Weekly Edition
Return to the Security page
| |||||||||||||
Security quotes of the week
The worst part about Comodo's letter to the public was how they claimed
that they never thought a nation state would attack them. If that's not
part of your threat model, what business do you have being part of Internet
infrastructure?
-- Dave
Aitel
Since VoIP calls may traverse untrusted networks, packets should be
encrypted to ensure confidentiality. However, we show that it is possible
to identify the phrases spoken within encrypted VoIP calls when the audio
is encoded using variable bit rate codecs. To do so, we train a hidden
Markov model using only knowledge of the phonetic pronunciations of words,
such as those provided by a dictionary, and search packet sequences for
instances of specified phrases. Our approach does not require examples of
the speaker's voice, or even example recordings of the words that make up
the target phrase.
-- Charles
V. Wright, et al. abstract for "Uncovering Spoken Phrases in Encrypted Voice over IP Conversations"
I hacked Comodo from InstantSSL.it, their CEO's e-mail address mfpenco@mfpenco.com
-- "A message from Comodo
hacker" — supposedly anywayTheir Comodo username/password was: user: gtadmin password: globaltrust Their DB name was: globaltrust and instantsslcms (Log in to post comments)
Security quotes of the week Posted Mar 31, 2011 17:39 UTC (Thu) by vonbrand (subscriber, #4458) [Link] Comodo "didn't think of a nation-state attacker scenario", and out of the woods crawls a critter who claims he took on Comodo because he wasn't (yet) able to crack RSA by factoring... this looks more and more like the black eye HBGary deservedly got.
No evidence Posted Mar 31, 2011 21:26 UTC (Thu) by job (guest, #670) [Link]
Comodo has so far published zero evidence that this was actually an attack made or even sanctioned by the Iranian state. If any of my systems were hacked from an IP in a North American DSL range, I would not get away with blaming the CIA, and I don't Comodo should either.
No evidence Posted Apr 3, 2011 0:37 UTC (Sun) by giraffedata (subscriber, #1954) [Link] Comodo has so far published zero evidence that this was actually an attack made or even sanctioned by the Iranian state. According to the article, the evidence is the choice of sites to hack -- the kind of sites that would be useful for political purposes but not profit. A common thief would prefer to hack something like Paypal. But as we see in the confession, it's also possible for a non-state party to have a political goal. And there is a third class of hacker that would be interested in www.google.com: the recreational hacker stroking his overinflated ego, which is also apparent in the confession.
No evidence Posted Apr 3, 2011 21:44 UTC (Sun) by job (guest, #670) [Link] According to the article, the evidence is the choice of sites to hack -- the kind of sites that would be useful for political purposes but not profit. A common thief would prefer to hack something like Paypal. But that's completely baseless. In fact, I would suggest that these are exactly the pages you'd want to slip your malware onto (especially the Mozilla one). That's how you make money on false certificates, Paypal payments would be much more difficult to monetize.
|
|||||||||||||