200 PS3's Break VeriSign's SSL

[Guest]

With the aid of 200 PlayStation 3's, a worldwide team of internet security experts were able to break VeriSign's Secure Socket Layer software.

200 PS3's Break VeriSign's SSL : Read more

 

[Shadow703793]

Wow....amazing.

So, assuming the detrimental information stays out of the wrong hands, we are all safe.

:lol: I don't believe that. It's just a matter of time.

 

[cl_spdhax1]

and it only took over $80,000 to do it..

 

[Shadow703793]

^ Still. $80k is pretty cheap considering that you can make ~$100k easily selling fake certs.

 

[bin1127]

^exactly, it's all about who's willing to pay for fake certificates.

 

[ossie]

microsuxx still faithful to it's corporate spin - security by obscurity - but this "security" model is proven to fail all over again, the unknown been when it'll be defeated, not if.

 

[Darkk]

I have to wonder tho. Remember when 40bit SSL certs was safe until somebody at distributed.net cracked it in 3 days then everybody switched it to 128bit certs? It cost money and time to make the switch.

So have to wonder, is this some kind of a scheme to scare people into "OMG" and force everybody to update their SSL certs?

Attempting to crack security products aren't new, just when they get the media involved people start to panic.

 

[zodiacfml]

computing security is a balancing act.
that might be dangerous but ssl is not the only security precaution on the internet.

 

[nekatreven]

the issue here is that they AREN'T 'fake certs'. they hacked the site and started creating cryptographically IDENTICAL certs. A hash is a hash folks.

That's like someone coming up with a way to make clones of diamonds that come out 100% correct on a molecular level, and then calling the clones fake.

If the chemist can't tell and the jeweler can't tell and it cuts the other damn diamond...WHO CARES.

Same with these certs.

Even if the CA finds the issue and removes the certs from their records, it's STILL a cryptographically valid cert.

If you were to re-buy the cert...this time legit...the hash would still be the same. I bet you wouldn't even have to re-install the old, supposedly fake, certificates.

 

[jabliese]

Nekatreven:

redirected site + fake cert = illegal $$$

Get it?

 

[nekatreven]

Of course I get what can be done with it. That's not hard.

At first I did think this referred to generating certs that never existed before. I suppose it refers to making copies of existing ones. That doesn't really matter either way though.

Even in trying to explain it to me...you just called the cert fake. If it was fake, the victim's browser would not accept it.

A 'copied cert' or a 'stolen cert' perhaps, but if the hashes match, it isn't fake. I don't really think people are grasping that concept.

Like if I had a program that generated duplicates of valid nuclear launch codes...you'd call them fake. That's dangerous.

"...and as the missile boar down upon them they thought to themselves, 'hey maybe fake was the wrong choice of wording here.'..."

This obviously isn't as dire as nuclear warheads, but I still think it is very unwise to call these certs fake. I guess for now I should just be happy they are phasing out md5.