Saudi Arabia, in its drive to enrich Arab culture, launches Arab Week at UNESCO in Paris    Civil Defense warns of thunderstorms hitting most Saudi regions until Saturday    Jeddah Mayoralty reclaims 18 government land sites on the North Obhur waterfront    Neymar exits Al Hilal match with muscle injury, leaving fans disappointed    Quality of Life Program CEO highlights Saudi urban transformations at UN-Habitat conference in Cairo    AlHisn Big Time Studios unveiled to transform film and TV production in Riyadh    Saudi Aramco's Q3 net income falls 15.5% to SR103 billion amid a jump in annual cash flows    Saudi Arabia approves cooperation agreement with US for the use of outer space for peaceful purposes    Almarai wins 'Best Corporate Sukuk' at Asset Triple A Islamic Finance Awards    Top climber falls to death after rare Himalayan feat    US voters flying home in time for election    Elon Musk can keep giving $1m to voters, judge rules    Drones and snipers on standby to protect Arizona vote-counters    India's Modi condemns violence after Canada temple incident    Mitrovic's hat-trick leads Al Hilal to 3-0 victory over Esteghlal    Al Ahli extends perfect start with 5-1 victory over Al Shorta    Quincy Jones, titan of US music, dies aged 91    Al Qadsiah secure 2-0 victory over Al Ettifaq in first Eastern Derby since 2021    Hidden sugars in Asia's baby food spark concerns    HONOR unveils pre-order of the stunning HONOR MagicBook Art 14 Featuring an ultra-slim design, HONOR Eye Comfort Display and AI Cross-OS WorkStation    India puts blockbuster Pakistani film on hold    The Vikings and the Islamic world    Filipino pilgrim's incredible evolution from an enemy of Islam to its staunch advocate    Muted Eid celebrations for millions of Nigerian Muslims    Exotic Taif Roses Simulation Performed at Taif Rose Festival    Asian shares mixed Tuesday    Weather Forecast for Tuesday    Saudi Tourism Authority Participates in Arabian Travel Market Exhibition in Dubai    Minister of Industry Announces 50 Investment Opportunities Worth over SAR 96 Billion in Machinery, Equipment Sector    HRH Crown Prince Offers Condolences to Crown Prince of Kuwait on Death of Sheikh Fawaz Salman Abdullah Al-Ali Al-Malek Al-Sabah    HRH Crown Prince Congratulates Santiago Peña on Winning Presidential Election in Paraguay    SDAIA Launches 1st Phase of 'Elevate Program' to Train 1,000 Women on Data, AI    41 Saudi Citizens and 171 Others from Brotherly and Friendly Countries Arrive in Saudi Arabia from Sudan    Saudi Arabia Hosts 1st Meeting of Arab Authorities Controlling Medicines    General Directorate of Narcotics Control Foils Attempt to Smuggle over 5 Million Amphetamine Pills    NAVI Javelins Crowned as Champions of Women's Counter-Strike: Global Offensive (CS:GO) Competitions    Saudi Karate Team Wins Four Medals in World Youth League Championship    Third Edition of FIFA Forward Program Kicks off in Riyadh    Evacuated from Sudan, 187 Nationals from Several Countries Arrive in Jeddah    SPA Documents Thajjud Prayer at Prophet's Mosque in Madinah    SFDA Recommends to Test Blood Sugar at Home Two or Three Hours after Meals    SFDA Offers Various Recommendations for Safe Food Frying    SFDA Provides Five Tips for Using Home Blood Pressure Monitor    SFDA: Instant Soup Contains Large Amounts of Salt    Mawani: New shipping service to connect Jubail Commercial Port to 11 global ports    Custodian of the Two Holy Mosques Delivers Speech to Pilgrims, Citizens, Residents and Muslims around the World    Sheikh Al-Issa in Arafah's Sermon: Allaah Blessed You by Making It Easy for You to Carry out This Obligation. Thus, Ensure Following the Guidance of Your Prophet    Custodian of the Two Holy Mosques addresses citizens and all Muslims on the occasion of the Holy month of Ramadan    







Thank you for reporting!
This image will be automatically disabled when it gets reported by several people.



Visiting trusted sites under spotlight with advanced attacks
By Jordan Robertson
Published in The Saudi Gazette on 07 - 08 - 2009

A powerful new type of Internet attack works like a telephone tap, except operates between computers and Web sites they trust.
Hackers at the Black Hat and DefCon security conferences have revealed a serious flaw in the way Web browsers weed out untrustworthy sites and block anybody from seeing them. If a criminal infiltrates a network, he can set up a secret eavesdropping post and capture credit card numbers, passwords and other sensitive data flowing between computers on that network and sites their browsers have deemed safe.
Browser makers and the companies that sell SSL certificates are working on a fix.
Microsoft Corp., whose Internet Explorer browser is the world's most popular, said it was investigating the issue. Mozilla Corp., which makes the No. 2 Firefox browser, said most of the problems being addressed were fixed in the latest version of its browser, and that the rest will be fixed in an update coming this week.
VeriSign Inc., one of the biggest SSL certificate companies, maintains that its certificates aren't vulnerable.
The attack falls into a class of hacks known as “man-in-the-middle,” in which a criminal plants himself between a victim's computer and a legitimate Web site and steals data as it moves back and forth.
SSL certificates are a critical technology in assigning trust on the Web. The presence of an SSL certificate on a site is designated by a padlock in the address bar. But many people don't pay attention to whether a padlock is present or not.
Browsers do care, though.
Browsers are programmed to block sites that don't have a valid SSL certificate, or have a certificate displaying a Web address that doesn't match the address a Web surfer was trying to reach. If the sites aren't blocked, users are warned about potential danger, and have the option to click through.
The problems outlined by researchers center on a quirk in the way browsers read SSL certificates. Many SSL certificate companies will allow people to attach a programming symbol called a “null character” into the Web address onto the certificates they receive. Web browsers generally ignore that symbol. All a criminal would need to do is put the name of a legitimate Web site before that character, and the browser will believe that the site it's visiting — which is under the criminal's control — is legitimate.
The criminal could then forward the traffic onto the legitimate site and spy on everything the victim does on that site. This highlights a significant weakness in the very technology widely used to assure people it's safe to navigate sensitive sites. - APWhat is SSL?
Short for Secure Sockets Layer, SSL certificate is a protocol developed by Netscape for transmitting private documents via the Internet. Sites buy them to encrypt traffic and assure visitors it's fine to enter confidential information. Companies that sell SSL certificates verify that someone trying to buy a certificate actually owns the site that certificate will be attached to. This is how it works.
• A browser requests a secure page (usually https://).
• The web server sends its public key with its certificate.
• The browser checks that the certificate was issued by a trusted party (usually a trusted root CA), that the certificate is still valid and that the certificate is related to the site contacted.
• The browser then uses the public key, to encrypt a random symmetric encryption key and sends it to the server with the encrypted URL required as well as other encrypted http data.
• The web server decrypts the symmetric encryption key using its private key and uses the symmetric key to decrypt the URL and http data.
• The web server sends back the requested html document and http data encrypted with the symmetric key.
• The browser decrypts the http data and html document using the symmetric key and displays the information. __


Clic here to read the story from its source.