web analytics

Comodo RA Compromised

Mar 31

I know it is too late to write about this but I came to know about this couple of days ago.

Comodo has confirmed that three registration authorities (RAs) affiliated with the company were compromised first reported on 23rd March 2011 by Iranian hacker to get fraud SSL Certificate for yahoo, google, Microsoft and Skype.

The Certificate was signed by third party without sufficient proof of identity and other information required.

The certificates could have been used by a fraudster to create a fake website that was able to bypass a browser’s validity mechanism and appear like the real thing to users.

Comodo has updated their most recent CRL (Certificate Revocation List) with removal of SSL Certificate.

Customers don’t need to do anything since the update is typically loaded automatically. As well, web browsers with the Online Certificate Status Protocol (OCSP) enabled will block the phony certificates from being used. Researcher Jacob Appelbaum first reported the problem to Comodo but withheld disclosure until the certification authority could remediate the issue.

The intruder, calling himself “Comodohacker,” has posted several lengthy documents on the text-sharing site Pastebin, offering up details about the incident. In the latest document, posted Tuesday, the hacker said it was a difficult infiltration that took time.

“From listed resellers of Comodo, I owned 3 of them,” the hacker wrote.

While rogue certificates were quickly revoked, the incident was serious enough to prompt Comodo to institute new controls and for the major web browsers – Mozilla’s Firefox, Microsoft’s Internet Explorer and Google’s Chrome – to issue updates to their browsers last week.

In response to rampant concerns about the trustworthiness of its certificate generation system from customers, browser companies and others in the security community, Comodo’s Alden said the company is in the process of rolling out hardware-based, two-factor authentication for its resellers to ward off attacks in the future.

The process could take several weeks to complete and, in the meantime, Comodo has promised to review all reseller validation work prior to issuing any certificates.

Mozilla, in particular, criticized Comodo for allowing RAs to issue certificates directly from the root that the company maintains, a practice that eliminated some possible attack mitigations. In response, Comodo said it plans to move away from this practice.

 

Read More

SSL Tools Website Part – II

Mar 04

SSL tools website part – II

After yesterday’s update about tools by ssltool.com. I am putting other tools details which would help you a lot with SSL Certificates and checking security of your SSL Certificate.

7) self-signed certificate generator (http://ssltool.com/?action=ssGenerate)

Do you want to generate self sign certificate? Here you go? this is great tool to generate self sign certificate for newbies who don’t want to run openssl commands to generate Self Sign Certificate. You can help self sign certificate in couple of minutes.

8) certificate and key match checker (http://ssltool.com/?action=modMatcher)

Check your Certificate key match. Certificate you got from your certificate vendor and key you have on your server this would be great to check Certificate before you installing it.

9) certificate root store list (http://ssltool.com/?action=certList)

Update Certificate root list in your server computer or check latest available root certificates available many of webservers still uses old certificate roots. which may cause problems.

SSLTools.com

Another good website I just came across ssltools.com. It allows you to check your CSR and Certificate. It is simple yet useful website which would help you to consider other option available to check your CSR.

There are many other SSL Related tools available. I will review other websites as well and update you about it. Till that time Happy Security..

Write Gaurav Maniar (IT Manager, SSL Support Expert @ www.thesslstore.com, MCITP, MCSE, MCSA)

Enhanced by Zemanta
Read More

SSL Testing Websites and Tools

Feb 25

SSL Testing WebSites.

In past couple of months I have come across many websites which helped me a lot to test and check SSL Installation and CSR. I would like to share the same with you.  There are many sites but today I am sharing with you special website which I think helped me a lot with SSL/TLS Testing and CSR testing.  List of websites are as below. I will later share features which I used on these websites and other information

1) SSLTools.com

2) redkestrel.co.uk

3) SSLshopper.com

4) secure.comodo.net/utilities/

-> 1) SSLTools.com

 

This is very great website I came across in past couple of months. It has great tools are available on this website. Following are description for the same:

1) CSR Decoder (http://ssltool.com/?action=csrDecodeOpenSSL)

CSR Decoder is great tool to check your CSR and verify that information you have filled in is correct and will be shown when you have your certificate from vendors.

2) SSL Certificate Checker (http://ssltool.com/?action=sslCheckOpenSSL)

Have you installed your certificate and want to check it. Here is another great tool to help you with SSL Certificate. It provides immanence information about SSL Certificate and will be very helpful after SSL Certificate installation.

3) OpenSSL S_client connector (http://ssltool.com/?action=sslCheckRawOpenSSL)

Great tool to help you to check the latest about SSL Certificate using OpenSSL s_client option. This tool provide you information like certificate details, CA authority and other stuff.

