Blog keyword search

POODLE is the brown M&Ms of security

Just because it won't be exploited, doesn't mean you shouldn't patch it.
Just because it won't be exploited, doesn't mean you shouldn't patch it. There is a famous story about the rock band Van Halen whose lists of requirements when performing a show… https://www.virusbulletin.com/blog/2015/04/poodle-brown-m-amp-ms-security/

FREAK attack takes HTTPS connections back to 1990s security

Golden keys from the (first) crypto wars have come back to haunt us.
Golden keys from the (first) crypto wars have come back to haunt us. When a web client makes a secure connection to a web server (using HTTPS), it starts by sending a 'Hello'… https://www.virusbulletin.com/blog/2015/03/freak-attack-takes-https-connections-back-1990s-security/

Book review: Bulletproof SSL and TLS

Must-read for anyone working with one of the Internet's most important protocols.
Must-read for anyone working with one of the Internet's most important protocols. I was reading Ivan Ristić's book Bulletproof SSL and TLS when rumours started to appear about an… https://www.virusbulletin.com/blog/2014/11/book-review-bulletproof-ssl-and-tls/

POODLE attack forces the Internet to move away from SSL 3.0

Users and administrators urged to stop supporting the protocol, or at least to prevent downgrade attacks.
Users and administrators urged to stop supporting the protocol, or at least to prevent downgrade attacks. After Heartbleed and Shellshock, or the SSL/TLS attacks CRIME and BEAST,… https://www.virusbulletin.com/blog/2014/10/poodle-attack-forces-internet-move-away-ssl-3-0/

1 in 500 secure connections use forged certificate

For reasons ranging from relatively good, to actual malware.
For reasons ranging from relatively good, to actual malware. Researchers from Facebook and Carnegie Mellon University have published a paper (PDF) in which they show that out of a… https://www.virusbulletin.com/blog/2014/05/1-500-secure-connections-use-forged-certificate/

OpenSSL vulnerability lets attackers quietly steal servers' private keys

Security firm advises regenerating keys and replacing certificates on vulnerable servers.
Security firm advises regenerating keys and replacing certificates on vulnerable servers. A very serious vulnerability in OpenSSL has caused panic among network administrators:… https://www.virusbulletin.com/blog/2014/04/openssl-vulnerability-lets-attackers-quietly-steal-servers-private-keys/

Iranians spied on using rogue DigiNotar certificates

Fake certificates signed for CIA, Mossad, Google, Facebook.
Fake certificates signed for CIA, Mossad, Google, Facebook. It is likely that Iranian Internet users have been spied on following a hack discovered at Dutch certificate authority… https://www.virusbulletin.com/blog/2011/09/iranians-spied-using-rogue-diginotar-certificates/

Rogue SSL certificates issued for popular websites

Certificates revoked, but browsers still need to be updated.
Certificates revoked, but browsers still need to be updated.Comodo, a major vendor of SSL certificates, has admitted to one of its affiliates' servers being hacked, leading to nine… https://www.virusbulletin.com/blog/2011/03/rogue-ssl-certificates-issued-popular-websites/

Symantec to acquire VeriSign business

Vendor splashes out more cash on authentication.
Vendor splashes out more cash on authentication.Symantec, the AV vendor with a reputation for snapping up other companies, has announced its purchase of VeriSign's authentication… https://www.virusbulletin.com/blog/2010/05/symantec-acquire-verisign-business/