S
SpiderLabs Blog
blog.spiderlabs.com · Company blog · on HN since 2010
The security research blog of Trustwave's SpiderLabs, covering malware, web attacks, vulnerabilities, and certificate authority issues.
What HN saysHN links it as a primary source for the Moar Pony malware post and in discussions of Trustwave's subordinate root certificate controversy.
26HN people shared it
4linked it in comments
28stories submitted
535story points
12 years agolast shared
2010people per year2026
Most-shared posts
- 1Mitigating Slow HTTP DoS Attacks against Apache with ModSecurity3 people · 6 points · first shared 2010 · discussion on HN
- 2Look What I Found: Moar Pony3 people · 5 points · first shared 2013 · discussion on HN
- 3The Kernel is calling a zero(day) pointer – CVE-2013-50652 people · 5 points · first shared 2013 · discussion on HN
- 4Clarifying The Trustwave CA Policy Update2 people · 3 points · first shared 2012 · 2 comments on HN
- 5Pwning a Spammer's Keylogger1 people · 318 points · first shared 2012 · 64 comments on HN
- 6How to Hack and Not Get Caught1 people · 85 points · first shared 2012 · 15 comments on HN
- 7Injection of malicious code into jQuery is increasing1 people · 74 points · first shared 2014 · 17 comments on HN
- 8Reflected File Download – A New Web Attack Vector1 people · 6 points · first shared 2014 · discussion on HN
- 9How to set up a OSX Trap Partition for Stolen Laptop Recovery1 people · 4 points · first shared 2012 · discussion on HN
- 10An interactive 802.11 wireless shell without the need for authentication1 people · 3 points · first shared 2014 · discussion on HN
- 11Server-Side XSS Attack Detection with ModSecurity and PhantomJS1 people · 3 points · first shared 2014 · discussion on HN
- 12Improving CAPTCHAs with Unicode Visual Spoofing1 people · 3 points · first shared 2011 · 3 comments on HN
- 13Defeating Flame String Obfuscation with IDAPython1 people · 2 points · first shared 2012 · discussion on HN
- 14Detecting A Surveillance State – Part 4 Cellular Attacks1 people · 2 points · first shared 2014 · discussion on HN
- 15How To Detect NSA ANT Catalog Hardware Implants1 people · 2 points · first shared 2014 · discussion on HN
What HN people wrote when they linked it
mballantyne · 2014-04-16
Do CRLs even work? My understanding is that the only browser that hard-fails to load a page if OCSP is blocked is Chrome for certs in CRLSets. Everyone else is vulnerable to MITM if access to the CRL / OCSP servers is blocked.
I would love to be wrong. Does anyone know if anything has changed for the better since 2011?
http://blog.spiderlabs.com/2011/04/certificate-revocation-behavior-in-…
http://dev.chromium.org/Home/chromium-security/crlsets
https://www.imperialviolet.org/2011/03/18/revocation.html
werrett · 2013-12-05
In case anyone is interested the primary source for the article is the following blog post (it is slightly buried):
http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html
dudus · 2013-12-04
What about this one? http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html
lambda · 2012-02-13
Note TrustWave, a widely trusted certificate authority, has recently explicitly acknowledged selling devices with subordinate root certificates that allow them to spoof certs for any domain that they want in order to allow companies to snoop on their employees. http://blog.spiderlabs.com/2012/02/clarifying-the-trustwave-ca-policy-…
If they are willing to sell these to private organizations, who's to say that one of the many certificate authorities have not sold such devices or certificates to repressive governments?
SSL is basically a joke at this point. Because it requires you to trust every single certificate authority for every single domain, it basically means that you are only protected against the average script kiddie, not a dedicated attacker. There have been plenty of CAs compromised, who continued to issue MD5 signed certificates well after it was broken, who are within the control of authoritarian governments, or who are willing to sell subordinate root certs for the purpose of snooping to any company who is willing to pay enough.
And that's not to mention that even if the information is properly protected in transit, putting this information on your servers makes you that much more vulnerable to attackers who may want access to this information, the government of the country in which it is hosted, legal process, or any number of other threats. Even if they had properly secured the information in transit, and SSL were secure, it still vastly increases…