Wednesday, October 7, 2009

Null-Prefix SSL Certificate For PayPal Released


An anonymous reader writes "Nine weeks after Moxie Marlinspike presented at Defcon 17, null-prefix certificates that exploit the SSL certificate vulnerability are beginning to appear. Yesterday, someone posted a null-prefix certificate for www.paypal.com on the full-disclosure mailing list. In conjunction with sslsniff, this certificate can be used to intercept communication to PayPal from all clients using the Windows Crypto API, for which a patch is still not available. This includes IE, Chrome, and Safari on Windows. What's worse, because of the OCSP attack that Moxie also presented at Defcon, this certificate cannot be revoked." Update: 10/06 23:19 GMT by KD: Now it seems that PayPal has suspended Marlinspike's account.

Read more of this story at Slashdot.


[link to original | source: Slashdot | published: 9 hours ago | shared via feedly]


at

1 comment:

  1. AnonymousOctober 15, 2009 at 8:00 AM

    Terrible that this ist still not fixed, SSL, should be a secure place

    ReplyDelete

Subscribe to: Post Comments (Atom)