Comments on: In 2008 Hackers Broke the Internet http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/ Information Security Think Tank Thu, 11 Mar 2010 22:49:16 +0000 http://wordpress.org/?v=2.9.1 hourly 1 By: ainvictus http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-126229 ainvictus Tue, 03 Mar 2009 12:11:41 +0000 https://www.gnucitizen.org/?p=2046#comment-126229 security is just as good as the ones using it. security is just as good as the ones using it.

]]> By: Qxts http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-125309 Qxts Thu, 15 Jan 2009 13:06:37 +0000 https://www.gnucitizen.org/?p=2046#comment-125309 simplicity is errithing *slanted eyes* simplicity is errithing
*slanted eyes*

]]> By: Researchers devise undetectable phishing attack | Creative Zone Blog http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-125051 Researchers devise undetectable phishing attack | Creative Zone Blog Sat, 03 Jan 2009 11:16:17 +0000 https://www.gnucitizen.org/?p=2046#comment-125051 [...] Congress hacker conference, held in Berlin Tuesday, in a talk that has already been the subject of some speculation in the Internet security [...] [...] Congress hacker conference, held in Berlin Tuesday, in a talk that has already been the subject of some speculation in the Internet security [...]

]]> By: JustIn http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124975 JustIn Thu, 01 Jan 2009 17:26:56 +0000 https://www.gnucitizen.org/?p=2046#comment-124975 http://www.win.tue.nl/hashclash/rogue-ca/ http://www.win.tue.nl/hashclash/rogue-ca/

]]> By: pdp http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124953 pdp Wed, 31 Dec 2008 11:04:34 +0000 https://www.gnucitizen.org/?p=2046#comment-124953 a system is as secure as the weakest link a system is as secure as the weakest link

]]> By: Janus Cook http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124952 Janus Cook Wed, 31 Dec 2008 10:16:00 +0000 https://www.gnucitizen.org/?p=2046#comment-124952 Re: pdp's "I guess on browser level, this attack can be mitigated to an extend." They researched what, 30.000 certificates, of which 9000 were MD5 signed and 97% of those were from RapidSSL. The really good solution is to urge companies not to use certs from RapidSSL, and for RapidSSL to improve the randomization of their auto generated keys. Which they are doing right NOW, working through new year's eve, to keep the few customers they had left. Yes, that's 270 certificates signed by other CA certs that MIGHT be spoofed. That's nothing on an internet-wide scale. The impact of this is wildly overstated, and it 'breaking the internet' is quite a bold claim. But then again, that's been the fad this year, hasn't it? Announcing internet-breaking techniques, and when push comes to shove, it's not actually that critical. (Heck, those swedish TCP stack breaking dudes don't even have anything to show!) In conclusion, what happened to actually checking the certificate you get sent, before confirming it? It's been long known that the trust CA certs get is unjustified, and this proves it again. It's this model that needs to be looked at, not MD5. It's only a hash, and with enough computerpower collisions in any hash will become apparent. MD5 is old, and has served the world for what it's worth. It's been long time to retire this technique, and apparently many certs have. Re: pdp’s “I guess on browser level, this attack can be mitigated to an extend.”

They researched what, 30.000 certificates, of which 9000 were MD5 signed and 97% of those were from RapidSSL.

The really good solution is to urge companies not to use certs from RapidSSL, and for RapidSSL to improve the randomization of their auto generated keys. Which they are doing right NOW, working through new year’s eve, to keep the few customers they had left.

Yes, that’s 270 certificates signed by other CA certs that MIGHT be spoofed. That’s nothing on an internet-wide scale.

The impact of this is wildly overstated, and it ‘breaking the internet’ is quite a bold claim. But then again, that’s been the fad this year, hasn’t it? Announcing internet-breaking techniques, and when push comes to shove, it’s not actually that critical. (Heck, those swedish TCP stack breaking dudes don’t even have anything to show!)

