tls – SSL and internet security news

Messaging Service Wiretap Discovered through Expired TLS Cert

October 27, 2023 infossl

certificates, man-in-the-middle attacks, privacy, Security technology, surveillance, tls, Uncategorized

Fascinating story of a covert wiretap that was discovered because of an expired TLS certificate: The suspected man-in-the-middle attack was identified when the administrator of jabber.ru, the largest Russian XMPP service, received a notification that one of the servers’ certificates had expired. However, jabber.ru found no expired certificates on the server, as explained in … Read More “Messaging Service Wiretap Discovered through Expired TLS Cert” »

An Untrustworthy TLS Certificate in Browsers

November 10, 2022 infossl

browsers, certificates, Security technology, tls, trust, Uncategorized

The major browsers natively trust a whole bunch of certificate authorities, and some of them are really sketchy: Google’s Chrome, Apple’s Safari, nonprofit Firefox and others allow the company, TrustCor Systems, to act as what’s known as a root certificate authority, a powerful spot in the internet’s infrastructure that guarantees websites are not fake, guiding … Read More “An Untrustworthy TLS Certificate in Browsers” »

The NSA Warns of TLS Inspection

November 22, 2019 infossl

certificates, cryptanalysis, encryption, maninthemiddleattacks, nsa, Security technology, tls, trafficanalysis

The NSA has released a security advisory warning of the dangers of TLS inspection: Transport Layer Security Inspection (TLSI), also known as TLS break and inspect, is a security process that allows enterprises to decrypt traffic, inspect the decrypted content for threats, and then re-encrypt the traffic before it enters or leaves the network. Introducing … Read More “The NSA Warns of TLS Inspection” »

New Reductor Nation-State Malware Compromises TLS

October 10, 2019 infossl

attribution, certificates, kaspersky, malware, randomnumbers, russia, Security technology, tls

Kaspersky has a detailed blog post about a new piece of sophisticated malware that it’s calling Reductor. The malware is able to compromise TLS traffic by infecting the computer with hacked TLS engine substituted on the fly, “marking” infected TLS handshakes by compromising the underlining random-number generator, and adding new digital certificates. The result is … Read More “New Reductor Nation-State Malware Compromises TLS” »

E-Mailing Private HTTPS Keys

March 13, 2018 infossl

certificates, email, https, keys, Security technology, securitypolicies, tls

I don’t know what to make of this story: The email was sent on Tuesday by the CEO of Trustico, a UK-based reseller of TLS certificates issued by the browser-trusted certificate authorities Comodo and, until recently, Symantec. It was sent to Jeremy Rowley, an executive vice president at DigiCert, a certificate authority that acquired Symantec’s … Read More “E-Mailing Private HTTPS Keys” »

The “Extended Random” Feature in the BSAFE Crypto Library

December 28, 2017 infossl

backdoors, cryptanalysis, cryptography, nsa, randomnumbers, Security technology, tls

Matthew Green wrote a fascinating blog post about the NSA’s efforts to increase the amount of random data exposed in the TLS protocol, and how it interacts with the NSA’s backdoor into the DUAL_EC_PRNG random number generator to weaken TLS. Powered by WPeMatico

How Signal Is Evading Censorship

December 28, 2016 infossl

academicpapers, censorship, egypt, encryption, Security technology, tls, unitedarabemirates

Signal, the encrypted messaging app I prefer, is being blocked in both Egypt and the UAE. Recently, the Signal team developed a workaround: domain fronting. Signal’s new anti-censorship feature uses a trick called “domain fronting,” Marlinspike explains. A country like Egypt, with only a few small internet service providers tightly controlled by the government, can … Read More “How Signal Is Evading Censorship” »

A New Free CA

November 18, 2014 infossl

certificates, eff, encryption, Security technology, ssl, tls

Announcing Let’s Encrypt, a new free certificate authority. This is a joint project of EFF, Mozilla, Cisco, Akamai, and the University of Michigan. This is an absolutely fantastic idea. The anchor for any TLS-protected communication is a public-key certificate which demonstrates that the server you’re actually talking to is the server you intended to talk … Read More “A New Free CA” »