Cryptography

Iran Temporarly Blocks Access to Email for some 30,000

Internet service providers (ISP) acting on behalf of the Iranian government have recently begun blocking encrypted internet services that rely on the secure sockets layer (SSL) protocol, curbing the use of virtual private networks (VPN), a number of email providers, and other communication tools ahead of next week’s parliamentary elections.

A total SSL blockage would prevent the use of any online service whose address begins with ‘https,’ thus cutting off internet users in Iran from one of the Web’s most widely used and trusted encryption connections.

What You Need to Know About the RSA Key Research

It’s always slightly disorienting and confusing when a story about something as esoteric as weak encryption keys produced by poor random number generators makes its way into the real world and begins scaring the citizens. This can lead to confusion and worry about whether everyone’s online banking sessions and purchases of Canadian pharmaceuticals are safe. To help allay those concerns, here are some things you need to know about the new research on weak RSA keys and its implications.

Weak RSA Keys Plague Embedded Devices, But Experts Caution Against Panic

If all of the noise about weak RSA keys and compromised cryptosystems in the last few days has done anything, it’s to confirm what many in the cryptography community have known for quite a long time: When it comes to implementing cryptosystems, there are a whole lot of people doing it wrong. However, experts say the new research showing large numbers of repeated and weak crypto keys is a good reminder of not only how hard it is to get this stuff right, but also how many different ways it can go wrong.

Mozilla to Warn CAs About Issuing MITM Certificates

by Dennis Fisher
2

Mozilla officials are preparing to send a letter to the certificate authorities that are part of its root CA program, warning them about issuing so-called man-in-the-middle certificates for systems that the CA does not actually own. The message comes on the heels of an incident in which Trustwave, a CA, issued a certificate that enabled a corporate customer to eavesdrop on the SSL-protected sessions of its employees.

Finding Location Data In Google Maps SSL Sessions

by Dennis Fisher
1

In the last couple of years, Google and some other Web giants have moved to make many of their services accessible over SSL, and in many cases, made HTTPS connections the default. That’s designed to make eavesdropping on those connections more difficult, but as researchers have shown, it certainly doesn’t make traffic analysis of those connections impossible.

Researchers Crack Satellite Phone Ciphers

by Dennis Fisher

Researchers at a German university have broken the encryption of the two main standards used to protect calls from satellite phones, giving them the ability to intercept conversations that are meant to be private. The attacks on the GMR-1 and GMR-2 standards are thought to be the first such work against the satellite phone ciphers.

Google to Stop Using Online CRL Checks for Chrome

by Dennis Fisher
1

In the face of mounting evidence that the CA system is inherently flawed, Google officials are in the process of making changes to the way Chrome handles certificate revocations, and no longer will be using online revocation checks. Instead, Chrome will use the existing update system in the browser to accomplish this task.

Apple Ships Huge Set of Patches for OS X

by Dennis Fisher
10

Apple has released a massive set of patches for a wide range of security vulnerabilities in a number of its products and components, including OSX Lion and QuickTime. The patches, which are rolled up in OS X 10.7.3, fix a slew of serious bugs, many of which can be used to execute remote code on vulnerable machines.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.