R.I.P
http://www.apple.com/stevejobs/
{ 0 comments }
Apple
Microsoft Security Advisory (2607712)
Fraudulent Digital Certificates Could Allow Spoofing
Published: August 29, 2011 | Updated: August 29, 2011
Microsoft is aware of at least one fraudulent digital certificate issued by DigiNotar, a certification authority present in the Trusted Root Certification Authorities Store, on all supported releases of Microsoft Windows. Although this is not a vulnerability in a Microsoft product, Microsoft is taking action to protect customers.
Microsoft has been able to confirm that one digital certificate affects all subdomains of google.com and may be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against all Web browser users including users of Internet Explorer. Microsoft is continuing to investigate how many more certificates have been fraudulently issued. As a precautionary measure, Microsoft has removed the DigiNotar root certificate from the Microsoft Certificate Trust List.
All supported editions of Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 use the Microsoft Certificate Trust List to validate the trust of a certification authority. Users of these operating systems will be presented with an invalid certificate error when they browse to a Web site or try to install programs signed by the DigiNotar root certificate. In those cases users should follow the instructions in the message. Microsoft will release a future update to address this issue for all supported editions of Windows XP and Windows Server 2003.
Microsoft is continuing to investigate this issue and may release future updates to help protect customers.
http://www.microsoft.com/technet/security/advisory/2607712.mspx
Edit
V3.0 (September 6, 2011): Revised to announce the release of an update that addresses this issue.
Computerworld
Hackers may have obtained more than 200 digital certificates from a Dutch company after breaking into its network, including ones for Mozilla, Yahoo and the Tor project, a security researcher reported today.
The count is considerably higher than DigiNotar has acknowledged. Earlier this week, a company spokesman said that “several dozen” certificates had been acquired by the attackers.
http://www.computerworld.com/s/article/9219663/Hackers_may_have_stolen_over_200_SSL_certificates
Mac OS X can’t properly revoke dodgy digital certificates
http://www.computerworld.com/s/article/9219669/Mac_OS_X_can_t_properly_revoke_dodgy_digital_certificates
Firefox and Thunderbird 6.0.1 released after the Mozilla team removed DigiNotar from their root program to protect users.
{ 0 comments }
Betanews
iTunes hack goes global, new affected games identified
With Apple all but silent on the issue, it has been difficult to determine what may be the source of the problem. However, with the quantity of reports received now numbering over three dozen, a pattern has emerged: every game targeted is a free download, and the fraudulent charges are all due to in-app purchases.
For this reason, Betanews now has reason to believe that this particular hack affecting iTunes is likely sourced to an exploit existing in Apple’s in-app purchasing mechanism. It is the only similiarity between every report received.
http://www.betanews.com/article/iTunes-hack-goes-global-new-affected-games-identified/1307564070?
iTunes hack widespread, and Apple appears to know about it
From the reports a pattern is emerging. Nearly every victim had a gift card balance on their account, and some have reported that their credit card and/or payment information had been removed from their account. This indicates that Apple likely is aware of the attacks, and is actively trying to protect its users.
http://www.betanews.com/article/iTunes-hack-widespread-and-Apple-appears-to-know-about-it/1307390216
{ 0 comments }
