We're Moving. So, we've disabled new registrations on this forum. The forum will not officially be released until 8 PM Pacific Standard Time (Friday, Sept, 9th, 2010)~ http://www.ego-one.net/

View previous topic View next topic Go down  Message [Page 1 of 1]

avatar

MrMario
Manager
Zero-day flaw found in Web encryption



Security researchers Marsh Ray and Steve Dispensa unveiled the TLS (Transport Layer Security) flaw on Wednesday, following the disclosure of separate, but similar, security findings. TLS and its predecessor, SSL (Secure Sockets Layer), are typically used by online retailers and banks to provide security for web transactions.



Ray, who along with Dispensa works for two-factor authentication company PhoneFactor, explained in a blog post on Thursday that he had initially discovered the flaw in August, and demonstrated a working exploit to Dispensa at the beginning of September.

The flaw in the TLS authentication process allows an outsider to hijack a legitimate user's browser session and successfully impersonate the user, the researchers said in a technical paper.

The fault lies in an "authentication gap" in TLS, Ray and Dispensa said. During the cryptographic authentication process, in which a series of electronic handshakes take place between the client and server, there is a loss of continuity in the authentication of the server to the client. This gives an attacker an opening to hijack the data stream, they said.


Read More Here

Guest posting activated




No Comment.

View previous topic View next topic Back to top  Message [Page 1 of 1]

Permissions in this forum:
You cannot reply to topics in this forum




Site powered by Forumotion
Copyright 2006-2013 | JalokimGraphics | Ego-One
<!-- <script type="text/javascript"> var vglnk = { key: '0d80ae9fe71cec9484f682bd59232f9e' }; (function(d, t) { var s = d.createElement(t); s.type = 'text/javascript'; s.async = true; s.src = '//cdn.viglink.com/api/vglnk.js'; var r = d.getElementsByTagName(t)[0]; r.parentNode.insertBefore(s, r); }(document, 'script')); </script><script type="text/javascript"> document.write('<scr' + 'ipt data-cfasync="false" type="text/javascript" src="https://www.adexchangeguru.com/a/display.php?r=1242764"></scr' + 'ipt>'); </script> <script type="text/javascript"> window._taboola = window._taboola || []; _taboola.push({flush: true}); </script></body></html><strong><a href="https://www.forumotion.com/" target="_blank">Free forum</a></strong>&nbsp;|&nbsp;<strong><a href="https://www.forumotion.com/directory/computers-and-internet" target="_blank">Computers and Internet</a></strong> | <strong><a href="https://www.forumotion.com/directory/computers-and-internet/computers" target="_blank">Computers</a></strong>&nbsp;|&nbsp;<span class="gensmall">&copy;</span> <a href="https://www.forumotion.com/punbb" target="_blank">PunBB</a>&nbsp;|&nbsp;<a name="bottom" href="http://help.forumotion.com/" target="_blank">Free forum support</a>&nbsp;|&nbsp;<a href="/abuse?page=%2Ft551-zero-day-flaw-found-in-web-encryption&amp;report=1" rel="nofollow">Report an abuse</a>&nbsp;|&nbsp;<strong><a href="https://www.forumotion.com" target="_blank">Forumotion.com</a></strong>Derp