Skip to main content

Hackers break SSL encryption used by millions of sites

Researchers have discovered a serious weakness in virtually all websites protected by the secure sockets layer protocol that allows attackers to silently decrypt data that's passing between a webserver and an end-user browser.

The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer technology that serves as the internet's foundation of trust. Although versions 1.1 and 1.2 of TLS aren't susceptible, they remain almost entirely unsupported in browsers and websites alike, making encrypted transactions on PayPal, GMail, and just about every other website vulnerable to eavesdropping by hackers who are able to control the connection between the end user and the website he's visiting.

At the Ekoparty security conference in Buenos Aires later this week, researchers Thai Duong and Juliano Rizzo plan to demonstrate proof-of-concept code called BEAST, which is short for Browser Exploit Against SSL/TLS. The stealthy piece of JavaScript works with a network sniffer to decrypt encrypted cookies a targeted website uses to grant access to restricted user accounts. The exploit works even against sites that use HSTS, or HTTP Strict Transport Security, which prevents certain pages from loading unless they're protected by SSL.

The demo will decrypt an authentication cookie used to access a PayPal account, Duong said.




via



Follow me on Twitter @rajneeshgarg!

Comments

Post a Comment

Popular posts from this blog

Installing Bugzilla on Windows

Bugzilla is the Bugs/Issues Tracking Tool from The Mozilla Organization. Version 2.18 is the latest stable release. There are couple of resources which guide a User installing Bugzilla on a Unix/linux machine. However, this entry describes a way to install Bugzilla on a Windows machine (W2K to be precise). This document guides you step by step through the installation process. First, get Administrative access to the machine on which you want to install Bugzilla. It should be a simple step. Usually, Users are given Administrative rights on Windows machine. However, if you dont have, contact your Administrator. Get Bugzilla Then download the Bugzilla from http://bugzilla.org/download.html . There are two ways of gettng it - through CVS or direct downloading the tar file. Remember there are no Zip files. However, any zip utility should be able to untar the Bugzilla. I download the tar file and untarred it using WinZip. I placed the untarred 'bugzilla' directory in my c: drive. So...
33 comments
Read more

JSP Performance Tips

Here are a few tips to improve JSP performance that I have been using. If you have your own listing of the tips, plz share. Disable JSP auto reloading feature. Use thread pool for your JSP engine and define the size of thread pool as per application requirement. Use jspInit() method to cache static data Initialize the 'out' object (implicit object) with proper size in the page directive. Set the content length Give 'false' value to the session in the page directive to avoid session object creation. Flush the data partly Use StringBuffer rather than using + operator when you concatenate multiple strings Use include directive instead of include action when you want to include the child page content in the translation phase. Avoid giving unnecessary scope in the 'useBean' action. Use print() method rather than println() method Use ServletOutputStream instead of JSPWriter to send binary data Minimize code in the synchronized block Do not use custom tags if you do no...
3 comments
Read more

How old are the daughters?

Two MIT math graduates bump into each other at Fairway on the upper west side. They hadn't seen each other in over 20 years. The first grad says to the second: "how have you been?" Second: "Great! I got married and I have three daughters now" First: "Really? how old are they?" Second: "Well, the product of their ages is 72, and the sum of their ages is the same as the number on that building over there.." First: "Right, ok.. oh wait.. hmmmm.., I still don't know" second: "Oh sorry, the oldest one just started to play the piano" First: "Wonderful! my oldest is the same age!" Problem: How old are the daughters?
11 comments
Read more