Author Archives: Hacker Medic

???? IPS ???????? 32 ????? Internet Explorer ???

破損した IPS 定義パッケージをインストールした結果、32 ビット版の Internet Explorer で問題が発生することが確認されていますのでご注意ください。シマンテックは、この問題に対応した修正版の定義パッケージを LiveUpdate サーバーを介してリリースいたしました。
Read More

Corrupt IPS definition package impacted Internet Explorer 11

Symantec is warning that our IPS 20150220.001 definition package was causing Internet Explorer 11 to crash. We have released a fix for this issue through our LiveUpdate servers.Read More

Superfish

      No Comments on Superfish
What you need to know

A security flaw was discovered in software that was pre-installed on some Lenovo laptops. Lenovo has issued the following Press Release.  The story has been reported on multiple sites (for example, here and here). We applaud Lenovo for quickly publishing details on affected models and instructions for removing the flaw. The problem lies in the software from a company called Superfish that was pre-installed by Lenovo on certain computers. The main function of the software was to intervene when the user performed web searches in IE or Chrome browsers, and insert Superfish’s content into the search result page. Lenovo enabled this software to “help users find and discover products visually”, by incorporating relevant search results not offered by the search engine.

Interjecting content in web pages is not new (for example, via browser add-ons), but Superfish’s approach was novel, and didn’t use a browser add-on. Instead, the software intercepted all traffic between the browser and the network external to the computer. But since most large search engines (such as, Google, Bing, and Yahoo) now serve all content over https, the Superfish software couldn’t read (and more importantly, modify) any of that encrypted traffic. To get around this, an SSL Man-in-the-Middle (MITM) was set up in the computer itself, creating fake SSL certificates with the domain name of the intended web site. These certificates were signed by or chained up to Superfish’s private root certificate. Ordinarily, browsers would display a prominent warning that such a certificate wasn’t trusted, so that was addressed that by injecting Superfish’s root certificate into the Windows trusted root store during manufacture. To make all this work, of course, the private key corresponding to that root certificate had to be pre-installed on all of these computers. Superfish took steps to encrypt that private key, but the encryption was trivial and quickly broken.

The result is that attackers now have the private key corresponding to a root certificate that is trusted in these Lenovo computers, and that can be abused in too many ways to describe here.

In some ways, this is similar to the recent incident with Gogo inflight wifi service. Both make use of an SSL MITM technique to insert themselves into the otherwise secure connection between a browser user and the websites they visit. See our recent blog post to learn how SSL MITM attacks work. In Gogo’s case, the MITM (the actor generating certificates on the fly) was in Gogo’s network; in Superfish’s case, the MITM is in the computer itself.

As we’ve said before, SSL Man-in-the-Middle solutions can be justified within an enterprise, for example, to monitor employees’ web traffic. But the well-intentioned inclusion of Superfish had unintended consequences far beyond web searching, and created a potential for malicious MITM attacks. Pre-installing any root that does not belong to an audited Certificate Authority and marking it as trusted undermines the trust model created and maintained by platform vendors, browser vendors, and Certificate Authorities. Platform and browser vendors go to great lengths to validate the Certificate Authorities whose roots they include in their trusted root store. Microsoft provided the ability for an enterprise to add additional roots to the Windows trusted root store, and Google Chrome explicitly avoids performing public-key pinning checks for such added roots. As a result, Chrome users receive no warning of the MITM, as they did in the Gogo incident.

If you think you may have an affected Lenovo computer, visit this web site to check. Uninstalling the Superfish software isn’t enough to remove the vulnerability – you must also remove the Superfish root from the Windows trust store. The instructions provided by Lenovo achieve both objectives.

Women Make Great Engineers

      No Comments on Women Make Great Engineers
Twitter Card Style: 

summary

Gender diversity in workforce is much talked about topic these days. So much that in some companies they have very stringent goals and defined hiring process to bring in diversity in the workforce.  So why is having more women in the workforce and especially more women in engineering so imperative? We are possibly looking at 50% of the potential workforce and that cannot be ignored. It is also a well-known fact that companies that have better diversity have better engagement rates and have higher profitability. There are several studies and surveys that prove this point. While I don’t want to delve deeper into those points, I want to touch upon factors that keep women from opting for engineering careers and even if they opt why they seem not to be aggressively pursuing their careers.

There are several social and cultural factors that go into creating the mindsets for women and men, which varies across the globe. However, pretty surprisingly there is a common pattern all over; women are really good at multitasking, and tend to be perfectionistic as well as prioritize family over career. Great qualities indeed and let me tell you, there is no need to change that.  Also, there are phases where women tend to give up their engineering careers midway through, which are essentially life changing, like getting married, bearing kids etc. There is no need to escape these important and wonderful phases of life, it is just a matter of learning to work around them and still have a great engineering career.

Strive for excellence and not perfection!

I have seen many women around me, and in my own team, feeling guilty that they could not be a better mother, wife, daughter-in-law etc. Many women at this phase will give up their careers, where the guilt gets the better of them. Where is this feeling of guilt arising, it is predominantly due to the inherent quality for women to seek perfection in everything they do – perfect employee, perfect mother, perfect cook and the list goes on. It is also from the fact that we tend to do everything ourselves. Letting go of things that others can do and concentrating of chores/activities that only I must do, has been a constant lesson for me. But, once l learnt this art, it has been liberating experience. While, I try to be “as good as I can be” mother/engineer, I stopped beating myself up for not being a perfect one! Furthermore, I am able to make more time these days to spend with my kids since I delegated work to others! 

