• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   SSL

OpenSSL CVE-2015-1793: Separating Fact from Hype

  • Posted on:July 16, 2015 at 2:33 am
  • Posted in:Vulnerabilities
  • Author:
    William Gamazo Sanchez (Vulnerability Research)
0

A vulnerability that allows attackers to create their malicious certificates without depending on any external and trustworthy CAs was fixed in the newest version of the open-source software OpenSSL released July 9. Identified as CVE-2015-1793 (Alternative Chains certificate forgery) and rated with “high severity”, the vulnerability allows attackers to use certificates to produce other valid Certificates even…

Read More
Tags: digital certificateHTTPSOpenSSLSSLvulnerability

Are Secure Communications Really Secure? Government Sites Affected by Weak DHE

  • Posted on:July 10, 2015 at 7:27 am
  • Posted in:Bad Sites
  • Author:
    William Gamazo Sanchez (Vulnerability Research)
0

How secure is online public communication? Last May, a paper was published that discusses about the Diffie-Helman (DH) crypto-strength deployment, which gives strong evidence that the current DH usage is weak and suggests that 1024-bit size parameters can be broken with a nation state’s computing power resources. The paper presents possible scenarios where such an incident could occur. They found,…

Read More
Tags: cryptographyDHEHTTPSman in the middleOpenSSLprivacySSLTLS

Digital Certificates: Who Can You Trust?

  • Posted on:April 10, 2015 at 9:26 am
  • Posted in:Vulnerabilities
  • Author:
    Hitomi Kimura (Security Specialist)
0

Digital certificates are the backbone of the Public Key Infrastructure (PKI), which is the basis of trust online. Digital certificates are often compared to signatures; we can trust a document because it has a signature, or certificate authority (CA) by someone we trust. Simply put, digital certificates are a reproduction of a simple model which occurs…

Read More
Tags: digital certificatesSSLtrust

Extended Validation Certificates: Warning Against MITM Attacks

  • Posted on:February 25, 2015 at 9:09 pm
  • Posted in:Bad Sites, Vulnerabilities
  • Author:
    Chris Bailey (General Manager, Trend Micro SSL)
0

The recent Superfish incident has raised more concerns that SSL/TLS connections of users can be intercepted, inspected, and re-encrypted using a private root certificate installed on the user system. In effect, this is a man-in-the-middle (MITM) attack carried out within the user’s own system. We believe that site owners adopting extended validation (EV) certificates would help…

Read More
Tags: MITMSSLsuperfish

POODLE Vulnerability Puts Online Transactions At Risk

  • Posted on:October 15, 2014 at 11:58 am
  • Posted in:Exploits, Vulnerabilities
  • Author:
    Ziv Chang (Director, Cyber Safety Solution)
3

Earlier today, Google researchers Bodo Möller, Thai Duong, and Krzysztof Kotowicz released a paper discussing a serious bug in SSL 3.0 that allows attackers to conduct man-in-the-middle attacks and decrypt the traffic between Web servers and end users. For example, if you’re shopping online with your credit card, you may think that your information is secure…

Read More
Tags: man in the middleMITMPOODLESSLSSL 3.0TLS
Page 1 of 3123

Security Predictions for 2020

  • Cybersecurity in 2020 will be viewed through many lenses — from differing attacker motivations and cybercriminal arsenal to technological developments and global threat intelligence — only so defenders can keep up with the broad range of threats.
    Read our security predictions for 2020.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Popular Posts

Sorry. No data so far.

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.