Old Crypto Vulnerability Hits Major Tech Firms (securityweek.com) 32
wiredmikey writes: A team of researchers has revived an old crypto vulnerability and determined that it affects the products of several major vendors and a significant number of the world's top websites. The attack/exploit method against a Transport Layer Security (TLS) vulnerability now has a name, a logo and a website. It has been dubbed ROBOT (Return Of Bleichenbacher's Oracle Threat) and, as the name suggests, it's related to an attack method discovered by Daniel Bleichenbacher back in 1998. ROBOT allows an attacker to obtain the RSA key necessary to decrypt TLS traffic under certain conditions. While proof-of-concept (PoC) code will only be made available after affected organizations have had a chance to patch their systems, the researchers have published some additional details. Researchers have made available an online tool that can be used to test public HTTPS servers. An analysis showed that at least 27 of the top 100 Alexa websites, including Facebook and PayPal, were affected.
Re: (Score:1)
We already have enough problems with the Ive-ification of fonts, i.e. thin and pale fonts which are hard to read and lack contrast.
Right to repair - making more sense all the time. (Score:2, Offtopic)
I've got lots of old stuff in use. The big issue is where do I draw the line between generating e-waste and using older energy hungry hardware instead of something more efficient?
Re: (Score:2)
Wireless charging is convenient, and it can extend the life of your phone if you would otherwise run into charging port issues. I switched to wireless charging when my phone complained of a wet charging port, since it bypasses the water detection.
The power loss is minimal for a device like my phone that doesn't really use that much power. You're much better off worrying about other ways of saving power. Turning off a light when you're not in the room can save a ton more power. Switching just a single bu
Re: (Score:2)
To add to this, there is actually a way for wireless charging to be MORE efficient. The USB port on my Galaxy S5 is wearing out. The phone supports optional wireless charging. A buddy of mine gave me a charging pad for free, and all I needed was the accessory to sit inside the battery compartment of the phone. Now I can continue to use the phone without the worry or need to replace it just because the wired charging port is going bad on it.
Re: (Score:2)
The big issue is where do I draw the line between generating e-waste and using older energy hungry hardware instead of something more efficient?
Where the question of longevity comes in. Compare stuff made 40-50 years ago to what's made today, including some of the stuff that has "planned obsolescence" built in or really shady shit like with video cards(see where nvidia degraded performance on cards when new models come out). My parents are still using the same refrigerator that they bought when they got married in the mid 1970's. Is it inefficient? Yep. Does the damn thing weigh an assload? Yep. But it's also built like a tank and keeps going.
Re: (Score:2)
Wow - how did I do this?
This was supposed to be a reply to the e-waste posting, not the crypto one. I guess I clicked back to the wrong tab or something. When people come into my office and interrupt my train of thought I make mistakes. I was upset someone marked me off-topic until I realized I was playing in the wrong playground.
Currency is in trouble then! (Score:1)
So, bad news for those fancy currencies - or are we using Crypto to mean cryptography again? Decide already.
Old Crypto Vulnerabilyty Hits Major Tech Firms (Score:1)
F5 equipment is garbage (Score:1)
Pretty much every piece of F5 equipment I've ever come across has usually been somehow fucked up, insecure or somehow non-operational in some retarded way. Years ago we had an F5 appliance doing TLS offload for us, but for some fucking reason it was mixing up data that came in via HTTP pipelining from the backend servers. So we had users getting credit card statements for other people. Terribly useful shit, I tell you.
Today I'm hacking around other F5 TLS brokenness (Score:3)
Today I'm re-writing a TLS (ssl) client to use the same hacky workarounds other clients have to use because F5 tries to read the ClientHello request into 256 byte buffer. The full packet is 684 bytes, and standards compliant. Since F5 standards compliant, we have to try three time to initiate a TLS connection, with three ClientHello requests, each under 256 bytes.
No RSA key recovery (Score:5, Interesting)
From the OP:
"ROBOT allows an attacker to obtain the RSA key necessary to decrypt TLS traffic under certain conditions."
As far as I can tell from reading the attack, this is not true. The attack lets you use the server as an oracle, that is, you can exploit the protocol to trick the server into signing arbitrary data with the server's private RSA key. I think this could be leveraged to mount a MITM attack, but it could not be used to recover the private RSA key. If the RSA private key was recoverable from a flaw in the TLS protocol, that would be a much bigger finding.
Re: (Score:2)
However that is still a huge fricking deal, because any TLS connection to an effected server can be man in the middled.
Its just me... (Score:2)
Its just me...or we are getting threads from other (random) topics