Compromise of 3 domain registries allows hackers to walk off with unauthorized certs.
Hackers obtain counterfeit TLS certificates for Google and other large services
7 days ago by BrikoX to c/cybersecurity
homesweethomeMrL 21 points 6 days ago
Attackers hijacked three top-level domains and used their control to mint counterfeit TLS certificates for Google and other large organizations, Google said Tuesday.
The attackers launched a series of attacks on the .gh, .sl, and .as country code top-level domains (ccTLDs) and then modified authoritative DNS records for selected domains within those namespaces.
JasonDJ 19 points 6 days ago
This sounds like a DNS side attack and not a certificate side attack...
The crypto is solid. These ccTLD admins suck.
I can't think of any reason not to issue DV certificates if...you can V the D.
homesweethomeMrL 9 points 7 days ago
Christ in a bucket.
OhVenus_Baby 4 points 6 days ago
Someone explain eli5 me?
gnufuu 4 points 6 days ago
Google is a big bully who knows everybody's secrets and likes to tell people what to think and what to do. Now someone tricked a costume shop into making them a high quality Google costume in which they can walk around do some of the bad things Google does. It will take some time until all of us have been warned of that impostor and we can at least be sure again who's bullying us.
cybersecurity
@sh.itjust.works
10664
5793
1092
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
go to feed...
cybersecurity
@sh.itjust.works
10664
5793
1092
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
go to feed...
Oh, that's not good
save