4) openssl s_client connector with full certificate output (http://ssltool.com/?action=sslCheckRawCertsOpenSSL)

Do you want more information about Certificate with this tool it will be great for you to understand SSL Certificate you have installed on your web server.

5) SSL Certificate Decoder (http://ssltool.com/?action=sslCertDecodeOpenSSL)

Do you have certificate you received from Vendor. Paste it at above URL and you will get all information you want for SSL Certificate  you are going to install on your server before you install it on server.

6) CSR Generator (http://ssltool.com/?action=csrGenerate)

Do you want to generate your own CSR. This tool will help you to generate one CSR for your SSL Certificate.

I will share other options available on SSLTool.com with you and my option about other website at next blog soon.

Write Gaurav Maniar (IT Manager, SSL Support Expert @ www.thesslstore.com, MCITP, MCSE, MCSA)

Enhanced by Zemanta
Read More

Venafi Survey: 78% of Organizations Experienced Downtime Due to Mismanaged Encryption This Year

Jan 21

View the original article here

Read More

Making mobile banking safer

Jan 15

Online Identity and Trust: Making mobile banking safer Online Identity and Trust « And the SC Magazine Award finalists are… | Main | Password should not be your “password” » Making mobile banking safer

There’s been recent news discussing the vulnerabilities of wireless apps for the banking industry and how they could impact users. As the number of Americans regularly using mobile banking services continues to grow, security concerns will grow along with them.

The challenges for banks to consider are all of the potential vulnerabilities in their implementation to better mitigate risks effectively while managing the delicate balance between extra layers of security vs. user experience.

Here are a few recommendations we suggest bank and financial institutions may want to consider:

Deploy strong or two-factor authentication that goes beyond the traditional username and password. If username and password are compromised, the fraudster still needs the second factor to gain access to an account. With our VIP mobile SDK, banks can enable a silent user experience for a second factor of authentication allowing greater security without negative impact to usability.

Implement fraud detection and transaction monitoring. If a hacker passes the front door, real-time fraud detection services can automatically detect novel attacks by recognizing abnormal behaviors in user behavior to help recognize an attack.

Avoid storing sensitive personal information on mobile devices which can easily be retrieved. For any information that a bank may require users to store on their mobile devices, banks should leverage platform secure storage with various encrypted and obfuscated techniques.

To find out more about the solutions that can help protect your bank and customers, check out these resources:

Resources:
VeriSign Identity Protection (VIP) Authentication Service
Mobile SDK
Fraud Detection Service (FDS)

There is no silver bullet security solution or service that will protect everyone from everything. However, banks and other financial institutions should always consider a layered approach to protect themselves and their customers.

Posted by VIP Team on November 15, 2010 3:03 PM | Post a comment (If you haven’t left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won’t appear on the entry. Thanks for waiting.)

Name:

Email Address:

URL:

Remember personal info?

Comments: (you may use HTML tags for style) VeriSign Identity Protection

Search Categories Authentication | Cloud-based Security | Device Security | Fraud Detection | Fraud Detection Service | Identity | Mobile devices and credentials | OpenID | VIP Blog | WiMAX | fraud protection | iPhone | layered security | two-factor authentication | second-factor authentication | verisign | Archives December 2010 November 2010 October 2010 July 2010 May 2010 April 2010 March 2010 January 2010 December 2009 November 2009 October 2009 September 2009 August 2009 April 2009 March 2009 February 2009 January 2009 December 2008 November 2008 October 2008 September 2008 August 2008 July 2008 June 2008 May 2008 April 2008 March 2008 February 2008 January 2008 Recent Posts Password should not be your “password” Making mobile banking safer And the SC Magazine Award finalists are… VIP Mobile So
ftware Developer Kit (SDK) Available for Windows Phone 7
Some additional “Social Security” Qualys provides VIP Protection to its customers VeriSign Customers Honored by Computerworld Cloud-based Authentication Matters Here ‘Smart’ meters will require ‘Smart’ security A Year of Progress for VIP Access for Mobile Subscribe to RSS FeedSubscribe Comments We encourage comments and look forward to hearing from you. Please note that VeriSign may, in our sole discretion, remove comments if they are off topic or inappropriate. Powered by
Movable Type 4.21-en Disclaimer: Opinions expressed here and in any corresponding comments are the personal opinions of the original authors, not of VeriSign.

VeriSign Legal Notices

Read our Privacy Policy

View the original article here

Read More