Heartbleed snatched CloudFlare Crypto Keys!

Private crypto keys are accessible to Heartbleed hackers, new data shows. Cloudflare published preliminary findings that seemed to indicate that it would be difficult, if not impossible, to use Heartbleed to get the vital key that essentially unlocks the secure sockets layer padlock in millions of browsers. To be extra-sure, Cloudflare launched “The Heartbleed Challenge” to see how other people exploiting Heartbleed might fare. The company set up an nginx server running a Heartbleed-vulnerable version of OpenSSL and invited the Internet at large to steal its private key.
Four people have been able to see server keys and certificates in a test.


The results are a strong indication that merely updating servers to a version of OpenSSL that's not vulnerable to Heartbleed isn't enough. Because Heartbleed exploits don't by default show up in server logs, there's no way for sites that were vulnerable to rule out the possibility the private certificate key was plucked out of memory by hackers. Anyone possessing the private key can use it to host an impostor site that is virtually impossible for most end users to detect. Anyone visiting the bogus site would see the same https prefix and padlock icon accompanying the site's authentic server.

The demonstration that it's possible to extract private SSL certificates means that out of an abundance of caution, administrators of sites that used vulnerable versions of OpenSSL should revoke and replace old certificates with new ones as soon as possible. Given the huge number of sites affected, the revelation could create problems.

"The bad news is that discovery changes our recommendation from: reissue and revoke as a medium priority to reissue and revoke as a high priority," Matt Prince, CEO of CloudFlare wrote in an e-mail to Ars. "We've accelerated our own reissuance and revocation process."

Cloudflare had originally reasoned that, at least on the Linux-based platform it uses, a server's certificate and private keys are usually stored in the server's memory early on after booting up, and because servers are not booted up frequently, it would be difficult to find a situation in which the block of memory that Heartbleed can be used to access (which can be up to 64Kb of information) would contain a server's private keys.

The process of revoking and reissuing certificates is unwieldy and slow even without half of the Internet trying to do the same process at the same time. “If every site revoked its certificates, it would impose a significant burden and performance penalty on the Internet,” wrote CloudFlare in a Friday blog post. “At CloudFlare-scale the reissuance and revocation process could break the Certificate Authority infrastructure.”

The company said that for its customers running on CloudFlare infrastructure, it has already begun the process of reissuing and revoking SSL certificates in stages, and expects to be done with the process sometime next week.

Continue reading →

HeartBleed - Critical Crypto Bug Exposes Yahoo Mail

OpenSSL is considered as a certificate for security but what when OpenSSL itself have a bug. That’s the reason Yahoo mail’s passwords were exposed. Heartbleed is a bug which is the result of a mundane coding error in OpenSSL. 

OpenSSL is for implementing HTTPS encryption in websites, e-mail servers, and applications. The result of a missing bounds check in the source code, Heartbleed allows attackers to recover large chunks of private computer memory that handle OpenSSL processes. The leak is the digital equivalent of a grab bag that hackers can blindly reach into over and over simply by sending a series of commands to vulnerable servers. The returned contents could include something as banal as a time stamp, or it could return far more valuable assets such as authentication credentials or even the private key at the heart of a website's entire cryptographic certificate.

After this bug and a huge loss to Yahoo Mail, OpenSSL developers have released version 1.0.1g that readers should install immediately on any vulnerable machines they maintain. But given the stakes and the time it takes to update millions of servers, the risks remain high.

This worked as by sending many requests at a time and get an entry into website through a hole because of heavy traffic. The bug allows to eavesdropping in a website who is using OpenSSL library.

The OpenSSL patch is only the starting point on the path of Heartbleed recovery. Website operators should strongly consider replacing their X.509 certificates after applying the update and getting all users and administrators to change passwords as well. 

Many websites have started to ask their users to change their passwords as soon as they have applied patch in their servers after knowing this attack and one of the example is most popular music website SOUNDCLUD.COM.

It's NOT probably so early for users to replace passwords across the board, but for sites they know have received the OpenSSL patch, it may be a good idea to change login credentials. People who are truly security conscious may want to change passwords a second time if they notice a patched site later updates its digital certificate.

It’s better to take step than cry later.

Continue reading →

NSA paid RSA again to release weaker Crypto Tool.

type='html'>

 
NSA leaves no stone unturned to infiltrate and spy on. As online security tools, too, are designed in the way NSA deems fit for its activities. Top security provider firm RSA endowed its BSAFE cryptography toolkit with a second NSA- influenced random number generator (RNG) which will render encrypted communications very easy to be de-crypted by hackers and eavesdroppers, says Reuters.
 Citing soon-to-be-published research from several universities, Reuters said the Extended Random extension for secure websites allows attackers to work tens of thousands of times faster when breaking cryptography that uses the Dual EC_DRBG algorithm to generate the random numbers that populate a specific cryptographic key. 
Dual EC_DRBG is a pseudo- random number generator that was developed by cryptographers from the National Security Agency and was the default RNG in BSAFE even after researchers demonstrated weaknesses so severe that many suspected they were introduced intentionally so the US spy agency could exploit them to crack encrypted communications of people it wanted to monitor. In December, Reuters reported that the NSA paid RSA $10 million to give Dual EC_DRBG its favored position in BSAFE. 
Extended Random was a second RNG that is meant to add random generated key to make encryption more strong. However, in truth, the algorithm made protected communications even easier for attackers to decrypt by reducing the time it takes to predict the random numbers generated by Dual EC_DRBG, which is short for Dual Elliptic Curve, Reuters reported Monday.
 A professor specializing in cryptography at Johns Hopkins University and one of the authors of the upcoming academic report, told Reuters, " If using Dual Elliptic Curve is like playing with matches, then adding Extended Random is like dousing yourself with gasoline".

