Category Archives: Cryptography

Let’s Encrypt – getting your own (free) SSL certificates

Posted on by

For those who’ve not been paying attention the Let’s Encrypt project entered public beta recently so that anyone could get their own SSL certificates. So I jumped right in with the simp_le client (as the standard client tries to configure Apache for you, and I didn’t want that as my config is pretty custom) and used this tutorial as inspiration.

My server is running Debian Squeeze LTS (for long painful reasons that I won’t go into here now) but the client installation was painless, I just patched out a warning about Python 2.6 no longer being supported in venv/lib/python2.6/site-packages/cryptography/__init__.py. 🙂

It worked well until I got rate limited for creating more than 10 certificates in a day (yeah, I host a number of domains).

Very happy with the outcome, A+ would buy again.. 🙂

News Corporation – the new face of piracy

Posted on by

According to Panorama from the BBC in the UK it appears Sky TV in the UK had a subsidiary involved with people cracking On Digital’s smartcards and also with people running a website to share the keys from those smartcards.

Of course News Corporation is a multinational, so it wouldn’t surprise you to know that there are now allegations that they were involved in similar antics here in Australia:

News Corporation is alleged to have used a security division known as Operational Security to encourage hackers to pirate the smart cards of rival pay TV operators including Austar and Optus, thereby draining them of revenue and devaluing the businesses.

Perhaps FACT, AFACT. MPAA, etc should adjust their “piracy funds terrorism” to warn that by supporting piracy you will be supporting Rupert Murdoch, News Corporation, Sky, Fox News, etc.. That would put a lot more people off..

Serious SSL Renegotiation Problem

Posted on by

This just in from Ben Lawrie:

For the last 6 weeks or so, a bunch of us have been working on a really serious issue in SSL. In short, a man-in-the-middle can use SSL renegotiation to inject an arbitrary prefix into any SSL session, undetected by either end.

But wait, there’s more..

To make matters even worse, through a piece of (in retrospect) incredibly bad design, HTTP servers will, under some circumstances, replay that arbitrary prefix in a new authentication context. For example, this is what happens if you configure Apache to require client certificates for one directory but not another. Once it emerges that your request is for a protected directory, a renegotiation will occur to obtain the appropriate client certificate, and then the original request (i.e. the stuff from the bad guy) gets replayed as if it had been authenticated by the client certificate. But it hasn’t.

Ben has a patch against the current development head of OpenSSL to ban renegotiation, but for most people it’ll need backporting to their current OpenSSL versions..

UK Government Apologises to Alan Turing

Posted on by

55 years after Alan Turing, one of the fathers of modern computing and one of the intellectual powerhouses behind the achievements of Bletchley Park, committed suicide following his conviction for “gross indecency” for being gay and his subsequent exile from GCHQ the UK Prime Minister has apologised for his treatment.

Turing was a quite brilliant mathematician, most famous for his work on breaking the German Enigma codes. It is no exaggeration to say that, without his outstanding contribution, the history of World War Two could well have been very different. He truly was one of those individuals we can point to whose unique contribution helped to turn the tide of war. The debt of gratitude he is owed makes it all the more horrifying, therefore, that he was treated so inhumanely. In 1952, he was convicted of ‘gross indecency’ – in effect, tried for being gay. His sentence – and he was faced with the miserable choice of this or prison – was chemical castration by a series of injections of female hormones. He took his own life just two years later. […] we’re sorry, you deserved so much better.

The BBC has a good article on Turing, his persecution and the apology.

Alan, we all owe you a massive debt of gratitude for all your work and I’m very sorry the UK treated you so very cruelly. We cannot right those wrongs, all we can hope to do is to learn from them and try to not let them be repeated.

(Heard via an InsideHPC blog)

The snooping dragon: social-malware surveillance of the Tibetan movement

Posted on by

Shishir Nagaraja of the University of Illinois at Urbana-Champaign and Ross Anderson of Cambridge University have published a very interesting paper called “The snooping dragon: social-malware surveillance of the Tibetan movement” (abstract, full report) on how agents of the Chinese government managed to infiltrate the computer network of the Dalai Lama’s organisation through ingenious social engineering and gain access to intelligence information that could lead to peoples arrest and possible execution.

It’s a very interesting report and points out that the techniques used are within the reach of motivated individuals as well as government intelligence agencies and ponders how much less well known organisations can cope with such attacks; it also lends weight to the sage advice offered in Ross Andersons “Security Engineering” book. Both are well worth a read, even for those of us whose network security is not a literal matter of life or death.

Redacted NSA Cold War History Released

Posted on by

Via Bruce Schneier, a redacted version of the NSA’s “American Cryptology during the Cold War, (1945-1989)“ has been released thank to a request from the George Washington Universities National Security Archive project.

It includes a rather interesting section (book 1, pages 18 and 19) on how, in 1947, the UK foreign intelligence agency, SIS, decrypted some KGB messages from Canberra that turned out to include classified UK intelligence military estimates. This caused the US to break off crypto intelligence sharing with Australia putting the British in an awkward situation; as Clement Attlee put it:

The intermingling of American and British knowledge in all these fields is so great that to be certain of of denying American classified information to the Australians, we should have to deny them the greater part of our own reports. We should thus be placed in a disagreeable dilemma of having to choose between cutting of relations with the United States in defence questions or cutting off relations with Australia.

It took 5 years, the establishment of ASIO and a change in government from Chifley to Menzies before the US would reestablish full resumption of cryptologic exchanges with Australia and the author of the history concludes that this has a very bad effect on early American intelligence efforts against China.

The cause of the original leak to the KGB ? Two “leftists” in the Australian diplomatic service…

Rogue CA – MD5 collisions for phun and profit

Posted on by

Now this is, umm, interesting..

We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This certificate allows us to impersonate any website on the Internet, including banking and e-commerce sites secured using the HTTPS protocol.

Trust no one..

(Via)

A Tale of Two Transport Hacks

Posted on by

In the USA a court has ordered that three MIT students not talk at DEFCON about their security assessment of the Massachusetts Bay Transit Authority (MBTA) fare cards. Apparently the court believes that “discussing the flaws at a public conference constituted a ‘transmission’ of a computer program that could harm the fare collection system“, which is pretty sad. There are more documents at Cryptome on the case. Their presentation was to include a cryptanalysis of the Mifare “Classic” card, which takes us to our second case..

Bruce Schneier reports that a group of Dutch researchers have won in court to be able to publish their own cryptanalysis of that very same Mifare Classic card, with the court stating:

Damage to NXP is not the result of the publication of the article but of the production and sale of a chip that appears to have shortcomings.

An outbreak of common sense that the MIT students could only dream of. I wonder if they could appeal and cite this case as grounds to have the judgement overturned ?