949
The Internet goes on high alert after discovery of 8 compromised TLS certs (arstechnica.com)
submitted 2 weeks ago by to c/technology@lemmy.world
153 comments fedilink hide all child comments
 

Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.

https://emudhra.we-have-a-problem.com/

Xkcd 221: int getRandomNumber() { return 4; // chosen by fair dice roll. guaranteed to be random. }

you are viewing a single comment's thread
view the rest of the comments
[–] 64 points 2 weeks ago (2 children)

At this early stage, the most immediate threat appears to be for those using VPNs, especially in countries with governments likely to maliciously intercept traffic.

So, all governments?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 5 points 2 weeks ago (1 child)

    I'm confused, doesn't a VPN help protect against mitm in public networks? Are you saying that governments might use this at VPN exit nodes? That actually makes sense

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 9 points 2 weeks ago*

    For VPNs to be vulnerable, the VPN provider's internal traffic must flow through an MITM server before exiting the VPN provider's internal network. VPN providers don't have any specific weakness or flaw that would would make an MITM attack easier to execute, but it is definitely true that a VPN provider would be a high-value target for such an attacker, both because a large volume of traffic flows through the VPN provider, and also because people who use a VPN provider are more likely to be doing so because they are doing things that their government wouldn't approve of.

  • permalink
  • fedilink
  • source
  • parent