Stealing Private SSL Keys Using Heartbleed Difficult, Not Impossible
Experts say it’s highly unlikely private SSL keys can be stolen by hackers using the Heartbleed OpenSSL bug, but not impossible.
Web Security
Threatpost News Wrap, April 11, 2014
Dennis Fisher and Mike Mimoso discuss–what else–the OpenSSL heart bleed vulnerability and the doings at the Source Boston conference this week. Download:Â digital_underground_149.mp3
BlackBerry, Cisco Products Vulnerable to OpenSSL Bug
Vendors are continuing to check their products for potential effects from the OpenSSL heartbleed vulnerability, and both Cisco and BlackBerry have found that a variety of their products contain a vulnerable version of the software. BlackBerry on Thursday said that several of its software products are vulnerable to the OpenSSL bug, but that its phones […]
In March I spoke at Cyber Intelligence Asia 2014, where CERTs from most Asians countries were presented. The fact is that only a few CERTs are now dealing in some way with industrial security, ICS and SCADA matters. One of the best of those is CERT of Japan, which is doing a great job here, […]
Cisco patched a quartet of vulnerabilities this week in one of its core operating systems and is looking into the potential impact of this week’s Heartbleed vulnerability.
Google is adding a new security feature to Android designed to scan installed apps on a device and ensure that they’re not acting maliciously or taking unwanted actions. The system is built on Google’s existing app-verification model, which warns users if there’s a potential problem with an app they’re installing. The addition to Android’s security […]
There’s nothing the Internet loves more than a fat, juicy story that it can sink its sharpened, yellowing canines into. And for the security community, the OpenSSL heartbleed vulnerability has been the equivalent of a 72-ounce steak. But an Internet-breaking vulnerability like this one is no good unless we can learn something from it (or […]
Two Netflix security engineers released an open source attack detection tool for Web applications that responds with tactics aiming to frustrate hackers.
Adobe released updates for both its Flash Player and AIR software yesterday, patching four critical vulnerabilities, including one that was exposed at last month’s Pwn2Own hacking competition.
The list of products and sites affected by the OpenSSL heartbleed vulnerability continues to grow, and as security teams implement the patch and dig into the thornier work of revoking certificates, a new problem is emerging: It’s difficult to know whether an attacker has exploited the vulnerability on a given system.
