❌

Visualização de leitura

↗️

Compromised TLS Certificates

✇Schneier on Security
Por:Bruce Schneier

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys:

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”

Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.”

At this early stage, the most immediate threat appears to be for those using VPNs, especially in countries with governments likely to maliciously intercept traffic. There are likely many other cases for concern. End users largely have no recourse other than to hold off using many non-browser forms of TLS communication until they receive assurances updates are in place.

The whole certificate regime has long been a mess:

The incident is the latest to expose a fatal flaw in the TLS regimen. It’s only as strong as its weakest link, which in this case was eMudhra. Fortunately, transparency logs account for much of that failure, but this measure requires parties to actively monitor massive feeds and works only after unauthorized certificates have been issued. eMudhra representatives weren’t immediately available to answer questions.

One caveat: exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network­at a coffee shop, university, or other organization­face much less of a challenge.

Cleanup of this is going to be another mess—and it’s right on top of the PHP vulnerabilities.

Some more information.

↗️

How to Transfer Passwords and Passkeys Between Android Password Managers

✇Security | TechRepublic
Por:TechRepublic Staff

Android users can transfer passwords and passkeys between compatible password managers. Here's how Credential Exchange works, how to import into 1Password, and what to check before switching.

The post How to Transfer Passwords and Passkeys Between Android Password Managers appeared first on TechRepublic.

↗️

Protect your WhatsApp account with new passkey and 2FA upgrades

✇Malwarebytes

WhatsApp announced on August 25 that more than one billion people now use passkeys to log back into the app.

The announcement included two other security upgrades: a stronger two-step verification method and more context for incoming calls from unknown numbers. It marks one of the largest passwordless authentication rollouts to date. Passkeys are now firmly mainstream, with the FIDO Alliance estimating that 5 billion are in use worldwide and 75% of consumers have enabled one on at least one account.

Three things changed:

  1. Passkey support originally launched on Android and later extended to iOS. WhatsApp now supports multiple passkeys per account, so people who switch between an Android phone and an iPhone (or use both) can register a passkey on each device.
  2. Two-step verification is moving from a simple six-digit PIN to a longer alphanumeric password that can include special characters, making it much harder to guess or brute-force.
  3. On Android, WhatsApp now shows extra context about calls from numbers not saved in your contacts, including whether the number is from another country and whether you share any groups. It’s a small but useful nudge against the urgency tactics scammers rely on.

Passkeys are resistant to phishing because there is no password or SMS code to type into a fake website or hand over to a scammer. Instead, a passkey is stored on your device or in its credential manager and unlocked using your fingerprint, face, or screen-lock code. They’re also useful in regions where SMS one-time-passcode delivery is unreliable, which might explain why adoption reached a billion users so quickly.

The upgraded two-step verification password closes a real gap. PINs such as “123456” were common, weak, and reused, and a longer alphanumeric password with special characters raises the bar against account-takeover attempts, even if an attacker somehow obtains your one-time code.

The caller-context feature gives people more information to assess legitimacy before answering an unfamiliar number.

Phone Scam Check

Don’t recognize that number? We’ll check it.

What WhatsApp users need to do

Users need to set up a passkey and upgrade their two-step verification password, while the caller-context feature will appear automatically on supported Android devices:

  • Set up a passkey via Settings > Account > Passkeys, and follow the instructions on your device. Don’t forget to add a second one if you use both an Android and an iOS device.
  • If you still use a six-digit PIN for two-step verification, upgrade to the new password format when it becomes available, especially if your PIN is predictable. You can find instructions to set up two-step verification for WhatsApp in this blog. If it’s already enabled, select Two-step verification to find the option to change your PIN.
  • Add a recovery email to two-step verification if you haven’t already. It’s the only way to reset the password if you forget it.
  • Android users should pay attention to the new caller-context details before answering calls from unknown numbers, treating urgency as a red flag rather than a reason to rush.

Passkeys and stronger two-step verification aren’t retroactive or forced, so accounts still relying on an old PIN or no passkey at all will remain unchanged until users upgrade them.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

↗️

WhatsApp Just Added 3 New Ways to Protect Your Account

✇Security | TechRepublic
Por:Joseph Ofonagoro

WhatsApp is adding stronger two-step verification, multiple passkeys and more context for unknown callers as it expands protections against scams.

The post WhatsApp Just Added 3 New Ways to Protect Your Account appeared first on TechRepublic.

↗️

The Password Notebook Is Back — but Is It Actually Safer?

✇Security | TechRepublic
Por:Joseph Ofonagoro

Password notebooks are making an unexpected comeback as infostealers and browser attacks revive debate over the safest way to store credentials.

The post The Password Notebook Is Back — but Is It Actually Safer? appeared first on TechRepublic.

↗️

Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts

✇Security | TechRepublic
Por:Aminu Abdullahi

Google added selfie video recovery for eligible accounts, using encrypted videos and liveness checks to help users regain access when locked out.

The post Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts appeared first on TechRepublic.

↗️

One Password Mistake Helped Hackers Access Chick-fil-A Account

✇Security | TechRepublic
Por:Joseph Ofonagoro

Chick-fil-A disclosed a credential stuffing attack affecting customers across 10 states, underscoring the risks of password reuse and account takeover.

The post One Password Mistake Helped Hackers Access Chick-fil-A Account appeared first on TechRepublic.

❌