Security Alerts & News
by Tymoteusz A. Góral

History
#838 “Forbidden attack” makes dozens of HTTPS Visa sites vulnerable to tampering
Dozens of HTTPS-protected websites belonging to financial services giant Visa are vulnerable to attacks that allow hackers to inject malicious code and forged content into the browsers of visitors, an international team of researchers has found.

In all, 184 servers—some belonging to German stock exchange Deutsche Börse and Polish banking association Zwizek Banków Polskich—were also found to be vulnerable to a decade-old exploit technique cryptographers have dubbed the "forbidden attack." An additional 70,000 webservers were found to be at risk, although the work required to successfully carry out the attack might prove to be prohibitively difficult. The data came from an Internet-wide scan performed in January. Since then, Deutsche Börse has remedied the problem, but, as of Wednesday, both Visa and Zwizek Banków Polskich have allowed the vulnerability to remain and have yet to respond to any of the researchers' private disclosures.

The vulnerability stems from implementations of the transport layer security protocol that incorrectly reuse the same cryptographic nonce when data is encrypted. TLS specifications are clear that these arbitrary pieces of data should be used only once. When the same one is used more than once, it provides an opportunity to carry out the forbidden attack, which allows hackers to generate the key material used to authenticate site content. The exploit was first described in comments submitted to the National Institute of Standards and Technology. It gets its name because nonce uniqueness is a ground rule for proper crypto.
Read more
#838 “Forbidden attack” makes dozens of HTTPS Visa sites vulnerable to tampering
#837 Google's Chrome 51: Less battery drain from video, simpler site logins - plus 42 bug fixes
#836 Symantec: Android threats evolve to handle Marshmallow’s new permission model
#835 Amazon users targets of massive Locky spear-phishing campaign
#834 Virtual assistants such as Amazon's Echo break US child privacy law, experts say
#833 Symantec: SWIFT attackers’ malware linked to more financial attacks
#832 Tor to use never-before-seen distributed RNG to generate truly random numbers
#831 Microsoft may ban your favorite password
#830 US nuclear force 'still uses floppy disks'
#829 SAS: Big data is a big miss when it comes to IoT
History
2017: 01 02 03 04 05
2016: 01 02 03 04 05 06 07 08 09 10 11 12