Schneier on Security's Journal
 
[Most Recent Entries] [Calendar View]

Wednesday, November 13th, 2013

    Time Event
    6:46a
    Another QUANTUMINSERT Attack Example

    Der Spiegel is reporting that the GCHQ used QUANTUMINSERT to direct users to fake LinkedIn and Slashdot pages run by -- this code name is not in the article -- FOXACID servers. There's not a lot technically new in the article, but we do get some information about popularity and jargon.

    According to other secret documents, Quantum is an extremely sophisticated exploitation tool developed by the NSA and comes in various versions. The Quantum Insert method used with Belgacom is especially popular among British and US spies. It was also used by GCHQ to infiltrate the computer network of OPEC's Vienna headquarters.

    The injection attempts are known internally as "shots," and they have apparently been relatively successful, especially the LinkedIn version. "For LinkedIn the success rate per shot is looking to be greater than 50 percent," states a 2012 document.

    Slashdot has reacted to the story.

    I wrote about QUANTUMINSERT, and the whole infection process, here. We have a list of "implants" that the NSA uses to "exfiltrate" information here.

    2:17p
    Microsoft Retiring SHA-1 in 2016

    I think this is a good move on Microsoft's part:

    Microsoft is recommending that customers and CA's stop using SHA-1 for cryptographic applications, including use in SSL/TLS and code signing. Microsoft Security Advisory 2880823 has been released along with the policy announcement that Microsoft will stop recognizing the validity of SHA-1 based certificates after 2016.

    More news.

    SHA-1 isn't broken yet in a practical sense, but the algorithm is barely hanging on and attacks will only get worse. Migrating away from SHA-1 is the smart thing to do.

    << Previous Day 2013/11/13
    [Calendar]
    Next Day >>

Schneier on Security   About LJ.Rossia.org