#122259 - 03/24/11 08:18 PM
Re: SSL meltdown forces browser developers to update
[Re: dudster]
|
Prime Rib
Registered: 02/23/01
Posts: 4619
Loc: In My Happy Place!
|
RSA SecurID Hack now these certs... yikes. A bit more info here: http://www.pcworld.com/businesscenter/ar...rtificates.htmlTalks about the sites where fake certs were created in the hack. Organized hacker(s) to say the least.
|
|
Top
|
|
|
|
|
#122283 - 03/25/11 03:06 PM
Re: SSL meltdown forces browser developers to update
[Re: mrhappy]
|
Prime Rib
Registered: 09/14/00
Posts: 6982
Loc: www.infowars.com
|
http://www.theregister.co.uk/2011/03/24/rsa_securid_news_blackout/
RSA won't talk? Assume SecurID is broken
No news is bad news for two-factor logins
By Dan Goodin in San Francisco • Get more from this author
Posted in Enterprise Security, 24th March 2011 20:25 GMT
Free whitepaper – Total cost of ownership of Dell, HP and IBM blade solutions
Comment It's been a week since RSA dropped a vaguely worded bombshell on 30,000 customers that the soundness of the SecurID system they used to secure their corporate and governmental networks was compromised after hackers stole confidential information concerning the two-factor authentication product.
For seven days, reporters, researchers, and customers have called on RSA, and its parent corporation EMC, to specify what data was lifted – or at the very least to say if it included details that could allow government or corporate spies to predict the one-time passwords that SecurID tokens generate every 60 seconds. And for seven days, the company has resolutely refused to answer. Instead, RSA has parroted Security 101 how-tos about strong passwords, support-desk best practices, and the dangers of clicking on email attachments.
Officials from RSA and EMC have steadfastly refused to give yes or no answers to two questions that have profound consequences for the 40 million or so accounts that are protected by SecurID: Were the individual seed values used to generate a new pseudo-random number exposed and, similarly, was the mechanism that maps a token's serial number to its seed leaked?
Without the answers to those two basic questions, RSA customers can't make educated decisions about whether to continue relying on SecurID to prevent unauthorized logins to their sensitive networks. After all, if the breach on RSA's servers exposed the seeds and the mapping mechanism, SecurID customers have lost one of the factors offered by the two-factor authentication product.
An RSA spokesman released an updated statement earlier this week that said in part: “Our investigation to date has revealed that the attack resulted in certain information being extracted from RSA’s systems. Even with this information being extracted, RSA SecurID technology continues to be an effective authentication solution for customers.” (Notice the statement didn't say “an effective two-factor authentication solution.”)
The statement went on to say that revealing additional details “could enable others to try to compromise our customers’ RSA SecurID implementations, so we are not disclosing further information.”
Translation: Yes, we were hacked, and yes, the hackers made off with confidential information that compromises the security of a product you've spent huge amounts of money on, but you'll just have to trust us that you're still safe.
In the wake of this information blackout, the prudent thing for customers to do is to assume that SecurID seeds have been lifted, and to also assume that the mechanism that maps a particular token's serial number to its individual seed has also been taken. That means if attackers can trick individual SecurID users into giving out the number printed on the back of their token, its two-factor protection has been broken. The same applies if a company's database of serial numbers is breached.
That assumption would be consistent with an advisory RSA sent to customers on Monday urging them to strengthen the personal identification numbers that are used along with a user ID and the one-time password, since the PIN would be the single factor of authentication left.
It would also be in keeping with the growing sophistication and determination of recent attackers piercing the fortresses of a dizzying array of technology, energy and security companies over the past 18 months.
The latest example of these so-called advanced persistent threats came Wednesday when digital certificate authority Comodo disclosed its private encryption keys were used to generate counterfeit credentials for Google Mail and six other sensitive addresses. The CEO has claimed that the attack, which was perpetrated on an unnamed SSL certificate reseller of Comodo, had the hallmarks of state-sponsored hackers, most likely from Iran, although he provided no convincing proof.
“The security companies who are providing authentication are being directly attacked by the government,” CEO Melih Abdulhayoglu said.
This is precisely the assumption being taken by a security administrator who was in the process of helping a financial institution set up a SecurID system when RSA made last week's announcement. He told The Reg on Thursday that he's spent the past week trying to pry meaningful details out of RSA, so far without success.
“If they don't give me an answer by the end of tomorrow about whether the seeds were taken, I'm returning the product,” said the admin, who asked not to be named because he wasn't authorized to speak publicly. "Their integrity is just shot. Yes, they got hacked but their response is what's so troubling. The silence is deafening.”
SecurID's two-factor authentication may not be broken, but until RSA comes clean and provides some yes or no answers to two simple questions, it's better to assume it is. The network security you preserve may be your own. ®
_________________________
|
|
Top
|
|
|
|
|
#122391 - 03/30/11 05:02 PM
Re: SSL meltdown forces browser developers to update
[Re: dudster]
|
Prime Rib
Registered: 02/23/01
Posts: 4619
Loc: In My Happy Place!
|
|
|
Top
|
|
|
|
Moderator: A_M, Comp, Deejay, dredger, Monk, Nunzio, Oddjob, Phatmex, Rocket, susie1, Thunderalley
|
|
1 registered (1 invisible),
4
Guests and
1
Spider online. |
|
Key:
Admin,
Global Mod,
Mod
|
|
|
Previous Topic
Index
