L33tdawg: Speaking of hackathons, registration for #HackWEEKDAY at HITB Haxpo is still open with some awesome prizes up for grabs including of course EUR1337 for the 'most l33t coder' sponsored by... read more
Featured Slideshow
SSL
First sites admit data loss through Heartbleed attacks
Submitted by l33tdawg on Tue, 2014-04-15 05:07
Canada’s tax authority and a popular British parenting website both lost user data after attackers exploited the Heartbleed SSL vulnerability, they said Monday.
The admissions are thought to be the first from websites that confirm data loss as a result of Heartbleed, which was first publicized last Tuesday. The flaw existed in Open SSL, a cryptographic library used by thousands of websites to enable encryption, and was quickly labeled one of the most serious security vulnerabilities in years.
OpenSSL: The single line of code that broke online security
Submitted by l33tdawg on Mon, 2014-04-14 05:11
On New Years Eve in 2011, at one minute before 11pm, a British computer consultant named Stephen Henson finished testing a new version of a popular piece of free security software. With a few keystrokes he released OpenSSL version 1.0.1 into the public domain. Now, more than two years later, the events of that night have shaken the foundations of the internet.
Tests confirm Heartbleed bug can expose server's private key
Submitted by l33tdawg on Mon, 2014-04-14 05:03
Four researchers working separately have demonstrated a server’s private encryption key can be obtained using the Heartbleed bug, an attack thought possible but unconfirmed.
The findings come shortly after a challenge created by CloudFlare, a San Francisco-based company that runs a security and redundancy service for website operators.
Heartbleed exploit, patch, both released
Submitted by l33tdawg on Mon, 2014-04-14 04:57
As the Heartbleed fallout continues, the good news is that code to fix the problem in OpenSSL has been released. The bad news is that exploit code is also available.
Let's start with the latter, released by a chap who took up Cloudlare's challenge to coders in the hope someone, somewhere, would be able to use Heartbleed to extract a private SSL key from an undefended server it erected.
'Heartbleed' bug in OpenSSL puts encrypted communications at risk
Submitted by l33tdawg on Tue, 2014-04-08 04:18
Computer security experts are advising administrators to patch a severe flaw in a software library used by millions of websites to encrypt sensitive communications.
The flaw, nicknamed “Heartbleed,” is contained in several versions of OpenSSL, a cryptographic library that enables SSL (Secure Sockets Layer) or TLS (Transport Security Layer) encryption. Most websites use either SSL or TLS, which is indicated in browsers with a padlock symbol.