Wow more things to worry about, but the net is :
- Update your Windows system now. There is a 19 year old bug found in their SChannel security layer. IBM folks discovered it and allows software you download to take control
- Dark Hotel. This is a targeted attack where people in Hotels get what looks like proper downloads, but people have hacked the certificates for things like Flash Updates to include a payload. Apparently in Japan, but the British GCHQ has a similar targeted program (according to Snowden papers) focused on high value folks who get into hotels.
- 80% of all Americans think privacy is essentially gone and more than 50% think there needs to be more regulations
- Poodle is a hack against SSL 3.0 so you need to make sure the servers you use don’t have SSL 3.0 enabled.
Sent from under my “tin hat” 😉
The net conclusion is:
- Windows needs an update asap
- You really can’t trust downloads anymore even from “legitimate sources” It is too easy to pack payload into it either by hacking the certificate or by compromising the source. Or find someone who has gone through and at least figured which certificates are corrupted or have week encyprtion. Similar to the way that you can check to see which servers have bad SSH.
- Check the servers you use and make sure they don’t have SSL 3.0 enabled. As an aside 30% of all sites that have been scanned there are vulnerable.