Who Got Hacked , copy rights

View the original article here

Continue reading →

RSA Crypto 768-Bit Keys Cracked

Yes, you heard it right one of the most famous and which have been for years to encrypt the communication standards have been cracked by a bunch of scientists who took about two-and-a-half years and hundreds of general-purpose computers.

 

 

This accomplishment was reached on December 12. In my eyes it would have been very much harder to crack this kind of cryptography because it is so much calculated and so much hard to to crack…

The team managed to factor the 232-digit number that RSA held out as a representative 768-bit modulus from a now-obsolete challenge. They spent half a year using 80 processors on polynomial selection.

 

Sieving took almost two years and was done on "many hundreds of machines". Using a single-core 2.2GHz AMD Opteron with 2GB RAM, sieving would have taken about 1,500 years, they estimated.

 

The only word come in my mouth right now is WOW.

"There's indisputable evidence here that 768-bit key are not enough. It's a pretty interesting way to close out a decade."

But as a matter of fact this is not the end as the new RSA crypto, which would be coming soon, is 1024 – Bit which would be much more harder to crack then all the previous one’s .

 

"If we are optimistic, it may be possible to factor a 1024-bit RSA modulus within the next decade by means of an academic effort on the same limited scale as the effort presented here," authors of the research wrote.

 

"From a practical security point of view this is not a big deal, given that standards recommend phasing out such moduli by the end of the year 2010."

 

So, its kinda like a win win for the scientists but not for the general purpose hackers as they cant be used until we get that amount of hardware to use and hence to crack that 768-bit crypto.

 

"It's an important milestone," said Benjamin Jun, vice president of technology at security consultancy Cryptography Research.

 

RSA 768 Bit Crypto Cracked

 

We have the research paper just for you guys, its all like maths thing if you want to read you can or you can download it too.

 

Happy Hacking @hackerthedude

Related Posts Tags : Guides/NewsRSA Crypto 768-Bit Keys Cracked

Yes, you heard it right one of the most famous and which have been for years to encrypt the communication standards have been cracked by a bunch of scientists who took about two-and-a-half years and hundreds of general-purpose computers.

 

 

This accomplishment was reached on December 12. In my eyes it would have been very much harder to crack this kind of cryptography because it is so much calculated and so much hard to to crack…

The team managed to factor the 232-digit number that RSA held out as a representative 768-bit modulus from a now-obsolete challenge. They spent half a year using 80 processors on polynomial selection.

 

Sieving took almost two years and was done on "many hundreds of machines". Using a single-core 2.2GHz AMD Opteron with 2GB RAM, sieving would have taken about 1,500 years, they estimated.

 

The only word come in my mouth right now is WOW.

"There's indisputable evidence here that 768-bit key are not enough. It's a pretty interesting way to close out a decade."

But as a matter of fact this is not the end as the new RSA crypto, which would be coming soon, is 1024 – Bit which would be much more harder to crack then all the previous one’s .

 

"If we are optimistic, it may be possible to factor a 1024-bit RSA modulus within the next decade by means of an academic effort on the same limited scale as the effort presented here," authors of the research wrote.

 

"From a practical security point of view this is not a big deal, given that standards recommend phasing out such moduli by the end of the year 2010."

 

So, its kinda like a win win for the scientists but not for the general purpose hackers as they cant be used until we get that amount of hardware to use and hence to crack that 768-bit crypto.

 

"It's an important milestone," said Benjamin Jun, vice president of technology at security consultancy Cryptography Research.

 

RSA 768 Bit Crypto Cracked

 

We have the research paper just for you guys, its all like maths thing if you want to read you can or you can download it too.

Continue reading →

Latest Android Crypto Exploit Allow Attacker to read WhatsApp , facebook , Instagram Chat Database

type='html'>

Bad programming practices , Android malware attack is to open the database backup WhatsApp chat.

Boss Bosschert, a self- billed "consultant / sysadmin / business , " that is used by WhatsApp messages stored locally on the local access database file system as any other Android, read by the application of shows how that can be a proof of concept exploit is performed .

were.

WhatsApp Boss chert proof of concept that the silence of the SQLite database used to steal one and the Android application , involved created . After that he moved for work to a remote web server results.

A key aspect of the exploitation and possible mitigating factor : the program from your backup function placed on the phone 's SD card , only copies of the database access . Database as a backup , there is stored , it can read SD Card will be accessible to any application . The Android developer docs on an external card to store data that is inherently unsafe, says in no uncertain terms.

For this purpose , WhatsApp backup database is encrypted , but with Bosschert work around this exploit . No common encryption - for one , each has the same AES key to encrypt WhatsApp user database was used . (Bosschert a simple Python script to perform the decryption provided . )

What is doubly ironic , as exposed by Bosschert with WhatsApp biggest weaknesses are easily solved with good programming practices is how . Including features to external storage , Android introduced to enhance security features, support for many , it may not be available for all users means - unfortunately, wide compatibility with this app WhatsApp seems to aim for .

WhatsApp is insecure programming practices has been nailed for the first time .the main mistake was committed.

In principle , surreptitiously stealing from other applications apps that have been banned from the Google Store , but such programs can be difficult to police. It thus on the Android community - as sometimes in users monitoring is the only way to bring these matters.

Cryptography is hard to do well , and WhatsApp as wide a user base as a request is too difficult to implement it properly . WhatsApp is siphoned off , but the data can be decrypted subtle ways in which not only serve as an important warning ought to matter.

Who Got Hacked , copy rights

View the original article here

Continue reading →