The Glider

One of our handlers posted this to our list and I though I would share (thanks Swa). The CVE has concluded that the NDSS Conference presentation of Revoked Yet Still Resolvable [1] to be verifiable but due to the protocol. [2]

[1]http://www.internetsociety.org/events/ndss-symposium-2012/symposium-program/feb08
[2]https://www.isc.org/software/bind/advisories/cve-2012-1033

Richard Porter
--- ISC Handler on Duty (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

There was a post on Ars Technica yesterday, that led back to another blog post from Sunday that suggests that Google Chrome will stop doing CRLchecks at some point in the not too distant future. This has led to some interesting debate because the CRLmechanism has largely been ineffective. For a public key infrastructure (PKI) such as HTTPS to work, there must be an effective way of verifying the validity of the certificates. Due to the number of Certificate Authority (CA) breaches in recent years we'd all like a fast and effective method of taking compromised certificates out of play. During the highest profile breaches, all the major browser vendors simply pushed new versions of the browser with the root certificates from the breached CAs removed, in part because the browsers by design fail open (allow the connection)if they are unable to verify the certificate. So, is this a big deal? Is it the right way to go? Is it time to rethink/redesign/replace SSLor HTTPS? What do you think?
References
http://arstechnica.com/business/guides/2012/02/google-strips-chrome-of-ssl-revocation-checking.ars
http://www.imperialviolet.org/2012/02/05/crlsets.html
---------------

Jim Clausing, GIAC GSE #26

jclausing --at-- isc [dot] sans (dot) edu (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Thank you to everyone who wrote in on the FDIC FIL 3- 2012 guidance to banks.......

Hackers claiming affiliation with Anonymous have launched a distributed denial-of-service (DDoS) attack on the Swedish government's main website.......

The commander of the US Army Military District of Washington has announced that Pfc.......

The computer network of US Department of Commerce's Economic Development Administration (EDA) has been hit with what appears to be a virus, forcing EDA to disable email and Internet access until an investigation determines the cause and scope of the problem.......

BT Junkie, a torrent search engine that is unaffiliated with BitTorrent, has voluntarily shuttered its website, ostensibly over concerns that it may be the target of law enforcement action similar to that which forced the shutdown of Megaupload.......

A California company has filed a lawsuit seeking damages from more than 50 named and unnamed Massachusetts individuals for participating in illegal filesharing.......