In conclusion, what happened to actually checking the certificate you get sent, before confirming it? It’s been long known that the trust CA certs get is unjustified, and this proves it again. It’s this model that needs to be looked at, not MD5. It’s only a hash, and with enough computerpower collisions in any hash will become apparent. MD5 is old, and has served the world for what it’s worth. It’s been long time to retire this technique, and apparently many certs have.

]]> By: Mark http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124950 Mark Wed, 31 Dec 2008 07:01:01 +0000 https://www.gnucitizen.org/?p=2046#comment-124950 Playstation 3s? Interesting choice, but a good way to make a proof of concept. Read up and see its because of the Intel chipset. Playstation 3s? Interesting choice, but a good way to make a proof of concept. Read up and see its because of the Intel chipset.

]]> By: pdp http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124944 pdp Tue, 30 Dec 2008 18:19:13 +0000 https://www.gnucitizen.org/?p=2046#comment-124944 I guess on browser level, this attack can be mitigated to an extend. I guess on browser level, this attack can be mitigated to an extend.

]]> By: pdp http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124941 pdp Tue, 30 Dec 2008 15:40:05 +0000 https://www.gnucitizen.org/?p=2046#comment-124941 interesting research and impressive result but the Internet will survive. interesting research and impressive result but the Internet will survive.

]]> By: Janus Cook http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124940 Janus Cook Tue, 30 Dec 2008 14:34:14 +0000 https://www.gnucitizen.org/?p=2046#comment-124940 Awww. So all they did is create a rogue CA cert. I guess my cherished gopher is safe :D Awww. So all they did is create a rogue CA cert.
I guess my cherished gopher is safe :D

]]> By: myname http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124939 myname Tue, 30 Dec 2008 13:33:18 +0000 https://www.gnucitizen.org/?p=2046#comment-124939 We’ve changed our previously semi-obscure title of “Making the theoretical possible” to “MD5 considered harmful today: Creating a rogue CA certificate.”
http://ioerror.livejournal.com/

]]> By: Janus Cook http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124935 Janus Cook Tue, 30 Dec 2008 10:53:31 +0000 https://www.gnucitizen.org/?p=2046#comment-124935 Oh my. The ENTIRE internet? I better start backing up my gopher bookmarks then. *shakes head* Oh my. The ENTIRE internet?

I better start backing up my gopher bookmarks then.
*shakes head*

]]> By: pdp http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124931 pdp Tue, 30 Dec 2008 09:09:49 +0000 https://www.gnucitizen.org/?p=2046#comment-124931 often things get quite over-hyped without even pushing them. i am sure that the research is great but who knows what it might turn out to be at the end. however, I get the feeling that it wont be related to PKI at all. often things get quite over-hyped without even pushing them. i am sure that the research is great but who knows what it might turn out to be at the end. however, I get the feeling that it wont be related to PKI at all.

]]> By: The Internet is Doomed, Again, For the First Time Since the Last Time… « Amrit Williams Blog http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124929 The Internet is Doomed, Again, For the First Time Since the Last Time… « Amrit Williams Blog Tue, 30 Dec 2008 06:53:33 +0000 https://www.gnucitizen.org/?p=2046#comment-124929 [...] thoughts from others around the blogosphere (here), (here), (here), and (here). I am sure there will be plenty of updates and analysis once the details are disclosed [...] [...] thoughts from others around the blogosphere (here), (here), (here), and (here). I am sure there will be plenty of updates and analysis once the details are disclosed [...]

]]> By: Fabio http://www.gnucitizen.org/blog/in-2008-hackers-broke-the-internet/comment-page-1/#comment-124927 Fabio Tue, 30 Dec 2008 00:02:36 +0000 https://www.gnucitizen.org/?p=2046#comment-124927 Errata Security thinks will be "something to do with PKI (public key cryptography)" http://erratasec.blogspot.com/2008/12/i-am-not-dead-and-guessing-redacted.html Errata Security thinks will be “something to do with PKI (public key cryptography)”
http://erratasec.blogspot.com/.....acted.html

]]>