seen from Germany
seen from United States
seen from United States
seen from United States
seen from South Africa
seen from Poland
seen from Oman
seen from Canada
seen from Poland
seen from United States
seen from United States
seen from United States
seen from Brazil
seen from Germany
seen from China
seen from United States
seen from China
seen from United States
seen from Poland
seen from Morocco
Los riesgos de la inspección SSL
Los riesgos de la inspección SSL
Recientemente , SuperFish y PrivDog han recibido cierta atención debido a los riesgos que ambos introdujeron a los clientes debido a defectos de implementación. Mirando más de cerca estos tipos de aplicaciones he llegado a darme cuenta de algunas cosas.
En este blog, voy a explicar
Las capacidades de SSL y TLS no son bien entendidas por muchos.
La inspección SSL está mucho más extendida de lo…
View On WordPress
PrivDog, worse than Superfish
In the wake of Superfish, a recent Hacker News posting led hackers on a hunt after an application named PrivDog, released by Comodo.
There's a lengthy article on itworld that goes into a few details on the app, as well as an up-to-date write-up on Hanno's blog which quotes:
A quick analysis shows that it doesn't have the same flaw as Superfish, but it has another one which arguably is even bigger. While Superfish used the same certificate and key on all hosts PrivDog recreates a key/cert on every installation. However here comes the big flaw: PrivDog will intercept every certificate and replace it with one signed by its root key. And that means also certificates that weren't valid in the first place.
In a response advisory by PrivDog, they announce an available patch to the minor security vulnerability and state
There are potentially a maximum of 6,294 users in the USA and 57,568 users globally that this could potentially impact.
So far, it looks like the malicious CA is limited to the domain of advertisers... how long until we find actual malware that replicates this behavior?
