Lavabit — Encrypted Email Service Once Used by Snowden, Is Back

Texas-based Encrypted Email Service 'Lavabit,' that was forced to shut down in 2013 after not complying with a court order demanding access to SSL keys to snoop on Edward Snowden's emails, is relaunching on Friday. Lavabit CEO Ladar Levison had custody of the service's SSL encryption key that cou...

How to Capture SSL Master Keys When Running an nstrace on NetScaler

This article describes how to capture SSL master keys when running an nstrace on NetScaler Background From NetScaler 11.0-66+ and 11.1/12.0 all builds, the "start nstrace" command has a new parameter, -capsslkeys, with which you can capture the SSL master keys for all SSL sessions. If the...

Sony Pictures Vue - Certificates or keys found, Customized SSL, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Sony Pictures Vue published at the 'play' market has multiple vulnerabilities...

Network traffic encrypted using RSA-based SSL certificates over SSLv2 may be decrypted by the DROWN attack

Overview Network traffic encrypted using an RSA-based SSL certificate may be decrypted if enough SSLv2 handshake data can be collected. This is known as the "DROWN" attack in the media. Description According to the researcher, "DROWN" is a new form of cross-protocol Bleichenbacher padding oracle...

Westermo Industrial Switch Hard-coded Certificate Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-028-01 Westermo Industrial Switch Hard-Coded Certificate Vulnerability that was published January 28, 2016, on the NCCIC/ICS-CERT web site. Independent researcher Neil Smith has identified a hard-coded certifica...

Encrypted Email Servers Seized by German Authorities After School Bomb Threats

In the wake of a hoax bomb threat, all public schools in Los Angeles were closed for a day last week, and now German authorities have seized an encrypted email server. But, Does that make sense? In a video statement posted on Monday, the administrator of Cock.li – an anonymous email provider...

CVE-2014-5247

Ganeti 2.10.0 prior to 2.10.7 and 2.11.0 prior to 2.11.5 are affected by CVE-2014-5247. The vulnerability arises from the _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py, which stores the configuration backup with world-readable permissions. This exposure allows local user...

CVE-2014-5247

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

CVE-2014-5247

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

Community Health data leak suspected of the use of the Heartbleed vulnerability-a vulnerability warning-the black bar safety net

When the Heartbleed OpenSSL vulnerability in 4 months is discovered, the security community many experts are warning that the vulnerability could be used to expose sensitive data, although at the time also there is no evidence that attackers are actively using Heartbleed vulnerability. And now, a...

[oCERT-2014-006] Ganeti insecure archive permission

2014-006 Ganeti insecure archive permission Description: Ganeti, an open source virtualisation manager, suffers from an insecure file permission vulnerability that leads to sensitive information disclosure. The Ganeti upgrade command 'gnt-cluster upgrade' creates an archive of the current...

CloudFlare Launches Bug Bounty Program

As the OpenSSL heartbleed saga unfolded over the last couple of weeks, one of the companies that was at the forefront of figuring out the scope and effects of the problem was CloudFlare. The company put up a challenge server, asking researchers to hit it with the heartbleed exploit to determine...

Federal Court Rejects Lavabit's Contempt Appeal

A Federal court struck down Lavabit’s appeal today, affirming contempt of court sanctions against the now-shuttered secure email provider that was forced to release its SSL keys to the FBI last year. Those keys could have decrypted emails belonging to the company’s founder Ladar Levison along wit...

Certificate Revocation Slow on Heartbleed Web Servers

The rush to revoke and replace digital certificates on Heartbleed-vulnerable Web servers seems to be no rush at all. Internet research and security services firm Netcraft reports today that of the more than 500,000 servers it knows of that are running vulnerable versions of OpenSSL, only 80,000...

Heartbleed OpenSSL Bug Exploited to Steal Private SSL Keys

Heartbleed went from a dangerous Internet-wide vulnerability over the weekend to one with real exploits, real victims and real problems for private SSL server keys. Mumsnet, a U.K.-based parenting website, said it was victimized by hackers exploiting the vulnerability in OpenSSL to steal password...

Private SSL Keys and the Heartbleed OpenSSL Vulnerability

Heartbleed can be patched, and passwords can be changed. But can you steal private keys by taking advantage of the Internet-wide bug in OpenSSL? Yes, but it’s difficult. Stealing private server SSL keys are a real pot at the end of a rainbow for criminal hackers and intelligence agencies alike...

Design/Logic Flaw

The pemcollective module in Puppet Enterprise PE before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role...

CVE-2013-1398

CVE-2013-1398 concerns the pe_mcollective module in Puppet Enterprise (PE) prior to version 2.7.1. The issue is that access to a catalog of private SSL keys is not properly restricted, allowing remote authenticated users to obtain sensitive information and potentially gain privileges by leveragin...

CVE-2013-1398

The pemcollective module in Puppet Enterprise PE before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role...

CVE-2013-1398

The pemcollective module in Puppet Enterprise PE before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role...