UAE Man-in-the-Middle Attack Against SSL

For those in the know with computer security, skip this and read the article. For those who aren't read on.

Now here's a problem. Most people have NO idea what SSL is, or what a CA provider does for SSL. For the layman, SSL stands for Secure Socket Layer, or the security layer in your web browser of choice that is responsible for creating and maintaining the integrity of your "secure" web transactions, i.e., your online banking sessions, online purchases, iTunes account management, Amazon purchases, etc. When you ask your browser to initiate a secure session, the SSL layer talks to a CA, or Certificate Authority, to validate that the server you are connecting to is indeed valid. Legitimate companies are required to update their CA licenses every so often, where the Certificate Authority, such as Verisign, acts as a sort of escrow manager, validating the company, their server domain name, then assigning them an encrypted certificate that says "Hey, I am who I say I am. Come on in." Pretty fine and dandy on paper. In reality, it's just someone giving someone else money for an ID; however, it's something, and it's worked fairly well for the past couple of decades the web has been around.

Now enter this situation. Browsers automatically trust these authorities. In normal situations, this works. However, these CA's are now delegating their powers to subsidiaries, some of which are relatively unknown, and a small handful of which reportedly reside in what some view as shady parts of the world. That only applies to a few (and I mean FEW) companies, but enter this interesting proposition. What if someone (criminal, government agency, or other), managed to fake a certificate with one of these lesser known authorities? Matt Blaze has done some looking into the matter, and it seems it might be a little more possible than previously thought. While the government eavesdropping on your vacation itinerary doesn't seem like much, with good reason, if these tools fell into the hands of others, who knows what madness may ensue. It may be little more than paranoid rhetoric at this point, but it's rightful observation into the possibilities.

UAE Man-in-the-Middle Attack Against SSL

Interesting:

Who are these certificate authorities? At the beginning of Web history, there were only a handful of companies, like Verisign, Equifax, and Thawte, that made near-monopoly profits from being the only providers trusted by Internet Explorer or Netscape Navigator. But over time, browsers have trusted more and more organizations to verify Web sites. Safari and Firefox now trust more than 60 separate certificate authorities by default. Microsoft's software trusts more than 100 private and government institutions.
Disturbingly, some of these trusted certificate authorities have decided to delegate their powers to yet more organizations, which aren't tracked or audited by browser companies. By scouring the Net for certificates, security researchers have uncovered more than 600 groups who, through such delegation, are now also automatically trusted by most browsers, including the Department of Homeland Security, Google, and Ford Motors­and a UAE mobile phone company called Etisalat.
In 2005, a company called CyberTrust­which has since been purchased by Verizon­ gave Etisalat, the government-connected mobile company in the UAE, the right to verify that a site is valid. Here's why this is trouble: Since browsers now automatically trust Etisalat to confirm a site's identity, the company has the potential ability to fake a secure connection to any site Etisalat subscribers might visit using a man-in-the-middle scheme.

[link to original | source: Schneier on Security | published: 3 days ago | shared via feedly]

Successful Attack Against a Quantum Cryptography System

This is too hilarious. No human-engineered system will ever be 100% secure using the type of thinking currently prevalent in the industry. Sorry. The only other option seems to be the creation of Skynet. No thank you. In the meantime, I enjoy the job security. No pun intended.

Successful Attack Against a Quantum Cryptography System

Clever:

Quantum cryptography is often touted as being perfectly secure. It is based on the principle that you cannot make measurements of a quantum system without disturbing it. So, in theory, it is impossible for an eavesdropper to intercept a quantum encryption key without disrupting it in a noticeable way, triggering alarm bells.
Vadim Makarov at the Norwegian University of Science and Technology in Trondheim and his colleagues have now cracked it. "Our hack gave 100% knowledge of the key, with zero disturbance to the system," he says.
[...]
The cunning part is that while blinded, Bob's detector cannot function as a 'quantum detector' that distinguishes between different quantum states of incoming light. However, it does still work as a 'classical detector' ­ recording a bit value of 1 if it is hit by an additional bright light pulse, regardless of the quantum properties of that pulse.
That means that every time Eve intercepts a bit value of 1 from Alice, she can send a bright pulse to Bob, so that he also receives the correct signal, and is entirely unaware that his detector has been sabotaged. There is no mismatch between Eve and Bob's readings because Eve sends Bob a classical signal, not a quantum one. As quantum cryptographic rules no longer apply, no alarm bells are triggered, says Makarov.
"We have exploited a purely technological loophole that turns a quantum cryptographic system into a classical system, without anyone noticing," says Makarov.
Makarov and his team have demonstrated that the hack works on two commercially available systems: one sold by ID Quantique (IDQ), based in Geneva, Switzerland, and one by MagiQ Technologies, based in Boston, Massachusetts. "Once I had the systems in the lab, it took only about two months to develop a working hack," says Makarov.

Just because something is secure in theory doesn't mean it's secure in practice. Or, to put it more cleverly: in theory, theory and practice are the same; but in practice, they're very different.
The paper is here.

[link to original | source: Schneier on Security | published: 3 days ago | shared via feedly]