Internet SecuritT Group » News

Trustwave admits issuing ‘man-in-the-middle’ digital certificate

Wed, 08 Feb 2012 15:38:12 +0000

Digital Certificate Authority (CA) Trustwave revealed that it has issued a digital certificate that enabled an unnamed private company to spy on SSL-protected connections within its corporate network, an action that prompted the Mozilla community to debate whether the CA’s root certificate should be removed from Firefox.

View full post on Security – Infoworld

ISC StormCast for Wednesday, February 8th 2012 http://isc.sans.edu/podcastdetail.html?id=2311, (Wed, Feb 8th)

Wed, 08 Feb 2012 13:05:53 +0000

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

View full post on SANS Internet Storm Center, InfoCON: green

More bogus ad-serving Android apps evade Google's Bouncer

Wed, 08 Feb 2012 12:45:03 +0000

Users searching for games on the official Android Market have lately been heavily targeted by ad-pushing scammers. First it was the fake Temple Run app, and now a string of bogus copies of popular iPh…

View full post on Help Net Security – News

Law Enforcement Ups Its Game In Cybercrime

Wed, 08 Feb 2012 11:21:28 +0000

New data from Trustwave SpiderLabs shows how law enforcement agencies worldwide are getting better at catching cybercriminals — but it’s still a major chase

View full post on Dark Reading – All Stories

Heathrow facial recognition tech stalled by borders fiasco

Wed, 08 Feb 2012 10:09:15 +0000

Airport’s scanner rollout to miss Olympics target

Heathrow airport may now not get facial recognition technology at all five of its terminals in time for the Olympics as planned, according to the Financial Times.…

View full post on The Register – Security

Fake Temple Run app found on Android Market

Wed, 08 Feb 2012 06:45:11 +0000

Android users who were looking forward to playing the popular Temple Run game – currently available only for iOS devices – have probably thought that the happy day has arrived when they discovered the…

View full post on Help Net Security – News

Have Your Users’ Passwords Already Been Hacked?

Wed, 08 Feb 2012 06:23:41 +0000

If employees use their same password at work and in their personal lives, another company’s breach may weaken your own security. Five steps to mitigate the risk.

View full post on Dark Reading – All Stories

Security lab: Something fishy about Google Chrome’s Safe Browsing API

Wed, 08 Feb 2012 05:38:59 +0000

From the start, Google’s Safe Browsing API was designed to spot malicious Web pages so users wouldn’t get trapped in them. Google identifies these sites through its own algorithms and user notification.

View full post on Security – Infoworld

Chrome to stop checking Certificate Revocation List (CRL)?, (Wed, Feb 8th)

Wed, 08 Feb 2012 05:07:26 +0000

There was a post on Ars Technica yesterday, that led back to another blog post from Sunday that suggests that Google Chrome will stop doing CRLchecks at some point in the not too distant future. This has led to some interesting debate because the CRLmechanism has largely been ineffective. For a public key infrastructure (PKI) such as HTTPS to work, there must be an effective way of verifying the validity of the certificates. Due to the number of Certificate Authority (CA) breaches in recent years we’d all like a fast and effective method of taking compromised certificates out of play. During the highest profile breaches, all the major browser vendors simply pushed new versions of the browser with the root certificates from the breached CAs removed, in part because the browsers by design fail open (allow the connection)if they are unable to verify the certificate. So, is this a big deal? Is it the right way to go? Is it time to rethink/redesign/replace SSLor HTTPS? What do you think?
References
http://arstechnica.com/business/guides/2012/02/google-strips-chrome-of-ssl-revocation-checking.ars
http://www.imperialviolet.org/2012/02/05/crlsets.html
—————

Jim Clausing, GIAC GSE #26

jclausing –at– isc [dot] sans (dot) edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

View full post on SANS Internet Storm Center, InfoCON: green

Internet Explorer dominates browser security as Google faces accusations

Wed, 08 Feb 2012 03:38:14 +0000

Internet Explorer 9 should be the go-to browser for organizations concerned about protecting machines from malicious downloads, according to a new study from NSS Labs: Microsoft’s browser trounced rivals Chrome, Firefox, and Saf

View full post on Security – Infoworld