“However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,”
Yeah, try not to sound too butthurt about being very publically called out. I doubt they could get back in the business even if they wanted to after such disgrace.
Many moons ago, long before generative slop coding, I made research on a file storage company for a project. I was already suspicious by their business page being fronted only by two smiling middle aged men without any trace is software engineering in their credentials. They claimed to have all kinds of certificates and whatnot. And they happily accepted that I made an admin account with a one letter password. Some more poking around and it didn't get any better.
Incompetence is everywhere. Do not trust that anybody selling services in the cloud have any idea what they are doing.
The CRL’s were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.
Lmao I have no words.
I have to assume that they were meant to set the private key based on an array value lookup at index 4 etc. and had a bug in the code that returned the index instead of the value
Spaceballs level security
They scammed their way into this, it’s very common for such companies to have scammers inside out.
4
I could have been a master hacker, but I only tried 1, 2 and 3 then gave up. Curse my lack of persistence!
Their stock crashed hard as well in India
Hell of a week to be in infosec.
Imagine trying to brute force the key, well knowing that it should take several forevers and your script returns "4" immediately after you press enter.
I was trying to explain this to the offices normies and I sounded insane.
That made me realize maybe I don’t even understand it completely. Then I read this article.
No. It was that dumb. So dumb it sounds implausible. But that’s how bugs are. So dumb someone would assume it’s impossible or never even think about it.
resigned with
re-signed, right?
This has inspired some really good, simple memes though
4
all 11 comments