Please note that I now only seek excellence and not perfection! The reason I tended to do everything myself earlier was because I thought I can do it perfectly and no one else could! I delegate better, have found bandwidth to do more exciting things at work. And behold! It is already bearing dividends! Suddenly my career seems to be blooming while I am able to take care of my family too!

women_in_engineering.jpeg

Why try to fit in when we can stand out?

I have constantly thought of fitting in to the system around me both in office and at home. It has taken a lot of mentoring and coaching from my friends, colleagues, family and my managers to unlearn the constant urge to fit in.  I learnt to celebrate the difference in my thought process whether in design discussions, meetings, everywhere! In fact, it took a while for me realize that the difference in my perspective is the real value I bring to table.  Don’t feel isolated for thinking differently, instead that is our unique selling position ladies! 

Look for role models – there might not many role models for women folk to look up to and get inspired in their immediate organizations. It will help to motivate other women if they have a role model around. In case there are none, look for ones in extended organizations. For example, I had the privilege to interact with our HR Vice President, Amy Cappellanti, and needless to say, that it was highly inspiring. I have heard similar thoughts from my female colleagues in Mountain View, who had the opportunity to interact with Roxane Divol, the Senior Vice President of our Trust Services BU. We must aim to become a role model ourselves. Help our friends to pursue relentlessly towards engineering excellence. 

Finally, Sky is the limit! What say ladies!!

Equation: Grupo avançado de ciberespionagem conhece todos os truques, e mais

cibercriminosos Sofisticados do Equation levam Malware para outro patamar.Read More

Equation: Advanced cyberespionage group has all the tricks in the book, and more

Sophisticated Equation attackers take malware to a new level.Read More

The New 39-Month SSL Certificate Maximum Validity

Changes in CA/B Forum Baseline Requirements

Twitter Card Style: 

summary

The past few years within the SSL certificate industry have been busy with changes.  1024-bit RSA certificates are long gone, using public SSL certificates on servers with internal domain names is starting to disappear, and the SHA-1 hash algorithm is starting to see its final days.  So what is next?

Starting 1 April 2015, Certification Authorities (CAs) are not permitted to issue SSL certificates (issued from a public root) with a validity period greater than 39 months.  SSL certificates have limited validity periods so that the certificate’s holder identity information is re-authenticated more frequently. Plus it’s a best practice to limit the amount of time that any key is used, to allow less time to attack it.

In line with the latest Certification Authority/Browser Forum Baseline Requirements, CAs will stop issuing 4 and 5-year SSL certificates in the near future.  Symantec plans on eliminating these options in late February 2015 on all SSL management consoles.  Extended Validation (EV) SSL certificates still have a max validity period of 27 months but Organizational Validated (OV) and Domain Validated (DV) certificates (DV not offered by Symantec) will have this new 39-month lifespan.

So how will this affect those who install SSL certificates?  The average person installing certificates in a large enterprise will have to go through the enrollment process a little more often.  If the organization on that level and scale finds this detracts from employee productivity they may want to look at leveraging Symantec Certificate Intelligence Center Automation.  To someone in a small organization who only issues SSL certificates on a very infrequent basis, they may find themselves looking for SSL installation instructions a little more often.  To help you, Symantec has always offered a wealth of information online via our Knowledge Base (the preceding site will be migrating to this location in the near future) and offers amazing support by phone.

Hourglass 350x350.jpg

Please let us know what you think below in the comment section.

The New 39-Month SSL Certificate Maximum Validity

Changes in CA/B Forum Baseline Requirements

Twitter Card Style: 

summary

The past few years within the SSL certificate industry have been busy with changes.  1024-bit RSA certificates are long gone, using public SSL certificates on servers with internal domain names is starting to disappear, and the SHA-1 hash algorithm is starting to see its final days.  So what is next?

Starting 1 April 2015, Certification Authorities (CAs) are not permitted to issue SSL certificates (issued from a public root) with a validity period greater than 39 months.  SSL certificates have limited validity periods so that the certificate’s holder identity information is re-authenticated more frequently. Plus it’s a best practice to limit the amount of time that any key is used, to allow less time to attack it.

In line with the latest Certification Authority/Browser Forum Baseline Requirements, CAs will stop issuing 4 and 5-year SSL certificates in the near future.  Symantec plans on eliminating these options in late February 2015 on all SSL management consoles.  Extended Validation (EV) SSL certificates still have a max validity period of 27 months but Organizational Validated (OV) and Domain Validated (DV) certificates (DV not offered by Symantec) will have this new 39-month lifespan.

So how will this affect those who install SSL certificates?  The average person installing certificates in a large enterprise will have to go through the enrollment process a little more often.  If the organization on that level and scale finds this detracts from employee productivity they may want to look at leveraging Symantec Certificate Intelligence Center Automation.  To someone in a small organization who only issues SSL certificates on a very infrequent basis, they may find themselves looking for SSL installation instructions a little more often.  To help you, Symantec has always offered a wealth of information online via our Knowledge Base (the preceding site will be migrating to this location in the near future) and offers amazing support by phone.

Hourglass 350x350.jpg

Please let us know what you think below in the comment section.