For people who are curious, the Bugzilla report has a number of details not disclosed here (this commentary is also pretty good). Anyway, what the actual fuck, how is one of the private keys "4"?...
For people who are curious, the Bugzilla report has a number of details not disclosed here (this commentary is also pretty good).
Anyway, what the actual fuck, how is one of the private keys "4"? (meme, and somehow a relevant xkcd)
EM-DV-TLS-CA-G3B.pub.pem: d = 0x9c
EM-DV-TLS-CA-G3C.pub.pem: d = 0xe6
EM-EV-TLS-CA-G3B.pub.pem: d = 0x73
EM-EV-TLS-CA-G3C.pub.pem: d = 0x38
EM-OV-CS-CA-G3B.pub.pem: d = 0x42
EM-OV-CS-CA-G3C.pub.pem: d = 0xed
EM-OV-TLS-CA-G3B.pub.pem: d = 0x9b
EM-OV-TLS-CA-G3C.pub.pem: d = 0x04
All of them are one byte each!? Edit: This is even more hilarious.
All of them are one byte each!?
Edit:
Mozilla was able to recover the private keys for the impacted certificates independently @ 21:48 UTC (note: less than two hours after receiving the report) and without any knowledge of the method the original reporter used, confirming the key generation process was flawed and is trivial to exploit.
Several publicly trusted intermediate CAs have been compromised, allowing anyone to generate fake certificates for any website or service. Patches are quickly rolling out, the page has a tester to...
Several publicly trusted intermediate CAs have been compromised, allowing anyone to generate fake certificates for any website or service.
Patches are quickly rolling out, the page has a tester to see if the intermediate CAs are still trusted by your system.
Who is impacted? Anyone with a device that can connect to the internet. It means that if you go to, say, tildes.net, you could end up on a tildes.net that's not owned by Deimos. How could that...
Who is impacted? Anyone with a device that can connect to the internet.
It means that if you go to, say, tildes.net, you could end up on a tildes.net that's not owned by Deimos. How could that happen? If you were on a compromised wifi network, for instance. This is called a man-in-the-middle attack.
What would happen then? Well, on the fake tildes.net, you may enter your login and password, which the attacker now has. Or, the attacker may faithfully transmit your data to the real tildes, but log all of it.
How likely is that to happen? To be honest, not all that likely. Hostile wifi is the most likely time when you'd get MITM. There's other cases, like hypothetically your ISP could do it, or the NSA can do it, or hostile devices on your network can potentially due with ARP hijacking. If you're on a VPN, the VPN can do it. But none of that is all that likely.
Nonetheless, you have to get updates to revoke the root certificate from the trusted list on an OS level. Another reason to keep your devices updated!
A certificate tells you whether a website is who they say they are. Certificates are signed and verified by certain providers, and that's how your browser knows that the certificate matches the...
A certificate tells you whether a website is who they say they are. Certificates are signed and verified by certain providers, and that's how your browser knows that the certificate matches the website.
There's a certain type of attack known as a man-in-the-middle (MITM) attack, where an attacker intercepts your request for a website, and returns a different website instead. Sometimes this website will look identical to the one you mean to go to, but as it's not the real one, if you enter a password or something, they now have a copy of your password. This is usually stopped by the certificate, which tells you that the website you loaded isn't the one that matches what the certificate says.
The exploit lets an attacker sign a "fake" certificate, which means your browser might not notice when a MITM attack is taking place. For all intents and purposes, your browser believes that it's going to the "real" website.
For people who are curious, the Bugzilla report has a number of details not disclosed here (this commentary is also pretty good).
Anyway, what the actual fuck, how is one of the private keys "4"? (meme, and somehow a relevant xkcd)
Full list of keys:
All of them are one byte each!?
Edit:
This is even more hilarious.
Several publicly trusted intermediate CAs have been compromised, allowing anyone to generate fake certificates for any website or service.
Patches are quickly rolling out, the page has a tester to see if the intermediate CAs are still trusted by your system.
So excited for all the upcoming write ups about all the ways this was used to jailbreak old stuff!
Can someone ELI5 what exactly this means, and give some examples of who and what could be impacted by this?
Who is impacted? Anyone with a device that can connect to the internet.
It means that if you go to, say, tildes.net, you could end up on a tildes.net that's not owned by Deimos. How could that happen? If you were on a compromised wifi network, for instance. This is called a man-in-the-middle attack.
What would happen then? Well, on the fake tildes.net, you may enter your login and password, which the attacker now has. Or, the attacker may faithfully transmit your data to the real tildes, but log all of it.
How likely is that to happen? To be honest, not all that likely. Hostile wifi is the most likely time when you'd get MITM. There's other cases, like hypothetically your ISP could do it, or the NSA can do it, or hostile devices on your network can potentially due with ARP hijacking. If you're on a VPN, the VPN can do it. But none of that is all that likely.
Nonetheless, you have to get updates to revoke the root certificate from the trusted list on an OS level. Another reason to keep your devices updated!
A certificate tells you whether a website is who they say they are. Certificates are signed and verified by certain providers, and that's how your browser knows that the certificate matches the website.
There's a certain type of attack known as a man-in-the-middle (MITM) attack, where an attacker intercepts your request for a website, and returns a different website instead. Sometimes this website will look identical to the one you mean to go to, but as it's not the real one, if you enter a password or something, they now have a copy of your password. This is usually stopped by the certificate, which tells you that the website you loaded isn't the one that matches what the certificate says.
The exploit lets an attacker sign a "fake" certificate, which means your browser might not notice when a MITM attack is taking place. For all intents and purposes, your browser believes that it's going to the "real" website.