Collaborate Disseminate
In late March 2019, we briefly highlighted our research on ShadowHammer attacks, a sophisticated supply chain attack involving ASUS Live Update Utility. Now it is time to share more details about the research with our readers. Continue reading Operation ShadowHammer: a high-profile supply chain attack
Operation ShadowHammer is a newly discovered supply chain attack that leveraged ASUS Live Update software. While the investigation is still in progress and full results and technical paper will be published during SAS 2019 conference in Singapore, we would like to share some important details about the attack. Continue reading Operation ShadowHammer
Let’s Encrypt certificates can now stand on their own for almost all newer versions of operating systems, browsers and devices. Continue reading Microsoft Adds Direct Trust for Let’s Encrypt
Way back in 2013 our malware analysts spotted the first malicious samples related to the Trojan-Ransom.Win32.Rakhni family. That was the starting point for this long-lived Trojan family, which is still functioning to this day. Now the criminals have decided to add a new feature to their creation – a mining capability. Continue reading To crypt, or to mine – that is the question
Google has put websites signed with WoSign/StartCom SSL certificates on notice that it will no longer trust certs from the Chinese CA starting in Chrome 61. Continue reading Google to Fully Distrust WoSign/StartCom SSL Certs in Chrome 61
Security tools that proxy and inspect HTTPS traffic create a blindspot for network administrators trying to determine whether communication between clients and servers is secure. Continue reading US-CERT Warns HTTPS Inspection May Degrade TLS Security
A bug in GoDaddy’s domain validation process forced the registrar to revoke SSL certificates and reissue certs for more than 6,000 customers. Continue reading Buggy Domain Validation Forces GoDaddy to Revoke Certs
Google released its final SHA-1 deprecation deadlines, and crypto services provider Venafi said that 35 percent of the web is still running weak SHA-1 certificates. Continue reading Google Removing SHA-1 Support in Chrome 56
Mozilla has proposed banning new SHA-1 certificates from Chinese Certificate Authority WoSign for one year after it accused the CA of back-dating the deprecated certs. Continue reading Mozilla Wants to Drop WoSign as Trusted CA
Crypto company Venafi points out potential holes in Yahoo’s processes and policies around cryptography and digital certificates, any of which could have been exploited in the breach to move data off the Yahoo network. Continue reading Questions Mount Around Yahoo Breach