Crypto News

[Dr Sardonicus]

Also interesting is how Microsoft learned of the problem...

[retina]

Originally Posted by retina

Apparently the final patch for 7 has a fix.

And also I read, the older versions of Windows don't support the ECC crypto so are not affected.

Correction: Older versions of the crypt32.dll do support ECC but don't support the custom parameters settings that this exploits needs. So the only versions of Windows that are affected are W10 and W10 Server.

And people using W10 are already not concerned about their privacy since MS already watches them, so those people shouldn't care about other agents also getting their data.

[retina]

Firefox uses its own certificate checking code, even on W10. So for browser users on W10 using FF you won't be vulnerable.

You can test your stuff here. If the page loads successfully then you have a problem. If you get an error similar to "improperly formatted DER-encoded message." then you are good to go.

[xilman]

Originally Posted by retina

And people using W10 are already not concerned about their privacy since MS already watches them, so those people shouldn't care about other agents also getting their data.

Privacy is not binary.

Some entitities are more trustworthy than others. There is stuff of mine for which I have no qualms SWMBO accessing but would prefer not to be available to a global readership.

[Stargate38]

I'm glad they patched it, otherwise we would've been hacked and not know about it until it was too late.

@retina: I use Pale Moon. For me, the security error is "SEC_ERROR_BAD_DER", so I should be OK security-wise.

[chris2be8]

Konqueror said:

The server failed the authenticity check (chainoffools.wouaib.ch).

The certificate is not signed by any trusted certificate authority

Which would put me on my guard if I was trying to connect to anywhere important.

Chris

[LaurV]

Originally Posted by xilman

Privacy is not binary.

Some entitities (sic)...

You sure didn't mean boolean? About the last one, we really have some hard time trying to read it

[xilman]

https://www.bbc.com/news/world-europe-51467536

though David Kahn (IIRC) reported a similar situation in his The Codebreakers which was published around 50 years ago.

[Dr Sardonicus]

US cybersecurity agency warns of 'grave' threat from hack

The cybersecurity agency previously said the perpetrators had used network management software from Texas-based SolarWinds^† to infiltrate computer networks. Its new alert said the attackers may have used other methods, as well.
<snip>
Another U.S. official, speaking Thursday on condition of anonymity to discuss a matter that is under investigation, said the hack was severe and extremely damaging although the administration was not yet ready to publicly blame anyone for it.

"This is looking like it’s the worst hacking case in the history of America," the official said. "They got into everything."

^†"They're not a household name the same way that Microsoft is. That's because their software sits in the back office," said Rob Oliver, a research analyst at Baird who has followed the company for years. "Workers could have spent their whole career without hearing about SolarWinds. But I guarantee your IT department will know about it."

Now plenty of other people know about it, too. One of SolarWinds' customers, the prominent cybersecurity firm FireEye, was the first to detect the cyberespionage operation, and began notifying other victims. Among other revealed spying targets were the U.S. departments of Treasury and Commerce.